CISO Tradecraft®

*/ ?>

Latest Episodes:

#236 - Build a World Class GRC Program (with Matt Hillary) Jun 09, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy sits down with Matt Hillary, the Chief Information Security Officer of Drata, to discuss governance, risk, and compliance (GRC) and trust management. They explore key topics such as the evolution of GRC, trust management, compliance automation, and the advent of AI in compliance processes. Matt shares insights on building a world-class GRC program, the challenges and opportunities in modern-day compliance, and the mental health aspects of being a cybersecurity leader. This episode is a must-watch for any cybersecurity professional looking to enhance their GRC strategies and compliance operations.

Big Thanks to our Sponsor Drata. You can learn more about them at https://drata.com/

Connect with Matt Hillary at https://www.linkedin.com/in/matthewhillary/

Transcripts - https://docs.google.com/document/d/1VzRQSEvgUwenDERlNn2bwlIpnz4QPQ15/

Chapters

01:39 Meet Matt Hillary: CISO of Drata
06:06 The Evolution of GRC and Trust Management
14:48 Continuous Compliance and Automation
19:26 Compliance as Code: The Future of GRC
22:18 The Importance of Getting It Right the First Time
23:15 Customer Compliance Challenges
24:21 Vendor Risk Management and Trust Building
26:26 Leveraging AI for Compliance and Risk Management
31:43 Evaluating Credibility of Third-Party Evidence
41:09 Common Mistakes in GRC Programs
43:56 Final Thoughts and Industry Call to Action

#235 - Grey is the New Black (with Ryan Gooler) Jun 02, 2025

Show notes

Join G Mark Hardy at THOTCON in Chicago for an insightful podcast episode on building a successful cybersecurity career. Featuring guest Ryan Gooler, they discuss the non-linear paths to success, the value of mentorship, financial planning, and the importance of continuous learning and adapting. Learn how to navigate career transitions, embrace risks, and find joy in teaching and learning from others in the cybersecurity community.

Transcripts: https://docs.google.com/document/d/1nsd61mkIWbmIL1qube0-cdqINsDujAVH

Chapters

00:00 Welcome to THOTCON: Meeting Amazing People
00:26 Introducing Ryan Gooler: A Journey into Cybersecurity
04:09 The Value of Mentorship in Cybersecurity
06:22 Career Management and Setting Goals
09:33 Financial Planning for Cybersecurity Professionals
16:40 Automating Finances and Smart Spending
21:25 Financial Sophistication and Mutual Funds
22:07 Automating Life Tasks
22:41 The Concept of a Finishing Stamp
24:17 Leadership and Delegation in the Navy
26:06 Building and Maintaining Culture
27:21 Surviving Toxic Environments
29:55 Taking Risks and Finding Joy
34:34 Advice for Cybersecurity Careers
39:01 The Importance of Teaching and Learning
40:29 Conclusion and Farewell

#234 - Model Context Protocol (MCP) May 26, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy delves into the emerging concept of Model Context Protocol (MCP) and its significance in AI and enterprise security. Launched by Anthropic in November 2024, MCP is designed to standardize how AI systems interact with external data sources and applications. Hardy explores how MCP differs from traditional APIs, its implications for security, and the steps organizations need to take to prepare for its adoption. Key topics include the stateful nature of MCP, security risks such as prompt injection and tool poisoning, and the importance of developing a robust governance framework. By the end of the episode, listeners will have a comprehensive understanding of MCP and practical recommendations for safeguarding their AI-driven workflows.

Transcripts https://docs.google.com/document/d/1vyfFJgTbsH73CcQhtBBkOfDoTrJYqzl_

References

Model Context Protocol specification and security best practices, https://modelcontextprotocol.io ⁠

Security risks of MCP, https://pillar.security ⁠ ⁠

MCP security considerations, https://writer.com

Chapters

00:00 Introduction to Model Context Protocol (MCP)
00:27 Understanding MCP and Its Importance
01:41 How MCP Works and Its Security Implications
04:23 Comparing MCP to Traditional APIs
08:41 MCP Architecture and Security Benefits
12:07 Top Security Risks of MCP
18:00 Implementing Security Controls for MCP
25:00 Governance Framework for MCP
28:03 Future Trends and Strategic Recommendations
30:34 Conclusion and Next Steps

#233 - Web 3.0 Explained (with Aaron Markell) May 19, 2025

Show notes

Web 3.0 Explained: Business Cases, Security, and Future Prospects | CISO Tradecraft In this episode of CISO Tradecraft, host G Mark Hardy welcomes special guest Aaron Markell to discuss the intricacies of Web 3.0. They explore the evolution from Web 1.0 and Web 2.0 to the decentralized structure of Web 3.0, describing its application in various industries like finance, healthcare, and supply chain. The conversation dives into blockchain technology, the role of tokens, smart contracts, and consensus mechanisms like proof of work and proof of stake. They also touch on potential future developments involving AI in Web 3.0, offering valuable insights for business leaders and cybersecurity professionals looking to understand and leverage this emerging technology.

Chapters

00:00 Introduction to Web 3.0
00:31 Meet the Expert: Aaron Markell
01:39 Aaron's Journey into Web 3.0
03:51 Understanding Web 1.0, 2.0, and 3.0
04:36 Decentralization and Blockchain Basics
05:51 The SETI Project and Distributed Workloads
08:09 Proof of Work and Blockchain Security
17:22 Smart Contracts Explained
20:10 Proof of Stake vs. Proof of Work
23:51 The Role of Tokens in Web 3.0
24:22 Understanding Microtransactions and Ownership
25:05 What is an NFT?
26:40 The Rise and Fall of NFTs
28:36 Web 3.0 and Its Impact on Industries
30:10 Blockchain in Finance and Commerce
30:55 Private Blockchains and Government Transparency
34:09 Blockchain in Legal and Healthcare Sectors
36:59 Supply Chain Transformation with Web 3.0
39:59 The Future of Web 3.0 and AI Integration
41:03 Final Thoughts and Security Tips

#232 - Inside The 2025 Verizon Data Breach Investigations Report May 12, 2025

Show notes

Join G Mark Hardy, host of CISO Tradecraft, as he breaks down the latest insights from the 2025 Verizon Data Breach Investigations Report (DBIR). In this episode, discover the top 10 takeaways for cybersecurity leaders including the surge in third-party breaches, the persistence of ransomware, and the human factors in security incidents. Learn actionable strategies to enhance your organization's security posture, from improving vendor risk management to understanding industry-specific threats. Stay ahead of cybercriminals and secure your data with practical, data-driven advice straight from one of the industry's most anticipated reports.

Verizon DBIR - https://www.verizon.com/business/resources/reports/dbir/

Transcripts - https://docs.google.com/document/d/1h_YMpJvhAMB9wRyx92WkPYiKpFYyW2qz

Chapters

00:35 Verizon Data Breach Investigations Report (DBIR) Introduction
01:16 Accessing the DBIR Report
02:38 Key Takeaways from the DBIR
03:15 Third-Party Breaches
04:32 Ransomware Insights
08:08 Exploitation of Vulnerabilities
09:39 Credential Abuse
12:25 Espionage Attacks
14:04 System Intrusions in APAC
15:04 Business Email Compromise (BEC)
18:07 Human Risk and Security Awareness
19:19 Industry-Specific Trends
20:06 Multi-Layered Defense Strategy
21:08 Data Leakage to Gen AI

#231 - Tackle Your Technical Debt May 05, 2025

Show notes

Join G Mark Hardy in this eye-opening episode of CISO Tradecraft as he shares a personal story about his dog Shelby's near-fatal experience and the costly lesson it taught him about technical debt. Discover how small overlooked issues in cybersecurity can compound and lead to significant risks and learn actionable steps to tackle technical debt before it turns into a crisis.

Pictures of Dog https://drive.google.com/file/d/1nBc9e3bBJVW0BQt5inGryhP3ahBz4XsQ/view?usp=drive_link https://drive.google.com/file/d/12V_DuwhgNBKgxJL0yqNq9Fopa4dauJfd/view?usp=drive_link

Transcripts https://docs.google.com/document/d/1-_X_9RQrurOLKRvbXyMjgbygESsabcCK

Chapters

00:21 Welcome to CISO Tradecraft
00:36 RSAC 2025 Conference Experience
01:22 Shelby's Health Scare
02:08 Understanding Technical Debt
02:41 The Consequences of Technical Debt
04:09 Shelby's Story as a Technical Debt Analogy
09:28 Lessons Learned from Shelby's Story
13:09 Conclusion and Call to Action

#230 - How To Make Your AI Less Chatty (with Sounil Yu) Apr 28, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy and guest Sounil Yu delve into the dual-edged sword of implementing Microsoft 365 Copilot in enterprises. While this productivity tool has transformative potential, it introduces significant oversharing risks that can be mitigated with the right strategies. Discover how Sounil and his team at Knostic have been tackling these challenges for over a year, presenting innovative solutions to ensure both productivity and security. They discuss the importance of 'need to know' principles and knowledge segmentation, providing insight into how organizations can harness the power of Microsoft 365 Copilot safely and effectively. Tune in to learn how to avoid becoming the 'department of no' and start being the 'department of know.'

Transcripts https://docs.google.com/document/d/1CT9HXdDmKojuXzWTbNYUE4Kgp_D64GyB

Knostic's Website - https://www.knostic.ai/solution-brief-request

Chapters

00:00 Introduction to Microsoft Copilot Risks
00:32 Meet the Guest: Sounil Yu
02:51 Understanding Microsoft 365 Copilot
06:09 The DIKW Pyramid and Knowledge Management
08:34 Challenges of Data Permissions and Oversharing
19:01 Need to Know: A New Approach to Access Control
35:10 Measuring and Mitigating Risks with Copilot
39:46 Conclusion and Next Steps

#229 - Understanding the Critical Role of CVEs and CVSS Apr 21, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy delves into the crucial topic of Common Vulnerabilities and Exposures (CVE) and the Common Vulnerability Scoring System (CVSS). Learn about the history, structure, and significance of the CVE database, the recent funding crisis, and what it means for the future of cybersecurity. We also explore the intricacies of CVE scoring and how it aids in prioritizing vulnerabilities. Tune in to understand how as a CISO, you can better prepare your organization against cyber threats and manage vulnerabilities efficiently.

Transcripts: https://docs.google.com/document/d/13VzyzG5uUVLGVhPA5Ws0UFbHPnfHbsII

Chapters

00:00 Introduction to CVE and CVSS
01:13 History of Vulnerability Tracking
03:07 The CVE System Explained
06:47 Understanding CVSS Scoring
13:11 Recent Funding Crisis and Its Impact
15:53 Future of the CVE Program
18:27 Conclusion and Final Thoughts

#228 - CIS CSAT (with Scott Gicking) Apr 14, 2025

Show notes

Join host G Mark Hardy on CISO Tradecraft as he welcomes expert Scott Gicking to discuss the Center for Internet Security's (CIS) Controls Self-Assessment Tool (CSAT). Learn what CSAT is, how to effectively use it, and how it can enhance your career in cybersecurity. Stay tuned for insights on creating effective security frameworks, measuring maturity, and improving organizational security posture using the CSAT tool.

Scott Gicking - https://www.linkedin.com/in/scottgickingus/

CIS CSAT - https://www.cisecurity.org/controls/cis-controls-self-assessment-tool-cis-csat

Transcripts: https://docs.google.com/document/d/1WAI9U0WEUSJH1ZVWM1HdtFEf-O9hLJBe

Chapters

01:16 Guest Introduction: Scott Gicking
02:49 Scott's Career Journey
04:03 The Hollywood Cybersecurity Incident
07:38 Introduction to CIS and Its Importance
09:49 Understanding the CIS CSAT Tool
10:13 Implementing CIS CSAT in a Real-World Scenario
13:00 Benefits of the CIS CSAT Tool
18:38 Developing a Three-Year Roadmap with CSAT
23:25 Scoring Policies and Controls
24:20 Control Implementation and Automation
25:22 CMMC Certification Levels
27:52 Honest Self-Assessment
30:01 Quick and Dirty Assessment Approach
33:07 Building Trust and Reporting
37:38 Business Impact Analysis Tool
40:02 Reputational Damage and CISO Challenges
42:55 Final Thoughts and Contact Information

#227 - The 30 Year CISO Evolution Apr 07, 2025

Show notes

Ever wonder how the CISO role went from obscure techie to boardroom MVP? In this episode of CISO Tradecraft, G Mark Hardy takes you on a journey through the evolution of the Chief Information Security Officer — from Steve Katz's groundbreaking appointment at Citibank in 1995 to the high-stakes, high-impact role CISOs play today.

Transcripts: https://docs.google.com/document/d/1FlKBW6zlVBqLoSTQMGZIfz--ZLD_aS9t/edit

Chapters

00:00 Introduction to the Evolution of the CISO Role
00:58 The First CISO: Steve Katz's Pioneering Journey
03:58 Rise of Security Certifications
08:39 Regulatory Wake-Up Calls and Compliance
12:23 Cybersecurity in the Age of State-Sponsored Attacks
17:58 The Impact of Major Cyber Incidents
25:07 Modern Challenges and the Future of the CISO Role
27:51 Conclusion and Final Thoughts

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected