Defense in Depth

Latest Episodes:

Getting Ahead of the Ongoing Malware Fight Jun 16, 2022

Show notes

All links and images for this episode can be found on CISO Series

For years we've been referring to malware protection as a cat and mouse game. The crooks come up with a new malware attack, and then the good guys figure out a way to stop it. And that keeps cycling over and over again. So where are we today with malware protection and is there any way to get ahead of the cycle?

Check out this post and this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Aviv Grafi (@avivgrafi), CTO and founder, Votiro.

Thanks to our podcast sponsor, Votiro

Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything – including Microsoft 365. Learn more at Votiro.com.

In this episode:

How can we take proactive approaches that are capable of stopping attacks, not just detecting them?
What do you think we're doing really well in terms of malware, and where could we do a lot better?
We examine the need for organizations to upgrade their defenses.
Has ransomware made a massive target out of every organization?

Building a Security Awareness Training Program Jun 09, 2022

Show notes

All links and images for this episode can be found on CISO Series

We all know and have experienced bad security awareness training. People can learn, and should learn about being cyber aware. How do you build a security awareness training program that sticks?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn with our guest Lisa Kubicki (@lmk2), trust and security, training and awareness director, DocuSign.

Thanks to our podcast sponsor, Drata

Save 200+ hours with Drata's automated continuous compliance solution for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, & CCPA. Drata connects to your techstack with 75+ integrations, including AWS, GitHub, GCP, & more to automate the compliance process. Kickstart your compliance journey by requesting a demo and get 10% off

In this episode:

We ask, "How do you build a security awareness training program that sticks?"
How do you develop a program that resonates with staff and actually improves security outcomes?
We get tips from the community on how they built a security awareness training program.
We examine what a successful engagement would look like.

Onboarding Cyber Professionals with No Experience Jun 02, 2022

Show notes

All links and images for this episode can be found on CISO Series

You want to bring on entry level personal, But green employees, who are not well versed in security, IT, or your data introduce risk once they have access to it. What are ways to bring these people on while also managing risk?

Thanks to our podcast sponsor, SolCyber

At SolCyber we're hell-bent on delivering Fortune 500 level cyber security for small and medium-sized enterprises. When you're being targeted by the same bad guys, nothing else will do. We bring to the table a curated stack of leading technologies and around-the-clock SOC support, all simply priced per user. Let us do the heavy lifting.

In this episode:

We ask, "What are ways to bring entry-level people onboard the company while also managing risk?"
How does education stack up against on-the-job experience?
Are there advantages to hiring an inexperienced greenthumb versus experienced only new hires?

Where's the Trust in Zero Trust? May 26, 2022

Show notes

All links and images for this episode can be found on CISO Series

Zero trust is a hollow buzzword. In any form of security, there exist critical points where we have to trust. What we need is a move away from implicit trust to explicit trust, or identity that can be verified.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Yaron Levi (@0xL3v1), CISO, Dolby.

Thanks to our podcast sponsor, Optiv

Need a guide on your Zero Trust journey? Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide" shares the following takeaways: - The key elements of Zero Trust - How to visualize your Zero Trust journey and place it in the proper context - Integrated technologies to drive adaptive processes and a mature security model Learn more at www.optiv.com/zerotrust.

In this episode:

We ask cyber professionals, where is the 'trust' in zero-trust?
What and who should we be trusting?
How should we refer to zero trust since you can't run any kind of operation where you trust no one and nothing?

Who Investigates Cyber Solutions? May 19, 2022

Show notes

All links and images for this episode can be found on CISO Series

Cyber professionals, who is responsible on your team for investigating new solutions?

Check out this post and this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Nick Ryan, director of enterprise technology security and risk, Baker Tilly.

Thanks to our podcast sponsor, Votiro

In this episode:

We ask cyber professionals, who is responsible on their team for investigating new solutions? If it's a collaborative effort, how is that handled?
What are CISOs looking for in a solution?
And we discuss using existing solutions before purchasing and implementing more solutions.

Does the Cybersecurity Industry Suck? May 12, 2022

Show notes

All links and images for this episode can be found on CISO Series

In the cyber industry we pat each other on the back and give each other awards, all while the statistics for breaches appear to be worsening, Are we celebrating growing failure? Does the cyber industry suck?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Fredrick Lee (AKA "Flee") (@fredrickl), Flee, CSO, Gusto.

Thanks to our podcast sponsor, Cymulate

The Ultimate Guide to Security Posture Validation: Learn how to effectively measure and reduce risk through continuous validation of your enterprise's security posture. Download the playbook here.

In this episode:

We ask if our very own industry, ourselves, are the ones to blame for our constant woes?
Where do we stand in accepting fault and responsibility for the industry's continued problems?
Are the companies to blame for not taking IT seriously within their organizations?
Are industry awards just fluff for patting each other on the back?

Are We Taking Zero Trust Too Far? May 05, 2022

Show notes

All links and images for this episode can be found on CISO Series

For some, the definition of zero trust has expanded from how we grant access to networks, applications, and data to how we trust individuals in the real world. Are we taking zero trust too far?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Thomas Doughty, CISO, Prudential Financial.

Thanks to our podcast sponsor, Netfoundry

NetFoundry, built on OpenZiti, is the only solution purpose-built to connect massively distributed apps, edges, clouds and devices in minutes, ensuring zero trust of the internet, local and OS host network and delivered as SaaS. Isolating the app to make network security irrelevant and remove the pain of public DNS, VPNs, bastions, as well as complex firewall rules.

In this episode:

We ask if we're taking the concept of zero-trust too far.
We try to distinguish between where do we have to trust and where do we have to implement zero trust principles?
Differentiating between humans and machines when it comes to trust.
And is zero trust supposed to be a silver bullet or a cure-all?

Is Shift Left Working? Apr 28, 2022

Show notes

All links and images for this episode can be found on CISO Series

Developers and security professionals have been heavily sold on the concept of "shift left" or deal with security issues early in development rather bolting it on at the end. It all made logical sense, but now we've been doing it for a few years and has shift-left actually reduced application security concerns?

Check out this post, this post, and this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Mike Gorman (@gormamic), head of security and compliance, NetFoundry.

Thanks to our podcast sponsor, Netfoundry

NetFoundry, built on OpenZiti, is the only solution purpose-built to connect massively distributed apps, edges, clouds and devices in minutes, ensuring zero trust of the internet, local and OS host network and delivered as SaaS. Isolating the app to make network security irrelevant and remove the pain of public DNS, VPNs, bastions, as well as complex firewall rules.

In this episode:

We look at dealing with security issues early in development rather than bolting it on at the end.
We ask whether or not application developers and security professionals are actually reducing security issues with "shift left" framework.
And do they actually reduce or even eliminate the need for other security controls?

Technical vs. Compliance Professionals Apr 21, 2022

Show notes

All links and images for this episode can be found on CISO Series

Do we have a Monitgue/Capulet rivalry between technical and compliance professionals? Why is this happening, and what can be done to improve it? Does it need to be improved?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Linda White, director of InfoSec, Axiom Medical.

Thanks to our podcast sponsor, Netfoundry

In this episode:

We look at the Monitgue/Capulet rivalry between technical and compliance professionals.
Is there a solution to this never-ending feud?
And what can be done to improve relations?

Why Do So Many Cybersecurity Products Suck? Apr 14, 2022

Show notes

All links and images for this episode can be found on CISO Series

Why do we end up with so many bad security products? Who is to blame and how can we fight back an ecosystem that may be fostering subpar products?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is Haroon Meer (@HaroonMeer), founder and researcher, Thinkst Canary.

Thanks to our podcast sponsor, Thinkst Canary

Most Companies find out way too late that they've been breached. Thinkst Canary changes this. Deploy Canaries in minutes and then forget about them. Attackers tip their hand by touching 'em giving you the one alert, when it matters. With 0 admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.

In this episode:

Is the cybersecurity ecosystem giving a rise to subpar products?
Why are so many security products implemented poorly
How important is vendor feedback?

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected