CISO Tradecraft®

*/ ?>

Latest Episodes:

#56 - Say Firewall One More Time Dec 13, 2021

Show notes

Have you ever heard someone say our firewalls block this type of attack? In this episode, you can increase your understanding of firewalls so it won’t just be another buzzword. 6 Basic categories of firewalls that we discuss on the show include:

Packet Filters focus on IP and port blocking
Stateful Inspection Firewall looks at active connections and consider context
Network Address Translation Firewalls tools that allow private networks to connect to public ones and create secure enclaves
Proxy Servers classify web traffic into topics that might be allowed or not allowed
Web Application Firewalls block Web Application Attacks (SQL Injection,Cross Site Scripting, …)
Next Generation Firewalls that try to do everything.

References - sitereview.bluecoat.com

Infographics:

#55 - I have more Agents than the FBI Dec 03, 2021

Show notes

On this episode of CISO Tradecraft you can learn all about Software Agents. Specifically we discuss: What does an Agent do, Why is an Agent helpful, and the 7 common types of Software Agents you would expect to find in large IT organizations. Also, if you stick to the end you can also learn about Secret Agents (ie Agentless).

7 Common Software Agents are:

Endpoint Configuration Agents - Tools like Microsoft Endpoint Manager or SCCM
Mobile Device Managers - Tools like Microsoft Intune or Google Endpoint Management
Vulnerability Agents - Tools like Qualys or Nessus
Antivirus Agents - Tools like McAfee or Symantec
Endpoint Detection & Response Agents - Tools like Crowdstrike or Carbon Black
Data Loss Prevention Agents - Tools like Forcepoint or GTB Technologies
Privilege Access Management Agents - Tools like BeyondTrust or CyberArk

#54 - The Great Resignation Nov 19, 2021

Show notes

The Great Resignation is upon us, and if some of your top talent hasn't given you their notice, it may be happening soon. Or not, depending on what you choose to do. With plenty of time to contemplate options, people are quitting jobs at a record pace. But wise leaders learn how to listen to their people's needs and desires, create a sense of purpose that motivates far beyond a paycheck, and creates a safe working space by allowing people to be human and make the occasional mistake. Keep your IT Security team intact with these concepts and much more.

For more great CISO content please subscribe to our LinkedIn Page

Thank you for listening to CISO Tradecraft

References:

https://www.bls.gov/news.release/archives/jolts_06082021.pdf
https://info.workinstitute.com/hubfs/2020%20Retention%20Report/Work%20Institutes%202020%20Retention%20Report.pdf
https://www.npr.org/2021/10/22/1048332481/the-great-resignation-why-people-are-leaving-their-jobs-in-growing-numbers
https://blog.trello.com/enterprise/how-to-retain-employees
https://hbr.org/2016/09/why-people-quit-their-jobs
https://www.mckinsey.com/business-functions/people-and-organizational-performance/our-insights/great-attrition-or-great-attraction-the-choice-is-yours
https://blog.trello.com/supportive-company-culture
https://www.statista.com/chart/19064/number-of-unused-vacation-days/
https://www.glassdoor.com/blog/vacation-realities-2017/
https://hbr.org/2016/03/two-thirds-of-managers-are-uncomfortable-communicating-with-employees
https://www.mckinsey.com/business-functions/people-and-organizational-performance/our-insights/igniting-individual-purpose-in-times-of-crisis
https://allthatsinteresting.com/myers-briggs-test
https://cybersecurityventures.com/jobs

#53 - Fun and Games to Stop Bad Actors (with Dr. Neal Krawetz) Nov 05, 2021

Show notes

In this episode, you can hear from Dr. Neal Krawetz, creator of Hacker Factor and FotoForensics. Neal's a long-time security practitioner who shares some fascinating insights in terms of how to identify potential bad actors early on (think reconnaissance interception), techniques for detecting bots and malicious entities, and ways to protect your team members from misattributed fake blog entries.

#52 - Welcome to the C-Level (with Nate Warfield) Oct 29, 2021

Show notes

Special Thanks to our podcast Sponsor, Prevailion.

Some of the best C-level executives start in the technical ranks. This episode features Nate Warfield, CTO of Prevailion, who differentiated himself by creating the CTI-League.com to assist healthcare companies with ransomware. We'll cover some of that organization, how Nate got his first C-level job, and some lessons learned you might appreciate in your own CISO journey.

To learn more about Cyber Adversary Intelligence, please check out Prevailion who sponsored this episode.

#51 - New Kid in Town (with Rebecca Mossman) Oct 18, 2021

Show notes

When you first start a cybersecurity job, or hire someone into a cybersecurity job, there is a window of opportunity to see things with a new perspective. In this episode, we’re privileged to share ideas with Rebecca Mossman, a successful cybersecurity leader who has led successfully a number of teams in her career. We’ll examine relationships, stakeholders, setting priorities, communication, and knowing when to call something “done” and move on to the next task.

#50 - Border Gateway Protocol (BGP) Oct 11, 2021

Show notes

A Border Gateway Protocol (BGP) misconfiguration is what took out Facebook on 4 October. Most IT folks don't understand how BGP works. This episode helps you gain a better understanding of the protocol that creates routing tables to move information from one end of the Internet to the other. We'll explain how Autonomous Systems (AS) share BGP route information, what should happen when things go right, and then examine what likely went wrong at Facebook and how you might be able to prepare for potential problems in advance before they occur.

#49 - Cyberlaw Musings (with Mark Rasch) Oct 01, 2021

Show notes

This is a special treat. On this episode of CISO Tradecraft you can hear Mark D. Rasch, JD, discuss legal and security topics that he's encountered in his more than 30 years of experience in cybersecurity law. We look into ransomware, reportable breaches, the appropriateness (or lack thereof) of certain legal statues, and finish with some actionable advice for CISOs and security leaders that you really need to hear.

#48 - Effective Meetings Sep 24, 2021

Show notes

We've all suffered through horrible meetings that felt like a total waste of time. As a security leader, you'll be convening your fair share of meetings with your staff. Don't be "that boss" who can't run an effective meeting. This episode shows ways you can ensure your meetings are both efficient and effective, result in actionable tasking, and keep people coming back for more because you showed respect for their time and their ideas. And we even practice what we preach -- this episode ends early.

Harvard Meeting Cost Calculator Link

OSS Simple Sabotage Manual Link

#47 - More Risky Business with FAIR Sep 17, 2021

Show notes

In our 31 July 2021 Episode 42, Risky Business, we covered the basics of risk and risk assessment. This part 2 episode gets into the practical application of risk management using the FAIR model, or Factor Analysis of Information Risk. We explain key risk terminology and walk through examples of how to express risk using this model, as well as creating a meaningful way to explain to executives that is actionable.

Risk Matrix Example: Link

One Page FAIR Model: Link

Measuring & Managing Information Risk: Link

FAIR Wiki: Link

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected