Adopting Zero Trust

Forrester's Principal Research Analyst on Zero Trust, David Holmes, discusses the core principles of Zero Trust, the acceleration of its adoption due to the COVID-19 pandemic, and the challenges and successes in implementing Zero Trust technologies. The conversation also touches on the evolution of programming languages, the role of AI in cybersecurity, and the integration of AI-driven conversations in sales processes.

Canva's Kane Narraway shares insights on building a Zero Trust strategy in under a year, emphasizing prioritizing data security, resource allocation, and transitioning to Zero Trust measures. The podcast also includes a light-hearted discussion on Gandalf's horse trivia and encountering a Sauron's Mace replica.

In this episode, the CIO of Energy Solutions discusses the formation of cybersecurity and technology budgets, the dynamics between CIOs and security vendors, navigating complex security challenges, strategic team collaboration, IT challenges, and enhancing security practices with external partnerships.

To start the new season, we are joined by Hacker Valley Media’s Ron Eddings and Chris Cochran, who discuss breaking into cybersecurity and the role storytelling plays.   A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people. People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny. And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills. Read more at adoptingzerotrust.com

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. PS, we're giving away a Flipper Zero on our site as a little season finale gift. Check out details on our site. You know what they say, you save the best for last. As we wrap season two of Adopting Zero Trust, we take a shift from our standard conversations about modern cybersecurity strategies and look back at some of the history that got us to where we are today. This week we chat with Hector Monsegur, Co-Founder of LulzSec, and current Director of Research for Alacrinet, who discusses his journey from hacktivism to white hat pen testing. In May of 2011, a series of cyber attacks swept the globe. Starting with Fox News, after a broadcaster called rapper Common ‘vile’, then an attack on X Factor (yes, the show Joe Rogan used to host) leaking contestant data, and through to taking down the Sony Playstation network. A, at the time, black hat hacking group was founded and picked off targets for laughs (lulz) rather than financial gain. Among the group was co-founder Hector Monsegur, better known by his alias Sabu, who shaped the movement into cause-based cyber attacks or hacktivism. But the story starts well before the formation of Lulzsec, and before the FBI knocked on Hector’s door. It stretches back to a time when there weren’t resources for people to learn how to hack, pen test, and become cybersecurity practitioners didn’t exist, unlike the endless amount of certs and higher education programs that exist today. Key Takeaways The evolution of one's ethical stance: Hector's journey highlights the importance of questioning and reassessing one's actions and beliefs. Collaboration and collective impact: Working together can amplify efforts and create positive change, even in the realm of cybersecurity. Balancing curiosity and responsibility: Exploring technology and hacking skills should be accompanied by a sense of responsibility and ethical considerations. Editor’s Note The season finale of AZT is here, and we couldn’t have found a more interesting way to wrap things up. Hector has such a unique and storied past, and we can’t recommend his own series enough. The very agent who knocked on his door joins him as the cohost on Hacker and the Fed. We also can’t thank you, our listeners, enough for another year of the show. Neal and I do this as a passion project first and foremost, but as we seek to attract harder-to-reach guests, we are also building in some ad opportunities. We are ensuring that doesn't impact how we highlight the practitioner's perspective on modern cybersecurity strategies, too. Speaking of growing, that other podcast I mentioned last episode? Mastering the Art of Failing can now be found at failingpod.com or on your favorite podcast app. The pilot series will highlight people who have found success in their lives, but not without some challenges along the way. Our first guest, Glen Hellman, was part of several successful exits… and quite a few not-so-successful flops. As the series progresses we’ll expand beyond just career-oriented stories and dig into physical, mental, and other states of pushing boundaries and levels of success.

Evgeniy Kharam, a founder, CISO, architect, and podcast producer, explores the rise of Enterprise (Secure) browsers. Topics include remote browser isolation, customized browser profiles, and the impact of managed devices on compliance requirements.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.   The word AI, much like Zero Trust, has come with a lot of baggage in the past few years. It’s a term that’s been misused, slapped on the front of startups’ overpriced booths at RSA and Black Hat, and it feels like every cybersecurity product under the sun now supports it in some flavor or fashion. It's the same cycle we’ve been in the past, but this time everyone is jumping in. This week we are getting in front of the bandwagon and chat with a pioneer in the cybersec AI space who has seen how the technology has been evolving over the past decade, Oliver Tavakoli, the CTO of Vectra AI.   “My contemporaneous definition of AI at any given moment in time is there's got to be enough pixie dust in it for people to view it as somewhat magical; so that's my incredibly technical definition. I'd say over the past 10-15 years, that is typically meant neural nets-that has those have been a stand in-and and obviously, neural nets can be used for discrimination [As opposed to a generative AI model]. Again, the example of cat (You search “Cat” on Google images, and it returns results that show images, in theory, of only cats) is an example of how they can be used in a generative sense, which is really the latest revolution that you see. And then the other thing is how broadly applicable they are and how well read they are.   Tavakoli’s definition of AI provides the context for how AI is primarily applicable today in cybersecurity. But, in the past, typically these concepts were held back by technology. There is also a stark difference between what has been referred to as AI, or a discriminative AI model, and what is most popular today, or generative AI. It turns out in these large language models, as you make them bigger, there was always kind of the question of if you make them big enough. Will they just plateau or will they take off? It really wasn't a foregone conclusion that if you made them big enough they would take off, but it was a bet that was placed and a bet that turned out to have some merit to it. And that is the crux of today’s interview: what was and will be the past and future impact of AI on cybersecurity? Key Takeaways AI plays a significant role in both offensive and defensive cybersecurity strategies. Threat actors use AI to enhance their attacks, making them more believable and harder to detect. Defensive uses of AI include improving workflow and making SOCs more productive. Organizations must always assume that compromise is possible and focus on minimizing the impact of breaches.

Zack Butcher, founding engineer at Tetrate, discusses building upon NIST’s Zero Trust policies and standards. They explore the challenges of implementing Zero Trust, the importance of identity-based segmentation and API security, and the role of service mesh in enhancing security and control in a distributed system. They also discuss the implementation and evolution of the Google BeyondCorp system.

Season two, episode 15: We talk ZT History and API security with the godfather of Zero Trust, Dr Zero Trust, and Richard Bird. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here. In the past few years, supply chain attacks and their impacts have or will soon overtake that of the damage done by ransomware. It’s of no surprise then that APIs are a critical attack vector that threat actors like to exploit, yet many organizations do not have a good understanding of how many doors they have running into their data. This week we chat with the godfather of Zero Trust, Dr. Zero Trust, and a chief security officer about the current state of API security maturity. Considering our guests, we, of course, also took the opportunity to chat a bit about Zero Trust's history. This week we have three very special guests: John Kindervag, the creator (godfather) of Zero Trust Chase Cunningham, AKA Dr Zero Trust, and the now VP of Market Research for G2 Richard Bird, Traceable AI’s Chief Security Officer Key Takeaways Like any other cybersecurity concept, APIs must have an asset inventory There is enough margin of error tied to the intended use of APIs that require continuous monitoring/verification There is a current maturity gap associated with securing the use of APIs in the name of speed and innovation, and often there is not a well-established owner Editors Note We will be taking a publishing break for the month of September as my daughter has arrived, and I will need to catch up on all the sleep I can get. We should be back in October and run through until the holiday break before we wrap season two. I’m also working on a few experimental podcast series during my parental leave, so stay tuned. At least one in particular should be of interest to our audience here. Also, if you work for a cybersecurity org and are interested in launching a podcast, slide into my inbox if you need a hand.

The podcast discusses the illusion of passwordless technology and how it is not a new concept. It emphasizes the importance of multifactor authentication for successful cybersecurity. The guest, Derek Hanson, shares insights on passwordless concepts, passkeys, and the split between identification and authentication. The podcast also delves into the significance of physical devices and certificates in security practices, explores vulnerabilities of using MFA through smartphones, and highlights the need to move away from SMS OTP for better security.