CISO Tradecraft®

Latest Episodes:

#76 - The Demise of the Cybersecurity Workforce May 02, 2022

Show notes

Our career has been growing like crazy with an estimated 3.5 million unfilled cybersecurity jobs within the next few years. More certs, more quals, more money, right? The sky’s the limit. But what if we’re wrong? AI, machine learning, security-by-design, outsourcing, and H-1B programs may put huge downward pressure on future job opportunities (and pay) in this country. Of course, we don’t WANT this, but shouldn’t a wise professional prepare for possibilities? [We did a ton of research looking at facts, figures, industry trends, and possible futures that might have us thinking that 2022 may have been “the good old days.” No gloom-and-doom here; just an objective look with a fresh perspective, you know, just in case.]

#75 - Avoiding Death By PowerPoint Apr 25, 2022

Show notes

On this episode of CISO Tradecraft, we discuss how to avoid Death By PowerPoint by creating cyber awareness training that involves and engages listeners. Specifically we discuss:

The EDGE method: Explain, Demonstrate, Guide, and Enable
Escape Rooms
Tabletop Exercises
Polling During Presentations
Short videos from online resources

References:

https://blog.scoutingmagazine.org/2017/05/05/living-on-the-edge-this-is-the-correct-way-to-teach-someone-a-skill/

http://www.inquiry.net/ideals/scouting_game_purpose.htm

https://cisotradecraft.podbean.com/e/ciso-tradecraft-shall-we-play-a-game/

Escape Rooms

https://library.georgetown.org/virtual-escape-rooms/

https://research.fairfaxcounty.gov/unlimited/escape

Tabletop Exercises

From GCHQ

https://www.ncsc.gov.uk/information/exercise-in-a-box

From CISA

https://www.cisa.gov/cisa-tabletop-exercises-packages

Funny Videos on Cyber

https://staysafeonline.org/resource/security-awareness-episode/

#74 - Pass the Passwords Apr 18, 2022

Show notes

On this episode of CISO Tradecraft, we focus on the Password Security and how it's evolving. Tune in to learn about:

Why do we need passwords
Ways consumers login and authenticate
How bad actors attack passwords
How long does it take to break passwords
Different types of MFA
The future of passwords with conditional access policies

Infographic:

References:

#73 - Wonderful Winn Schwartau Apr 11, 2022

Show notes

Winn Schwartau is a well-recognized icon in the cybersecurity community, and also a dear friend for over 25 years. Always one to stir the pot and offer radical ideas (many of which come true), we discuss Hacker Jeopardy, INFOWARCON, his books "Pearl Harbor Dot Com", "Time-Based Security", and his magnum opus "Analog Security." We speculate on the future of our industry with respect to quantum and probabilistic computing, and after hanging up his pen, looks like he's doing a Tom Brady and writing one more amazing book. **Warning Adult Language**

Winn's Website Link

#72 - Logging In with SIEMs (with Anton Chuvakin) Apr 04, 2022

Show notes

On this episode of CISO Tradecraft, Anton Chuvakin talks about Logging, Security Information & Event Management (SIEM) tooling, and Cloud Security. Anton share’s fantastic points of view on:

How moving to the cloud is like moving to a space station (13:44)
How you may be one IAM mistake away from a breach (20:05)
How a SIEM is a logging based approach, whereas EDRs require agents at endpoints. This becomes really interesting when cloud solutions don’t have an endpoint to install an agent (26:53)
Why you don’t want an on premises SIEM (32:35)
The 3 AM Test - Should you wake someone up for this alert at 3 AM (39:24)

#71 - Lessons Learned as a CISO (with Gary Hayslip) Mar 28, 2022

Show notes

On this special episode of CISO Tradecraft, we have Gary Hayslip talk about his lessons learned being a CISO. He shares various tips and tricks he has used to work effectively as a CISO across multiple companies. Everything from fish tacos and beer to how to look at an opportunity when your boss has no clue about cyber frameworks. There's lots of great information to digest.

Additionally, Gary has co-authored a number of amazing books on cyber security that we strongly recommend reading. You can find them here on Gary's Amazon page.

#70 - Partnership is Key Mar 21, 2022

Show notes

On this episode of CISO Tradecraft you can learn how to build relationships of trust with other executives by demonstrating executive skill & cyber security expertise. You can learn what to say to each of the following executives to build common ground and meaningful work:

CFO
Legal
Marketing
Business Units
CEO
CIO
HR

Note Robin Dreeke mentions 5 keys to building goals.:

Learn… about their priorities, goals, and objectives.
Place… theirs ahead of yours
Allow them to talk…. suspend your own need to talk.
Seek their thoughts and opinions.
Ego suspension!!! Validate them unconditionally and non-judgmentally for who they are as a human being.

During this week's Monday Morning Email, CISO Tradecraft answers the question on how to craft a winning resume to land your first CISO role.

InfoGraphic

#69 - Aligning Security Initiatives with Business Objectives Mar 14, 2022

Show notes

On this episode of CISO Tradecraft, we talk about how cyber can help the four business key objectives identified by InfoTech:

1. Profit generation: The revenue generated from a business capability with a product that is enabled with modern technologies.

2. Cost reduction: The cost reduction when performing business capabilities with a product that is enabled with modern technologies.

3. Service enablement: The productivity and efficiency gains of internal business operations from products and capabilities enhanced with modern technologies.

4. Customer and market reach: The improved reach and insights of the business in existing or new markets.

We also discuss Franklin Covey's 4 Disciplines of Execution (TM):

Focus on the Wildly Important
Act on the lead measures
Keep a compelling scoreboard
Create a cadence of accountability

Please note references to Infotech and Franklin Covey Material can be found here:

Infographic:

#68 - Thought Provoking Discussions (with Richard Thieme) Mar 07, 2022

Show notes

Today we speak with Richard Thieme, a man with a reputation for stretching your mind with his insights, who has spoken at 25 consecutive DEFCONs as well as keynoted BlackHat 1 and 2. In a far-ranging discussion, we cover the concept of what it's like to be a heretic (hint: it's one step beyond being a visionary), the thought that the singularity has already arrived, Pierre Teilhard de Chardin's noosphere, disinformation and cyber war, ethical decision-making in automated systems, and why there is convincing evidence we are not alone in this universe.

References: https://thiemeworks.com/

#67 - Knock, Knock? Who’s There and Whatcha Want? Feb 28, 2022

Show notes

On this episode of CISO Tradecraft we are going to talk about various Access Control & Authentication technologies.

Access Control Methodologies:

Mandatory Access Control or (MAC)
Discretionary Access Control or (DAC)
Role Based Access Control or (RBAC)
Privileged Access Management or (PAM)
Rule Based Access Control
Attribute Based Policy Control (ABAC) or Policy Based Access Control (PBAC)

Authentication Types:

Password-based authentication
Certificate-based authentication
Token-based authentication
Biometric authentication
Two-factor Authentication (2FA)
Multi-Factor Authentication (MFA)
Location-based authentication
Computer recognition authentication
Completely Automated Public Turing Test to Tell Computers & Humans Apart (CAPTCHA)
Single Sign On (SSO)
Risk Based authentication

References

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected