Cybersecurity Where You Are (video)

View Top 200 Chart

Back to Rankings Page

Technology
**Cybersecurity Where You Are (video)**

Welcome to video version of “Cybersecurity Where You Are,” the podcast of the Center for Internet Security® (CIS®). Cybersecurity affects us all, so join us on Wednesdays as Sean Atkinson, CISO at CIS; Tony Sager, SVP & Chief Evangelist at CIS; and Ed Skoudis, President of the SANS Technology Institute discuss trends and threats, explore security best practices, and interview experts in the industry. Together, we’ll clarify these issues, Creating Confidence in the Connected World®. Subscribe to the audio version of our podcast here: https://fast.wistia.net/embed/channel/wbyhaw35xf?wchannelid=wbyhaw35xf.

Latest Episodes:

Episode 11: Remote Attestation Helps Zero Trust Jul 16, 2021

Show notes

This week’s Cybersecurity Where You Are podcast highlights:

Automated attestation processes
Vendor attestation capabilities
Root of trust via Trusted Platform Module (TPM)
Method of verification for zero trust

Episode Resources

Visit the CIS Website
CIS Controls List
About Kathleen Moriarty, Chief Technology Officer, CIS
Related Blog on Zero Trust: Where Does Zero Trust Begin and Why is it Important?

In this edition of Cybersecurity Where You Are, host and CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes guest Kathleen Moriarty, Chief Technology Officer (CTO) at CIS. Together, the duo discuss attestation in terms of hardware and software, and the process of performing a posture assessment.

Episode 10: Hospitals in Need of Cybersecurity STAT! Jun 28, 2021

Show notes

This week’s Cybersecurity Where You Are podcast highlights:

Why the medical industry is so appealing to attackers
The challenges of protecting medical facilities
How a defense-in-depth strategy plays a role in a hospital’s cybersecurity plan
Malicious Domain Blocking and Reporting (MDBR) for hospitals

Episode Resources

In this edition of Cybersecurity Where You Are, host and CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes guests John Riggi and Ed Mattison. Riggi is the Senior Advisor for Cybersecurity for the American Hospital Association (AHA) and Mattison is the Executive Vice President of Operations and Security Services at CIS. Together they discuss how hospitals and other medical facilities can protect themselves against cyber-attacks.

Episode 9: Mitigating Risk: Information Security Governance Jun 11, 2021

Show notes

Resources:

Visit the CIS Website

Highlights:

The importance of information security governance
Security vs. compliance
Data – determining what you need and where to find it
Understanding risk from a decision-basis
Critical elements to fulfill business requirements
Producing value in a compliance program
Applying agility for continuous improvement

Good compliance = good security

Security is the practice of implementing effective technical controls to protect an organization’s digital assets. Compliance, on the other hand, is the application of that practice to meet regulatory or contractual requirements. Unfortunately, more often than not, organizations focus on compliance once a year when it’s time to certify that their “security is good.” The process of being compliant and secure should be a continuous process.

Episode 8: CIS Controls v8...First Impressions May 28, 2021

Show notes

Resources:

Highlights:

Everything has to be measurable
Everything has to be achievable
CIS Controls v8 must have a peaceful coexistence with cybersecurity frameworks
The Controls need to be backed by data and able to defend against real-world threats

First Impressions Matter

The CIS Controls team and volunteers pretty much rewrote every word of v8 in an effort to modernize and consolidate the document. CIS Controls v8 is a lot more focused and less redundant than previous versions. Find out what people are saying about this new Version!

Feedback: Request, Manage, Gather, & Use for the Greater Good

Organizations big and small rely on the CIS Controls to defend against the most prevalent cyber-attacks against systems and networks. And, they count on the Controls team to do the best job they can for the greater good of the cybersecurity community.

Episode 7: CIS Controls v8...It’s Not About the List May 14, 2021

Show notes

Resources:

In this edition of Cybersecurity Where You Are, host and CIS Senior Vice President and Chief Evangelist, Tony Sager welcomes guests Randy Marchany and Phyllis Lee. Marchany is the Chief Information Security Officer (CISO) at Virginia Tech, and Lee serves as Senior Director of the CIS Controls. The connection between the two guests is the CIS Controls – a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks.

Highlights:

History of the CIS Controls
Guiding principles for CIS Controls v8
CIS Controls ecosystem
Practical implications for the Controls and real-world applications
CIS Controls life cycle

Remember to subscribe to get the latest cybersecurity news and updates to Start Secure and Stay Secure.

Episode 6: 2020 Elections Year in Review Apr 23, 2021

Show notes

Resources:

In this edition of Cybersecurity Where You Are, host and CISO at the Center for Internet Security (CIS), Sean Atkinson welcomes guests Geoff Hale and Lew Robinson. Hale leads the Election Security Initiative at the Cybersecurity and Infrastructure Security Agency (CISA), while Robinson serves as CIS Vice President of Election Operations. Both agencies and both men, respectively, played a big role in the success of the 2020 General Election, which has been deemed the most secure election in American history.

Highlights:

Elections...A Critical Infrastructure
Strong Partnerships Make for Strong Collaborative Efforts
Technical and physical controls that contributed to the 2020 General Election being the most secure election in history
Steps taken to enhance communications and provide threat intelligence to state and local entities
Collaborative process to provide stakeholder input to influence the approach to election security
Strategies and techniques used to manage mis- and disinformation
Efforts made to assist state and local election offices with best practice guidance
Lessons learned from the 2020 General Election

Remember to subscribe to get the latest cybersecurity news and updates to Start Secure and Stay Secure.

Episode 5: The Tools of Cyber Defense...an Ongoing, Repetitive Process Apr 12, 2021

Show notes

Part 2 of a 2-part series

Resources:

Listen to Part 1
CIS website
CIS SecureSuite Tools and Resources
CIS Benchmarks
CIS Controls (v8 coming Spring 2021)
CIS CSAT (CIS Controls Self Assessment Tool)
Community Defense Model (v2 coming Spring 2021)

In this week’s Cybersecurity Where You Are podcast, hosts Tony Sager and Sean Atkinson continue their conversation on cyber defense as a risk-based process. They discuss the actions and resources that help build and implement “defensive machinery” that support an organization’s current cyber defense plan and help it mature.

Highlights:

A CISO’s First 90 days
The Importance of a Strong Foundation
Knowing Your Lineage
Mapping to Regulatory Frameworks
Tools: From Spreadsheets to CIS CSAT
Sharing with the Group

Remember to subscribe to get the latest cybersecurity news and updates to Start Secure and Stay Secure.

Episode 4: Dynamics of Cyber Defense...an Ongoing, Repetitive Process Mar 26, 2021

Show notes

Episode Resources:

Blog: Assess, Remediate, and Implement with CIS SecureSuite: https://www.cisecurity.org/blog/assess-remediate-and-implement-with-cis-securesuite/
Free Webinar: CIS Benchmarks and CIS-CAT Pro Tool Demo: https://www.cisecurity.org/webinar/cis-benchmarks-demo/

Part 1 of a 2-part series

Technology is ever-changing AND ever-evolving, creating an uncertainty amongst cybersecurity professionals – the defenders – in their pursuit of an effective cyber defense strategy. The uncertainty of the defender can justifiably be attributed to the uncertainty of the attacker. In this week’s Cybersecurity Where You Are podcast, hosts Tony Sager and Sean Atkinson introduce cyber defense as a risk-based process to reduce the overall probability and impact that a cyber-attack will have on an organization.

Cyber defense never ends

Cyber defense refers to the ability to prevent cyber-attacks from infecting a computer system or device; it involves anticipating adversarial cyber actions and countering intrusions. There’s no “one-size-fits-all” when it comes to cyber defense protocol or strategy. However, a good cyber defense strategy should aim to protect, prevent, detect, respond to, and recover from external and internal attacks. As technology expands, the complexity of cyber-attacks also evolves, forcing cyber defense initiatives and defenders of such, to do whatever they can to keep up.

OODA loop process

The OODA (Observe, Orient, Decide, Act) loop is a repetitive four-step decision-making process that focuses on gathering information, putting that information into context, making the most appropriate decision while also understanding that changes can be made as more data becomes available, and then taking action. The OODA loop is especially applicable to cybersecurity and cyber defense where agility and repetition (by the defender) potentially overcomes that of the attacker.

Fog of More

While cyber defense is an abstract model, cybersecurity defenders have to actually do concrete things. It initially comes down to having a plan in place and asking the right questions: What data do we have? Where is it? What do we do with it?

Asking the right questions (for clarity) eliminates the Fog of More (coined by Tony Sager, of all people) – the overload of defensive support (i.e., more options, more tools, more knowledge, more advice, and more requirements, but not always more security).

An effective cyber defense program requires defenders to gather information and data, put that data into context, make decisions, take action, and then REPEAT, REPEAT, REPEAT.

Episode 3: Third-party Risk Management – Beyond the Questionnaire Mar 12, 2021

Show notes

Resources:

Find us at https://www.cisecurity.org/
Third-party Risk Association: https://www.tprassociation.org/
National Institute of Standards and Technology (NIST): https://www.nist.gov/
CIS Controls: https://www.cisecurity.org/controls/

Can a risk assessment questionnaire be the catalyst for true change to the entire vendor cybersecurity ecosystem? Cybersecurity Where You Are podcast host Sean Atkinson welcomes guest Ryan Spelman, former CIS employee, and now Managing Director at Duff & Phelps on their CYBERCLARITY360 team. Together, Sean and Ryan discuss tactics companies can use to better understand their cyber-risk posture and how stronger relationships between companies and their third parties impact the industry as a whole.

Better use of the third-party risk assessment questionnaire

The go-to “third-party risk assessment questionnaire” being used as a one-and-done exercise is an all too common practice. While completing these questionnaires meets certain regulatory requirements, truly managing risk is about acting on the data collected - not just collecting it.

There is a misconception that the questionnaire is for general information collection and that the same questions can apply to all vendors. Some questions, such as those about overseas relations or services, may be applicable to all vendors. But to more accurately assess a third party’s risk it is important to customize the questions to match the vendor's use case and scope.

This episode shares how an organization can start drafting these inquiries.

Once the questionnaire is crafted, completed, and returned, a plan should also be in place for how to address the issues that arise from the submitted answers.

Beyond the questionnaire – communication is key

The issue of third-party management rests in the hands of both the company and the vendor. Clear, accurate, and truthful communication between both parties makes both entities ultimately stronger.

Building a stronger security ecosystem

This is an “area where the common good can happen,” says Ryan. If a company can make the third party’s security posture better, then everyone else who uses this third party is made better. It ultimately makes a measurable difference in the entire vendor ecosystem.

The Atkinson 9

In the vein of another famous interviewer, Sean asked Ryan his “Atkinson 9,” a quick Q&A about security. Listen now to find out what our guest said!

Episode 2: Trends: Then, Now, and Into the Future Mar 05, 2021

Show notes

Resources

Find us at https://www.cisecurity.org/
Blog: 2021 Cybersecurity Trends to Prepare For: https://www.cisecurity.org/blog/2021-cybersecurity-trends-to-prepare-for/
Blog: Where Does Zero Trust Begin and Why is it Important?: https://www.cisecurity.org/blog/where-does-zero-trust-begin-and-why-is-it-important/
CIS Controls: https://www.cisecurity.org/controls/
Cybercrime Support Network (CSN: https://cybercrimesupport.org/

2020 was considered “the year like no other”. The industry saw a mass convergence of social issues with cyber issues due to the pandemic, the elections, and the SolarWinds supply chain issue. Cybersecurity resilience was tested and it was crucial that the industry adapt quickly.

With the onset of the COVID-19 pandemic in March of 2020 many organizations went fully remote, including CIS. CIS had to be agile and the cybersecurity industry had to adapt to new challenges with a growing remote workforce.

The Trends

Risk management strategies such as ways to identify gaps, how to best implement the CIS Controls, data management, and privacy requirements were the foundations for crisis management.

Ransomware is here to stay as a top cyber threat. It moved from the lone hacker to a capitalist business structure where the software just needs to be purchased and used as opposed to needing to build it yourself.

Zero Trust: Sean uses the analogy of “the castle and the moat”. Today the drawbridge is always open and things are going in and out without the ability to monitor it all. Zero Trust is setting the new tone for security practices.

What the Future (May) Hold

Small Businesses need support: The weight of responsibility to small businesses to accommodate the assessment evaluations for risk management is a huge burden.

A Diminishing Cyber Workforce: There is a growing concern about the shortage of cybersecurity professionals.

The Role of Government: With the change in government, like we have in 2021, there is a change in the way government thinks about priorities.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cybersecurity Where You Are (video)

Related Podcasts

Links

Stay Connected