Season 3, Episode 8: AZT and Dr. Zero Trust have a crossover episode where we chat with reps from MITRE and OWASP about challenges associated with emerging threats. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. Every few weeks, and occasionally every few days, we hear report of a new novel technique or zero day. Those headlines often create an unnecessary level of fear for organizations, but battle-worn cybersecurity professionals know just because it’s on a headline doesn’t necessarily mean it will impact their environment. That is because emerging threats are just that, new and novel. While zero day threats can be interesting and something to be aware of, most threat actors stick to tried and true methods. But how do we identify what is most impactful to our security posture, attack surface, or insert your other buzzy term? Threat intelligence and the collective defense. And for that, it’s time to introduce our two very equipped guests to navigate this conversation and our guest moderator: This week on AZT, we have representatives from OWASP and MITRE, with Dr Zero Trust leading the charge. The Guests Special Guest Moderator Dr. Chase Cunningham - Dr. Zero Trust and Vice President of Security Market Research for G2 Avi Douglen - Chair of the Global Board of Directors for the OWASP Foundation and Founder and CEO of Bounce Security. Avi is a security architect and software developer, leading development teams in building secure products for over 20 years. As a systems developer and security consultant, over the years Avi has amassed much technical knowledge and understanding of the enterprise security needs at the business level. Avi currently serves on the OWASP Global Board of Directors, and leads the Israel chapter. He is the founder and leader of the the popular AppSecIL security conference, the OWASP Threat Modeling Project, and co-authored the Threat Modeling Manifesto. He is a community moderator on Security StackExchange, and a frequent speaker at industry conferences, recent ones can be seen here. Stanley Barr - Senior Principcal Cyber Researcher for MITRE Dr. Stanley Barr is a three time graduate of University of Massachusetts Lowell. He has a BS in Information Sciences, an MS in Mathematics, and a PhD in Computer Science. He has coauthored published papers in malware analysis, barrier coverage problems, expert systems for network security, and robotic manufacturing. He has spoken at MILCOM, RSA, Bsides Boston, and Defcon. He has been a panelist for conferences. Panels topics have included fighting through real world computer network attacks from both external and internal threats. Currently, he is a Senior Principal Scientist at The MITRE Corporation, a not-for-profit corporation that manages six federally funded research and development centers (FFRDCs). Key Takeaways Emerging threats are interesting, but threat modeling and understanding how systems work to identify potential issues is more impactful AI can pose a threat due to its ability to remember and tailor information, as well as its scalability. The panel emphasized that basic security hygiene is often overlooked, such as enabling 2FA on all accounts. The OWASP Top 10 most common attack vectors are still a significant concern, but they should not be the only focus. The panel argued that responsibility for security breaches should extend beyond the CISO to the entire board and engineering organization. Cybersecurity is a people-centric challenge, and relying on people not to make mistakes is not a sustainable strategy. There is value in investing in proper security measures, as it can save organizations money in the long run.

Cybersecurity leaders from Lacework and Drata discuss challenges of rapid incident reporting, collaboration in the industry, and emerging AI-related laws. They explore SEC breach notification regulations, cultural shifts towards automation, integration of AI in cybersecurity, managing intersecting regulations, and the partnership between security and privacy teams.

Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not? Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal answer, but how often does life throw us simplicity? Rarely. This week on Adopting Zero Trust, we continue our conversation that looked at the role cyber insurance plays in organizations and drill into one of the most challenging topics associated with it: Ransomware. And, because this is a heavy subject, we brought in two heavy hitters from past episodes to share their perspectives, Kris Lovejoy and Brian Willett TL;DR Paying ransomware ransoms is a complex decision that depends on various factors, such as the potential impact on the organization's services or employees. Having robust and tested backups is crucial in a ransomware situation, but organizations must be prepared for scenarios where ransomware affects backups. Cyber insurance can help mitigate the financial impact of ransomware attacks, but organizations should be cautious and consider all the potential outcomes. Avoiding ransomware attacks requires a proactive approach, which includes implementing hardening standards, good practices around vulnerability management, enforcing compliance on systems, and having good identity protection. AI holds promise in the cybersecurity sector, but its role in ransomware attacks is still in its infancy.

Season 3, Episode 5: Cyber Insurance may not be the sexiest topic, but it’s an important piece of any mature cyber program. We chatted with a lawyer and a VC who share their perspective. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. There are many aspects of cybersecurity that are not classified as cool or sexy, but every component plays a role in securing people, data, and businesses. One particular aspect that is often seen as a necessary evil, even more so than policies and documentation, is cyber insurance. On one hand, you have a system that forces backstops to protect the organization in the event of an incident; on the other, requirements to not only remain insured but reduce premiums encourage businesses to invest more in securing the business. This week, we chatted with Karl Sharman of Forgepoint Capital and Andy Moss of Reed Smith to better understand the role cyber insurance plays today.

Forrester's Principal Research Analyst on Zero Trust, David Holmes, discusses the core principles of Zero Trust, the acceleration of its adoption due to the COVID-19 pandemic, and the challenges and successes in implementing Zero Trust technologies. The conversation also touches on the evolution of programming languages, the role of AI in cybersecurity, and the integration of AI-driven conversations in sales processes.

Canva's Kane Narraway shares insights on building a Zero Trust strategy in under a year, emphasizing prioritizing data security, resource allocation, and transitioning to Zero Trust measures. The podcast also includes a light-hearted discussion on Gandalf's horse trivia and encountering a Sauron's Mace replica.

In this episode, the CIO of Energy Solutions discusses the formation of cybersecurity and technology budgets, the dynamics between CIOs and security vendors, navigating complex security challenges, strategic team collaboration, IT challenges, and enhancing security practices with external partnerships.

To start the new season, we are joined by Hacker Valley Media’s Ron Eddings and Chris Cochran, who discuss breaking into cybersecurity and the role storytelling plays.   A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people. People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny. And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills. Read more at adoptingzerotrust.com

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. PS, we're giving away a Flipper Zero on our site as a little season finale gift. Check out details on our site. You know what they say, you save the best for last. As we wrap season two of Adopting Zero Trust, we take a shift from our standard conversations about modern cybersecurity strategies and look back at some of the history that got us to where we are today. This week we chat with Hector Monsegur, Co-Founder of LulzSec, and current Director of Research for Alacrinet, who discusses his journey from hacktivism to white hat pen testing. In May of 2011, a series of cyber attacks swept the globe. Starting with Fox News, after a broadcaster called rapper Common ‘vile’, then an attack on X Factor (yes, the show Joe Rogan used to host) leaking contestant data, and through to taking down the Sony Playstation network. A, at the time, black hat hacking group was founded and picked off targets for laughs (lulz) rather than financial gain. Among the group was co-founder Hector Monsegur, better known by his alias Sabu, who shaped the movement into cause-based cyber attacks or hacktivism. But the story starts well before the formation of Lulzsec, and before the FBI knocked on Hector’s door. It stretches back to a time when there weren’t resources for people to learn how to hack, pen test, and become cybersecurity practitioners didn’t exist, unlike the endless amount of certs and higher education programs that exist today. Key Takeaways The evolution of one's ethical stance: Hector's journey highlights the importance of questioning and reassessing one's actions and beliefs. Collaboration and collective impact: Working together can amplify efforts and create positive change, even in the realm of cybersecurity. Balancing curiosity and responsibility: Exploring technology and hacking skills should be accompanied by a sense of responsibility and ethical considerations. Editor’s Note The season finale of AZT is here, and we couldn’t have found a more interesting way to wrap things up. Hector has such a unique and storied past, and we can’t recommend his own series enough. The very agent who knocked on his door joins him as the cohost on Hacker and the Fed. We also can’t thank you, our listeners, enough for another year of the show. Neal and I do this as a passion project first and foremost, but as we seek to attract harder-to-reach guests, we are also building in some ad opportunities. We are ensuring that doesn't impact how we highlight the practitioner's perspective on modern cybersecurity strategies, too. Speaking of growing, that other podcast I mentioned last episode? Mastering the Art of Failing can now be found at failingpod.com or on your favorite podcast app. The pilot series will highlight people who have found success in their lives, but not without some challenges along the way. Our first guest, Glen Hellman, was part of several successful exits… and quite a few not-so-successful flops. As the series progresses we’ll expand beyond just career-oriented stories and dig into physical, mental, and other states of pushing boundaries and levels of success.

Evgeniy Kharam, a founder, CISO, architect, and podcast producer, explores the rise of Enterprise (Secure) browsers. Topics include remote browser isolation, customized browser profiles, and the impact of managed devices on compliance requirements.