CISO Series Podcast

Latest Episodes:

Do These Jeans Make My Vulnerabilities Look Too Big? Jun 03, 2019

Show notes

Full episode with images and links available at CISO Series (https://cisoseries.com/do-these-jeans-make-my-vulnerabilities-look-too-big/)

We're starting to get a little self-conscious that our vulnerabilities are starting to show. People we don't even know are telling us we have them on the latest episode of CISO/Security Vendor Relationship Podcast.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Fredrick Lee (AKA "Flee") (@fredrickl), CSO of Gusto.

Effective vulnerability prioritization helps you answer three questions: Where should we prioritize based on risk? Which vulnerabilities are likeliest to be exploited? What should we fix first? Tenable gives you the accurate and actionable data you need to answer these questions and better secure your business. Learn more: tenable.com/predictive-prioritization.

What's a CISO to do?

Chris Romeo, CEO of Security Journey, wrote a post where he asked, "What if I had to develop an application security program with a budget of zero dollars?" What he presented was a means to lean on the OWASP open source community and tools to build an application security program.

You're a CISO, what's your take on this?

I was chatting with a pentester, Benjamin McEwan, from Scotland, who reaches out to CISOs trying to responsibly disclose, not expose, a credible security vulnerability. It's his effort to get recognized. He's frustrated though in his ability to find permanent work because those hiring only see him as an independent researcher. Is his exercise the right approach? What can a talented security person in his position do to make himself more attractive to CISOs?

What's Worse?!

We've got a couple of scenarios that shocked our guest at the sheer InfoSec horror.

Breathe In, It's Time for a Little Security Philosophy

On Quora, a question right out of the Matthew Broderick movie WarGames asks, "If a student hacked into university computers and changed his grade in cyber security to an A, does he actually deserve the A?" Except for one person, everyone said, "No," but for different reasons. Mike, are you saying no, and if so, what reason?

What do you think of this pitch?

We've got two pitches from vendors this week. One came directly to me.

Cloud Security Tip, by Steve Prentice - Sponsored by OpenVPN.

The idea behind an Advanced Persistent Threat is both intriguing and a little distracting. It sounds like the title of a Tom Clancy novel – maybe a sequel to Clear and Present Danger.

Designed to penetrate a network, operate while hidden for a long time, all the while receiving commands from an outside agent, an APT is more sophisticated than everyday malware and tends to be deployed against large targets.

Great Demo! Let's Schedule a Time to Ignore Your Follow Up May 28, 2019

Show notes

All links and images for this episode can be found on CISO Series (https://cisoseries.com/great-demo-lets-schedule-a-time-to-ignore-your-follow-up/)

We're playing hard to get on the latest episode of CISO/Security Vendor Relationship Podcast.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Al Ghous, head of cloud security at GE Digital.

Thanks to this week's podcast sponsor Carbon Black

Carbon Black (NASDAQ: CBLK) is a leader in endpoint security dedicated to keeping the world safe from cyberattacks. The company's big data and analytics platform, the CB Predictive Security Cloud (PSC), consolidates endpoint security and IT operations into an extensible cloud platform that prevents advanced threats, provides actionable insight and enables businesses of all sizes to simplify operations.

On this week's episode

Why is everybody talking about this now?

On LinkedIn, Marcus Capone, Partner at Onyx, a physical and cybersecurity firm said, "I laugh when clients balk at prices. They expect champagne but want to pay for Coors Light…" This caused a flurry of discussion of price/value in security. There was an attitude across the board that we're the absolute best and we should be paid that. But as Allan Alford said on Defense in Depth, there's a market for a slightly worse, but way cheaper version of Splunk. Do CISOs want beer-level security solutions?

It's time to measure the risk

How can startups and large companies get along better? Enterprises are jealous of startup's agility, and startups are eager to get at an enterprises' assets. But startups can be a security nightmare and it's a non-starter if they can't pass the third-party risk management process. With all this frustration, is there any middle ground?

What's Worse?!

We have a common real-world scenario in this week's game.

You're a CISO, what's your take on this?

We have talked in the past about how the term "AI" can mean a lot of things. It can be a simple script or it can be an algorithm that actually learns by itself. Both will do something for you automatically, but the expectations are vastly different. When security vendors tout AI, what would CISOs like to hear so your expectations can be set appropriately?

Understanding security sales

The frustration of the vendor follow up process after a demo. An anonymous listener asks, "We are usually told some sort of next step or asked to follow up in a few weeks." The challenge is they're often left chasing the potential client getting no response. This can go on for months. "Is there a way to make this more productive for all involved?" Should the prospect be blamed? What can be done to improve the process?

Application Programming Interfaces (API's) are wonderful for customizing and enhancing the cloud experience, but as a common front door, they pose a significant security risk. Regardless how secure a cloud service provider is, their primary role as an interface means APIs will always pose a weakness that can be exploited by hackers.

We Unleash Our Military Grade InfoSec BS Detector May 21, 2019

Show notes

Find all images and links for this episode on CISO Series (https://cisoseries.com/we-unleash-our-military-grade-infosec-bs-detector/)

We're trying to clean up vendor pitches of unnecessary and outrageous claims so they can sail through to a CISO's inbox. It's our service to cybersecurity community on this week's episode of CISO/Security Vendor Relationship Podcast.

This show was recorded live in front of an audience of CISOs and security vendors at the San Francisco CISO Executive Summit, hosted by Evanta. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Aaron Peck, CISO, Shutterfly.

Thanks to our podcast sponsors ExtraHop and Tenable

Unlike security solutions that focus on signature- and rule-based detection, ExtraHop Reveal(x) helps you rise above the noise of alerts with complete east-west visibility and machine learning for real-time detection of known and unknown threats, plus guided investigations for rapid response. Find and address real threats faster with ExtraHop.

On this week's episode

Why is everybody talking about this now?

Last week I was about to install a popular and approved app in the Google Play store that asked if the app could read, copy, download, and DELETE my contacts. Also last week during Google I/O, Sundar Pichai, Google's chief executive touted their focus on privacy. This is not the first time we've heard this from Google or Facebook who is going to be facing the largest privacy violation in FTC history. Getting access to our behaviors is how Facebook and Google make their money. What would we like to see, not hear, from either Google or Facebook that convinces us that yes, they are doing something significant and proactive about privacy. Maybe they've already done it.

Why is this a bad pitch?

A Twitter thread asked, "What do vendors say that immediately undermines their credibility?"

There were a lot listed, but the ones I saw repeated multiple times were military grade, next-gen, bank-level encryption, full visibility, 100% effective, and single pane of glass.

We have brought up many of these on our show. And while we understand companies are trying to find a short pithy way to describe their technology, using terms like these can turn a great pitch into an effort to dig out of a hole.

What's Worse?!

We squeeze in two rounds of this game and our guest tries to dodge the question, but I don't let him.

You're a CISO, what's your take on this?

Brian Fricke, CISO at BBVA Compass is eager to hear how to successfully reconcile the cloud-driven CapEx to OpEx budget shift. CFOs don't get any depreciation benefit from OpEx, and Brian believes they'd prefer to see CapEx even if it's double the cost. He's struggling. Our CISOs offer up some advice.

How to become a CISO

Jason Clark, CISO of Netskope, wrote an article on Forbes about security mentorship. Mentors are needed to create more security leaders, CISOs, increase interest in security, and teach the ability to talk to the business. All of it centered around one theme of motivating others. What are ways to teach motivation across all these areas?

What's Worse?! "Culture of No" or No Culture? May 11, 2019

Show notes

See all links and images for this episode on CISO Series (https://cisoseries.com/whats-worse-culture-of-no-or-no-culture/)

We want to put an end to InfoSec negativity, but not at the sacrifice of the soul of the company. We're weighing our options on this week's episode of CISO/Security Vendor Relationship Podcast.

This show, like all the previous ones is hosted by me, David Spark (@dspark), founder of Spark Media Solutions and Mike Johnson. Our guest this week is Sean Catlett, CISO of Reddit.

Thanks to this week's sponsor, Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and mobile workforce. We allow cybersecurity professionals to easily build, manage and secure their organization's networks in one unified, multi-tenant, cloud-native platform. Learn more at www.perimeter81.com.

On this week's episode

Why is everybody talking about this now?

Helen Patton, CISO at Ohio State University, asked the security community, "What cultural/behavioral influences on Security would you like to see changed?"

First 90 Days of a CISO

Matt McManus who works in InfoSec at WeWord asks, "What's the ideal information security team make-up and structure?" Sean, you came into Reddit recently as a new CISO. How did you go about determining what you needed for a team?

What's Worse?!

What needs to be protected? The endpoints or the network?

You're a CISO, what's your take on this?

Last year I was chatting with a CEO, and he mentioned one common frustration with a scenario that keeps repeating itself. He will have a truly fantastic meeting with a potential buyer. Absolutely everything goes right, but the moment he asks to engage in a PoC, Proof of Concept, the conversation does an about face and everything falls apart. And vendors have unrealistic expectations of the time it will take a potential buyer to conduct a PoC.

Ask a CISO

With the recent release of the Verizon Data Breach Investigation Report, or DBIR, we brought up a question from Kip Boyle, author of Fire Doesn't Innovate. He asks, "What role do vendors and the media play in determining and prioritizing your cyber risks?"

Whether your data is in transit or at rest, it's vital to remember that neither state is secure. Data must be protected in both states, and encryption plays a major role in this. In addition to encryption standards for in-transit data such as TLS for email, HTTPS and SSL for websites and the use of a VPN when connecting from public Wi-Fi hotspots (even those that say they are secure), there is symmetric and asymmetric encryption, part of the Advanced Encryption Standard. Symmetric encryption happens when the sender and receiver of a message use a single shared key to encrypt and decrypt the message, which is something most internet traffic uses. Asymmetric encryption uses more CPU power and is harder to encrypt, and is used for secure online exchanges via the Secure Sockets Layer.

But encryption isn't the end of the story. There must be network security controls to help protect data in transit as well as securing the transmission networks themselves. Proactivity is key here, which means identifying at-risk data, establishing user prompting regulations and automatic encryption for things like files attached to an email message, and taking stock of, and categorizing all types of data to ensure the right level of security is applied to each.

On a human level, Role-Based Access Control (RBAC) ensures different levels of security and permissions, multi factor authentication helps make data a more difficult target, and of course, each company should take ownership of this challenge and not rely on their cloud supplier to do it for them.

Our "What Not to Do" Security Selling Secret May 06, 2019

Show notes

Check out all links and images for this episode on CISO Series (https://cisoseries.com/our-what-not-to-do-security-selling-secret/)

We're not always clear on what vendors should do when selling security products, but when we get a really bad email pitch, we're very clear on what they should not do. We're bedazzled with bad pitch disbelief on this episode of CISO/Security Vendor Relationship Podcast.

Thanks to this week's sponsor, Women in Security and Privacy (WISP)

Women in Security and Privacy works to advance women in security and privacy. We accomplish this through practical and technical workshops, TANDEM mentorship programs, leadership training, job board postings, Equal Respect speakers bureau, and conference and training scholarships.

On this week's episode

Why is everybody talking about this now?

Facebook is expected to pay somewhere between $3 to $5 billion in FTC fines for violating the 2011 consent decree. They violated user's privacy without giving clear notice or getting clear consent. But, all this financial and reputational damage doesn't seem to do a darn thing to dissuade individuals or investors from Facebook. The site has 2.38 billion active users. It's growing 8% year over year. And after their earnings announcement which mentioned the multi-billion dollar fine, their stock jumped 7%. This doesn't appear to get people to care about security and privacy, So what will?

Hey, you're a CISO, what's your take on this?'

The NSA has announced that no zero day attacks were used in any high profile breach in the last 24 months. Most of the attacks were simple intrusion where they went after users through techniques like phishing or water holing. We talk endlessly on this show about good cyber hygiene, but we have an event coming up, Black Hat, that thrives on showing security professionals the latest attack techniques, which I know are not zero days. But how can security professionals NOT gravitate towards the newest and coolest?

What's Worse?!

Who needs to control the problem? Security or the business unit?

How to become a CISO

Gary Hayslip, CISO of Webroot, and a former guest on Defense in Depth. He wrote an article to his younger self of what he wish he had known when he started in cybersecurity and then becoming a CISO. I'll ask the two of you to do the same exercise. What is something that you now know that there's no way you would have known starting out but would have made your life a lot easier as you took the climb to become a CISO.

Why is this a bad pitch?

We've got a one-two punch on a bad pitch email that uses self-deprecating humor plus an assumption of business relationship. Ouch.

The importance of developing consistent data protection policies across multiple cloud services Many IT departments manage multiple clouds to ensure redundancy and avoid vendor lock-in. But diversifying brings along a new set of risks that demand a consistent and constantly reviewed data governance solution.

In general, cloud vendors do not take responsibility for the security of your data. So, your policy must take full responsibility for endpoints, networks and cloud environments. Just a few of the must-haves on this list include limiting user's permissions to only what they absolutely need, strong security practices including multi-factor authentication and password management, enforcing a uniform set of data loss prevention policies, and building a dynamic inventory of applications by the types of data stored, compliance requirements, and potential threats. Policies should be assigned to groups or roles rather than individual people.

In-house IT people are already busy. Their attention and energies might be best served by working with senior management to establish and maintain Multicloud and data loss prevention policies, while leaving the heavy lifting and day-to-day proactive maintenance to a completely reputable as-a-service cloud security vendor.

We're Gonna Run These Pen Test Exercises Until You Turn Purple Apr 30, 2019

Show notes

Find all the links and images on CISO Series (https://cisoseries.com/were-gonna-run-these-pen-test-exercises-until-you-turn-purple/)

We learn to iterate our security stamina faster by bringing the attackers and defenders in the room together. We're seeing purple on this episode of CISO/Security Vendor Relationship Podcast.

This show, like all the previous ones is hosted by me, David Spark (@dspark), founder of Spark Media Solutions and Mike Johnson. Our guest this week is Matt Southworth (@bronx), CISO of Priceline, who was brought to us by our sponsor, Praetorian.

Thanks to this week's sponsor, Praetorian

As a professional services company, Praetorian helps enterprise customers solve complex cybersecurity problems. We are the security experts.

Why is everybody talking about this now?

Senator Elizabeth Warren's proposed bill, the Corporate Executive Accountability Act, would pave the way for criminal charges of executive wrongdoing that leads to some public harm, like a public data breach. Note, there needs to be proof of wrongdoing. This isn't designed to blame victims. Regardless, the cybercommunity lit up on this topic. Warren said that too many executives were walking away free with no penalty while the community were left to suffer. Is this the bill that's needed to put a check on breaches?

Hey, you're a CISO, what's your take on this?'

Priceline has been conducting purple team exercises with our sponsor Praetorian. We discuss the value in purple team efforts over all the other alternatives, like pen testing, red team/blue team exercises, and threat hunting reports. Plus, we discuss the cultural benefits of purple team exercises.

What's Worse?!

We get a consensus on a question about asset and risk management.

How to become a CISO

Question from the director of information security at a Fortune 100 company wants to know how to make the leap from his position to CISO.

Pay attention, it's security awareness training time

Dan Lohrmann, CSO of Security Mentor and an upcoming guest on our live podcast we're going to be recording on June 6th in Grand Rapids, Michigan had a very interesting article on Peerlyst about avoiding the punishment angle of security training. He said his number one struggle in education is explaining how important security is at an individual level and that individuals understand the impact of their actions. At Priceline, Matt Southworth created a Security Champs program to extend the reach of his security team by training interested non-security coworkers about security. We discuss what this has done to improve culture, security, and help people understand the impact of their actions.

Two-factor authentication, also called 2FA, is vital, and should be considered the default in online security, not a fancy option.

In short, 2FA means that two separate identifiers are required to gain access to an account. These identifiers should come from: 1.) something only you know, like a complex password, and 2.) something physically separate that belongs to you like a phone that can receive SMS messages, a physical token, a time or location limited message, or something biometric, like a retinal scan or fingerprint.

Currently the SMS message is the most popular "second factor," but security analysts say this is still the weakest option. A better option is to use an approved app, or to partner with a cybersecurity company who can build one for you.

Vulnerability Management Apr 25, 2019

Show notes

This is a special episode of Defense in Depth being shared on this feed. Find the full post with links and images on the CISO Series site here (https://cisoseries.com/defense-in-depth-vulnerability-management/)

So many breaches happen through ports of known vulnerabilities. What is the organizational vulnerability in vulnerability management?

Check out this post and discussion and this one for the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest is Justin Berman (@justinmberman), CISO for Zenefits.

Vulcan's vulnerability response automation platform allows enterprises to automate their TVM programs. Vulcan integrates to existing IT DevOps and security tools to fuse enterprise data with propriety intelligence which allows to accurately and subjectively priorities and remediate vulnerabilities - either using a patch workaround or compensating control.

On this episode of Defense in Depth, you'll learn:

As the CIS 20 concurs, vulnerability management is the first security measure you should take right after asset inventory.
Vulnerability management needs to be everyone's issue and managed by all departments.
Lots of discussion around vulnerability management being driven by culture which is a very hard concept to define. To get a "vulnerability management culture" look to a combination of awareness and risk management.
Vulnerabilities don't get patched and managed without someone taking on ownership. Without that, people are just talking and not doing.
Increased visibility across the life cycle of a vulnerability will allow all departments to see the associated risk.
Who are the risk owners? Once you can answer that questions you'll be able to assign accountability and responsibility.

I'm Humbled to Tell You About My Prestigious Award Apr 23, 2019

Show notes

Find the full episode of this podcast (with links and images) on the CISO Series site right here: (https://cisoseries.com/im-humbled-to-tell-you-about-my-prestigious-award/)

I'm not exactly sure what "humbling" means, but I'm going to use it to hopefully soften my braggadocio announcement.

We discuss semantics and when it's OK to boast your accomplishments on this week's episode of CISO/Security Vendor Relationship Podcast.

This show, like all the previous ones is hosted by me, David Spark (@dspark), founder of Spark Media Solutions and Mike Johnson. Our guest this week is Will Lin (@WilliamLin), partner and co-founder, ForgePoint Capital.

Thanks to this week's sponsor, Praetorian

As a professional services company, Praetorian helps enterprise customers solve complex cybersecurity problems. We are the security experts.

On this week's episode

How CISOs are digesting the latest security news

In many industries we see VC investments following trends. This is hot and new, let's go and invest in it. A recent story on Forbes spotlights five trends in cybersecurity which comes off as catnip for VCs or at least those in those spaces looking for investments. Is trend hopping a lucrative way to succeed with cybersecurity investments?

Why is everybody talking about this now?

Peter Cohen, director at Countercept remarked on the hypocrisy of posting a photo of yourself on stage and referring to it as "humbling". People say this with zero idea of the definition. The use of humbled or humbling as a verb means that at one time you thought you were superior and now you realize you are not because essentially someone defeated you and put you in your place. I don't get the sense that's what people mean when they refer to an experience as "humbling." But do a search for the term on LinkedIn and you will see people use it ALL THE TIME. Some of the most popular posts on LinkedIn are achievement announcements. Where's the line between saying you're proud of something and would you honor it with me and coming off like a jackass?

What's Worse?!

We have two scenarios this week in honor of our VC guest.

Hey, you're a CISO, what's your take on this?

In a special VC edition of "Hey, you're a CISO, what's your take on this?"

Much of what we talk about on this show is what we like and don't like about how security companies market themselves. In the news, the only role we hear VCs playing is financial. But given that VCs are seeing the inner workings of a startup, they can probably see firsthand why a company succeeds or fails. Given what VCs are privvy to that others of us are not, how can VCs help shape the way vendors market themselves?

Ask a CISO

Fernando Montenegro of 451 Research brought to my attention this tweet from Soldier of Fortran that caused a flurry of discussion. The tweet pointed out that many sites say they offer pricing, but when you go to the page it's just a lot of verbiage with a link to request a quote. Haroon Meer of Thinkst, producers of Canary deception devices and a former guest on this show, said they have pricing on their site even when experienced salesmen told them not to do it. Kyle Hanslovan of Huntress Labs, asked how he could provide transparent pricing when half of his clients are direct and the other half are distributors. Is there a happy medium here or is obfuscation the way to succeed with security selling?

No Shirt. No Security. No Merger. Apr 16, 2019

Show notes

Episode available on CISO Series blog (https://cisoseries.com/no-shirt-no-security-no-merger/)

Sure, we'd like to merge with your company but geez, have you looked at your security posture lately? Uggh. I don't know if I could be seen in public with your kind let alone acquire your type.

We're wary as to who wants to enter our digital home on this week's episode of CISO/Security Vendor Relationship Podcast.

This show, like all the previous ones is hosted by me, David Spark (@dspark), founder of Spark Media Solutions and Mike Johnson. Our guest this week is Mark Eggleston (@meggleston), vp, chief information security and privacy officer, Health Partners Plans.

Thanks to this week's sponsor, Praetorian

As a professional services company, Praetorian helps enterprise customers solve complex cybersecurity problems. We are the security experts.

On this week's episode

How CISOs are digesting the latest security news

Good cybersecurity hygiene is critical not just to mitigate breaches but also the valuation of a company, especially during a merger or acquisition. Itzik Kotler, co-founder and CTO of Safe Breach, notes that back in 2016 the Verizon acquisition price of Yahoo was lowered nearly $350 million after Yahoo disclosed data breaches that had happened up to two years earlier. Kotler said, "The problem is cybersecurity risk from mergers and acquisitions perspective should not be about what has happened, but about what vulnerabilities are being introduced and what could happen as a result."

Why is everybody talking about this now?

An interesting question on Quora asked, "Do you regret working in cybersecurity?" Do our CISOs ever regret? Why do people regret?

"What's Worse?!"

We have a challenge that pits securing old and new technology.

Ask a CISO

Eric Rindo just graduated with his MS in Cybersecurity. He has a certification, but zero experience. He's looking for his first InfoSec opportunity. For a CISO, what's attractive about a candidate like Eric?

What do you think of this pitch?

What happens when you pitch something CISOs already have?

Machine Learning Failures Apr 10, 2019

Show notes

Full post for this episode (https://cisoseries.com/defense-in-depth-machine-learning-failures/)

NOTE: You're seeing this special episode of Defense in Depth, because we think our CISO/Security Vendor Relationship Podcast listeners should hear it.

Is garbage in, garbage out the reason for machine learning failures? Or is there more to the equation?

Check out this post and discussion for the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest for this episode is Davi Ottenheimer (@daviottenheimer), product security for MongoDB.

Thanks to this week's podcast sponsor, Remediant

81% of cyberattacks utilize stolen administrative credentials. Yet, legacy enterprise password vaults solve only a fraction of the problem and are difficult to rollout. Remediant's SecureONE takes a new approach to privileged access management: offering agent-less, vault-less, continuous detection and just-in-time-administration. Learn what Remediant can do in a half-day POC deployment.

On this episode of Defense in Depth, you'll learn:

Don't fall victim to believing that success and failure of machine learning is isolated to just garbage in/garbage out. It's far more nuanced than that. Some human actually has to determine what is considered garbage in and what is not.
It only takes a very small amount of data to completely corrupt and ruin machine learning data.
This knowledge of small infection can spread and corrupt all of the data and can have political and economic motivations to do just that.
We have failures in human intervention. Machine learning can just magnify that at rapid rates.
While there are many warning signs that machine learning can fail, and we have the examples to back it up, many argue that competitive environments don't allow us to ignore it. We're in a use it or lose it scenario. Even when you're aware of the pitfalls, you may have no choice but to utilize machine learning to accelerate development and/or innovation.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected