CISO Tradecraft®

*/ ?>

Latest Episodes:

#246 - Tim Brown on SolarWinds: What Every CISO Should Know Aug 18, 2025

Show notes

In this episode of the CISO Tradecraft podcast, host G Mark Hardy speaks with Tim Brown, the CISO of SolarWinds, at the Black Hat conference in Las Vegas. They delve into the details of the infamous SolarWinds breach, discussing the timeline of events, the involvement of the Russian SVR, and the immediate and long-term responses by SolarWinds. Tim shares insights on the complexities of supply chain security, the importance of clear communication within an organization, and the evolving regulatory landscape for CISOs. Additionally, they discuss the personal and professional ramifications of dealing with such a high-profile incident, offering valuable lessons for current and future cybersecurity leaders.

Chapters

00:00 Introduction and Welcome
00:59 The SolarWinds Incident Unfolds
03:13 Understanding the Attack and Response
04:04 The Role of SVR and Supply Chain Security
10:43 Technical Details of the Attack
14:56 Compliance and Reporting Challenges
19:24 Rebuilding Trust and Personal Impact
22:06 CISO Concerns and Company Support
22:14 Legal Challenges and Company Expenses
23:40 SEC Charges and Legal Proceedings
29:35 Supply Chain Security and Vendor Assurance
35:47 CISO Accountability and Industry Standards
39:41 Final Thoughts and Advice for CISOs

#245 - Mastering Cybersecurity Recruitment and Career Growth (with Casey Marquette) Aug 11, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy is joined by cybersecurity expert Casey Marquette to discuss effective HR and recruiting strategies for building a top-notch cybersecurity team. They dive into career development, the importance of networking, and how to navigate the challenges of hiring in cybersecurity. Casey shares his personal journey from law enforcement to becoming a leading figure in the cybersecurity world, highlighting the role of mentorship and continuous learning. The episode also covers innovative uses of AI in the hiring process and provides practical advice for both hiring managers and job seekers in the cybersecurity field. Tune in for valuable insights on how to hire the best talent and advance your career in cybersecurity. Transcripts https://docs.google.com/document/d/1c-3qy6KkQuhjuHquycQ3rRwMdSlZBfz4 Chapters

00:00 Introduction to Cybersecurity Recruitment
00:31 Guest Introduction: Casey Marquette
01:46 Casey's Career Journey
04:41 Hiring for Attitude vs. Skillset
05:30 Promoting from Within vs. Hiring Externally
07:34 Leadership and Morale
20:20 The Importance of Networking and Mentorship
22:19 AI in Recruitment
23:30 The Talent Pool and Recruitment Challenges
24:04 Introducing Scout: The AI Recruitment Tool
24:51 Security Measures in AI Recruitment
25:32 Addressing Fraudulent Candidates
26:10 Remote Hiring and Deepfake Concerns
28:52 Insider Threats and Tabletop Exercises
31:51 Enhancing Career Marketability for CISOs
37:47 Building Effective Networks and Relationships
42:04 The Importance of Specialized Recruitment
44:21 Final Thoughts and Contact Information

#244 - Breaking into Cybersecurity (with Christophe Foulon) Aug 04, 2025

Show notes

Join host G Mark Hardy in another enlightening episode of CISO Tradecraft as he speaks with special guest Christophe Foulon, a seasoned cybersecurity professional and podcast host. In this episode, Christophe delves into his journey from the help desk to cybersecurity expert, the challenges faced by newcomers, and the keys to successfully building and leading cybersecurity teams. Learn about the importance of continuous learning, managing career transitions, and the emotional rewards and challenges of being a CISO. Whether you're an aspiring CISO or looking to advance in your cybersecurity career, this episode offers invaluable insights and practical advice.

Christophe's LinkedIn: https://www.linkedin.com/in/christophefoulon/ Christophe's Website: https://christophefoulon.com/ Christophe's Podcast: https://podcasts.apple.com/us/podcast/breaking-into-cybersecurity/id1463136698

Transcripts: https://docs.google.com/document/d/1UytoyelIMezzbtxdPHo5FE_oLiXYS_58

Chapters

00:00 Introduction to the Episode
00:27 Meet the Guest: Christophe Foulon
01:30 Christophe's Journey into Cybersecurity
06:24 The Allure and Challenges of a CISO Role
09:55 Developing Political and Leadership Skills
20:30 Aligning Team Members with Their Strengths
31:34 Navigating HR and Diversity in Cybersecurity
36:29 Becoming a Fractional or Virtual CISO
42:27 Final Thoughts and How to Connect with Christophe

#243 - Navigating Hacker Summer Camp in 2025 Jul 29, 2025

Show notes

Navigating Hacker Summer Camp: A Comprehensive Guide Join host G Mark Hardy on this episode of CSO Tradecraft as he provides a detailed guide on what to expect at Hacker Summer Camp, a series of significant cybersecurity events including DEFCON, Black Hat, and BSides Las Vegas. G Mark shares historical insights, tips for first-timers, and personal anecdotes from his extensive experience attending these events over the years. Learn about the origins, key activities, and networking opportunities that make these conferences pivotal in the cybersecurity community. Stay tuned for practical advice on planning your visit and making the most out of your Hacker Summer Camp experience.

Transcripts: https://docs.google.com/document/d/1Y-MenErnVCzUga4xu20ZIz8hT9xsGSJD

Chapters

00:00 Introduction to Hacker Summer Camp
01:29 History and Significance of DEFCON
02:50 Spot the Fed and Early DEFCON Experiences
05:31 The Evolution of Black Hat
09:34 The Birth and Growth of BSides
11:19 Tips for Attending Hacker Summer Camp
19:57 Networking and Participation Strategies
25:31 Conclusion and Final Thoughts

#242 - The Secret to Career Success: Your Personal Board of Directors Jul 21, 2025

Show notes

In this episode of CISO Tradecraft, co-host G Mark Hardy and guest Ross Young explore the concept of having a personal board of directors. Learn how to leverage mentors, coaches, and role models to gain diverse perspectives and valuable advice for your professional growth as a cybersecurity leader. Discover the importance of building authentic relationships and seeking advice from experienced individuals, and understand how to make informed career decisions. Tune in to hear practical tips on creating and maintaining your own board of directors, and how it can elevate your career in cybersecurity.

Helpful Reading

https://pe.gatech.edu/blog/working-learning/personal-board-of-directors

https://career.uga.edu/uploads/documents/hireuga/PersonalBoardOfDirectors-worksheet24.pdf

Transcripts:

https://docs.google.com/document/d/1qhx38KERHAc1T0qoE6mphUODeOt2xWC4 Chapters

00:00 Introduction to Personal Board of Directors
00:27 Welcome to CISO Tradecraft
01:25 Understanding the Concept of a Personal Board of Directors
03:51 The Role of Mentorship and Feedback
04:38 Building Effective Mentor-Mentee Relationships
06:53 The Importance of Sponsorship
07:57 Navigating Career Paths and Organizational Culture
09:28 Recruiting Your Personal Board of Directors
15:34 Making the Most of Mentorship
22:17 Advice and Board of Directors
22:46 The Power of a Mastermind
23:52 Identifying Key Roles for Your Board
26:27 Time Commitment and Mentor Relationships
27:22 Grave Diggers and Organizational Insights
28:26 Categories of Board Members
29:54 Leveraging Admins and Chiefs of Staff
31:55 Building Trust and Influence
35:09 Discernment in Taking Advice
41:23 Career Opportunities and Emerging Technologies
42:57 Summary and Final Thoughts

#241 - The OWASP Threat and Safeguard Matrix (with Ross Young) Jul 14, 2025

Show notes

Join G Mark Hardy in this special episode of CISO Tradecraft as he interviews Ross Young, the creator of the OWASP Threat and Safeguard Matrix (TaSM). Ross shares his extensive cybersecurity background and discusses the development and utility of the TaSM, including its applications in threat modeling and risk management. Additionally, Ross introduces his upcoming book, 'Cybersecurity's Dirty Secret: How Most Budgets Are Wasted,' and provides insights on maximizing cybersecurity budgets. Don't miss this episode for essential knowledge on enhancing your cybersecurity leadership and strategies.

OWASP Threat and Safeguard Matrix - https://owasp.org/www-project-threat-and-safeguard-matrix/

Transcripts - https://docs.google.com/document/d/1anGewI3XccGnXoV3oE2h7BfelY5QxiSL/

Chapters

00:00 Introduction to the Threat and Safeguard Matrix

00:30 Meet Ross Young: Cybersecurity Expert

01:08 Ross Young's Career Journey

01:59 The Upcoming Book: Cybersecurity's Dirty Secret

03:04 Introduction to the Threat and Safeguard Matrix (TaSM)

03:48 Understanding the TaSM Framework

07:10 Applying the TaSM to Real-World Scenarios

19:32 Using TaSM for Threat Modeling and Risk Committees

21:58 Extending TaSM Beyond Cybersecurity

23:52 AI Risks and the TaSM

24:43 Conclusion and Final Thoughts

#240 - From CruiseCon to AI Threats (with Ira Winkler) Jul 07, 2025

Show notes

Join us for an engaging episode of CISO Tradecraft, hosted by G Mark Hardy, featuring cybersecurity veteran Ira Winkler. In this episode, we dive deep into cybersecurity careers, discuss the unique CruiseCon cybersecurity event, and explore the evolution of information security. Hear firsthand accounts of career journey highlights, networking strategies, and the importance of democratizing top-tier content. Learn about the impacts of AI in cybersecurity, data poisoning, and upcoming cybersecurity conferences. Whether you're a seasoned professional or just starting your journey, this episode is packed with invaluable insights and advice.

https://cruisecon.com/

Don't forget to the the following code for 10% off "CISOTRADECRAFT10"

Transcripts: https://docs.google.com/document/d/1-H1CShsyirr4ZL9d1WCx6IMA_ngjWoEN

Chapters

00:00 Introduction to CISO Tradecraft
01:34 Meet Ira Winkler: Cybersecurity Veteran
02:50 The Concept of CruiseCon
05:58 Challenges in Cybersecurity Events
08:03 Building a Cybersecurity Community
13:45 Mentorship and Networking in Cybersecurity
21:52 The Importance of Relevant Mentorship
24:40 The Importance of Programmatic Principles
25:19 Finding the Right Mentor for Your Career Path
26:38 Adapting to a Shifting Career Landscape
27:05 Understanding AI Fundamentals
29:12 The Role of Data in AI
30:57 Agentic AI and Its Applications
32:48 Challenges and Risks in AI
41:33 Upcoming Events and Keynote Speakers
43:35 Leadership Lessons from Ground Zero
46:39 Future Cruise Con Events
47:44 Conclusion and Farewell

#239 - Actionable Gamification and Lasting Success (with Yu-Kai Chou) Jun 30, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy speaks with gamification pioneer Yu-Kai Chou about his new book, '10,000 Hours of Play: Unlock Your Real Life Legendary Success.' Explore key concepts such as aligning your passions, skills, and goals through six essential steps: choosing your game, knowing your attributes, selecting your role, enhancing your skills, building alliances, and achieving your quest. Discover how gamification can lead to personal and professional success. Tune in for an insightful conversation that could change the way you approach your career and life.

Yu-Kai Chou - https://www.linkedin.com/in/yukaichou/

Actionable Gamification Book - https://a.co/d/isv7K0W

10,000 Hours of Play Book - https://a.co/d/3L88jTs

Transcripts: https://docs.google.com/document/d/1gPxWVeS8QYNsgGpXt3EDQy5zGcCYH7hL

Chapters

00:00 Introduction: The Power of Play
00:34 Meet Yu-Kai Chou: Gamification Pioneer
04:16 Understanding the Octalysis Framework
07:34 10,000 Hours of Play: A New Perspective
09:24 Choosing Your Game: Discovering Your Life's Mission
16:49 Knowing Your Attributes: Identifying Your Strengths
22:14 Selecting Your Role: Layers of Your Role Sphere
23:12 Aspiration and Identity: Defining Who You Want to Be
24:46 Occupation and Specialization: Aligning Your Roles
26:48 The Importance of Direction and Continuous Growth
28:05 The Concept of Ikigai and Skill Enhancement
30:38 Creating a Skill Triangle and Role Models
31:39 Gamification in Cybersecurity and Beyond
32:50 The Role of Determination and Passion
37:50 Building Alliances for Success
41:27 Recap and Final Thoughts

#238 - The Impact of the Israel Iran Conflict (with Nathan Case) Jun 23, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy discusses the ongoing Israel-Iran conflict and its potential cyber implications with cybersecurity expert Nathan Case. They delve into lessons learned from the Russia-Ukraine conflict, discuss the effectiveness of cyber warfare, and evaluate Iran's cyber capabilities. The conversation also covers the ethical implications of cyber attacks, dual-use targets, and the danger of supply chain vulnerabilities. Practical advice is provided on improving cybersecurity measures, including the importance of MFA, network segmentation, and evaluating internal threats. Join us for an in-depth look at how current geopolitical tensions can impact global cybersecurity.

Nathan Case - https://www.linkedin.com/in/nathancase/

Chapters

00:00 Introduction to the Israel-Iran Conflict
00:52 Meet the Expert: Nate Case
01:51 Cyber Warfare Insights from Russia-Ukraine Conflict
03:36 The Impact of Cyber on Critical Infrastructure
08:00 Ethics and Rules of Cyber Warfare
15:01 Iran's Cyber Capabilities and Strategies
16:56 Historical Context and Modern Cyber Threats
23:28 Foreign Cyber Threats: The Iranian Example
24:06 Israel's Cyber Capabilities
25:39 The Role of Cyber Command
26:23 Challenges in Cyber Defense
27:11 The Complexity of Cyber Warfare
32:21 Ransomware and Attribution Issues
36:13 Defensive Cyber Operations
39:39 Final Thoughts and Recommendations

#237 - Build a World Class SOC (with Carson Zimmerman) Jun 16, 2025

Show notes

Join G Mark Hardy and Carson Zimmerman, the author of '11 Strategies of a World-Class Cybersecurity Operations Center,' in this insightful episode of CISO Tradecraft. Carson shares his career journey, the evolution from the 10 to 11 strategies, and delves into the future needs of Security Operations Centers (SOCs). They discuss critical topics such as the importance of continuous improvement, AI's impact on SOCs, and the value of embracing neurodiversity in cybersecurity teams. Whether you're a seasoned cybersecurity leader or an aspiring professional, get actionable advice on how to enhance and revolutionize your SOC operations.

11 Strategies of a World Class Cybersecurity Operations Center https://www.mitre.org/sites/default/files/2022-04/11-strategies-of-a-world-class-cybersecurity-operations-center.pdf

14 Questions are all you need - https://www.first.org/resources/papers/conf2024/1445-14-Questions-Carson-Zimmerman.pdf

Transcripts - https://docs.google.com/document/d/1WVJi9WkxOG7yedQYWSooiqRFjBERd9kV

Chapters