CISO Series Podcast

Latest Episodes:

I Need Resources to Free Up My Resources Aug 11, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/i-need-resources-to-free-up-my-resources)

Automation sounds wonderful and I'd love to have some free time, but geez, who do I need to hire to make that happen?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest this week is Aaron Ansari (@theanswar), VP, Cloud One, Trend Micro.

Thanks to this week's podcast sponsor Trend Micro.

Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information. Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud environments, networks, and endpoints. For more information, visit www.trendmicro.com.

On this week's episode

There's got to be a better way to handle this

How well has the cybersecurity automation gambit played itself out? Last year, Ericka Chickowski wrote a piece on Dark Reading about the cybersecurity automation paradox. She said that "security teams find that a lack of automation expertise keeps them from getting the most out of cybersecurity automation." According to a Ponemon study, that accounts for 56% of organizations. That's the number one obstacle. It's more than legacy IT challenges, lack of budget, and interoperability issues. 40% of respondents say they'll need to hire more people to support security automation. Everyone speaks of wanting automation, but is it more of an aspiration and a marketing pitch? Has it specifically alleviated any pain over the past year. And if so, what?

What annoys a CISO?

For my co-host MIke Johnson, the annoyance is the "single panes of glass" that so many security vendors offer. Our guest, Aaron Ansari is ready to challenge Mike on his grand distaste for "the single pane of glass" as the window to your security status/infrastructure/whatever you like it to be.

"What's Worse?!"

What's worse, failure but honesty, or success and deception?

Please, Enough. No, More.

Topic is "cloud configuration." What have we heard enough about with cloud configuration, and what would we like to hear a lot more?

Ummm. Maybe you shouldn't have done that

We're talking about vendor lock-in. It makes recurring sales for vendors super easy. But it makes exit strategies very difficult. On Quora, the question was asked, "How do huge companies like Netflix avoid vendor lock-in with a cloud computing provider?" So I ask the question to both of you, what safeguards can you setup to prevent vendor lock-in or at least make an exit from a cloud provider as painless as possible?

Creative Commons photo attribution to Alden Jewell (CC BY 2.0)

We're Not Fooled By Your Diversity Theater Aug 04, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/were-not-fooled-by-your-diversity-theater/)

We're casting for our diversity theater program on the latest episode of CISO/Security Vendor Relationship Podcast.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Matt Conner, CISO, National Geospatial Intelligence Agency.

Thanks to this week's podcast sponsor, PlexTrac

PlexTrac is a revolutionary, yet simple, cybersecurity platform that centralizes all security assessments, penetration test reports, audit findings, and vulnerabilities into a single location. PlexTrac vastly improves the risk management lifecycle, allowing security professionals to generate better reports faster, aggregate and visualize important analytics, and collaborate on remediation in real-time.

How CISOs are digesting the latest security news

If you thought tech firms were abysmal with diversity hiring, it appears venture capital firms are even worse. In a Washington Post article by Nitasha Tiku, just 1 percent of VC dollars went to black start-up founders in 2018, and that same year and percentage reflects the number of black decision-makers at VC firms as well. With the scrutiny turned up, small minority-focused funds have spurned, and there has been some cosmetic title inflation of minority employees at VC firms, but black tech entrepreneurs are brushing it off as diversity theater. What opportunities and money are VC firms leaving on the table by not taking diversity seriously? What should VC firms do to prove that their efforts are not diversity theater?

We don't have much time. What's your decision?

Interesting question on reddit by throwawaycostam who asks, "How do you create easy to memorize, yet relatively strong passwords?" A password manager is first and foremost recommended, but there are cases where you do have to remember a few passwords, like the one to get into your password manager and desktop screen lock. If you have to memorize five really good complex passwords, what technique do you recommend to create those passwords?

What's Worse?!

Is clueless better than not being engaged?

It's time for "Ask a CISO"

On a previous episode, CISO, Dennis Leber, now with University of Tennessee Health Science Center, but previously with a state government agency said there's no perfect pitch a vendor could make to him that would facilitate a sale. Heck, he couldn't even write the perfect pitch to himself that would work. We know the government is a different beast when it comes to procurement. What are the stumbling blocks vendors need to concern themselves when pitching a government agency?

We've got listeners and they've got questions

Jesse Rosenbaum of Varonis brought a job posting to my attention that showed requests for extremely specific experiences with different applications. Jesse asks, does the listing the name of products or protocols you're using expose the company to additional security risks? Isn't this the reason so many customers of security vendors are not willing to give testimonials? But if they're putting these products and protocols in job descriptions, isn't this the same darn thing?

How to Tell If Your CISO Sucks at Their Job Jul 28, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/how-to-tell-if-your-ciso-sucks-at-their-job/)

If your CISO wants to be a 'visionary' but they can't seem to pull off basic security functions, they probably suck at their job.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Lee Parrish (@leeparrish), CISO, Hertz.

Thanks to this week's podcast sponsor, Keyavi Data.

Our Keyavi breaks new ground by making data itself intelligent and self-aware, so that it stays under its owner's control and protects itself immediately, no matter where it is or who is attempting access. Keyavi is led by a team of renowned data security, encryption, and cyber forensics experts. See for yourself at keyavidata.com.

On this week's episode

Is this the best use of our Money

On CSO Online, Terena Bell has a piece on how to cut your budget without hurting security. The suggestions are well known: Identify overlaps in technology, renogiate contracts, and use tech to lower the need for manhours. Her last tip was a warning about layoffs. Are you always looking to reduce costs or is it something you do when it's mandated? And how are you supported by the business if and when you proactively reduce costs? Or does that not ever happen because the demand is ever growing.

Is this where I should put my marketing dollars?

I'm not sure, but it's possible that our guest is our first CISO that has an MBA. In his role as CISO he's mentioned he uses common marketing techniques to advance your organization's cybersecurity program. He said, "Security is just an inside sales job and that marketing creates the demand that sales fulfills." Lee tells us about what he learned in his MBA training that was so critical for your growth as a CISO.

What's Worse?!

We have a split decision on third party risk management.

How a security vendor helped me this week

We haven't done this segment in a long time and we got a request from a listener to bring it back. So I ask Mike and our guest, recently, how has a security vendor helped you. And were any of those security vendors who helped not customers?

We've got listeners and they've got questions

A listener, who wishes to remain anonymous asks this question: "How do you convince a CISO to focus on the basics?"

The listener goes on and says, "I'm not a CISO but have seen and talked to many that want to be seen as 'visionaries' so they focus on 'new hotness' things like 'zero trust' instead of the basics things that are missing like patching, asset management, etc." The listener understand this, and he's obviously talking about his own CISO, hence the anonymity, but how do you approach your CISO and get him or her to balance their own time with basics or as Yaron Levi, CISO of Blue Cross Blue Shield of Kansas City says, "fundamentals" while also having a forward looking vision of security?

How Will the Candidate Respond to "What's Worse?!" Jul 21, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/how-will-the-candidate-respond-to-whats-worse/)

A potential candidate's response to a "What's Worse?!" question will show how they can handle risk decisions.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest this week is Elliot Lewis (@elliotdlewis), CEO, Keyavi Data.

Thanks to this week's podcast sponsor, Keyavi Data (formerly Encryptics)

Now you can share data without ever losing control of it. Our advanced architecture makes data self-protecting, intelligent and self-aware – wherever it goes, no matter who has it. Our .SAFE patented multi-key technology enables data to evaluate its own safety conditions, including geo-sensing, recipient authentication, and policy changes from its owner. Contact Keyavi Data today and see for yourself.

On this week's episode

Why is everybody talking about this now

If we could change one thing about the cybersecurity industry, what would it be? Rilhouse on reddit brought this post by Naomi Buckwalter of Energage to my attention. What you can change are processes and behavior currently in the industry.

Is this the best solution?

Both Mike and Elliot hire cybersecurity talent. Here's a question from bubblehack3r on reddit who asked during our AMA. "What are your different methods and tools you use to verify and test the professionally of a new hire in the cyber security domain?"

"What's Worse?!"

The shortest ever "What's Worse?!" question.

Please, Enough. No, More.

Encryption. We've had it around for decades, but people and companies still don't use it. What have you heard enough about regarding encryption and what would you like to hear a lot more?

It's time for "Ask a CISO"

What have Mike and Elliot learned from a product deployment that they didn't realize until after they deployed it.

"I LOVE Cold Calls", Said the CISO on Opposite Day Jul 14, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/i-love-cold-calls-said-the-ciso-on-opposite-day/)

While CISOs are not excited to receive your unexpected phone call, they are excited to listen to this week's episode of CISO/Security Vendor Relationship Podcast.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Helen Patton, CISO, The Ohio State University.

GitGuardian empowers organizations to secure their secrets - such as API keys and other credentials - from being exposed in compromised places or leaked publicly. GitGuardian offers a threat intelligence solution focused on detecting secrets leaked on public GitHub and an automated secrets detection solution which tightly integrates with your DevOps pipeline.

On this week's episode

Why is everybody talking about this now

Are we making ourselves safer by calling end users "dumb"? On LinkedIn, Shaun Marion, CISO, Republic Services called out those security professionals who chose to put down the end user. As a result, security professionals in aggregate are getting a bad wrap.

What do you do to change this long held belief of security professionals as putting down the end user?

Rich Mason of Critical Infrastructure said, "offer something beyond training to mitigate the damage potential of that click. You can bash those who don't heed your advice on running with scissors or you can design better processes and safer scissors."

How do you go about building systems and behavior of the security team with the end user in mind?

Are we having communication issues?

There is ENDLESS debate on cold calling. I know most CISOs despise it, but as evidenced by Ross Gustavson of Reciprocity, he met 120% of his sales quota solely on cold calling. He posted all his stats so you simply can't argue with that success rate. And Jay Jensen of Sales Evolution said the conversation of cold calling should be about how to do it effectively, and not whether it should be eradicated. And Allan Alford said he wants the conversation to be about partnering with sales staff.

What is the communication you're open to having with a security vendor to which you don't currently have a relationship?

What's Worse?!

Those miserable team building exercises. Is there a worse way to do them?

If you haven't made this mistake, you're not in security

Eli Migdal of Boardish ran a poll on LinkedIn asking how many cyber professionals suffer from impostor syndrome. Sixty two percent believed most did, and Allan Alford, who admitted having it himself, said he was on a call with 25 other security professionals and all of them admitted to suffering at one time from impostor syndrome. Why does this come about and is it healthy or detrimental?

RESOURCE: Do You Suffer From Impostor Syndrome? You Are Not Alone

Is this where I should put my marketing dollars?

On LinkedIn, I published an article entitled, "Formula for Creating a Successful Security Podcast." In it I just talked about my experience publishing successful and not successful shows. I'm a proponent of security vendors using their marketing dollars to produce podcasts because it's a means to create a one-to-many and many-to-many relationship with the audience.

Focusing on other security and technology podcasts, what makes us excited to listen to a show and actually engage with the show or other listeners. And have we for any reason stopped listening to a show and why?

NOTE: CISO Series and its parent company Spark Media Solutions is now offering consulting and production services for others, including vendors, who want to launch and maintain their own successful podcast. Please contact me, David Spark, for more information.

NYTimes Critic Called Our Security Theater "Unconvincing" Jul 07, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/nytimes-critic-called-our-security-theater-unconvincing/)

We tried to pull off the Hamilton of security theater and we fell short.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Shawn Bowen (@smbowen), CISO, Restaurant Brands International which handles restaurants such as Burger King, Popeye's, Tim Hortons, and Louisiana Kitchen.

Thanks to this week's podcast sponsor GitGuardian.

On this week's episode

How CISOs are digesting the latest security news

We recorded this episode on June 24th, just a five days after Trump's first rally in Oklahoma where purportedly TikTok fans en masse were able to register for Trump's rally and fool his entire staff into believing that 1 million people had registered and were planning to attend his rally. In the end, the arena was less than half full. We are all well aware that some cyber protests can cause serious damage, but does this one? Is this the kind of peaceful cyber protests that we should encourage or not encourage? Dan Lohrmann at Security Mentor posted this discussion and said no matter what political affiliation you're on this is a call for more cybersecurity because this will happen again. But is this the fault of Trump's cyber team or his social media team for not keeping an eye on TikTok?

Why is everybody talking about this now?

On AskNetSec on reddit, NoInterestingGuy, a college student starting his first internship at a security firm, posted he likes to participate in "extracurricular activities". He then asked, "If I were to get caught with a crime related to cyber security, would that impact my chances significantly of getting hired in the future for a security company?" The community almost resoundingly said, "Stop," but has Mike and our guest ever hired someone with a cybercrime past or caught an employee engaging in cybercrime? How did they handled it. Is there an "it depends" meter? We all do stupid stuff in college.

What's Worse?!

Is the unknowing always the worst?

It's security awareness training time

On CSO Online, J.M. Porup wrote a piece about five examples of security theater and how to spot them. Security theater refers to the practice having a show of implementing security where its effectiveness is in question. Some examples are purposefully complex passwords, checkbox compliance, and bad security awareness training.

How do we spot security theater? Is there any value to security theater? What's the antidote? If it's in place, how do we eradicate it?

What Is It and Why Do I Care?

We played this game before and like the "What's Worse?!" game, the title pretty much explains it. I have three pitches from three different vendors who are all in the same category, Security Awareness Training. I have asked the reps to first, in 25 words or less, just explain their category. That's the "What Is It?" and then for the "Why Do I Care?" I asked them to explain what differentiates their product or makes them unique also in 25 words or less. It is up to Mike and Shawn pick their favorite of each and explain why. I only reveal the winning contestants and their companies.

Why Am I Working Harder During This Pandemic? Jun 30, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/why-am-i-working-harder-during-this-pandemic/)

Is it the increased work or the pandemic itself that's causing us all to work more than we've ever worked before?

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Christopher Zell, vp, head of information security, The Wendy's Company.

Thanks to this week's podcast sponsor GitGuardian.

GitGuardian empowers organizations to secure their secrets - such as API keys and other credentials - from being exposed in compromised places or leaked publicly. GitGuardian offers a threat intelligence solution focused on detecting secrets leaked on public GitHub and an automated secrets detection solution which tightly integrates with your DevOps pipeline.

On this week's episode

Why is everybody talking about this now?

On TechRepublic, Scott Matteson wrote an article about cybersecurity pros working harder than ever during the pandemic. Stuart Mitchell of Stott and May posted the article to LinkedIn and asked if anyone has taken a day off since COVID-19 started, and the general consensus is no. I see a multitude of factors affecting this: increased surface area to protect, compliance is more difficult, I also have to deal with my family, and where the heck is anyone going to go for vacation? I guess I'll just work.

Close your eyes and visualize the perfect engagement

On LinkedIn, our guest Chris Zell asked others to be more welcoming when you see someone post "aspiring cybersecurity professional." We discussed the approach and what the community could teach us.

What's Worse?!

Three options of how to talk to the board.

There's got to be a better way to handle this

On CSO Online, Mary Pratt has a guide for CISOs on securely laying people off. What are critical technical considerations during layoff time, and as a manager how do you manage security for those people who are still there. Have either of you made a massive security mistake during a layoff that was a great learning experience for you?

What Is It and Why Do I Care?

We played this game before and like the "What's Worse?!" game, the title pretty much explains it. I have three pitches from three different vendors who are all in the same category of governance, risk and compliance or GRC. I have asked the reps to first, in 25 words or less, just explain their category. That's the "What Is It?" and then for the "Why Do I Care?" I asked them to explain what differentiates their product or makes them unique also in 25 words or less. It is up to Mike and Chris to pick their favorite of each and explain why. I only reveal the winning contestants and their companies. Ready to play?

I Have the Perfect Job for You (But Probably Not) Jun 23, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/i-have-the-perfect-job-for-you-but-probably-not/)

You put those qualifications on your resume, and I queried. So don't blame me for getting your hopes up.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week Brandon Greenwood, vp, security, Overstock.com.

Thanks to this week's podcast sponsor Trend Micro.

On this week's episode

How CISOs are digesting the latest security news

Paul Martini of iboss asks, "What network weaknesses has the current pandemic revealed?"

Close your eyes and visualize the perfect engagement

As evidenced by a previous episode, security recruiters have a hard time getting some respect. Let's discuss this issue from the viewpoint of the candidate. On Peerlyst, David Froud of Concept Security felt that the recruiter approach of saying I have a perfect job for you was misguided. Mike and our guest talk about their early security careers and how welcome they were to approaches from security recruiters.

What's Worse?!

Crappy tools or crappy team? What's worse?

I tell ya, CISOs get no respect

On CSO Online, Neal Weinberg has a story about hard truths security professionals have to deal with. One item was the outright lack of respect, being misunderstood and underappreciated, from the board and your coworkers. I know the generic response is communications and listen, but I want to know what are ways to command leadership so those do pay attention to you and you do get that respect. We discuss specific turning points in security leadership careers that allowed Mike and our guest to do this.

Vendors have questions. Our CISOs have answers

Dennis Underwood of Cyber Crucible asks if you can you be a threat hunter if you have to sign NDAs. Are NDAs the cover up so companies don't have to reveal information about their failed defenses? And are NDAs a common occurrence in bug bounties?

We Compensate Our Low Paying CISO Jobs with High Stress Jun 16, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/we-compensate-our-low-paying-ciso-jobs-with-high-stress/)

On this week's episode we're seeking candidates for unrealistically low-paying CISO positions.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Nir Rothenberg, CISO, Rapyd.

Thanks to this week's podcast sponsor Trend Micro.

On this week's episode

Why is everyone talking about this now?

On LinkedIn, Farhan Khan, a recruiter at CyberApt Recruitment, told a tale of getting a call asking if he could help his company recruit a seasoned CISO for their 300+ person company. He was excited until he found out the salary they were offering the CISO was in the range of $90-$105K.

We've talked before about unrealistic CISO salaries before, but this is actually below the rate of entry level cyber positions in the Bay Area. How do CISOs or heck any cybersecurity professional handle someone's unrealistic expectations? Do you say something or just say, "No thank you"?

Also, Davi Ottenheimer of Inrupt, brought this story to my attention and argued that high CISO salaries are just attracting fraudsters. Does our panel agree, and if so, what would a company have to be wary of?

Mike's Confused. Let's help him out

On previous shows Mike has admitted he would not want to (not confused although that may be part of it) run the IT department. Nir mentioned that he feels that getting out of one's comfort zone is critical, no matter what department you're in. What are the pros and cons of other departments not just being security aware, but taking on cybersecurity responsibilities? And vice versa, cybersecurity taking on other department responsibilities? How far can/should it go?

What's Worse?!

Too much flexibility or too many restrictions?

We've got listeners and they've got questions

Anya Shpilman of Swiss Gulf Partners sent recorded this question: "I'm a recruiter and I specialize in cybersecurity recruitment. At the end of the show everyone says they're hiring. But I have a hard time getting traction from CISOs. So what would you like to see/hear in those initial emails or LinkedIn messages."

Go here to record a question to be played on one of our shows.

Umm, Is this good idea?

I recently published an article on CISO Series entitled "25 API Security Tips You're Probably Not Considering". The very first tip, from Gary Hayslip, CISO, Softbank Investment Advisers, is K.I.S.S. or Keep It Simple Stupid. I then went on to provide 24 more tips from experts which if you were to deploy them all would in no way be simple. KISS sounds great in theory, but how the heck do you pull it off in practice. Can you point to an example of how you took something that was complicated and simplified it?

Keep Pouring. I'll Tell You When I've Had Enough Security. Jun 09, 2020

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/keep-pouring-ill-tell-you-when-ive-had-enough-security/)

When do we hit the diminishing returns of too much cybersecurity? How will we know? Will a bell go off? Will our cup runneth over?

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest is Tony Sager, svp, chief evangelist, Center for Internet Security.

Thanks to this week's podcast sponsor, AppOmni.

AppOmni is the leading provider of SaaS security and management platform for the enterprise. AppOmni provides unprecedented data access visibility, management and security of SaaS, enabling organizations to secure mission-critical and sensitive data. With AppOmni, organizations can automatically and continuously enforce rules for data access, data sharing and third-party applications.

On this week's episode

Looking down the security roadmap

Dean Webb of ForeScout asked this great question on Peerlyst. "What are the things that are the hardest to fix that leave organizations the most vulnerable?" These are not the quick security fixes or low hanging fruit, but rather the big projects that nobody wants that often never get finished. What are they and is there any way to make them not so painful?

It's time for "Ask a CISO"

sitdownson on reddit's AskNetSec asked, "How and when did you decide to specialize?" Sultan_of_Ping answered, "For most people it's not a decision, the specialization comes to them." Do you get a taste of everything and then determine which one you're passionate about? Do you read market demands (e.g. cloud security) and go in that route? What have you seen your colleagues do?

What's Worse?!

A "What's Worse?!" first - FOUR scenarios. Which one is worst?

Here's some surprising research

We're revisiting the Verizon Data Breach Investigations Report. Tony's organization, Center for Internet Security had a hand in the report and specifically at the end where you map the CIS top 20 to the breach findings. In particular, the report notes that there are 171 safeguards that are grouped based on the resources and risks the organizations are facing. Has anything shifted significantly in this most recent report?

What's the return on investment?

Tip of the hat to Norman Hunt, Deputy CISO, GEICO, who sent this article from HelpNet Security about a study on CEOs and CISOs approaches to "When is security enough security?" There seems to be a disparity with CEOs being more confident with the security that CISOs. I have to assume that mature understanding of risk is the biggest contributor, and the nature of the job of a CISO who sees more threats than the CEO, but only in a cyber context. A CEO sees all the other risks. What causes such swings in opinions?

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected