Cybersecurity Where You Are (video)

Episode 134: How GenAI Lowers Bar for Cyber Threat Actors May 07, 2025

In episode 134 of Cybersecurity Where You Are, Sean Atkinson is joined by Randy Rose, VP of Security Operations & Intelligence at the Center for Internet Security® (CIS®); and Timothy Davis, Lead Cyber Threat Intelligence (CTI) Analyst at CIS. Together, they discuss how generative artificial intelligence (GenAI) lowers the barrier of entry for cyber threat actors (CTAs). Here are some highlights from our episode:

01:37. CTAs' use of GenAI to improve their existing campaigns
03:38. The need for CTI teams to look beyond language in analyzing GenAI-enabled threats
07:22. The evolving impact of GenAI on phishing campaigns, malware development, deepfakes, and malicious Artificial Intelligence as a Service (AIaaS) offerings
12:28. How GenAI increases the the speed at which CTAs can scale their efforts
17:29. Technical barriers and other limitations that shape CTAs' use of GenAI
22:46. A historical perspective of AI-enabled cybersecurity and how GenAI can support cybersecurity awareness training
26:50. The cybersecurity benefits of AI and machine learning (ML) capabilities for clustering data
29:05. What the future might hold for GenAI from an offensive and defensive perspective

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 133: DieNet's DDoS Hacktivism and Evolving TTPs Apr 30, 2025

In episode 133 of Cybersecurity Where You Are, Sean Atkinson is joined by Lauren McFayden, Threat Intelligence Analyst at the Center for Internet Security® (CIS®). Together, they discuss the Distributed Denial of Service (DDoS) hacktivism of DieNet and how the group continues to evolve its Tactics, Techniques, and Procedures (TTPs). Here are some highlights from our episode:

01:22. An overview of DieNet and its emergence on Telegram
01:55. DDoS attacks and the potential for service disruptions
02:55. DieNet's pro-Palestinian ideology and opposition to the 47th U.S. Presidential Administration
05:00. U.S. and foreign targets claimed by the group
06:30. DieNet's history of claiming attacks against U.S. critical national infrastructure (CNI)
10:33. Two pieces of evidence used to partially assess the credibility of a claimed attack
15:16. How DieNet v2 suggests an escalation of attack strategies
20:43. How the DDoS hacktivist group may continue to evolve its TTPs in subsequent versions
23:48. The use of the CIS Critical Security Controls (CIS Controls) to reduce an attack surface
25:56. How ThreatWA stands out in keeping you informed about emerging threats

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 132: Day One, Step One, Dollar One for Cybersecurity Apr 23, 2025

In episode 132 of Cybersecurity Where You Are, Sean Atkinson is joined by Valecia Stocchetti, Sr. Cybersecurity Engineer of the CIS Critical Security Controls (CIS Controls) at the Center for Internet Security® (CIS®). Together, they discuss what the first day, step, and dollar of implementing a controls framework look like for organizations stepping into their cybersecurity journey. Here are some highlights from our episode:

01:54. Building and improving a cybersecurity program through the power of consensus
04:55. The use of an assessment to determine where you are and where you're going
09:15. How cross-mapping to multiple frameworks simplifies regulatory compliance efforts
12:00. The use of governance to secure leadership buy-in for your cybersecurity program
13:33. Continuous auditing and monitoring as tools for adapting to change
15:10. How Controls prioritization flows through the Implementation Groups (IGs)
19:39. Leadership as the backbone for getting any business program off the ground
22:59. Calculating the cost of cyber defense as a preventative action
24:55. Tradeoffs with security tools to keep in mind so that you can budget efficiently
30:00. Qualifications when using security offerings of MSPs and CSPs

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 131: It Takes a Village to 'Reasonably' Secure SoCal Apr 16, 2025

In episode 131 of Cybersecurity Where You Are, Tony Sager is joined by Stan Stahl, PhD, Founder and President of SecureTheVillage. Together, they discuss how SecureTheVillage, a nonprofit and inaugural Alan Paller Laureate Program awardee, is using a collaboration-driven approach to enhance reasonable cybersecurity awareness and practices within Southern California (SoCal). Here are some highlights from our episode:

01:07. An introduction to Stan and how he came to champion small business cybersecurity
04:28. How SecureTheVillage emerged to support small businesses' cybersecurity needs using the power of community
07:15. The need for nonprofits to play a strong role in addressing cybersecurity challenges
12:01. How Stan drew inspiration from Alan Paller and support from the Alan Paller Laureate Program to advance SecureTheVillage's work
17:57. Reasonable cybersecurity as part of SecureTheVillage's foundation story
22.13. Aligning cybersecurity needs to the goals of public policy
25:33. What's next for SecureTheVillage
29:52. Closing thoughts on why a "village" model for cybersecurity is so important

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 130: The Story and Future of CIS Thought Leadership Apr 09, 2025

In episode 130 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by John Gilligan, President and Chief Executive Officer (CEO) of the Center for Internet Security® (CIS®). Set against the backdrop of the 2025 CIS Annual Full Staff Meeting, they celebrate 25 years of CIS, including the "serendipity" by which the company became a global cybersecurity thought leader. They also discuss how this thought leadership may evolve over the next 25 years. Here are some highlights from our episode:

01:30. How CIS started along with how John and Tony initially got involved
07:12. How CIS thought leadership changed with the absorption of the "SANS Top 20," the precursor of the CIS Critical Security Controls
11:04. The "serendipity" through which CIS grew and formalized its sales, funding, support, and other operations in the 2010s
15:18. How mission and culture advanced CIS to its 25th anniversary in 2025
22:52. What the future might hold for "CIS 2.0"

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 129: Embedding Cybersecurity in Project Management Apr 02, 2025

In episode 129 of Cybersecurity Where You Are, Sean Atkinson discusses best practices for embedding cybersecurity in project management. Here are some highlights from our episode:

01:34. Elements for connecting the dots between cybersecurity risk assessment and project risk assessment
03:06. How our conceptualization of a project changes under a zero trust implementation
04:02. What security may look like in a Waterfall vs. Agile approach to project management
06:26. The importance of resources and stakeholders in managing any project
08:34. Scope creep and other challenges of embedding cybersecurity in project management
15:45. How continuous monitoring and other best practices can help us to overcome these hurdles
25:30. How cybersecurity can inform projects involving generative artificial intelligence

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 128: How Cryptocurrency Is Used for Financial Fraud Mar 26, 2025

In episode 128 of Cybersecurity Where You Are, Sean Atkinson is joined by Joshua Palsgraf, Senior Cyber Threat Intelligence (CTI) Analyst at the Center for Internet Security® (CIS®). Together, they examine how cyber threat actors use cryptocurrency for financial fraud and how professionals like Joshua track this illicit activity. Here are some highlights from our episode:

01:35. What a data-driven approach to CTI looks like
02:47. What makes cryptocurrency useful in the digital economy, including for financial fraud
06:50. How cryptocurrency-related financial crime compares to traditional forms of fraud
13:20. Examples of cryptocurrency theft and its use in facilitating ransomware attacks
27:24. Tooling and forensic methods that are being used to track crypto fraud/scams
31:40. The need to build awareness around financial crime in the digital economy

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 127: Visible Ops as a Cybersecurity Foundation Mar 19, 2025

In episode 127 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Scott Alldridge, President and CEO of IP Services and the IT Process Institute. Together, they use Scott's book, "Visible Ops Cybersecurity: Enhancing Your Cybersecurity Posture with Practical Guidance," to discuss how visible IT operations (Visible Ops) provide a foundation for cybersecurity. Here are some highlights from our episode:

01:31. How Visible Ops reflect an appreciation for the original config change release processes
10:19. The limitations of treating security as a silo and "new toys" as security cure-alls
15:23. How to embrace a dynamic view of visibility and configuration management
24:50. The importance of leadership buy-in when shifting left to a security-first mindset
27:10. What an effective change configuration management system looks like and how it changes people's view of IT
30:20. Parting thoughts and where to find more of Scott's work

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 126: A Day in the Life of a CTI Analyst Mar 12, 2025

In episode 126 of Cybersecurity Where You Are, Sean Atkinson is joined by Casey Cannon, Lead Cyber Threat Intelligence (CTI) Analyst at the Center for Internet Security® (CIS®). Together, they review what a regular day looks like for a CTI analyst. Here are some highlights from our episode:

01:46. How a service-oriented mindset factors into a CTI career
03:55. What task prioritization looks like at the beginning of a CTI analyst's day
06:50. How bedrock CTI principles and threat actor matrices help to counter information overload and filter out noise
10:45. The value of an "eclectic" set of intelligence sources
25:50. How the CIS CTI team works with the 24x7x365 CIS Security Operations Center (SOC), the Cyber Incident Response Team (CIRT), and others
31:27. Advice for getting into CTI as a career path

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 125: How Leadership Principles Influence CIS Culture Mar 05, 2025

In episode 125 of Cybersecurity Where You Are, Sean Atkinson is joined by Waldo Perez, Human Resources Support Specialist at the Center for Internet Security® (CIS®); and Penny Davis, Sr. Manager of Leadership Development at CIS. Together, they use the CIS Leadership Principles and other examples from CIS to understand how leadership influences and nurtures the organization's workplace culture.

Here are some highlights from our episode:

02:00. The human aspect in defining workplace culture
03:55. How leadership principles directly shape company culture
05:40. Key indicators of a strong company culture and one that can improve
16:31. Examples where company culture has made an impact on a CIS employee's experience
21:59. The importance of feedback in supporting positive cultural change
25:41. How leadership training programs help employees to grow

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 124: The Many Layers of a Malware Takedown Operation Feb 26, 2025

In episode 124 of Cybersecurity Where You Are, Sean Atkinson is joined by Timothy Davis, Lead Cyber Threat Intelligence (CTI) Analyst at the Center for Internet Security® (CIS®). Together, they explore the many layers of a malware takedown operation.

Here are some highlights from our episode:

01:58. A high-level overview of what a malware takedown might involve
04:11. Some of the key players who help to disrupt known malware infrastructure
07:35. Which operational functionalities make malware infrastructure and tactics difficult to dismantle
10:56. Jurisdictional and legal challenges of a takedown operation
14:53. What goes into identifying malware networks and infected end-user devices
20:47. The technical strategies used for disrupting malware
24:13. How cyber threat actors respond differently to a takedown effort

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 123: An Operational Playbook for Security Impact Feb 19, 2025

In episode 123 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Gina Chapman, Chief Operating Officer (COO) at the Center for Internet Security® (CIS®). Together, they use examples from CIS to identify elements of an operational playbook for making an impact in the cybersecurity industry.

Here are some highlights from our episode:

01:21. Business development and organizational change over the course of 12 years at CIS
13:49. Change management and communication as means for preserving company culture
23:08. The importance of context in developing an operational playbook for a business
32:49. The use of operational understanding to create effective cybersecurity business models

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 122: DeepSeek AI Security and Utility Considerations Feb 12, 2025

In episode 122 of Cybersecurity Where You Are, Sean Atkinson is joined by Rian Davis, Associate Hybrid Threat Intelligence Analyst at the Center for Internet Security® (CIS®); and Timothy Davis, Lead Cyber Threat Intelligence (CTI) Analyst at CIS. Together, they discuss security and utility considerations surrounding the DeepSeek AI model.

Here are some highlights from our episode:

01:31. What enterprises and individuals can do before they start deploying foreign-developed, open-source large language models (LLMs)
08:48. How DeepSeek fits into evolving adversarial tactics and techniques involving AI
25:15. The impact on threat assessments and where we see controls built around AI
31:45. Parting thoughts on approaching newer technologies like DeepSeek

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 121: The Economics of Cybersecurity Decision-Making Feb 05, 2025

In episode 121 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Tyler Moore, Ph.D., Chair of Cyber Studies at the University of Tulsa. Together, they discuss the role of economics in cyber risk quantification and cybersecurity decision-making.

Here are some highlights from our episode:

01:55. How incentives, market failures, and other economic principles intersect with cybersecurity
08:39. A model of translating shared information as a way to capture complexity in cybersecurity decision-making
13:20. Pressing issues when making decisions about cybersecurity
18:08. How to have enough confidence and a cyber risk quantification model that's useful
23:45. How rigorous recommendations can help to match modeling and techniques like minimization
29:23. The role of the Board in making cybersecurity decisions and how to speak its language
34:57. Parting thoughts about risk quantification in cybersecurity

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 120: How Contextual Awareness Drives AI Governance Jan 29, 2025

In episode 120 of Cybersecurity Where You Are, Sean Atkinson explores how contextual awareness of generative artificial intelligence (GenAI) deployment in the business creates a foundation for AI governance strategy.

Here are some highlights from our episode:

01:58. Why specificity is important when we use the term "AI" in the governance space
04:10. Two AI distributions and how contextual function varies between them
13:52. The importance of engagement and asking the right questions
18:28. The role of lifecycle approaches and risk tolerance in understanding AI integration
23:45. Navigating two common questions that arise when governing AI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 119: Multidimensional Threat Defense at Large Events Jan 22, 2025

In episode 119 of Cybersecurity Where You Are, Sean Atkinson is joined by John Cohen, Executive Director of Countering Hybrid Threats at the Center for Internet Security® (CIS®). Together, they discuss the importance and provide examples of multidimensional threat defense as a means of securing large events.

Here are some highlights from our episode:

01:42. An overview of the multidimensional threat landscape from 2024 going into 2025
07:00. The shift to multidimensional threat analysis in crisis management
10:52. The importance of a sustainable, actionable approach to addressing today's threats
16:10. How CIS is working to help organizations build safety against multidimensional threats, including at large events

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 118: Preparing for Post-Quantum Cryptography Jan 15, 2025

In episode 118 of Cybersecurity Where You Are, Sean Atkinson is joined by Andy Smith, Security Architect for BP and Instructor at the SANS Institute. Together, they review the state of post-quantum cryptography as well as share recommendations for how organizations and individuals can prepare to move into the post-quantum era.

Here are some highlights from our episode:

02:55. What post-quantum cryptography is and why we need to pay attention
04:11. The impact of a cryptographically relevant quantum computer on symmetric vs. asymmetric cryptography
08:58. How media attention contributes to preparedness from an infrastructure perspective
14:30. The importance of a cryptography bill of materials (CBOM)
21:58. How organizations can prepare against quantum-enabled cyber attacks
29:05. How individuals need to understand quantum infrastructure in order to protect it
32:24. Optimism for the future of post-quantum cryptography

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 117: 2025 Cybersecurity Predictions from CIS Experts Jan 08, 2025

In episode 117 of Cybersecurity Where You Are, Sean Atkinson reflects on the 2025 cybersecurity predictions of 12 experts at the Center for Internet Security® (CIS®), as shared on the CIS website.

Here are some highlights from our episode:

01:40. Artificial intelligence (AI) as a means for crafting higher quality phishing emails
04:24. Zero trust with identity as a catalyst in 2025
07:55. A governance focus for K-12 school districts
12:37. Secure by design as part of the DNA of IT departments
14:22. The need for continuous patching with Internet of Things (IoT) devices
15:27. Training and adherence to basic cybersecurity practices as ongoing emphases
17:15. Consolidation from an operations perspective
20:40. The integration of AI into business operations
24:07. The socio-political impacts of emerging technologies on multidimensional threats
26:46. Growing attention on cloud security and data location
29:13. Cybercriminal markets and Phishing as a Service models
32:16. The benefit of AI to organizations

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 116: AI-Enhanced Ransomware and Defending Against It Jan 01, 2025

In episode 116 of Cybersecurity Where You Are, Sean Atkinson discusses the threat of AI-enhanced ransomware along with the use of generative artificial intelligence (GenAI) to defend against it.

Here are some highlights from our episode:

02:10. How AI in the cybersecurity space has advanced over the past few years
05:12. Why cybercriminals are incorporating artificial intelligence into their attacks
19:24. The application of AI in various stages of a ransomware attack
26:10. How AI can inform different aspects of a ransomware defense strategy

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 115: Continuous Feedback as CIS Employee Culture Dec 25, 2024

In episode 115 of Cybersecurity Where You Are, Sean Atkinson is joined by Carolyn Comer, Chief Human Resources Officer at the Center for Internet Security® (CIS®); Heidi Gonzalez, Sr. Employee Experience Specialist at CIS; and Jennifer Myers, Sr. Director of Learning and Development at CIS. With an in-person holiday open house and office party as their backdrop, they celebrate the continuous feedback that sustains and grows the employee culture at CIS.

Here are some highlights from our episode:

02:35. How the holiday open house and office party celebrate CIS employee culture
04:11. How the workforce culture at CIS has changed over time
07:57. What types of employee feedback CIS obtains after in-person events
09:33. How in-person interactions guide a continuous learning program for CIS employees
10:55. How events such as the holiday open house and office party continue to evolve
16:48. Why CIS has been so successful in helping employees to navigate remote work
20:04. The impact of an engaged Board of Directors on workplace culture
21:40. Celebrations and upcoming plans for culture and learning at CIS

Resources

CIS Cares

Episode 114: 3 Board Chairs Reflect on 25 Years of Community

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 114: 3 Board Chairs Reflect on 25 Years of Community Dec 18, 2024

In episode 114 of Cybersecurity Where You Are, Tony Sager is joined by three past and current Board Chairs of the Center for Internet Security® (CIS®): Frank Reeder, CIS Director Emeritus and Founding Chair as well as Director of the National Cybersecurity Scholarship Foundation; John Gilligan, President and Chief Executive Officer of CIS; and Bobbie Stempfley, CIS Board Chair and Business Security Officer of the Infrastructure Solutions Group at Dell Technologies. Together, they reflect on 25 years of CIS building community in the cybersecurity space.

Here are some highlights from our episode:

07:04. Perception of the problem that led to the idea of CIS
10:18. The value of building community outside of government
17:31. A sustainable and powerful business model for CIS
21:28. John's priorities during his transition from Board Chair to CEO
34:38. What CIS will focus on next
39:00. Parting thoughts for the future

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 113: Cyber Risk Prioritization as Ransomware Defense Dec 11, 2024

In episode 113 of Cybersecurity Where You Are, Tony Sager is joined by Phyllis Lee, VP of SBP Content Development at the Center for Internet Security® (CIS®); Adam Bobrow, Co-Founder and President of Veribo Analytics; and Sridevi Joshi, Co-Founder and CEO of Veribo Analytics. Together, they discuss how the Business Impact Analysis tool created by CIS and Veribo Analytics empowers individuals and organizations to use cyber risk prioritization as a basis for their ransomware defense strategy.

Here are some highlights from our episode:

04:35. Background on the impetus for the tool's development
07:57. How our understanding of cybersecurity risk differs from other areas of risk
12:21. Insight into Sridevi's learning process about cyber risk prioritization as a technologist
18:23. How the development process of the Business Impact Analysis tool got underway
21:05. What went into the process of translating the goal into tooling
31:34. Reflections on the tool's reception and what's next

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 112: How SANS Fosters Action on Cybersecurity Trends Dec 04, 2024

In episode 112 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Rob T. Lee, Chief of Research and Head of Faculty at SANS Institute. Together, they discuss how SANS Institute applies an operational or "do" model of leadership to gather expertise, build shared purpose, and foster action on evolving cybersecurity trends.

Here are some highlights from our episode:

05:47. How Rob ended up teaching at SANS Institute
08:49. Rob's first experience meeting and working with the late Alan Paller
12:07. How Rob's responsibility at SANS Institute has expanded
20:02. Key cybersecurity trends on Rob's agenda as Chief of Research
23:52. The need to refine our understanding of AI based on its different applications
36:28. Guidance for the 47th U.S. Presidential Administration

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 111: Distilling a First Principle of Cybersecurity Nov 27, 2024

In episode 111 of Cybersecurity Where You Are, Tony Sager is joined by Rick Howard, N2K Chief Security Officer and the Chief Analyst and Senior Fellow at The Cyberwire. Together, they discuss a first principle of cybersecurity proposed by Rick in his book, Cybersecurity First Principles: A Reboot of Strategy and Tactics.

Here are some highlights from our episode:

04:30. What drove the need to formulate a foundational cybersecurity assumption
07:44. How other "first" principles of cybersecurity have failed
14:13. The three elements of Rick's first principle of cybersecurity
25:55. How to derive action and improvements from Rick's first principle
40:34. Tips on getting started with a risk forecasting strategy

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 110: How Security Culture and Corporate Culture Mesh Nov 20, 2024

In episode 110 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Lee Noriega, Executive Director of the Cybersecurity Services Organization and Acting General Manager of Sales and Business Services at the Center for Internet Security® (CIS®); and Jerry Gitchel, founder of Leverage Unlimited and listener to Cybersecurity Where You Are. Together, they examine a question sent in by Jerry: if a corporate culture is lacking, can a security culture exist?

Here are some highlights from our episode:

01:33. What security culture is and how it differs from corporate culture
05:30. What elements factor into a strategy to drive corporate culture
09:30. The importance of a feedback loop for culture
15:43. How to cultivate "institutional ownership" in an organization's workforce
19:03. What goes into fostering security consciousness in support of security champions
25:14. The challenges of engaging corporate culture to think about security culture
29:13. Examples and takeaways for listeners

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 109: The Scariest Malware of 2024 Nov 13, 2024

In episode 109 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Randy Rose, VP of Security Operations & Intelligence at the Center for Internet Security® (CIS®); and Theodore "TJ" Sayers, Director of Intelligence & Incident Response at CIS. Together, they examine the scariest malware of 2024 and share some recommendations for how organizations can keep up with the changing cyber threat landscape.

Here are some highlights from our episode:

01:32. What makes certain malware strains "scarier" than others
05:37. What trends shaped the cyber threat landscape in 2024
14:25. The most terrifying cyber threat actor sphere in 2024
19:41. How malware tactics and techniques from 2024 will continue to evolve
25:04. How individuals and organizations can proactively defend themselves
29:52. National strategies that are shaping malware defense and incident response

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 108: Gaming and Competition in Cybersecurity Nov 06, 2024

In episode 108 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Ed Skoudis, CEO of Counter Hack Challenges and President of SANS Technology Institute. Together, they discuss the evolution of gaming and competition in cybersecurity and how these activities help to make the industry stronger.

Here are some highlights from our episode:

02:04. What goes into creating a game environment that attracts all kinds of skill levels
04:43. A multi-disciplinary approach to creating a game environment
16:14. How gaming and competition help to spot people with talent and potential
23:32. The challenges of keeping pace with new technology
32:03. The biggest challenges of putting a game environment together
36:47. How to keep track of characters, situations, and story elements of a game

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 107: Continuous Improvement via Secure by Design Oct 30, 2024

In episode 107 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Steve Lipner, Executive Director of SAFECode. Together, they discuss how software development organizations can use principles of "secure by design" to get on a track of continuous improvement.

Here are some highlights from our episode:

01:38. Steve's background and thoughts on the emergence of secure by design
14:04. Three guiding principles of secure software development
16:13. The impact of security awareness from a developer's perspective
22:22. How threat modeling helps to address security as a system problem
25:37. The effect of modern software development methodologies like Agile and DevSecOps
30:29. What CISA's activity around secure by design means for the industry

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 106: How to Avoid Falling for a Donation Scam Oct 23, 2024

In episode 106 of Cybersecurity Where You Are, Sean Atkinson is joined by Chris Smith, Social Media Specialist at the Center for Internet Security® (CIS®).

Together, they use a donation scam about a natural disaster to advise how you can stay safe against this type of cyber threat.

Here are some highlights from our episode:

00:49. Why it's important to talk about donation scams and why they're so prevalent
05:13. Recounting a real-world example of a donation scam
10:43. Common tactics leveraged by online scammers
13:27. Guidance for defending against a donation scam
16:48. The rise of checks and balances to defend against crowdfunding scams
20:59. How research can help you to verify before you donate
29:11. What to do if you have fallen for a scam

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 105: Context in Cyber Risk Quantification Oct 16, 2024

In episode 105 of Cybersecurity Where You Are, Sean Atkinson discusses the importance of context in maturing how you use cyber risk quantification to build cases for risk treatment strategies.

Here are some highlights from our episode:

01:56. The inspiration for an episode on cyber risk quantification
02:38. How to situate risk quantification in your business processes
08:56. Traps to avoid when quantifying cyber risks
12:12. How the quantification process relates to controls implementation
16:50. Why the right people and data can help you build something sustainable
23:19. Three lenses for examining cyber risk
26:50. Different means for communicating risk to stakeholders

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 104: Inside the First Year of a Cybersecurity Career Oct 09, 2024

In episode 104 of Cybersecurity Where You Are, Sean Atkinson is joined by Kennidi Ortega, Information Security Analyst at the Center for Internet Security® (CIS®).

Together, they explore the experience of a first-year analyst and how they might make the most of getting started in a cybersecurity career.

Here are some highlights from our episode:

01:07. How Kennidi got started in cybersecurity and what led her to the field
03:44. What the beginning of Sean's cybersecurity career looked like
04:23. The biggest challenges a first-year analyst may face
07:56. Helpful resources for getting started in the cybersecurity industry
11:58. Which technical skills Kennidi sharpened the quickest in her role
16:05. The most important business skills for planning a future in cybersecurity
20:13. How an agile mindset in cybersecurity supports career growth
23:00. Recommendations on career mapping for first-year analysts
28:13. The value of mentorships in cybersecurity

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 103: Education vs. Experience in Cybersecurity Oct 02, 2024

In episode 103 of Cybersecurity Where You Are, Sean Atkinson examines education and experience as pathways for new professionals to enter the cybersecurity industry.

Here are some highlights from our episode:

01:42. What's motivating Sean to talk about this topic
03:32. The value of cybersecurity degrees
05:17. The pros and cons of degree programs in cybersecurity
07:47. How a cybersecurity certification compares to a degree
10:57. Considerations for pursuing a certification in cybersecurity
14:00. Using certifications to learn new technology paradigms
16:54. Why a breadth of practical experience is important
22:49. Pathways for gaining experience in cybersecurity

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 102: The Sporty Rigor of CIS Controls Accreditation Sep 25, 2024

In episode 102 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by the following guests:

Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®)
Lawrence Cruciana, President of Corporate Information Technologies (CorpInfoTech)

Together, they discuss the "sporty" rigor underlying the process and value of achieving CIS Controls Accreditation.

Here are some highlights from our episode:

01:36. What is meant by CIS Controls Accreditation, as certified by CREST
03:32. What motivated CorpInfoTech to pursue accreditation
07:47. The importance of CIS Controls Accreditation to the cybersecurity ecosystem
20:07. The business value of accreditation for recipients

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 101: Visualizing Attack Paths in Active Directory Sep 18, 2024

In episode 101 of Cybersecurity Where You Are, Sean Atkinson is joined by Justin Kohler, Vice President of Products at SpecterOps, and Jonathan Parfait, Technical Account Manager at SpecterOps.

Together, they discuss how the visualization of attack paths in Active Directory helps organizations to better contextualize risks to their enterprise security.

Here are some highlights from our episode:

01:54. What Bloodhound is and how it assists organizations in assessing risks in their Active Directory environments
05:08. Why have organizations look at their Active Directory environments
11:15. Common vulnerabilities and misconfigurations identified by Bloodhound
21:21. How organizations can best use Bloodhound as part of their cyber defensive strategy
29:18. How Bloodhound is adapting to keep up with evolving Active Directory environments

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 100: Celebrating 100 Episodes and Looking Ahead Sep 11, 2024

In episode 100 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by David Bisson, Sr. Content Marketing Strategist at the Center for Internet Security® (CIS®).

Together, they celebrate the first 100 episodes of Cybersecurity Where You Are and discuss where the podcast might go in the future.

Here are some highlights from our episode:

01:14. How the podcast's approach and content have changed since the first episode
04:19. What surprised the team about the "machinery" of putting on a cybersecurity podcast
07:53. A look back at some of our favorite guests and types of podcast episodes
27:20. How the podcast can continue to support the cybersecurity industry going forward

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 99: How Cyber-Informed Engineering Builds Resilience Sep 04, 2024

In episode 99 of Cybersecurity Where You Are, Sean Atkinson is joined by Marcus Sachs, SVP and Chief Engineer at the Center for Internet Security® (CIS®).

Together, they discuss how cyber-informed engineering builds resilience to the potential failure of a digital system into new and existing engineering products.

Here are some highlights from our episode:

03:51. What cyber-informed engineering is and how this paradigm has emerged
11:39. What CIS is doing to emphasize cyber-informed engineering among U.S. State, Local, Tribal, and Territorial (SLTT) government organizations
16:25. Why resilience requires everyone to be "cyber-informed"
20:50. The need for boards of directors and C-Suite leaders to understand cybersecurity risk
25:30. What preparations help to lay the foundation for cyber-informed engineering

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 98: Transparency as a Tool to Combat Insider Threats Aug 28, 2024

In episode 98 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Roger Grimes, Data-Driven Defense Evangelist at KnowBe4.

Together, they embrace transparency as a vehicle for the cybersecurity industry to better defend against insider threats.

Here are some highlights from our episode:

01:28. How KnowBe4 detected an insider threat from North Korea
09:09. How the Center for Internet Security® (CIS®) responded to news of this incident
21:02. The role of technical controls in detecting these types of threats
23:56. Common signs you can use to detect fake employees in your hiring process
29:22. How cybersecurity companies can use this incident to improve their defenses

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 97: How Far We've Come preceding CIS's 25th Birthday Aug 21, 2024

In episode 97 of Cybersecurity Where You Are, Tony Sager is joined by the following guests:

Dr. Ramon Barquin, Board Member at the Center for Internet Security® (CIS®) and President and Chief Executive Officer at Barquin International
Franklin Reeder, Director Emeritus and Founding Chair of CIS as well as Director of the National Cybersecurity Scholarship Foundation
Clint Kreitner, Founding President/CEO and Former Board Member at CIS

Together, they look back at how much CIS has accomplished as an organization in the leadup to its 25th birthday.

Here are some highlights from our episode:

06:04. What brought everyone to CIS's founding meeting at the Cosmos Club
16:08. The first steps to operationalizing the takeaways of the Cosmos Club meeting
25:40. How CIS's business model came to be
34:24. The events that brought the Multi-State Information Sharing and Analysis Center® (MS-ISAC®) into CIS
42:42. Tracing the past forward to where we are now

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 96: Making Continuous Compliance Actionable for SMBs Aug 14, 2024

In episode 96 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Tarah Wheeler, CEO of Red Queen Dynamics.

Together, they discuss ongoing efforts to translate continuous compliance into something actionable for small- to medium-sized businesses (SMBs).

Here are some highlights from our episode:

03:11. The philosophy behind a business model focused on continuous compliance for SMBs
17:44. How the Fog of More complicates security and compliance for the "cyber-underserved"
30:56. How the industry can navigate the multiple-framework issue and streamline compliance

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 95: AI Augmentation and Its Impact on Cyber Defense Aug 07, 2024

In episode 95 of Cybersecurity Where You Are, Sean Atkinson is joined by Randy Rose, VP of Security Operations & Intelligence at the Center for Internet Security® (CIS®).

Together, they discuss AI augmentation in terms of how cyber defenders are using generative artificial intelligence to enhance their capabilities.

Here are some highlights from our episode:

01:16. How artificial intelligence has changed the landscape for cybersecurity defenders
03:49. How AI is starting to augment threat detection
10:12. What security researchers are exploring around AI and cyber defense
20:54. Key challenges and limitations for AI-based cyber defense
30:54. Future trends and innovations for cybersecurity defenders' use of AI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 94: Community Defense at the ISAC Annual Meeting Jul 31, 2024

In episode 94 of Cybersecurity Where You Are, Tony Sager is joined by the following guests from the Center for Internet Security® (CIS®):

Carlos Kizzee, SVP of Multi-State Information Sharing and Analysis Center® (MS-ISAC®) Strategy & Plans
Karen Sorady, VP of MS-ISAC Strategy & Plans
Greta Noble, Director of Community Engagement

Together, they discuss how the ISAC Annual Meeting supports the 24x7x365 community defense efforts of the MS-ISAC and Elections Infrastructure Information Sharing and Analysis Center® (EI-ISAC®).

Here are some highlights from our episode:

02:30. Background information on ISACs in general and the role of the MS-ISAC
04:17. Why it's an annual meeting and not a conference
06:40. What made the 2024 ISAC Annual Meeting the largest of its kind so far
08:43. How the human dimension drives our yearly meeting
15:44. The role of the MS- and EI-ISACs in CIS's broader strategy
19:42. How our yearly meeting improves what CIS does
29:57. What's next for the ISAC Annual Meeting

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 93: Keeping Societal Confidence in a Connected World Jul 24, 2024

In episode 93 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined once again by John Cohen, Executive Director of Countering Hybrid Threats at the Center for Internet Security® (CIS®).

Together, they discuss a whole-of-society approach to help make the U.S. public resilient against multidimensional threats in our connected world.

Here are some highlights from our episode:

01:52. What the U.S. public needs to consider in order to strengthen its resilience
06:04. How a national framework addresses the need for organizations to build resilience and intercommunication in the face of increasingly sophisticated threats
11:41. Identifying who key partners are in a complex, hybrid world
16:49. How people are responding to the national framework and where they are seeing value
21:50. Clarifying hopes for the national framework going forward

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 92: A Framework to Counter Evolving Cyber Threats Jul 17, 2024

In episode 92 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by John Cohen, Executive Director of Countering Hybrid Threats at the Center for Internet Security® (CIS®).

Together, they discuss "Enhancing Safety in the Connected World — A National Framework for Action," a multi-year project to help law enforcement and security professionals better contextualize and respond to evolving cyber threats.

Here are some highlights from our episode:

02:01. Why the current threat environment necessitates a framework that accounts for "cyber physical," "cyber safety," and other considerations
08:48. How entities at the federal level and local law enforcement approach evolving cyber threats differently
16:34. The different types of threats that characterize the evolving cyber threat environment
22:05. How the Federalist Papers inform the Framework's "whole-of-society" approach

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 91: What You Need to Know about CIS Controls v8.1 Jul 10, 2024

In episode 91 of Cybersecurity Where You Are, Sean Atkinson is joined by Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®).

Together, they discuss what you need to know about the release of CIS Controls v8.1.

Here are some highlights from our episode:

01:17. What you can expect to see in version 8.1 of the Controls
06:19. How CIS Controls v8.1 helps you to integrate other governance structures
09:23. How version 8.0 and version 8.1 of the Controls differ
14:19. What goes into creating a new version of the Controls
21:06. Which resources you can use to guide your implementation plan
26:39. A sneak peek into the development of version 9.0

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 90: Migrating to the Cloud with Control Continuity Jul 03, 2024

In episode 90 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by the following guests:

Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®)
Mia LaVada, Product Manager of CIS Benchmarks and Cloud at CIS
Don Freeley, VP of IT Services at CIS

Together, they discuss how you can use CIS resources to ensure control continuity when migrating to the cloud.

Here are some highlights from our episode:

01:35. The biggest drivers for why organizations are moving to the cloud
02:42. Foundational factors to consider as part of your cloud migration
07:24. Resources from CIS designed to help you in your transition to the cloud
11:00. Common challenges of migrating to the cloud
14:37. The importance of three CIS Controls to your cloud security program
18:35. The value of partnerships and community in driving cloud security improvements
19:32. How you can use the CIS Foundations Benchmarks to get started in the cloud
23:06. Inside the human and process side of moving to the cloud

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 89: How Threat Actors Are Using GenAI as an Enabler Jun 26, 2024

In episode 89 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by the following guests:

Rian Davis, Elections Cyber Threat Intelligence Intern at the Center for Internet Security® (CIS®)

Timothy Davis, Sr. Elections Cyber Threat Intelligence Analyst at CIS

Together, they discuss how cyber threat actors (CTAs) are using generative artificial intelligence (GenAI) as an enabler of their attacks.

Here are some highlights from our episode:

01:04. Why it's important to raise awareness of how CTAs are using GenAI
01:59. How the CIS Cyber Threat Intelligence (CTI) team is seeing generative AI in CTAs' attack methodology
03:50. The types of attacks that are using this technology and how the frequency of those attacks is changing
05:46. Some notable attacks that have used GenAI in their methodology
16:10. The ways in which CTAs are incorporating generative AI into social engineering
24:17. What defenders can do in response to CTAs' use of GenAI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 88: The Evolution of the Role of a CISO Jun 19, 2024

In episode 88 of Cybersecurity Where You Are, co-host Sean Atkinson discusses the evolving role of a chief information security officer (CISO).

Here are some highlights from our episode:

02:47. Why communication is a core competency for CISOs
08:35. How to take a balanced approach when evaluating an organization's implementation of artificial intelligence (AI) and machine learning (ML)
11:47. The role a CISO plays in integrating privacy requirements into the organization
15:35. Thoughts on how you can start preparing for or moving into a CISO position
19:12. A future outlook of the CISO role
26:40. Average longevity of CISOs in their roles and how this affects a security posture

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 87: Marking 11 Years as a Verizon DBIR Contributor Jun 05, 2024

In episode 87 of Cybersecurity Where You Are, co-host Tony Sager is joined by the following guests:

Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®)
Philippe Langlois, Senior Principal, Security Risk Management and Author of the Verizon Data Breach Investigations Report (DBIR)
Theodore "TJ" Sayers, Director of Intelligence & Incident Response at CIS

Together, they celebrate 11 years of CIS and Verizon working together to contextualize the threat activity security teams are seeing and to help teams use the Controls as an improvement framework.

Here are some highlights from our episode:

02:00. How the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS-ISAC® and EI-ISAC®) contribute anonymized data to the Verizon DBIR
07.27. The two types of data that Verizon uses as input for its report
13:50. The ways CIS uses the content of Verizon's DBIR to help people embrace programs of security improvement
24:48. A glimpse at what goes into producing the DBIR
28.33. The importance of leadership in guiding team dynamics and fun
32.07. Reception of the 2024 DBIR and exploration of what's next for the Verizon DBIR team

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 86 Evangelizing CIS's Message at RSAC 2024 May 29, 2024

In episode 86 of Cybersecurity Where You Are, co-host Sean Atkinson is live once again from Booth 4319 at RSA Conference (RSAC) 2024.

00:57. Sean chats with Mat Everman, Information Security Operations Manager, about his talk, "Shades of Purple: Getting Started and Making Purple Teaming Possible." They discuss some of the questions Mat received following his talk and how they can put purple teaming into practice at the Center for Internet Security® (CIS®).

Sean asks passersby what they're looking to get out of RSAC 2024 and what stood out to them at the conference.

13:56. José Mena, Founder of Digital Twin Networks
20:34. Jonathan Kern, CEO of Castile Defense
25:42. Ken Klestinec, Regional Sales Manager at Akamai

Finally, Sean talks to fellow team members about CIS's objective for RSAC 2024.

18:10. Aaron Perkins, Director of Communications
23:25. Nick Rust, Director of Reseller & Channel Partners
27:04. Jeff Sparks, CIS Services Sr. Account Executive
28:08. Mia LaVada, Product Manager of CIS Benchmarks and Cloud
30:01. Mishal Makshood, Sr. Cloud Security Account Executive

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 85: Reenergizing Collective Action at RSAC 2024 May 22, 2024

In episode 85 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are live from Booth 4319 at RSA Conference (RSAC) 2024. Together, they discuss how events like RSAC 2024 reenergize collective action in the cybersecurity industry. They begin by noting how resources such as the CIS Community Defense Model (CDM) bring more data and transparency to security recommendations for the cybersecurity industry. They then look back on some of Tony's presentations at prior years of RSAC before looking at the interest surrounding supply chain security, zero trust, and artificial intelligence (AI). To address these developments, organizations must create a foundation for defense and scale rapid improvements, needs which Tony and Sean see as opportunities for collective action in the industry.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 84: Why We Need to Define Reasonable Cybersecurity May 15, 2024

In episode 84 of Cybersecurity Where You Are, co-host Tony Sager is joined by Brian de Vallance, Senior Advisor at Cambridge Global Advisors; and Phyllis Lee, VP of Security Best Practices (SBP) Content Development at the Center for Internet Security® (CIS®). Together, they discuss the notion of reasonable cybersecurity. They begin by providing some background about reasonableness in cybersecurity and identifying the problem we need to solve — namely, the lack of a definition of reasonableness around which organizations can build their cybersecurity program. They then discuss how a definition for reasonable cybersecurity needs to include security best practices that are doable. They conclude by exploring how CIS's work around this topic may influence its content development going forward.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 83: Why Meeting in Person Matters to CIS Employees May 01, 2024

In episode 83 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by nearly 20 employees at the Center for Internet Security® (CIS®). Together, they discuss the value of meeting in person to CIS workplace culture. With the company's 2024 Annual Full Staff Meeting in Orlando, FL, as their backdrop, they explore how personal relationships create a foundation for building effective teams, more agile workflows, and a sustainable sense of engagement and motivation at CIS. Along the way, they reflect on how much the company has changed since before the pandemic.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 82: How CIS Leadership Values Team Building Events Apr 24, 2024

In episode 82 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by John Gilligan, President and CEO at the Center for Internet Security® (CIS®); and Gina Chapman, Chief Operating Officer at CIS. Together, they discuss the importance of in-person team building events. They use the pandemic as a frame to understand how events such as the 2024 Annual Full Staff Meeting preserve and cultivate CIS's workplace culture. They also look to other ongoing initiatives at the company, such as CIS Cares and the IDEA Alliance, as efforts to sustain employee engagement both in person and virtually.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 81: Exploring IAM for Identity Management Day 2024 Apr 10, 2024

In episode 81 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Daniel McIntyre, Identity and Access Management (IAM) Manager at the Center for Internet Security® (CIS®). Together, they acknowledge Identity Management Day 2024 with a discussion of IAM. They begin by looking at how IAM as a concept has changed over the years. They then explore current challenges in the modern environment and strategies for IAM to keep up with emerging threats. After emphasizing the importance of training in an effective IAM program, they conclude their conversation by sharing best practices for getting started in IAM and cybersecurity more broadly.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 80: Advancing Common Good in Cybersecurity – Part 2 Apr 03, 2024

In episode 80 of Cybersecurity Where You Are, co-host Tony Sager is once again joined by Philip Reitinger, President and CEO of Global Cyber Alliance. Together, they continue their discussion around Common Good Cyber. Tony and Philip begin by recapping the events of the Common Good Cyber Workshop on February 26–27, 2024. From there, they explore the perspective of IT companies and governments in supporting common good solutions for the cybersecurity industry. They conclude their conversation by looking to the future of Common Good Cyber and explaining how you can get involved.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 79: Advancing Common Good in Cybersecurity – Part 1 Mar 27, 2024

In episode 79 of Cybersecurity Where You Are, co-host Tony Sager is joined by Philip Reitinger, President and CEO of Global Cyber Alliance. Together, they discuss the Common Good Cyber cybersecurity initiative. Tony and Philip begin by sharing the paths that brought them to the nonprofit sector. From there, Philip recounts the events and needs that led to the formation of Common Good Cyber. They end the first part of their conversation by exploring the nature of "common good" in relation to internet technology. Both agree that common good efforts must include more than just money to produce meaningful change in the cybersecurity industry.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 78: Conductors of Risk Building Harmony in Ambiguity Mar 13, 2024

In episode 78 of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson are joined by Lisa Young, Senior Metrics Engineer at Netflix. Lisa is a long-time practitioner in the cybersecurity risk, risk quantification, and metrics field. She has a rich career and experience of putting resources towards practices that will protect, sustain, make organizations resilient over time. In her current role, Lisa helps Netflix measure what works, what doesn't work, and how to optimize practices and controls that help enhance coverage and efficacy of things that need to be done. Together, the three discuss the hurdles of harmonizing teams to determine acceptable risk in the cybersecurity ecosystem.

Resources:

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 77: How to Use Data to Make Cybersecurity Decisions Feb 28, 2024

In episode 77 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Roger Grimes, Data-Driven Defense Evangelist at KnowBe4. Together, they discuss how to use data to inform your decision-making in cybersecurity. They begin by discussing the cybersecurity industry's lack of maturity in its use of data. From there, they explore the risks of not using data to make cybersecurity decisions. In Tony's words, the cybersecurity industry doesn't have to accept "perfection is the enemy of the good" as its paradigm. When we understand the data with which we can work, we can frame the information in a way to strengthen the cybersecurity posture of our respective organizations.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 76: The Role of Thought Leadership in Cybersecurity Feb 16, 2024

In episode 76 of Cybersecurity Where You Are, co-host Tony Sager is joined by Julie Morris, CEO and Co-Founder of Persona Media. Together, they discuss the role of thought leadership in cybersecurity. They begin by discussing misconceptions surrounding the notion of thought leadership. Next, they explore what thought leadership looks like in the context of an industry like cybersecurity and a company like the Center for Internet Security® (CIS®). Their conversation concludes with some advice on how individuals, especially senior leaders, can get started with thought leadership.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 75: How GenAI Continues to Reshape Cybersecurity Feb 02, 2024

In episode 75 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager discuss how generative artificial intelligence (GenAI) continues to reshape cybersecurity. They begin by using Episodes 48, 49, and 56 to consider the ongoing impact of GenAI on confidence, trust, and consistency as elements of a mature cybersecurity program. After reflecting on how confidence has shaped the work of the Center for Internet Security® (CIS®) more generally, Sean and Tony conclude by revisiting the verification challenge of GenAI.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 74: The Nexus of Cybersecurity & Privacy Legislation Jan 19, 2024

In episode 74 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Brian de Vallance, Senior Advisor at Cambridge Global Advisors; and Carlos Kizzee, Senior Vice President (SVP) for Multi-State Information Sharing and Analysis Center® (MS-ISAC®) Strategy & Plans at the Center for Internet Security® (CIS®). In recognition of Data Privacy Week on January 21-27, 2024, they discuss the nexus of cybersecurity and privacy legislation in the United States. They begin by reviewing how the privacy laws passed by U.S. states over the past several years all include a cybersecurity element – namely, the effort to implement "reasonable" cybersecurity around protecting consumers' data. They then look to the future and consider how the laws will lead to regulations and, in turn, enforcement actions that will help raise our understanding of consumer privacy rights and how they can be defended.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 73: A YIR for Our 2023 Cybersecurity Predictions Jan 05, 2024

In episode 73 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager use our 2023 cybersecurity predictions to understand how the industry changed last year. They discuss progress and challenges around Artificial Intelligence (AI), zero trust, and other key trends they and others brought up in our blog post, "Our Experts' Top Cybersecurity Predictions for 2023." They also promise a similar year in review (YIR) for our 2024 cybersecurity predictions, for which 17 experts at the Center for Internet Security® (CIS®) contributed their thoughts.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 72: Cybersecurity in Education as a Balancing Act Dec 22, 2023

In episode 72 of Cybersecurity Where You Are, co-host Tony Sager is joined by Phyllis Lee, VP of Security Best Practices (SBP) Content Development at the Center for Internet Security® (CIS®). Together, they discuss "Cybersecurity: Practice What, and While, We Teach," a keynote panel where they discussed cybersecurity in education during Tech Tactics in Education: Data and IT Security in the New Now. Throughout this episode, they pull in recorded snippets from their panel. They use those recordings to reflect on IT operational challenges and the need to balance different interests in education organizations, including K-12 schools and higher education institutions. They also highlight commonalities that present not only opportunities for collaboration in the education sector but also instances where CIS can help advance cybersecurity in education through the content it produces.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 71: Advancing K-12 Cybersecurity Through Community Dec 08, 2023

In episode 71 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Carlos Kizzee, SVP for the Multi-State Information Sharing and Analysis Center® (MS-ISAC®) Strategy & Plans at the Center for Internet Security® (CIS®); Dr. Bhargav Vyas, Assistant Superintendent for Compliance and Information Systems as well as Data Protection Officer at Monroe-Woodbury Central School District; and Terry Loftus, Assistant Superintendent & Chief Information Officer of Integrated Technology Services for the San Diego County Office of Education.

Together, they discuss how our publication, "K-12 Report: A Cybersecurity Assessment of the 2021-2022 School Year," facilitates better decision-making around K-12 cybersecurity. They begin by considering some common cybersecurity challenges for K-12 organizations, most notably a lack of funding and skilled personnel. From there, they reflect on how entities in this sector have grown their cybersecurity maturity despite those obstacles over the past few years. Their conversation ends with guidance for getting started with a K-12 cybersecurity program.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 70: How the Media Molds Public Perception of Infosec Nov 22, 2023

In episode 70 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Mathew Schwartz, Executive Editor for DataBreachToday & Europe at the Information Security Media Group (ISMG). Together, they discuss the media's role in shaping public understanding and perception of infosec. They begin by considering the idea of media channels helping to educate the public about cybersecurity matters, including data breaches and digital threats. From there, they go on to talk about how the language that the media uses to report on cybersecurity affects its ability to build trust with the public. Their conversation ends by reviewing tips for how members of the public can find trustworthy media channels in the infosec space.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 69: How the NCSR Assessment Sows SLTT Cyber Maturity Nov 09, 2023

In episode 69 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Tyler Scarlotta, Manager of Member Programs at the Center for Internet Security (CIS). Together, they discuss how the Nationwide Cybersecurity Review (NCSR) helps U.S. State, Local, Tribal, and Territorial (SLTT) government organizations evaluate their cyber maturity. They begin by reviewing what the NCSR assessment program entails and identifying trends from previous years. They then explore the lessons learned by SLTTs through participating in the NCSR, the steps to getting involved with the program, as well as the resources from CIS and the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS- and EI-ISACs) that a participant can use to strengthen their cyber maturity.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 68: Designing Cyber Defense as a Partnership Effort Oct 27, 2023

In episode 68 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by James Yeager, VP of Public Sector and Healthcare at CrowdStrike. Together, they discuss designing cyber defense as a partnership effort. They begin by reflecting on the ongoing work of CIS and CrowdStrike to advance cyber defense together. After touching on some of the biggest trends they've seen in the threat landscape, they note how giving advice to customers around cyber defense requires partnership activity. They observe that cybersecurity companies like CIS and CrowdStrike must continue to work together, and they highlight the importance of working with customers directly to identify new angles, new challenges, and new ways of providing help.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 67: Seizing the Moment after a Cybersecurity Audit Oct 13, 2023

In episode 67 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Stephanie Gass, Director of Governance, Risk, and Compliance at the Center for Internet Security (CIS). Together, they discuss how to seize the moment once you've completed a cybersecurity audit. They explore the types of questions that you need to think about and the challenges you might encounter when acting upon a cybersecurity audit's findings. Additionally, they walk through a few examples of how you might consider responding to certain audit findings within your organization. Throughout the entire episode, they cite the importance of using business context to determine your priorities and a way for achieving them.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 66: How RABET-V Verifies Non-Voting Election Tech Oct 06, 2023

In episode 66 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Mike Garcia, Senior Cybersecurity Advisor at the Center for Internet Security (CIS), and Jared Dearing, Sr. Director of Elections Best Practices at CIS. Together, they discuss the Rapid Architecture-Based Election Technology Verification (RABET-V) program. They begin by noting how the lack of a standardized verification process for non-voting election systems warranted the creation of a holistic testing approach for these technologies. From there, they explain how RABET-V differs from traditional testing methodologies by verifying non-voting election systems using a three-pronged approach. They conclude by sharing their ongoing work to improve RABET-V.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 65: Making Cyber Risk Analysis Practical with QRA Sep 29, 2023

In episode 65 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Christopher Painter, Board Member of the Center for Internet Security (CIS) and President of the Global Forum on Cyber Expertise Foundation. Together, they discuss cybersecurity risk management. They begin by discussing how cyber risk analysis fits into a business risk management program in general. From there, they explore quantitative risk analysis (QRA), including its benefits for understanding cyber risk and the challenges of getting started. Their conversation then gets into how the CIS Board of Directors, specifically the Risk Committee, is using different methods of QRA to achieve CIS's business goals and objectives.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 64: Defining Your Data Management Standards Sep 15, 2023

In episode 64 of Cybersecurity Where You Are, co-host Sean Atkinson initiates a series around establishing an underlying policy for your organization's cybersecurity program. He begins by discussing how a policy provides an overview of the business rules, or standards, that will feature in the program. With each standard, he clarifies that you can take a procedural approach to upholding supporting elements. He then narrows his focus to managing data and information, including different types of data management considerations for your organization. Along the way, he points out how you can use resources from the Center for Internet Security (CIS) to drive continuous improvement in this space.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 63: Building Capability and Integration with SBOMs Sep 01, 2023

In episode 63 of Cybersecurity Where You Are, co-host Sean Atkinson discusses software bills of materials (SBOMs). He uses CISA and other resources to contextualize key considerations of an SBOM, including how you can use one to understand your organization's underlying risks. From there, Sean explores how to build capability in the SBOM space. He urges a judicious approach that follows practice and builds on resiliency.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 62: Inside the 'Spidey Sense' of a Pentester Aug 18, 2023

In episode 62 of Cybersecurity Where You Are, co-host Sean Atkinson sits down with Chris Elgee, Senior Security Analyst at Counter Hack; and Erik Pursley, Technical Engineer at Counter Hack. Together, they discuss the "spidey sense" that goes into being a penetration tester. They reflect on key skills and certifications that help to make a successful pentester, review some of the methodologies that go into pentesting, and consider how specialization might be inevitable in an evolving technology landscape. They conclude by offering advice to organizations that are looking to engage in a pentest.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 61: Overcoming Pre-Audit Scaries Through Governance Aug 04, 2023

In episode 61 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Stephanie Gass, Director of Governance, Risk, and Compliance. Together, they discuss the components of an effective cybersecurity risk governance program. They explore how to represent technical security questions to others, how to overcome challenges associated with changing the way a company makes decisions related to risk, and how culture plays into these types of shifts. They also reflect on how quantification, supply chain security, and other issues factor into a modern-day approach to governance.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 60: Guiding Vendors to IoT Security by Design Jul 21, 2023

In episode 60 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Kathleen Moriarty, CTO at the Center for Internet Security (CIS); Ben Carter, Internet of Things (IoT) specialist at CIS; and Kaitlin Drape, Research and Innovation Process Lead at CIS. Together, they discuss a white paper they recently released that guides IoT vendors on how to build security into their products by default and by design. Kathleen, Ben, and Kaitlin begin by reflecting on why they created such a document in the first place. After explaining some of what went into drafting the white paper, they look to the future and note how IoT frameworks such as theirs helps to shift left IoT security toward purchasing decisions.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 59: Probing the Modern Role of the Pentest Jul 07, 2023

In episode 59 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Ed Skoudis, founder of the SANS Penetration Testing Curriculum and Counter Hack. Together, they discuss the value of penetration testing – all while CIS as an organization is undergoing a pentest! They begin by considering the historical perspective of pentests. (In Tony's words, "the foundational perspective for testing back then was to create drama.") They then reflect on how penetration tests excel when they prioritize education using a process of feedback. During the course of the conversation, Sean and Ed draw upon their years of collaboration to explain what this process can look like. They conclude by providing advice on how less mature organizations can get value from a penetration test.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 58: Inside CIS's Award-Winning Workplace Culture Jun 23, 2023

In episode 58 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by more than a dozen Center for Internet Security (CIS) employees during the company's 2023 Full Staff Meeting at the Sagamore Resort. Together, they discuss the collaborative nature of CIS's award-winning workplace culture. Using the Full Staff Meeting as a lens, each employee reflects on the importance of an annual in-person meeting for all employees. Their responses highlight how colleagues, teams, and business units alike focus on building relationships. Doing so empowers CIS to engage with partners, members, and the cybersecurity community writ large as a cohesive whole.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 57: Celebrating the 20th Anniversary of the MS-ISAC! Jun 09, 2023

In episode 57 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by the following guests: William Pelgrin, Founder and Former Chair of the MS-ISAC; Thomas Duffy, Former Senior VP Of Operations and Services at the MS-ISAC; and Karen Sorady, VP of MS-ISAC Stakeholder Engagement Division. Together, they celebrate the 20th anniversary of the Multi-State Information Sharing and Analysis Center (MS-ISAC). They look back on the past two decades and reminisce on pivotal moments in the MS-ISAC's history, including when it became a division of the Center for Internet Security (CIS). After discussing how much it's grown in that time, they turn their eyes to the future and explore the MS-ISAC's plans to continue to serve its membership.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 56: Cybersecurity Risks and Rewards of LLMs May 26, 2023

In episode 56 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Dr. Paulo Shakarian, Associate Professor at the School of Computing, Informatics, and Decision Systems Engineering (CIDSE) at Arizona State University. Together, they discuss the cybersecurity implications of large language models (LLMs) like ChatGPT-3. They first look back on how deep learning has enabled machine learning (ML) and artificial intelligence (AI) to reach new levels of accuracy. Next, they discuss how ChatGPT-3 and other new AI models, which are designed to mimic human language, may have inaccuracies. This possibility opens up new vulnerabilities, such as the ability to scale information operations, along with new challenges from a cybersecurity perspective. They conclude by sharing their thoughts about the future of the AI and LLM space.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 55: Live at RSA Conference 2023 May 12, 2023

In episode 55 of Cybersecurity Where You Are, co-host Sean Atkinson speaks with experts in attendance at RSA Conference 2023. He asks nearly a dozen different attendees to share their impressions of the event. They explain how someone can get the most out of being at RSA and what made this year's conference stand out compared to previous years. (Spoiler alert: "AI" as a buzzword was everywhere.) They also discuss just some of the different topics you can learn about at RSA, such as the opportunity for partnerships between red teams and blue teams as well as the cybersecurity impact of AI on the music industry.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 54: How to Get Started in Cybersecurity Apr 28, 2023

In episode 54 of Cybersecurity Where You Are, co-host Sean Atkinson addresses how to get started in cybersecurity. He begins by looking at the different types of hard skills and soft skills that form the foundation of any cybersecurity career. Next, he draws upon his expertise to offer advice around certifications, learning a programming language, using a training provider, and building a portfolio. He also shares key insights into how you can make cybersecurity a rewarding career choice for years to come.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 53: Fostering a Neurodiverse Cybersecurity Industry Apr 14, 2023

In episode 53 of Cybersecurity Where You Are, co-host Tony Sager is joined by Ron Gula, President and Co-Founder of Gula Tech Foundation. Together, they acknowledge Autism and Neurodiversity Awareness Month by discussing the need to create more opportunities in cybersecurity for neurodiverse individuals. They point out that there's no one way for all employers and supervisors to support employees with different abilities. It's up to the employers and supervisors to decide where those efforts fit into their culture and what each victory looks like.

Attending RSA Conference 2023? Make sure you visit the main conference hall at 12:00 P.M. PT on Wednesday, April 26. At that time and place, Gula Tech Foundation will announce the four winners of its Spring 2023 grant campaign, "Expanding Opportunities in Cyber for the Neurodivergent." As part of the ceremony, you'll have a chance to speak with the winners about engaging neurodiverse individuals in your organization.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 52: Back in the Buzz of RSA Conference Mar 31, 2023

In episode 52 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager discuss RSA Conference 2023. Together, they point out that the annual conference is more than just a trade show. They use that lens to identify some tips and tricks that attendees can use to get the most out of their time there. Additionally, they discuss what themes and activities you can expect to see at RSA Conference 2023. Their conversation ends with a teaser of Sean's talk at the event.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 51: Making a Roadmap for Your Cybersecurity Journey Mar 15, 2023

In episode 51 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager discuss the strategic importance of using a roadmap to navigate your cybersecurity journey. Together, they point out that this journey is like many others. You need to know how to get packing, plan your route, hit the road, and take a snapshot of how far you've come and where you're going next. Sean and Tony identify some important considerations to keep in mind for each leg of your trip, and they note that the Center for Internet Security shares your journey and supports you along it.

One of the ways it does this is through CIS SecureSuite. Members gain access to benefits, tools, and resources that help them, their clients, and their customers navigate the different stages of their respective cybersecurity journeys. Now through April 30, you can save up to 20% on a new CIS SecureSuite Membership using promo code CYBER2023.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 50: The Best of Cybersecurity Where You Are Mar 03, 2023

In episode 50 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Randy Rose, Sr. Director of Security Operations & Intel for the MS-ISAC, and Kathleen Moriarty, Chief Technology Officer at CIS. Together, they celebrate Cybersecurity Where You Are reaching Episode 50. To mark this milestone, they look back on some of their favorite moments in the podcast's history. They also share how those moments tie back not only to the maturation of the podcast but also to CIS's ethos as a "platform for activism." (Thanks, Tony.)

Thank you to all our listeners for helping us reach Episode 50. We couldn't have done it without you. More laughter and learning to come!

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 49: Artificial Intelligence and Cybersecurity Feb 17, 2023

In episode 49 of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson discuss artificial intelligence (AI) and cybersecurity. The two review the relationship, specifically how AI and cybersecurity meet, enhance each other, and ways AI could be a detriment.

Resources:

Episode 48: 3 Trends to Watch in the Cybersecurity Industry Feb 03, 2023

In episode 48 of Cybersecurity Where You Are, co-host Sean Atkinson introduces three trends within the cybersecurity industry that we'll discuss in upcoming episodes. He first touches on how new developments in artificial intelligence, particularly ChatGPT, might affect cybersecurity processes like incident response. Next, Sean reflects on what widespread layoffs in big tech mean for cybersecurity, especially when set against an ongoing cybersecurity skills gap. Finally, he provides an overview of the legislation and preparations for securing a post-quantum world.

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 45: The Importance of Mentorship Dec 16, 2022

In episode 45 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Valecia Stocchetti who is a Sr. Cybersecurity Engineer on the CIS Critical Security Controls team here at CIS. Valecia and Sean discuss how their mentorship took shape and how it worked as a partnership from the very beginning. Together with Tony, they go over mentorship vs. career counseling and note that a vetting process can help you spot the difference. They conclude by exploring why it's important to pay it forward whether you're a mentor or mentee.

Resources:

Episode 47: How Security and Compliance Support Each Other Jan 06, 2023

In episode 47 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Sawyer Miller, Senior Manager of Cyber Risk at risk3sixty LLC. Together, they discuss security and compliance. Their discussion explores various ways that security and compliance can align even though they are different business considerations. (Spoiler alert: risk and balance are key.) Sean and Sawyer also touch on how evolving technologies and threats are changing our understanding of security and compliance. They conclude with some recommendations on how your business and security leaders can begin to navigate these developments.

Resources

Episode 46: Integration as a Theme for 2023 Dec 30, 2022

In episode 46 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager discuss their cybersecurity predictions for 2023 along with those from a few other CIS experts. "Integration" is the word of the day for their conversation. Sean and Tony feel that this concept will shape how we measure the progress of cybersecurity in a number of areas, from managing vendor risk management in the open-source landscape to promoting meaningful discussions about security.

Resources

Episode 44: A Zero Trust Framework Knows No End Dec 02, 2022

In episode 44 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Scott Hall, Security Architect at the Center for Internet Security (CIS). Together, they identify resources and buy-in as some of the key elements for implementing a zero trust framework. So begins a journey that evolves with your organization's changing business processes and functions. To be successful, it's important to accept that you'll always be tweaking things to fit your needs. It's also invaluable to take a business-centered approach. This includes maintaining an inventory of what you have so that your zero trust journey can drive, not inhibit, business growth.

Resources

Episode 43: Giving Back Through CIS CARES Nov 18, 2022

In episode 43 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Amanda Flynn, Manager of Admin Services and Board Relations at the Center for Internet Security (CIS), and Elijah Cedeno, Sr. Account Management Specialist at CIS. Together, they discuss the work of CIS CARES, a CIS program that gives back to the community every year through campaigns focused on community, animals, resource conservation, and education. Their conversation looks back at the evolution of CIS CARES over the past 11 years, explores the program's focus for Q4 2022, and teases what's to come next year and beyond.

Resources

Episode 40 See Yourself in Cyber to Be Cyber Smart Oct 07, 2022

In episode 40 of Cybersecurity Where You Are, co-host Tony Sager is joined by Murray Kenyon, Vice Cybersecurity Partnerships Executive at U.S. Bank. Together, they discuss the human dimension of cybersecurity, that is, bringing people with different talents together to understand common problems and help both organizations and individuals make informed choices. This is the philosophy behind Cybersecurity Awareness Month, an initiative which Kenyon helps organize as a Board member of the National Cybersecurity Alliance. The purpose of this year's theme, "See Yourself in Cyber," is not to make users into cybersecurity experts, as Sager and Kenyon point out. It's to create resources and lines of communication for sharing basic steps that everyone can take to better protect themselves online.

Resources

Follow Murray Kenyon on LinkedIn.
Cybersecurity Awareness Month – National Cybersecurity Alliance
Jumpstart Your Security Program with Essential Cyber Hygiene
CIS Communities

Episode 42: Advocacy for the Underserved Oct 28, 2022

In episode 42 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Mat Everman, Information Security Operations Manager at the Center for Internet Security (CIS). Together, they discuss the topic of advocating for the underserved. Both agree that there's no silver bullet that a person or business can use to minimize all cyber risk. In the absence of a cure-all solution, however, there are opportunities for improving the security maturity of the underserved more broadly. This process begins with a discussion of where the underserved are. It then focuses on security measures that they can use to establish a baseline and create a foundation for an ever-evolving security journey.

Resources

Episode 41: A Blueprint for Ransomware Defense Oct 21, 2022

In episode 41 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Valecia Stocchetti, Sr. Cybersecurity Engineer of the CIS Critical Security Controls (CIS Controls); Megan Stifel, Chief Strategy Officer for the Institute for Security and Technology; and Davis Hake, Co-Founder and Vice President of Policy at Resilience Insurance. Together, they discuss their collaboration as members of the Ransomware Task Force to create the "Blueprint for Ransomware Defense." After situating this effort within the evolving ransomware landscape, they explain how organizations can best use the Blueprint as an internal and external resource to minimize their ransomware risk. They also offer insight into how the Blueprint stands apart from other anti-ransomware guides that are currently available.

Resources

Follow Megan on LinkedIn

Follow Davis on LinkedIn
Register for the webinar: Foundational Safeguards: Building Your Cybersecurity Foundation
A Blueprint for Ransomware Defense Using the CIS Controls
Cybersecurity at Scale: Piercing the Fog of More
CIS Software Supply Chain Security Guide
CIS Community Defense Model 2.0

Episode 39: Cybersecurity at Scale Sep 16, 2022

In episode 39 of Cybersecurity Where You Are, CIS's Chief Information Security Officer Sean Atkinson discusses the importance of scaling in relation to cybersecurity. A business needs to be able to manage growth without risking security, while also managing security without hindering growth. Atkinson offers guidance on how to go about this and highlights the benefits organizations will see when scaling their cybersecurity strategy.

Resources

Episode 38: How the Cyber Threat Landscape Is Changing Sep 02, 2022

In episode 38 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Theodore "TJ" Sayers, Manager of the Cyber Threat Intelligence (CTI) team at the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS-ISAC and EI-ISAC), and Aaron Zaleski, Sr. Cyber Incident Response Team Analyst at the MS-ISAC. Together, they discuss how the cyber threat landscape is changing. Some cyber threat actors (CTAs) are now writing their payloads in different programming languages, for instance, while others are employing new types of delivery vectors. Their conversation wraps up by identifying steps that organizations can take to defend themselves against these and other developments going forward.

Resources

Episode 37: Collaboration at the 15th Annual MS-ISAC Meeting Aug 19, 2022

In episode 37 of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson are joined by Carlos Kizzee, SVP of CIS Stakeholder Engagement Operations at the Multi-State Information Sharing and Analysis Center (MS-ISAC). Together, they discuss how the 15th Annual ISAC Meeting – held recently in Baltimore – gives an opportunity for representatives of U.S. State, Local, Tribal, and Territorial (SLTT) government organizations to network, share best practices, and learn from one another's experiences. Tony then takes us to the ISAC Meeting, connects with a couple of attendees on the floor, and explores what the event means to them.

Resources

Follow Carlos on LinkedIn
Follow the MS-ISAC on LinkedIn
MS-ISAC Charter
MS-ISAC Members
Join the MS-ISAC

Episode 36: Strong Elections are Cyber STRONG Aug 05, 2022

In episode 36 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Marci Andino, Sr. Director of the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), and Trevor Timmons, EI-ISAC Executive Committee Chair and Chief Information Officer at Colorado Department of State. Together, they discuss Cyber STRONG, a campaign launched by the EI-ISAC that encourages election officials to take decisive and deliberate steps towards improving their cybersecurity posture. Cyber STRONG provides officials with actionable guidance that they can use to further protect the security and integrity of their elections.

Resources

Episode 35: Remembering the Late Alan Paller Jul 15, 2022

In episode 35 of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson are joined by Bobbie Stempfley, Board Chair at the Center for Internet Security (CIS). Together, they remember the late Alan Paller, a CIS co-founder and former Board member. Each of them recalls when they first met Alan, and exchange stories of how his passion for bringing people together and solving big challenges helped change their lives, drive CIS's mission, and reshape the cybersecurity industry.

Resources

Episode 34: A Survey of Hacking in Hollywood Jul 08, 2022

In episode 34 of Cybersecurity Where You Are, co-host Sean Atkinson and Chris Elgee, a senior security analyst and Core NetWars Tournament design lead for Counter Hack, look back at how Hollywood has portrayed hacking over the years. They cover long-standing crowd favorites like Hackers, Sneakers, and Mr. Robot along with some lesser-known gems. The overarching trend? Viewers are getting more computer-literate, so the way in which Hollywood portrays hacking is evolving in a way that not only satisfies audiences but also raises their awareness of cybersecurity.

Resources

Episode 33" The Shift-Left of IoT Security to Vendors Jun 27, 2022

In episode 33 of Cybersecurity Where You Are, co-host Sean Atkinson and Ben Carter, IoT Specialist for CIS’s Chief Technology Officer, discuss the need to secure IoT devices at the vendor level. This is impossible without taking a high-level view and ensuring that all protocols used by IoT devices and vendors are taken into account. Only by ensuring security by design can organizations in healthcare, manufacturing, government, and other sectors accomplish security at scale for IoT management – all while preserving interoperability between their connected devices.

Resources

Episode 32: What You Need to Know Ahead of RSA 2022 Jun 03, 2022

In episode 32 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager discuss RSA 2022 — which is always a highlight of our conference calendar. Tony gives a preview of three sessions in which he'll present on cybersecurity nonprofits, incentivizing the adoption of cybersecurity best practices, and securing the supply chain. He also provides tips and best practices that can help RSA newbies, individual teams, and general attendees make the most of the conference.

Resources

Episode 31: To Achieve ICS Security Today, Look to Yesterday May 19, 2022

In episode 31 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Karen Sorady, VP for Multi-State Information Sharing and Analysis Center (MS-ISAC) Member Engagement at the Center for Internet Security (CIS). Their discussion focuses on industrial control system (ICS) security, some of the threats they're susceptible to, and what goes into making a good operational technology (OT) security program. Looking back over the past 20 years, the security community has learned some valuable lessons on the information technology (IT) side of things. But we won't be able to apply those lessons to OT and ICS without communication and collaboration. This isn't just about fostering conversations between OT and IT teams. It's also a call to action for organizations to work with public-private partnerships and communities like the MS-ISAC so that they don't have to go it alone.

Episode 30: Solving Cybersecurity at Scale with Nonprofits May 06, 2022

In episode 30 of Cybersecurity Where You Are, co-host Tony Sager is joined by Philip Reitinger, President and CEO of the Global Cyber Alliance. Their discussion focuses on the role that nonprofits play in solving cybersecurity problems at scale. In today's mutually dependent technology landscape, nonprofits' resources and expertise remove the need for enterprises to solve cybersecurity issues on their own. This is especially true given initiatives like Nonprofit Cyber, a "collective effort of equals" for which Philip and Tony are Executive Committee Co-chairs.

Resources

Episode 29: Conceptualizing Reasonableness for Risk Analysis Apr 28, 2022

In episode 29 of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson are joined by Chris Cronin, ISO 27001 Auditor and Partner at HALOCK, a leading information security consultancy. Their discussion focuses on "reasonableness" as it relates to cybersecurity risk management. This topic isn't just about proving to regulators, litigators, and others that security controls were in place prior to an incident. It also considers how to implement safeguards without overburdening users and executives.

Resources

Episode 28: The Convergence of Cybersecurity and Public Policy Apr 08, 2022

In episode 28 of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson are joined by Brian Ray, Director of the Center for Cybersecurity and Privacy Protection, and Leon and Gloria Professor of Law at the Cleveland-Marshall College of Law at Cleveland State University. Together, the three discuss the convergence of cybersecurity and public policy with an emphasis on the concept of 'reasonable' security measures affording a data breach safe harbor for businesses.

Episode 27: Cyber Scams Mar 29, 2022

In this episode of Cybersecurity Where You Are, co-hosts Tony Sager and Sean Atkinson are joined by Stacey Wright, former CIS employee and current Vice President of Cyber Resiliency Services at the Cybercrime Support Network. The discussion focuses on the common cyber scams malicious actors have been using for decades and offer advice for dealing with them.

Resources

Episode 26: Automating the Secure Configuration Management Process Mar 11, 2022

Resources

In episode 26 of Cybersecurity Where You Are, co-host Tony Sager is joined by Brian Hajost, Chief Operating Officer at SteelCloud. They discuss some of the common issues around secure configuration management, the struggles that organizations face, and ways to overcome those challenges.

Episode 24: How Do I Start a Career in Cybersecurity? Feb 11, 2022

Resources

Follow Guest Linnie Meehan on Twitter and Twitch
US Cyber Challenge (USCC)
CyberStart America
Career Opportunities at CIS
11 of the Coolest Technical Jobs at CIS

In episode 24 of Cybersecurity Where You Are, co-host Tony Sager poses the question that many people interested in the industry ask: How do I start a career in cybersecurity?

To offer some insight, co-host Sean Atkinson joins cybersecurity professionals Linnie Meehan and Thomas Sager. Together, the three share their personal experiences, offer advice to those interested in a cybersecurity career, and remind listeners that persistence is key.

Episode 23: Cybersecurity Predictions for 2022 Jan 31, 2022

In Episode 23 of Cybersecurity Where You Are, hosts Tony Sager and Sean Atkinson are joined by our Vice President of Operations and Security Services, Josh Moulin. Together, the three share their thoughts on some of the topics that were discussed in our recent blog post, 2022 Cybersecurity Predictions to Watch Out For.

Resources

Episode 25: Building an Internal Incident Response Team Feb 25, 2022

In this episode of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Lou Smith, a Senior Information Security Intrusion Analyst at the Center for Internet Security. Smith has a background in Digital Forensics and previously worked for New York State's Cyber Command Center. The two discuss building digital forensics and incident response capabilities in-house. Tune in to learn about the skills you need and the tactics you can use to successfully implement an incident response plan at your organization.

Resources

Episode 22: CIS Behind the Veil: Log4j Jan 21, 2022

Resources:

Information on Log4j
CIS Critical Security Controls
Essential Cyber Hygiene

In early January, the cybersecurity world was introduced to a new foe when researchers discovered a vulnerability in the code of a software library called Log4j. In the latest episode of Cybersecurity Where You Are, CIS CISO, Sean Atkinson, and CIS Chief Evangelist, Tony Sager, were joined by two colleagues who walked them through the steps CIS took to address the Log4j vulnerability.

Episode 18: Top 5 Scariest Malware Oct 29, 2021

Resources:

In this edition of Cybersecurity Where You Are, CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes Randy Rose, CIS Sr. Director of Cyber Threat Intelligence. In the spirit of Halloween, they list the top five3 (and some honorable mentions) malware of all time – so far!

Episode 21: Year In Review; A List of our Favorite Episodes Dec 28, 2021

In this edition of Cybersecurity Where You Are, CIS CISO, Sean Atkinson, and CIS Senior VP and Chief Evangelist, Tony Sager are joined by two members of the CIS podcast production team, Jason Forget, VP of Communications, and Chad Rogers, Digital Media Program Manager. Together they discuss this past year in cybersecurity, creating this podcast, and their favorite episodes.

Episode 20: The State of Election Cybersecurity Dec 13, 2021

Resources:

In this edition of Cybersecurity Where You Are, CIS Senior VP and Chief Evangelist, Tony Sager welcomes Kathy Boockvar, Vice President of Election Operations and Support and Marci Andino, Director of the Elections Infrastructure Information Sharing and Analysis Center, or EI-ISAC. Together, they discuss the state of election security for state and local governments.

Episode 19: For Data Compliance, Automation is Key Nov 15, 2021

Resources:

In this edition of Cybersecurity Where You Are, CIS Senior VP and Chief Evangelist, Tony Sager welcomes Thordis Stella Thorsteins, Senior Data Scientist at Panaseer. Panaseer provides a controls monitoring platform and has played a valuable role in the development of the CIS Critical Security Controls, as well as the implementation of the CIS Controls Assessment Specification. Together, Tony and Thordis discuss the role that data collection and automation play in cybersecurity.

Episode 17: Cybersecurity Awareness Month: It's All About the Big Picture Oct 13, 2021

Resources

Discussed in this podcast:

Cybersecurity Awareness Month
Psychology of cybersecurity
Evolution of common cyber threats
"Big picture" resources

In this edition of Cybersecurity Where You Are, CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes Philippe Langlois of the Verizon Business Group and co-author of the Verizon Data Breach Investigations Report (DBIR). In celebration of Cybersecurity Awareness Month, the duo discuss the DBIR and version 2.0 of the CIS Critical Security Controls (CIS Controls) Community Defense Model (CDM). Both reports pull data from a community of experts and many different resources to provide a more holistic picture of cybersecurity.

Episode 16: Cybersecurity: Think INSIDE the Box Sep 27, 2021

Resources:

In this edition of Cybersecurity Where You Are, CIS Senior VP and Chief Evangelist, Tony Sager welcomes back Kathleen Moriarty, Chief Technology Officer for CIS. Together they discuss the role service providers play in the future of cybersecurity.

Episode 15: Cybersecurity Success Takes Soft Skills Sep 10, 2021

Episode Highlights:

Why soft skills are important
Top soft skills
Building a company culture

Resources:

CIS Careers

Publication: Cybersecurity Quarterly

In this edition of Cybersecurity Where You Are, CIS Chief Information Security Officer (CISO), Sean Atkinson, and CIS Senior VP and Chief Evangelist, Tony Sager discuss soft skills and how they pertain to the the cybersecurity industry. Whether it is an an employee wanting to expand their career or an employer seeking a new hire, soft skills are just as important as technical knowledge.

Episode 14: The Top 5 Cybersecurity Tips for the Family Sep 01, 2021

Resources:

In this edition of Cybersecurity Where You Are, CIS Chief Information Security Officer (CISO), Sean Atkinson counts down the top five ways families can be cyber smart. CIS Content Marketing Manager, Danielle Koonce, stops by to talk about what she does as a parent to keep her child safe from cyber-attackers.

Episode 13: What's Important to You in Cybersecurity? A Host Q&A Aug 23, 2021

Resources:

CIS Twitter
CIS LinkedIn
CIS Critical Security Controls
Related podcast: RC Manager at Frame.io, Mosi Platt answers the Atkinson 9

In this edition of Cybersecurity Where You Are, CIS Chief Information Security Officer (CISO), Sean Atkinson, and CIS Senior VP and Chief Evangelist, Tony Sager share part of themselves in this intimate episode. Taking a guest-free moment of asking them the 'Atkison 9', hosts turn the questions on themselves. Listen to them discuss their favorite CIS Critical Security Controls, the biggest waste of time in cybersecurity, and how they want to be remembered in the industry.

Episode 12: Cybersecurity and Government: Less Wizardry, More Policy Jul 30, 2021

This week’s Cybersecurity Where You Are podcast highlights:

The problem regulating cybersecurity
Cybersecurity is currently the "Wild West"
What makes cybersecurity different than other industries
What roles different levels of government are taking
Dispelling the mystery behind cybersecurity

Episode Resources

It can appear that cybersecurity practices are being built on the creative wizardry of technical experts rather than referential universal policy that everyone can abide by. In this edition of Cybersecurity Where You Are, host and Senior Vice President and Chief Evangelist Tony Sager for CIS welcomes guest Brian de Vallance, Alliance Outreach Coordinator for CIS. Together, they discuss the role government and technology experts play in the building of universal cybersecurity best practices and policy.

Episode 11: Remote Attestation Helps Zero Trust Jul 16, 2021

This week’s Cybersecurity Where You Are podcast highlights:

Automated attestation processes
Vendor attestation capabilities
Root of trust via Trusted Platform Module (TPM)
Method of verification for zero trust

Episode Resources

Visit the CIS Website
CIS Controls List
About Kathleen Moriarty, Chief Technology Officer, CIS
Related Blog on Zero Trust: Where Does Zero Trust Begin and Why is it Important?

In this edition of Cybersecurity Where You Are, host and CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes guest Kathleen Moriarty, Chief Technology Officer (CTO) at CIS. Together, the duo discuss attestation in terms of hardware and software, and the process of performing a posture assessment.

Episode 10: Hospitals in Need of Cybersecurity STAT! Jun 28, 2021

This week’s Cybersecurity Where You Are podcast highlights:

Why the medical industry is so appealing to attackers
The challenges of protecting medical facilities
How a defense-in-depth strategy plays a role in a hospital’s cybersecurity plan
Malicious Domain Blocking and Reporting (MDBR) for hospitals

Episode Resources

In this edition of Cybersecurity Where You Are, host and CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes guests John Riggi and Ed Mattison. Riggi is the Senior Advisor for Cybersecurity for the American Hospital Association (AHA) and Mattison is the Executive Vice President of Operations and Security Services at CIS. Together they discuss how hospitals and other medical facilities can protect themselves against cyber-attacks.

Episode 9: Mitigating Risk: Information Security Governance Jun 11, 2021

Resources:

Visit the CIS Website

Highlights:

The importance of information security governance
Security vs. compliance
Data – determining what you need and where to find it
Understanding risk from a decision-basis
Critical elements to fulfill business requirements
Producing value in a compliance program
Applying agility for continuous improvement

Good compliance = good security

Security is the practice of implementing effective technical controls to protect an organization’s digital assets. Compliance, on the other hand, is the application of that practice to meet regulatory or contractual requirements. Unfortunately, more often than not, organizations focus on compliance once a year when it’s time to certify that their “security is good.” The process of being compliant and secure should be a continuous process.

Episode 8: CIS Controls v8...First Impressions May 28, 2021

Resources:

Highlights:

Everything has to be measurable
Everything has to be achievable
CIS Controls v8 must have a peaceful coexistence with cybersecurity frameworks
The Controls need to be backed by data and able to defend against real-world threats

First Impressions Matter

The CIS Controls team and volunteers pretty much rewrote every word of v8 in an effort to modernize and consolidate the document. CIS Controls v8 is a lot more focused and less redundant than previous versions. Find out what people are saying about this new Version!

Feedback: Request, Manage, Gather, & Use for the Greater Good

Organizations big and small rely on the CIS Controls to defend against the most prevalent cyber-attacks against systems and networks. And, they count on the Controls team to do the best job they can for the greater good of the cybersecurity community.

Episode 7: CIS Controls v8...It’s Not About the List May 14, 2021

Resources:

In this edition of Cybersecurity Where You Are, host and CIS Senior Vice President and Chief Evangelist, Tony Sager welcomes guests Randy Marchany and Phyllis Lee. Marchany is the Chief Information Security Officer (CISO) at Virginia Tech, and Lee serves as Senior Director of the CIS Controls. The connection between the two guests is the CIS Controls – a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks.

Highlights:

History of the CIS Controls
Guiding principles for CIS Controls v8
CIS Controls ecosystem
Practical implications for the Controls and real-world applications
CIS Controls life cycle

Remember to subscribe to get the latest cybersecurity news and updates to Start Secure and Stay Secure.

Episode 6: 2020 Elections Year in Review Apr 23, 2021

Resources:

In this edition of Cybersecurity Where You Are, host and CISO at the Center for Internet Security (CIS), Sean Atkinson welcomes guests Geoff Hale and Lew Robinson. Hale leads the Election Security Initiative at the Cybersecurity and Infrastructure Security Agency (CISA), while Robinson serves as CIS Vice President of Election Operations. Both agencies and both men, respectively, played a big role in the success of the 2020 General Election, which has been deemed the most secure election in American history.

Highlights:

Elections...A Critical Infrastructure
Strong Partnerships Make for Strong Collaborative Efforts
Technical and physical controls that contributed to the 2020 General Election being the most secure election in history
Steps taken to enhance communications and provide threat intelligence to state and local entities
Collaborative process to provide stakeholder input to influence the approach to election security
Strategies and techniques used to manage mis- and disinformation
Efforts made to assist state and local election offices with best practice guidance
Lessons learned from the 2020 General Election

Remember to subscribe to get the latest cybersecurity news and updates to Start Secure and Stay Secure.

Episode 5: The Tools of Cyber Defense...an Ongoing, Repetitive Process Apr 12, 2021

Part 2 of a 2-part series

Resources:

Listen to Part 1
CIS website
CIS SecureSuite Tools and Resources
CIS Benchmarks
CIS Controls (v8 coming Spring 2021)
CIS CSAT (CIS Controls Self Assessment Tool)
Community Defense Model (v2 coming Spring 2021)

In this week’s Cybersecurity Where You Are podcast, hosts Tony Sager and Sean Atkinson continue their conversation on cyber defense as a risk-based process. They discuss the actions and resources that help build and implement “defensive machinery” that support an organization’s current cyber defense plan and help it mature.

Highlights:

A CISO’s First 90 days
The Importance of a Strong Foundation
Knowing Your Lineage
Mapping to Regulatory Frameworks
Tools: From Spreadsheets to CIS CSAT
Sharing with the Group

Remember to subscribe to get the latest cybersecurity news and updates to Start Secure and Stay Secure.

Episode 4: Dynamics of Cyber Defense...an Ongoing, Repetitive Process Mar 26, 2021

Episode Resources:

Blog: Assess, Remediate, and Implement with CIS SecureSuite: https://www.cisecurity.org/blog/assess-remediate-and-implement-with-cis-securesuite/
Free Webinar: CIS Benchmarks and CIS-CAT Pro Tool Demo: https://www.cisecurity.org/webinar/cis-benchmarks-demo/

Part 1 of a 2-part series

Technology is ever-changing AND ever-evolving, creating an uncertainty amongst cybersecurity professionals – the defenders – in their pursuit of an effective cyber defense strategy. The uncertainty of the defender can justifiably be attributed to the uncertainty of the attacker. In this week’s Cybersecurity Where You Are podcast, hosts Tony Sager and Sean Atkinson introduce cyber defense as a risk-based process to reduce the overall probability and impact that a cyber-attack will have on an organization.

Cyber defense never ends

Cyber defense refers to the ability to prevent cyber-attacks from infecting a computer system or device; it involves anticipating adversarial cyber actions and countering intrusions. There’s no “one-size-fits-all” when it comes to cyber defense protocol or strategy. However, a good cyber defense strategy should aim to protect, prevent, detect, respond to, and recover from external and internal attacks. As technology expands, the complexity of cyber-attacks also evolves, forcing cyber defense initiatives and defenders of such, to do whatever they can to keep up.

OODA loop process

The OODA (Observe, Orient, Decide, Act) loop is a repetitive four-step decision-making process that focuses on gathering information, putting that information into context, making the most appropriate decision while also understanding that changes can be made as more data becomes available, and then taking action. The OODA loop is especially applicable to cybersecurity and cyber defense where agility and repetition (by the defender) potentially overcomes that of the attacker.

Fog of More

While cyber defense is an abstract model, cybersecurity defenders have to actually do concrete things. It initially comes down to having a plan in place and asking the right questions: What data do we have? Where is it? What do we do with it?

Asking the right questions (for clarity) eliminates the Fog of More (coined by Tony Sager, of all people) – the overload of defensive support (i.e., more options, more tools, more knowledge, more advice, and more requirements, but not always more security).

An effective cyber defense program requires defenders to gather information and data, put that data into context, make decisions, take action, and then REPEAT, REPEAT, REPEAT.

Episode 3: Third-party Risk Management – Beyond the Questionnaire Mar 12, 2021

Resources:

Find us at https://www.cisecurity.org/
Third-party Risk Association: https://www.tprassociation.org/
National Institute of Standards and Technology (NIST): https://www.nist.gov/
CIS Controls: https://www.cisecurity.org/controls/

Can a risk assessment questionnaire be the catalyst for true change to the entire vendor cybersecurity ecosystem? Cybersecurity Where You Are podcast host Sean Atkinson welcomes guest Ryan Spelman, former CIS employee, and now Managing Director at Duff & Phelps on their CYBERCLARITY360 team. Together, Sean and Ryan discuss tactics companies can use to better understand their cyber-risk posture and how stronger relationships between companies and their third parties impact the industry as a whole.

Better use of the third-party risk assessment questionnaire

The go-to “third-party risk assessment questionnaire” being used as a one-and-done exercise is an all too common practice. While completing these questionnaires meets certain regulatory requirements, truly managing risk is about acting on the data collected - not just collecting it.

There is a misconception that the questionnaire is for general information collection and that the same questions can apply to all vendors. Some questions, such as those about overseas relations or services, may be applicable to all vendors. But to more accurately assess a third party’s risk it is important to customize the questions to match the vendor's use case and scope.

This episode shares how an organization can start drafting these inquiries.

Once the questionnaire is crafted, completed, and returned, a plan should also be in place for how to address the issues that arise from the submitted answers.

Beyond the questionnaire – communication is key

The issue of third-party management rests in the hands of both the company and the vendor. Clear, accurate, and truthful communication between both parties makes both entities ultimately stronger.

Building a stronger security ecosystem

This is an “area where the common good can happen,” says Ryan. If a company can make the third party’s security posture better, then everyone else who uses this third party is made better. It ultimately makes a measurable difference in the entire vendor ecosystem.

The Atkinson 9

In the vein of another famous interviewer, Sean asked Ryan his “Atkinson 9,” a quick Q&A about security. Listen now to find out what our guest said!

Episode 1: Welcome to the Basics Jan 27, 2021

Co-hosts Sean Atkinson and Tony Sager welcome you to the CIS podcast Cybersecurity Where you Are.

This episode gives you an overview of what the Center for Internet Security is, how the co-hosts grew with the industry, and the importance of basic cyber hygiene.

Find us at www.cisecurity.org
Check out the CIS Controls: https://www.cisecurity.org/controls/cis-controls-list/
Learn more about Basic Cyber Hygiene: https://www.cisecurity.org/blog/cleaning-up-a-definition-of-basic-cyber-hygiene/

The Center for Internet Security is a community-driven nonprofit, responsible for the CIS Controls® and CIS Benchmarks™, globally recognized best practices for securing IT systems and data. We lead a global community of IT professionals to continuously evolve these standards to proactively safeguard against emerging threats.

CIS is home to the Multi-State Information Sharing and Analysis Center® (MS-ISAC®), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities, and the Elections Infrastructure Information Sharing and Analysis Center® (EI-ISAC®), which supports the rapidly changing cybersecurity needs of U.S. elections offices.

Meet co-host Tony Sager - Tony has over 43 years of experience in the industry most of which was with the National Security Agency (NSA). With a background as a mathematician, he worked at the NSA in the Communications Security Interim Program focusing on the security of U.S. systems. He worked mostly on cryptography and confidentiality in the interest of the country’s defense. He then moved to Computer Science when computers began to move from large systems in buildings to at home workstations (do you remember the Apple2+?). Tony witnessed the transition of cybersecurity from mathematics to information and communications and found himself in great company helping to develop CIS over the passed 20 years.

Meet co-host Sean Atkinson – Sean lived in England for about 20 years before moving back to the U.S. His background was not actually in computer science but carried an MBA in Business but with a concentration in Technology Management. He credit the book “A Business Data Networks and Telecommunications” by Raymond Panko for getting him into Network and Technology Specialization. He then worked as a IT Auditor and in 2004 found himself working on Section 404 projects. He then worked in State Government moving his way up to security Manager implementing PeopleSoft when adding security to the software lifecycle was in its infancy. He then moved to the Dept of Defense and now has worked with CIS as CISO to frame best practices and implementation.

Basic Cyber Hygiene - We know cybersecurity is an issue for any business, but where do you start? By looking at your data, networks, and systems from a risk perspective you can then implement means to protect it. There are foundational best practices that everyone can do and should do. Tony and Sean will touch on the CIS Controls – the prioritized set of actions to protect your organization and data from known cyberattack vectors – and what actions to take first.

Episode 2: Trends: Then, Now, and Into the Future Mar 05, 2021

Resources

Find us at https://www.cisecurity.org/
Blog: 2021 Cybersecurity Trends to Prepare For: https://www.cisecurity.org/blog/2021-cybersecurity-trends-to-prepare-for/
Blog: Where Does Zero Trust Begin and Why is it Important?: https://www.cisecurity.org/blog/where-does-zero-trust-begin-and-why-is-it-important/
CIS Controls: https://www.cisecurity.org/controls/
Cybercrime Support Network (CSN: https://cybercrimesupport.org/

2020 was considered “the year like no other”. The industry saw a mass convergence of social issues with cyber issues due to the pandemic, the elections, and the SolarWinds supply chain issue. Cybersecurity resilience was tested and it was crucial that the industry adapt quickly.

With the onset of the COVID-19 pandemic in March of 2020 many organizations went fully remote, including CIS. CIS had to be agile and the cybersecurity industry had to adapt to new challenges with a growing remote workforce.

The Trends

Risk management strategies such as ways to identify gaps, how to best implement the CIS Controls, data management, and privacy requirements were the foundations for crisis management.

Ransomware is here to stay as a top cyber threat. It moved from the lone hacker to a capitalist business structure where the software just needs to be purchased and used as opposed to needing to build it yourself.

Zero Trust: Sean uses the analogy of “the castle and the moat”. Today the drawbridge is always open and things are going in and out without the ability to monitor it all. Zero Trust is setting the new tone for security practices.

What the Future (May) Hold

Small Businesses need support: The weight of responsibility to small businesses to accommodate the assessment evaluations for risk management is a huge burden.

A Diminishing Cyber Workforce: There is a growing concern about the shortage of cybersecurity professionals.

The Role of Government: With the change in government, like we have in 2021, there is a change in the way government thinks about priorities.