CISO Tradecraft®

*/ ?>

Latest Episodes:

#226 - Vulnerability Management (with Chris Hughes) Mar 31, 2025

Show notes

In this episode of CISO Tradecraft, we host Chris Hughes, CEO of Aquia, cybersecurity consultant, and author. Chris shares insights on the evolving landscape of cybersecurity, discussing software supply chain threats, vulnerability management, relationships between security and development, and the future impacts of AI. Tune in to gain expert advice on becoming an effective cybersecurity leader.

Chris Hughes - https://www.linkedin.com/in/resilientcyber/

Transcripts: https://docs.google.com/document/d/1j5ernS0Gk3LH-qcjhi6gOfojBqQljGhi

Chapters

00:00 Introduction and Special Guest Announcement
00:55 Chris Hughes' Background and Career Journey
02:46 Government and Industry Engagement
03:42 Supply Chain Security Challenges
07:34 Vulnerability Management Insights
12:13 Navigating the Overwhelming Vulnerability Landscape
22:19 Building Positive Relationships in Cybersecurity
23:41 Empowering Risk-Informed Decisions
24:29 Aligning with Organizational Risk Appetite
25:33 Navigating Job Changes and Organizational Fit
26:32 The Role of Compliance in Security
33:27 The Impact of AI on Security
43:05 Balancing Build vs. Buy Decisions
45:05 Conclusion and Final Thoughts

#225 - The Full Irish Mar 24, 2025

Show notes

In this episode of CSO Tradecraft, host G. Mark Hardy introduces 'The Full Irish,' a cybersecurity framework based on the '12 Steps to Cybersecurity' guidance from Ireland's National Cybersecurity Center. The episode covers comprehensive steps from governance and risk management to incident response and resilience, making it a valuable resource for cybersecurity professionals. G Mark also discusses the implications of multinational companies operating in Ireland, including tax strategies and notable GDPR fines. The episode provides pragmatic guidance and actionable insights to enhance your cybersecurity program.

References: https://www.ncsc.gov.ie/pdfs/Cybersecurity_12_steps.pdf

Transcripts: https://docs.google.com/document/d/1VLeRozClLZAkZsusYsUn4Q9_1v7WCoN0

Chapters

00:00 Introduction to the Full Irish
01:32 Why Ireland?
02:40 Tax Avoidance Schemes
04:25 GDPR Penalties and Data Protection
05:54 Overview of the 12 Steps to Cybersecurity
07:19 Step 1: Governance and Organization
09:24 Step 2: Identify What Matters Most
10:31 Step 3: Understanding the Threats
12:35 Step 4: Defining Risk Appetite
14:10 Step 5: Education and Awareness
16:00 Step 6: Implement Basic Protections
18:00 Step 7: Detect and Attack
19:37 Step 8: Be Prepared to React
21:24 Step 9: Risk-Based Approach to Resilience
22:52 Step 10: Automated Protections
23:58 Step 11: Challenge and Test Regularly
25:29 Step 12: Cyber Risk Management Lifecycle
26:29 Conclusion and Final Thoughts

#224 - The Evolution of Data Loss Prevention (DLP) Mar 17, 2025

Show notes

In this episode of CISO Tradecraft, host G. Mark Hardy dives into the evolution, challenges, and solutions of Data Loss Prevention (DLP). From early methods like 'dirty word lists' in the military to advanced AI and machine learning models of today, discover how DLP technologies have developed to safeguard sensitive information. Learn about different DLP phases, regulatory impacts, and modern tools like Microsoft Purview that can help manage and classify data effectively. This episode is packed with valuable insights to help you tackle data security with confidence and efficiency.

Transcripts

https://docs.google.com/document/d/1u7owNI5P3WajJvRPIXbzrUYy-PCsRcfC

References

Crash course in Microsoft Purview: A guide to securing and managing your data estate

Chapters

00:00 Introduction to Data Loss Prevention (DLP)
00:45 Early Days of DLP: Dirty Word Lists and Simple Networks
02:39 Evolution of DLP: Content Filtering and Endpoint Protection
06:05 Advanced Content Inspection and Policy Enforcement
09:19 Unified DLP and Cloud Adoption
16:04 Modern DLP: AI, Machine Learning, and Zero Trust
19:12 Implementing DLP with Microsoft Purview
28:59 Summary and Final Thoughts

#223 - A CISO Primer on Agentic AI Mar 10, 2025

Show notes

In this episode of CISO Tradecraft, G. Mark Hardy dives deep into the world of Agentic AI and its impact on cybersecurity. The discussion covers the definition and characteristics of Agentic AI, as well as expert insights on its feasibility. Learn about its primary functions—perception, cognition, and action—and explore practical cybersecurity applications. Discover the rapid advancements made by tech giants and potential risks involved. This episode is a comprehensive guide to understanding and securely implementing Agentic AI in your enterprise.

Transcripts https://docs.google.com/document/d/1tIv2NKX0DL4NTnvqKV9rKrgrewa68m3W

References

Vladimir Putin - https://www.rt.com/news/401731-ai-rule-world-putin/
Minds and Machines - https://link.springer.com/article/10.1007/s44163-024-00216-2
Anthropic - https://www.cnbc.com/2024/10/22/anthropic-announces-ai-agents-for-complex-tasks-racing-openai.html
Convergence AI - https://convergence.ai/training-web-agents-with-web-world-models-dec-2024/
OpenAI Operator - https://openai.com/index/introducing-operator/
ByteDance UITARS - https://venturebeat.com/ai/bytedances-ui-tars-can-take-over-your-computer-outperforms-gpt-4o-and-claude/
Zapier - https://www.linkedin.com/pulse/openai-bytedance-zapier-launch-ai-agents-getcoai-l6blf/
Microsoft OmniParser - https://www.microsoft.com/en-us/research/articles/omniparser-v2-turning-any-llm-into-a-computer-use-agent/
Google Project Mariner - https://deepmind.google/technologies/project-mariner/
Rajeev Sharma - Agentic AI Architecture - https://markovate.com/blog/agentic-ai-architecture/
NIST.AI.600-1 - https://doi.org/10.6028/NIST.AI.600-1
Mitre ATLAS - https://atlas.mitre.org/
OWASP Top 10 for LLMs - https://owasp.org/www-project-top-10-for-large-language-model-applications/
ISO 42001 - https://www.iso.org/standard/81230.html

Chapters

00:00 Introduction and Intriguing Quote
01:10 Defining Agentic AI
02:01 Expert Insights on Agency
04:32 Agentic AI in Practice
06:54 Recent Developments in Agentic AI
08:20 Deep Dive into Agentic AI Infrastructure
15:35 Use Cases for Agentic AI

#222 - 40 Years of Career Advice in 40 Minutes Mar 03, 2025

Show notes

In this episode of CISO Tradecraft, G. Mark Hardy shares 15 crucial characteristics to help you succeed in your cybersecurity career and become an effective CISO. From knowing yourself and developing leadership skills to enhancing communications and staying current with trends, Hardy distills decades of wisdom into practical advice. Learn how to navigate career transitions, build technical credibility, become an effective storyteller, and master political skills essential for C-level success.

Transcripts: https://docs.google.com/document/d/1MpjXD8LqnHS_Lj1S-6T7vxcclxzUjEhe

Chapters

01:30 Know Yourself: The First Step to Success
05:23 Develop Your Leadership Skills
07:09 Enhance Your Communication Skills
11:37 Gain Broad Experience
14:28 Pursue Advanced Education
18:13 Network with Other Professionals
20:47 The Importance of Mentorship
22:20 Building Valuable Connections
23:43 Aligning with Business Goals
25:38 Deepening Technical Expertise
26:59 Staying Current with Trends
28:03 Promoting a Security-First Culture
30:18 Addressing Skills Gaps
31:53 Becoming a Master Storyteller
33:35 Engaging with Executives
34:41 Strategic Thinking and Time Management
37:27 Mastering Political Skills
39:14 Conclusion and Final Thoughts

#221 - Microsoft Majorana is Taking the Quantum Leap Feb 24, 2025

Show notes

In this episode of CISO Tradecraft, host G Mark Hardy discusses Microsoft's groundbreaking announcement of their new quantum chip, the Majorana. The chip harnesses properties of a topological superconductor, making quantum computing promises more tangible. The episode delves into the technical aspects of quantum bits (qubits), cryptography, and the implications of topological quantum computing. With insights on competitor advancements by Google and potential challenges, this episode provides a comprehensive overview of quantum computing's future and its cyber security implications.

Transcripts: https://docs.google.com/document/d/1O2XG47o2_6jHBtPKL2PcwGRKPe69wFvi

Link: https://azure.microsoft.com/en-us/blog/quantum/2025/02/19/microsoft-unveils-majorana-1-the-worlds-first-quantum-processor-powered-by-topological-qubits/

Chapters

00:00 Introduction to CISO Tradecraft
00:26 Microsoft's Quantum Chip Announcement
01:51 Understanding Quantum Bits
03:23 Quantum Computing and Cryptography
06:00 Microsoft's Quantum Leap
09:41 The Physics Behind Quantum Computing
16:48 Majorana Particle and Its Significance
20:29 Applications and Future of Quantum Computing
25:01 Conclusion and Final Thoughts

#220 - Executive Updates to AI Feb 17, 2025

Show notes

In this CISO Tradecraft episode, host G. Mark Hardy delves into the recent U.S. presidential executive orders impacting AI and their implications for cybersecurity professionals. Learn about the evolution of AI policies from various administrations and how they influence national security, innovation, and the strategic decisions of CISOs. Discover key directives, deregulatory moves, and practical steps you can take to secure your AI systems in an era marked by rapidly changing regulations. Plus, explore the benefits of using AI tools like ZeroPath to bolster your cybersecurity efforts.

Big Thanks to our Sponsors: ZeroPath - https://zeropath.com/

Transcripts: https://docs.google.com/document/d/1Nv27tpDQs2fjdOedJOi0LhlkyQ5N5dKt

Links:

Chapters

00:00 Introduction to AI Policy Shifts
00:23 AI Tool for Cybersecurity: ZeroPath
01:12 Understanding Executive Orders

#219 - The Professionalization of CISOs (with Steve Zalewski & Tyson Kopczynski) Feb 10, 2025

Show notes

This podcast episode discusses the formation of a professional association for CISOs, driven by increasing personal liability risks faced by these executives. The conversation centers on establishing a formal definition and accreditation process for the CISO role, moving beyond existing certifications to demonstrate operational and theoretical expertise. This professionalization effort aims to reduce personal liability through a tailored insurance product, negotiated collectively by the association, and preempt potentially ill-defined government regulations. Ultimately, the goal is to create a structured, respected profession for CISOs, offering benefits such as insurance, professional development, and a unified voice within the industry.

Professional Association of CISOs - https://theciso.org/

Transcripts - https://docs.google.com/document/d/1BNeUzSyPYX-vAYwQl9qCi0GhknYhKnWF/

Chapters

00:00 Introduction to Professionalizing the CISO Role
00:52 The Genesis of a Professional Association
03:39 Challenges and Legal Liabilities for CISOs
04:43 The Value of Joining the Association
06:24 Accreditation and Certification Process
10:38 Insurance and Risk Management for CISOs
18:45 Future Directions and Getting Involved

#218 - How AI Changes Talent Management (with Colleen Lennox) Feb 03, 2025

Show notes

In this episode of CISO Tradecraft, host G. Mark Hardy and special guest Colleen Lennox dive into the transformative power of AI in HR. Discover how AI can revolutionize identifying, attracting, and retaining cybersecurity talent. They discuss the challenges of finding the right personnel in the cybersecurity field, the innovative AI-driven solutions that can streamline recruitment processes, and how these tools can help in talent management and career progression. Stay tuned as they explore the potential of AI in creating a more effective and bias-free hiring process, while also discussing the future implications for HR and recruiters in the evolving landscape. Big Thanks to our

Sponsors: CruiseCon - Use code CISOTRADECRAFT10 at https://cruisecon.com/ for 10% off registration!

Transcripts: https://docs.google.com/document/d/1f6B9Ye02WHWo7q15avBm0359pxGNqnVu

Chapters

00:00 Introduction: AI and Workforce Concerns
00:28 Welcome to CISO Tradecraft
01:01 Meet Colleen Lennox: AI in HR
01:27 Challenges in Cybersecurity Recruitment
03:11 AI-Powered Recruitment Solutions
07:07 Improving Talent Management with AI
13:36 Addressing Bias in AI Recruitment
17:20 Future of AI in HR and Recruitment
21:04 Conclusion and Contact Information

#217 - Includes No Dirt (with Bill Dougherty) Jan 27, 2025

Show notes

In this episode of CISO Tradecraft, host G. Mark Hardy sits down with Bill Dougherty, CISO of Omada Health, to discuss a groundbreaking threat model called 'Includes No Dirt'. This comprehensive model integrates security, privacy, and compliance considerations, aiming to streamline and enhance threat modeling processes. The conversation covers the origin and principles of the model, its applicability across different sectors, and the essential aspects of threat modeling. Listeners are also treated to insights on handling third-party risks and adapting to emerging AI challenges. The episode provides practical advice for cybersecurity leaders looking to effectively manage and mitigate risks while reducing redundancy.

Big Thanks to our Sponsors:

ZeroPath - https://zeropath.com/

CruiseCon - Use code CISOTRADECRAFT10 at https://cruisecon.com/ for 10% off registration!

The No DIRT Threat Model can be found here: http://www.includesnodirt.com/nodirt.pdf

Transcripts: https://docs.google.com/document/d/1vWq4Zx7pzM_B65W933m8_TE0fLKaUw3X

Chapters