Cybersecurity Where You Are (video)

Latest Episodes:

Episode 141: A Human-Centered Take on Password Policies Jun 25, 2025

Show notes

In episode 141 of Cybersecurity Where You Are, Tony Sager is joined by Phyllis Lee, VP of SBP Content Development at the Center for Internet Security®(CIS®); and Julie Haney, Computer Scientist & Human-Centered Cybersecurity Researcher at the National Institute of Standards and Technology (NIST). Together, they use a human-centered understanding of security to discuss password policies, including their benefits, drawbacks, and efficacy. Here are some highlights from our episode:

01:03. Introductions to Phyllis and Julie
03:34. How "human-centered cybersecurity" goes beyond just usability
05:35. The use of NIST and other authoritative sources to dispel confusion in cybersecurity
09:09. How password policies positively and negatively impact human behavior
15:06. Three anecdotes that showcase the importance of context when enacting security policy
21:49. The process of using NIST SP 800-63 to recommend password security best practices
27:11. Our changing understanding of "the human element"
29:23. The need to do cybersecurity awareness training "right" and measure its effectiveness
31:30. Recognition of the absence of natural systems thinking in cybersecurity
33:14. Psychological safety, feedback, and trust as foundations of security culture
39:03. Human touchpoints as a starting point to help usability and security work together

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 140: Threat-Informed Travel Safety Tips Jun 18, 2025

Show notes

In episode 140 of Cybersecurity Where You Are, Sean Atkinson is joined by John Cohen, Executive Director of the Program for Countering Hybrid Threats at the Center for Internet Security®(CIS®). Together, they discuss travel safety tips informed by today's evolving multidimensional threat environment. Here are some highlights from our episode:

01:30. The most overlooked security risks we need to take seriously whenever we travel
03:42. How threat actors can exploit our tendency to overshare online
07:25. Top security practices you can use to safely plan your next trip
12:28. The value of playing out your travels' worst-case scenario before you leave
16:02. The benefits and drawbacks of using electronic navigations systems while traveling
18:00. Videos as a means of attuning to the "flow" of a different place and/or culture
24:10. Which types of people make attractive targets for foreign intelligence services
25:05. Honeypot operations in the physical and digital worlds
27:24. Opportunities to protect the technology on which we rely

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 139: Community Building for the Cyber-Underserved Jun 11, 2025

Show notes

In episode 139 of Cybersecurity Where You Are, Tony Sager is joined by Amelia Gifford, Sr. Manager, Administration, at the Center for Internet Security®(CIS®); and George Bailey, Director of Purdue cyberTAP. Together, they discuss how the 2025 grant from the Alan Paller Laureate Program will support Purdue cyberTAP's mission of community building for the cyber-underserved. Here are some highlights from our episode:

01:02. Honoring a legacy of making cybersecurity practical and accessible
03:34. The business of giving products away to benefit the cybersecurity community
05:00. The use of the CIS Critical Security Controls (CIS Controls) to help rural electricity cooperatives in Indiana
11:00. Methodology, tooling, and repeatability as part of a lifecycle of realizing a good idea
11:56. Cross-Mapping as a means to help people live with so many security frameworks
12:59. Accountability and re-assessment as methods for measuring program success
14:59. The power of community in prioritizing the CIS Controls
16:38. Community building as a way to navigate the cybersecurity business together
17:42. A controlled Controls experiment to generate data, learn lessons, and create feedback
19:03. Progress reporting as a way to foster connections
24:39. Feedback on the Alan Paller Laureate Program application process
26:30. Focus on cybersecurity community impact as a consideration for future applicants
30:31. Parting thoughts about the grant program and an invitation to reach out to George

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 138: The Use of GenAI to Refine Your TTX Development Jun 04, 2025

Show notes

In episode 138 of Cybersecurity Where You Are, Sean Atkinson is joined by Timothy Davis, Lead Cyber Threat Intelligence (CTI) Analyst at the Center for Internet Security®(CIS®). Together, they discuss how organizations can use Generative Artificial Intelligence (GenAI) to refine how they develop Tabletop Exercises (TTXs). Here are some highlights from our episode:

01:49. Why TTXs function as a "blue sky" opportunity for crisis management and preparedness
04:33. A quick recap of how GenAI stands apart from traditional AI
06:19. The direct relationship between input and output when measuring GenAI content quality
07:36. TTXs as a use case for GenAI to help the "cyber-underserved"
10:14. How GenAI can quickly customize TTXs for different organizations and threat models
13:56. The use of GenAI to improve TTX facilitation, regularity, and cost
17:22. GenAI as an inspiration to act on the findings of a simulation
18:26. Risks and ethical concerns to keep in mind for GenAI-enhanced TTX development
24:46. Where humans can still play a part in augmented exercises
30:08. Closing thoughts about the future of GenAI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 137: National Cybersecurity Through SLTT Resilience May 28, 2025

Show notes

In episode 137 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Terry Loftus, Assistant Superintendent (Chief Information Officer) of Integrated Technology Services at the San Diego County Office of Education (SDCOE); and Netta Squires, President of Government Affairs, Cybersecurity, & Resilience at Open District Solutions (ODS). Together, they discuss how the Multi-State Information Sharing and Analysis Center® (MS-ISAC®) functions as a space for U.S. State, Local, Tribal, and Territorial (SLTT) entities to collectively strengthen their cyber resilience in support of U.S. national cybersecurity. Here are some highlights from our episode:

01:15. A study to understand the cybersecurity perspectives of the MS-ISAC community
03:24. The need for sustained cyber defense accelerators to drive U.S. SLTT resilience
07:31. How surveys and focus groups uncovered U.S. SLTT cybersecurity funding, staffing, and governance challenges
13:06. The superpower of cyber threat intelligence driven, tailored, and provided via community
17:41. Trust as a foundation for building relationships among MS-ISAC members and partners
21:26. How the MS-ISAC moved community cyber defense from conversational to operational
22:22. The role of trust in making membership affordable and solutions at scale possible
25:00. Opportunities for relationship building, training, and access to services in the MS-ISAC
30:00. Examples of MS-ISAC success stories and the need to share them
33:40. The MS-ISAC as a space to craft a strategic path for national cybersecurity
36:29. Closing thoughts on how members value and can get involved in the MS-ISAC

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 136: How WiCyS Advances Women in Cybersecurity May 21, 2025

Show notes

In episode 136 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined live by Lynn Dohm, Executive Director of Women in CyberSecurity (WiCyS). Together, they discuss how WiCyS works to advance women in cybersecurity. Here are some highlights from our episode:

01:03. A mission of recruiting, retaining, and advancing women in cybersecurity
05:38. How community-focused conferences and scholarships promote community growth
06:25. The need to celebrate the work of and encourage support among cyber defenders
08:52. Four strategic pillars as a foundation for navigating COVID, societal change, and more
13:50. The importance of laying out cybersecurity career paths outside of individual companies
15:15. How a foundation of inclusion enables diversity to expand
19:45. The use of strategic partners to anticipate changing cybersecurity and hiring needs
22:38. Inside the successes of the mentorships and other WiCyS programs
28:22. The impact of Alan Paller on opening doors for WiCyS
32:35. How volunteerism supports retention in cybersecurity through inclusion and satisfaction

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 135: Five Lightning Chats at RSAC Conference 2025 May 14, 2025

Show notes

In episode 135 of Cybersecurity Where You Are, Sean Atkinson is joined live at RSAC Conference 2025 by five attendees, including two Center for Internet Security® (CIS®) employees. He conducts a lightning chat with each attendee to get their thoughts about the conference, how it reflects the changing cybersecurity industry, and the role CIS plays in this ongoing evolution. Here are some highlights from our episode:

00:40. Stephanie Gass, Sr. Director of Information Security at CIS

How to start creating a policy and make it effective through implementation processes

A transition to an approach integrating mappings for CIS security best practices
The use of GenAI and security champions to make this transition

04:08. Brad Bock, Director of Product Management at Chainguard

Building and compiling security from the ground up in open-source container images
Trusting pre-packaged software in an increasingly complex world
Support of customer compliance with attestation, SBOMs, and vulnerability remediation

07:43. Stephane Auger, Vice President Technologies and CISO at Équipe Microfix

Customer awareness and other top challenges for MSPs and MSSPs
The use of case studies and referrals to communicate the importance of cybersecurity
A growing emphasis on cyber risk insurance as media attention around breaches grows

11:36. Brent Holt, Director of Cybersecurity Technology at Edge Solutions LLC

How the CIS Critical Security Controls facilitates a consultative approach to customers
The importance of knowing where each company is in their use of GenAI
Mapping elements of a portfolio to CIS security best practices

17:23. Mishal Makshood, Sr. Cloud Security Account Executive at CIS

The use of learning and research to investigate GenAI's utility for CIS
An aspiration to scale efficiency and drive improvements with GenAI training
A reminder to augment human thought, not replace it, with GenAI

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 134: How GenAI Lowers Bar for Cyber Threat Actors May 07, 2025

Show notes

In episode 134 of Cybersecurity Where You Are, Sean Atkinson is joined by Randy Rose, VP of Security Operations & Intelligence at the Center for Internet Security® (CIS®); and Timothy Davis, Lead Cyber Threat Intelligence (CTI) Analyst at CIS. Together, they discuss how generative artificial intelligence (GenAI) lowers the barrier of entry for cyber threat actors (CTAs). Here are some highlights from our episode:

01:37. CTAs' use of GenAI to improve their existing campaigns
03:38. The need for CTI teams to look beyond language in analyzing GenAI-enabled threats
07:22. The evolving impact of GenAI on phishing campaigns, malware development, deepfakes, and malicious Artificial Intelligence as a Service (AIaaS) offerings
12:28. How GenAI increases the the speed at which CTAs can scale their efforts
17:29. Technical barriers and other limitations that shape CTAs' use of GenAI
22:46. A historical perspective of AI-enabled cybersecurity and how GenAI can support cybersecurity awareness training
26:50. The cybersecurity benefits of AI and machine learning (ML) capabilities for clustering data
29:05. What the future might hold for GenAI from an offensive and defensive perspective

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 133: DieNet's DDoS Hacktivism and Evolving TTPs Apr 30, 2025

Show notes

In episode 133 of Cybersecurity Where You Are, Sean Atkinson is joined by Lauren McFayden, Threat Intelligence Analyst at the Center for Internet Security® (CIS®). Together, they discuss the Distributed Denial of Service (DDoS) hacktivism of DieNet and how the group continues to evolve its Tactics, Techniques, and Procedures (TTPs). Here are some highlights from our episode:

01:22. An overview of DieNet and its emergence on Telegram
01:55. DDoS attacks and the potential for service disruptions
02:55. DieNet's pro-Palestinian ideology and opposition to the 47th U.S. Presidential Administration
05:00. U.S. and foreign targets claimed by the group
06:30. DieNet's history of claiming attacks against U.S. critical national infrastructure (CNI)
10:33. Two pieces of evidence used to partially assess the credibility of a claimed attack
15:16. How DieNet v2 suggests an escalation of attack strategies
20:43. How the DDoS hacktivist group may continue to evolve its TTPs in subsequent versions
23:48. The use of the CIS Critical Security Controls (CIS Controls) to reduce an attack surface
25:56. How ThreatWA stands out in keeping you informed about emerging threats

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Episode 132: Day One, Step One, Dollar One for Cybersecurity Apr 23, 2025

Show notes

In episode 132 of Cybersecurity Where You Are, Sean Atkinson is joined by Valecia Stocchetti, Sr. Cybersecurity Engineer of the CIS Critical Security Controls (CIS Controls) at the Center for Internet Security® (CIS®). Together, they discuss what the first day, step, and dollar of implementing a controls framework look like for organizations stepping into their cybersecurity journey. Here are some highlights from our episode:

01:54. Building and improving a cybersecurity program through the power of consensus
04:55. The use of an assessment to determine where you are and where you're going
09:15. How cross-mapping to multiple frameworks simplifies regulatory compliance efforts
12:00. The use of governance to secure leadership buy-in for your cybersecurity program
13:33. Continuous auditing and monitoring as tools for adapting to change
15:10. How Controls prioritization flows through the Implementation Groups (IGs)
19:39. Leadership as the backbone for getting any business program off the ground
22:59. Calculating the cost of cyber defense as a preventative action
24:55. Tradeoffs with security tools to keep in mind so that you can budget efficiently
30:00. Qualifications when using security offerings of MSPs and CSPs

Resources

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cybersecurity Where You Are (video)

Related Podcasts

Links

Stay Connected