Defense in Depth

Allan Cockriel, Group CISO at Shell, dives into the impact of new SEC regulations on cybersecurity roles. He discusses the heightened accountability CISOs now face and the complexities of meeting regulatory demands amidst cyber threats. Cockriel highlights the importance of transparency while balancing security risks and the potential for a talent exodus in the field. Additionally, he emphasizes the need for industry collaboration and robust control frameworks to navigate these challenges successfully.

Karthik Krishnan, Founder and CEO of Concentric AI, dives into the risks associated with generative AI tools and how organizations can use them safely. He emphasizes the importance of proactive strategies for effective risk management. The conversation highlights the integration challenges of AI with traditional data security practices and the need for solid governance. Krishnan also warns against the disillusionment with AI-generated information, urging businesses to critically evaluate content and focus on data protection for successful AI adoption.

Steve Zalewski, a cybersecurity expert in identity access management, teams up with Damon Fleury, Chief Product Officer at SpyCloud, to discuss the evolving landscape of identity security. They highlight the necessity of centralized identity management and dynamic risk assessments. The conversation dives into the role of automation and user awareness in combating unauthorized access. Their insights focus on proactive defense strategies, tailored access controls, and the importance of adapting security measures to stay ahead of cyber threats.

Joe Lewis, CISO for the CDC and an expert in managing a remote workforce, dives into the evolving landscape of work-from-home dynamics. He highlights the impressive quality of life benefits that remote work offers and the need for flexibility. The conversation explores how to foster corporate culture remotely through strong communication and personal connections, while also addressing the challenges of staff retention. Joe critiques traditional office strategies, advocating for dedicated spaces over flex desks to promote employee comfort and productivity.

Adam Fletcher, CSO of Blackstone, shares his expertise on the critical dangers of neglected cybersecurity tools. He highlights how these tools can drain resources and emphasizes the need for regular updates and investment in cybersecurity. The conversation dives into the complications resulting from excessive alerts and the importance of a technology-agnostic approach. Adam also discusses the significance of strategic decision-making in selecting security tools and warns against cutting corners in foundational cybersecurity practices.

All links and images for this episode can be found on CISO Series. Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Shawn Bowen, VP, Deputy CISO - Gaming, Microsoft. Joining us is Patty Ryan, senior director, CISO, QuidelOrtho. In this episode: Recognizing humanity Death by a thousand meetings What are we looking for? Find your value Thanks to our podcast sponsor, GitGuardian GitGuardian is a Code Security Platform that caters to the needs of the DevOps generation. It provides a wide range of code security solutions, including Secrets Detection, Infra as Code Security, and Honeytoken, all in one place. A leader in the market of secrets detection and remediation, its solutions are already used by hundreds of thousands of developers in all industries. Try now gitguardian.com.

Davi Ottenheimer, vp of trust and digital ethics at Inrupt, and Sir Tim Berners-Lee, co-founder of Inrupt and the World Wide Web, dive deep into the need for integrity in AI. They discuss the challenges of biases in large language models and the limitations of self-policing AI. The conversation highlights the importance of third-party validation to ensure data integrity, ethical considerations in tech innovation, and the significance of personal responsibility in using AI tools responsibly in society.

Dennis Pickett, VP and CISO at Westat, dives into the complexities of phishing tests in cybersecurity. He argues that not all education requires testing, emphasizing the need for building a culture of security awareness over punishment. Pickett champions empowering employees to report suspicious activities and discusses the significance of implementing supportive tools like phishing alert buttons. He advocates for a positive security culture that recognizes and incentivizes proactive engagement, rather than blaming victims.

Russell Spitler, CEO and co-founder of Nudge Security, delves into the complexities of securing SaaS tools in a rapidly evolving landscape. He highlights the shift from 'verify then trust' to 'trust and verify' models, emphasizing teamwork among IT, security, and users. The conversation also tackles shadow IT challenges and the importance of clarity in security responsibilities. Spitler advocates for innovative approaches to safeguard data and strong authentication measures to manage access, ensuring organizations can effectively handle post-employee departure security.

In this engaging discussion, Adam Arellano, VP of enterprise cybersecurity at PayPal, advocates for hiring teenagers with criminal records into cybersecurity roles. He emphasizes the importance of mindset, ethics, and the potential to harness unique talents from unconventional backgrounds. Arellano critiques traditional hiring criteria, encouraging a shift towards inclusivity and second chances. The conversation highlights the role of mentorship and social validation in motivating these individuals, showcasing how curiosity and moral integrity are vital in the cyber workforce.