CISO Tradecraft®

Latest Episodes:

#86 - The CISO MindMap (with Rafeeq Rehman) Jul 11, 2022

Show notes

This episode features Rafeeq Rehman. He discusses the need for a CISO Mindmap and 6 Focus Areas for 2022-2023:

1. Re-evaluate ransomware defenses, detection and response capabilities, perform a business impact analysis and identify critical processes, applications and data.

2. Reduce/consolidate security tools/technologies and vendors. More tools don’t necessarily reduce risk but do add the need for maintaining expertise on security teams.

3. To serve your business better, train staff on business acumen, value creation, influencing and human experience.

4. Take an inventory of open source software (standalone and libraries) and make it part of your vulnerability management program.

5. Build team expertise in technology fields including machine learning (ML) models, model training, API security, service mesh, containers, DevSecOps.

6. Maintain a centralized risk register. Even better: integrate into your enterprise risk management program. Track risk for technology, insiders, processes, third parties, compliance and skill gaps.

Links:

CISO MindMap Link
CISO MindMap 2022 Recommendations Link
Information Security Leaders Handbook Link
Cybersecurity Arm Wrestling Link

#85 - The Fab 5 Security Outcomes Study (with Helen Patton) Jul 04, 2022

Show notes

On this episode of CISO Tradecraft, we feature Helen Patton.

Helen shares many of her career experiences working across JP Morgan, The Ohio State University, and now Cisco.

-Is technical acumen needed for CISOs?

-Surviving organizational politics

(34:45) Helen discusses The Fab 5 Security Outcomes study.

Volume 1 Study - Link

Volume 2 Study - Link

#84 - Gaining Trust (with Robin Dreeke) Jun 27, 2022

Show notes

On this episode of CISO Tradecraft we feature Robin Dreeke from People Formula. Robin was the former head of the FBI Counterintelligence Behavioral Analysis Program and has an amazing background in learning how individuals think, build trust, and communicate. Robin highlights 4 Pillars of Communicating:

Seek the thoughts and opinions of others
Talk in terms of priorities, pain points, and challenges of others
Use Nonjudgmental validation (ie seek to understand others without judging)
Empower others with choice and give them cause and effect of each choice

To learn more about Robin's way of thinking you can check out his podcast and books:

#83 - Cyber Defense Matrix Reloaded (with Sounil Yu) Jun 20, 2022

Show notes

This episode is sponsored by Varonis. You can learn more on how to reduce your ransomware radius by performing a free ransomware readiness assessment Link

On this episode, Sounil Yu continues his discussion about his new book ("Cyber Defense Matrix"). Listen to learn more about:

Pre-Event Structural Awareness vs Post-Event Situational Awareness
Environmental vs Contextual Awareness
Understanding Security Handoffs
Rationalizing Technologies
Portfolio Analysis
Responding to Emerging Buzzwords (Zero Trust and SASE)

#82 - Cyber Defense Matrix (with Sounil Yu) Jun 13, 2022

Show notes

This episode is sponsored by Varonis. You can learn more on how to reduce your ransomware radius by performing a free ransomware readiness assessment Link

This episode of CISO Tradecraft has Sounil Yu talk about his new book, "Cyber Defense Matrix: The Essential Guide to Navigating the Cybersecurity Landscape". Sounil reviews the Cyber Defense Matrix in depth. We discuss how the Cyber Defense Matrix can be used for:

Capturing & Organizing Measurements & Metrics
Developing a Cyber Security Roadmap
Gaining Greater Situational & Structural Awareness
Understanding Organizational Responsibilities & Handoffs
Rationalizing Technologies & Finding Investment Opportunities
Deciphering the Latest Industry Buzzword

You can purchase Sounil's new book here Link

#81- Career Lessons from a CISO (with John Hellickson) Jun 06, 2022

Show notes

On this episode of CISO Tradecraft, John Hellickson from Coalfire talks about his career as a CISO. Listen and learn about:

The evolving role of the CISO
How John got started as a CISO
Whis is a Field CISO and how does it differ from a traditional CISO role
Tips on getting your career to the next level by attending the right conferences and getting an executive coach
How to get Business Alignment
How the Security Advisor Alliance is helping the next generation of cyber talent

#80 - Breaking Backbones (with Deb Radcliff) May 30, 2022

Show notes

A respected journalist focusing on cybersecurity and our community of people for over 25 years, Deb Radcliff remains a trusted information source who checks and double-checks her sources before publication -- a refreshing change to the low signal - high noise world of social media. In this episode, we discuss where CISOs might turn for accurate information, how the industry has evolved in complexity, and take a look at the first of three fictional novels she's writing about a future world where hackers take on an oppressive digital state. What is really interesting is her explanation of how she went from book idea to published reality.

Breaking Backbones Information is Power may be purchased from the following Amazon Link

#79 - Addressing the Top CEO Concerns May 23, 2022

Show notes

On this Episode of CISO Tradecraft we talk about the Top 10 areas of concern for the C Suite about Ransomware. Note you can read the full ISC2 Study here (Link).

Cybersecurity professionals should keep the following golden rules in mind when communicating with the C-suite about ransomware.

Increase Communication and Reporting to Leadership
Temper Overconfidence as Needed
Tailor Your Message
Make the Case for New Staff and Other Investments
Make Clear that Ransomware Defense is Everyone’s Responsibility

#78 - Business Objectives & 5 CISO Archetypes (with Christian Hyatt) May 16, 2022

Show notes

On this episode of CISO Tradecraft, Christian Hyatt from risk3sixty stops by to discuss the 3 major Business Objectives for CISOs:

Risk Management
Cost Reduction
Revenue Generation

He also discusses the five CISO Archetypes.

The Executive
The Engineer
The GRC Guru
The Technician
The Builder

References: The 5 CISO Archetypes Book Link

Designing the CISO Role Link

#77 - Countering Corporate Espionage May 09, 2022

Show notes

Chances are your organization has information that someone else wants. If it's another nation state, their methods may not be friendly or even legal. In this episode we address assessing risk, known "bad" actors, information targets, exfiltration, cyber security models, what the federal government is doing for contractors, and response strategies. Listen now so you don't become a statistic later.

References:

https://www.fbi.gov/file-repository/china-exec-summary-risk-to-corporate-america-2019.pdf

https://nhglobalpartners.com/made-in-china-2025/

https://www.cybintsolutions.com/cyber-security-facts-stats/

http://www.secretservice.gov/ntac/final_it_sector_2008_0109.pdf

http://www.secretservice.gov/ntac/final_government_sector2008_0109.pdf

CIS Controls v8.0, Center for Internet Security, May 2021, https://www.cisecurity.org

https://owasp.org/www-project-threat-and-safeguard-matrix/

https://www.acq.osd.mil/cmmc/about-us.html