Defense in Depth

Latest Episodes:

Do Breaches Happen Because the Tool Fails, or the Tool Was Poorly Configured? Apr 13, 2023

Show notes

All links and images for this episode can be found on CISO Series.

Security tools are supposed to do a job. Either they need to alert you, protect you, or remediate an issue. But they don't always work and that's why we have breaches. Who's at fault, the tool or the administrators who configured the tool?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Kenneth Foster (@Kennethrfoster1), vp of IT governance, risk and compliance at FLEETCOR.

Thanks to our podcast sponsor, AppOmni

Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.

In this episode:

Why do security tools fail?
Who's at fault, the tool or the administrators who configured the tool?
Is it usually because the control is ineffective or was the control misconfigured / ignored?
Do InfoSec produts have an efficacy issue or an implementation issue?

What We Love About Working in Cybersecurity Apr 06, 2023

Show notes

All links and images for this episode can be found on CISO Series.

We talk a lot on this show about what makes cybersecurity such a hard job, yet there are so many people who are in it and love it. What draws people to this profession and why do they love it so much?

Thanks to our podcast sponsor, Orca Security

Orca Security is the pioneer of agentless cloud security that is trusted by hundreds of enterprises globally. With continuous first-to-market innovations and expertise, the Orca Platform ensures security teams quickly identify and remediate risks to keep their businesses secure. Connect your first account in minutes by visiting www.orca.security.

In this episode:

We talk a lot on this show about what makes cybersecurity such a hard job, yet there are so many people who are in it and love it.
What draws people to this profession and why do they love it so much?
Do you love the ability to influence the organization and leadership?
Do you love making an impact by helping people and businesses with safer behaviors and activities?

Security That Accounts for Human Fallibility Mar 30, 2023

Show notes

All links and images for this episode can be found on CISO Series.

We expect our users to be perfect security responders even when the adversaries are doing everything in their power to trick them. These scams are designed to make humans respond to them. Why aren't we building our security programs to account for this exact behavior that is simply not going to go away?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Ken Athanasiou, CISO, VF Corporation.

Thanks to our podcast sponsor, Code42

In this episode:

Why do we expect our users to be perfect security responders even when the adversaries are doing everything in their power to trick them?
Aren't these scams designed to make humans respond to them?
Why aren't we building our security programs to account for this exact behavior that is simply not going to go away?
Why do so many security practitioners treat our users as children to be managed instead of adults to be educated and assigned a level of accountability?

Why You Should Be Your Company's Next CISO Mar 23, 2023

Show notes

All links and images for this episode can be found on CISO Series.

How do you make the argument that your company needs a CISO, and that YOU should be that leader? What do you need to demonstrate to prove you can be that person?

Check out this post and this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Radley Meyers (@radleymeyers), Partner, SPMB Executive Search.

Thanks to our podcast sponsor, SPMB

SPMB connects top executive talent to the world's best and fastest growing innovators across the country. A key area we bring extensive knowledge and expertise to is our dedicated Security Practice, leading both functional searches (CISO and VP's defining security strategy) and building out executive teams at top security software companies.

In this episode:

How do you make the argument that your company needs a CISO, and that YOU should be that leader?
What do you need to demonstrate to prove you can be that person?
Do you have a sound understanding of the WHY behind the organization's existence and how value is added or taken away?
How do you lay out a plan to win in whatever industry you are in because of security NOT despite it?

How to Become a CISO Mar 16, 2023

Show notes

All links and images for this episode can be found on CISO Series.

How do you become a CISO? It doesn't follow a linear pattern as many other professions. There are many different paths and there are many different entry points.

Thanks to our podcast sponsor, SPMB

In this episode:

How do you become a CISO?
Why doesn't it follow a linear pattern as many other professions?
Why are there so many different paths and entry points?
Why is it valuable to know how others did it and how you can glean that knowledge and apply it to your situation?

Can You Build a Security Program on Open Source? Mar 09, 2023

Show notes

All links and images for this episode can be found on CISO Series.

What would it take to build your entire security program on open source software, tools, and intelligence?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome guest DJ Schleen (@djschleen), distinguished security architect, Yahoo Paranoids.

Thanks to our podcast sponsor, SPMB

In this episode:

What would it take to build your entire security program on open source software, tools, and intelligence?
Is it possible/feasible/practical to run a security program entirely based upon free and open source software, open source tools, and open source intelligence?
Is it true that the more open source you use the more people you need?
Do commercial software systems, tools, and intelligence have value above what can be found in open source?

Third Party Risk vs. Third Party Trust Mar 02, 2023

Show notes

All links and images for this episode can be found on CISO Series.

Businesses grow based on trust, but they have to operate in a world of risk. Even cybersecurity operates this way, but when it comes to third party analysis, what if we leaned on trust more than trying to calculate risk?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and our guest co-host is Yaron Levi (@0xL3v1), CISO, Dolby. Yaron and I welcome Dan Walsh, CISO, VillageMD.

Thanks to our podcast sponsor, TrustCloud

TrustCloud is the all-in-one platform to accelerate sales and security reviews, automate compliance efforts, and map contractual liability across your business. Connect with us to learn how you can transform security from a cost center into a profit driver with TrustCloud's programmatic risk and compliance verification tools.

In this episode:

When it comes to third party analysis, what if we leaned on trust more than trying to calculate risk?
Should we have a "glass half empty" or a "glass half full" attitude towards third party risk?
Wouldn't it be better to measure the level of how much we can TRUST the 3rd party?
Is it vitally important to assess how resilient the organization is to failure caused by each third party?

How Can We Improve the Cyber Sales Cycle? Feb 23, 2023

Show notes

All links and images for this episode can be found on CISO Series

The cybersecurity sales process is so terribly inefficient. And everyone, the targets and cybersecurity leaders, are losing valuable time because of that inefficiency. Where can we start making improvements?

Check out this post for the discussion that's the basis for this podcast episode. This week's Defense in Depth is hosted by me, David Spark (@dspark), producer, CISO Series. Our guest co-host is John Overbaugh, CISO, ASG. John and I welcome our guest, Jerich Beason (@blanketsec), commercial CISO, Capital One.

Thanks to our podcast sponsor, Compyl

GRC solutions often cause process roadblocks within organizations. They are either antiquated and lack the functionality needed or so stripped down they can't fix the problems you set to solve. That's why the team over at Compyl created the all-in-one security and compliance automation platform. Compyl quickly integrates with the tools you use, and automates 85% of the day-to-day tasks, all while providing complete transparency and comprehensive reporting along the way. Start your free trial with Compyl today and see all the efficiency gains you can expect from a leading solution. Learn about Compyl today at www.compyl.com/getstarted.

In this episode:

Why is the cybersecurity sales process so terribly inefficient? Where can we start making improvements? What could be done to improve the efficiency? What is the solution to removing wasted effort and time?

What Leads a Security Program: Risk or Maturity? Feb 16, 2023

Show notes

All links and images for this episode can be found on CISO Series.

When you think about building a plan (and budget!) for your security program, do you lead with risk, maturity, or something else?

Thanks to our podcast sponsor, runZero

runZero is the cyber asset management solution that helps you find and identify every managed and unmanaged asset connected to your network and in the cloud. Get the data and context needed to effectively manage and secure your environment. Try runZero for free at runzero.com.

In this episode:

When you think about building a plan (and budget!) for your security program, do you lead with risk, maturity, or something else?
What's the overall theme you lead with when you're building a security program?
Why is it an important question to answer before you build your program?
How greatly can it vary?

Limitations of Security Frameworks Feb 09, 2023

Show notes

All links and images for this episode can be found on CISO Series

Why do strongly supported security frameworks have such severe limitations when building a security program?

Check out this post for the discussions that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Stas Bojoukha, CEO, Compyl.

Thanks to our podcast sponsor, Compyl

In this episode:

Why do strongly supported security frameworks have such severe limitations when building a security program?
Is it because the product security landscape updates with such speed and ferocity that these frameworks can't keep up?
Are most regulatory and third-party compliance "programs" simply non-prescriptive?
Is the intention to achieve compliance with every single control?

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected