Defense in Depth

Latest Episodes:

Cybersecurity Isn't That Difficult Apr 01, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-cybersecurity-isnt-that-difficult/

What are you security people complaining about? As compared to 10, 15, 20 years ago, the technical aspects of cybersecurity are not that difficult. We've got the control frameworks, tools, and training that are predecessors didn't have.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Naomi Buckwalter (@ineedmorecyber), director of information security and IT at Beam Technologies, and our guest, John Overbaugh (@johnoverbaugh), vp, security, CareCentrix

Thanks to our podcast sponsor, Trend Micro as bold

Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud.

In this episode

What infosec was like "back in the day"
What's out of alignment: the technology or the culture?
Can we really stand on the shoulders of giants amid so much change?
Where is individual cyberhygiene in all of this?

Cloud Security Myths Mar 25, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-cloud-security-myths/

The cloud is inherently insecure! The cloud will handle all your security needs. More data breaches happen in the cloud. These are just some of the many many myths of cloud security. Listen as we debunk as many as we possibly can.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Steve Zalewski, CISO, Levis, and our sponsored guest Mark Nunnikhoven (@markna), vp, cloud research, Trend Micro.

Thanks to our podcast sponsor, Trend Micro

In this episode

How many cloud myths from years back still endure?
Is cloud less secure or more secure now?
Who has the responsibility for security?
Just because you're in the cloud, does that mean you're protected?

What Is Security's Mission? Mar 18, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-what-is-securitys-mission/

What's the mission of your security program? Is it to proactively SECURE THE COMPANY against a compromise of the CONFIDENTIALITY, INTEGRITY, and AVAILABILITY, OR, is it to PROTECT THE COMPANY BRAND by effectively PREVENTing, DETECTING and RESPONDING to cyber-threats? These are the two options for security's mission that we discuss on this week's show.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Steve Zalewski, Deputy CISO, Levis, and our guest, Johna Till Johnson (@JohnaTillJohnso), CEO, Nemertes Research.

Thanks to our podcast sponsor, Trend Micro

The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO

In this episode

Security mission option 1: protecting the company
Security mission option 2: protecting the brand & revenue stream
Does one lead to/support the other?
Does the degree of cloud presence make a difference?
How much of this is technical vs philosophical?

Vendor CISOs Mar 11, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-vendor-cisos/

It's hard to be a CISO. But, what's it like to be a CISO at a security vendor, doing the hard work while carrying the stigma of being a "vendor"?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our sponsored guest Allan Alford (@AllanAlfordinTX), CTO/CISO, TrustMAPP, and host of The Cyber Ranch Podcast.

Thanks to our podcast sponsor, TrustMAPP

Does your board want to see yet more heat maps? No, they do not. They want to see that security investments align with business goals, and that their costs are objectively justified. TrustMAPP's data visualization helps you communicate with your board in a way they can understand – and approve.

In this episode

How to balance being an advocate, an evangelist and an operator
Are there really "stigmas" to being a security vendor?
What's unique to practicing security while being a security vendor?

How Much Log Data Is Enough? Mar 04, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-how-much-log-data-do-you-need

You're a CISO struggling with an influx of log data into your SIEM. What's the data you want to keep, and for how long? You want insights, but you also want to keep costs down. Holding onto everything is going to cost a fortune.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host Steve Zalewski, deputy CISO, Levis, and our guest Naomi Buckwalter (@ineedmorecyber), director of information security and IT at Beam Technologies .

Thanks to our podcast sponsor, TrustMAPP

In this episode

So, what is the sweet spot for retaining log files? 90 days? 1 year?
Should you categorize according to business criticality?
How do you separate the "junk" from the valuable data?

Should Finance or Legal Mentor Cyber? Feb 25, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-should-finance-or-legal-mentor-cyber

Cybersecurity leaders are constantly looking for ways to improve how they think about risk, and how they communicate risk. But they're not the only ones. Others have been managing risk long before CISOs existed. So, who could be the best mentor to help a CISO gain better insight into business risk and how to communicate about it: the chief financial officer, or the legal department's general counsel?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest, David Schellhase (@davidschellhase), general counsel, Slack.

Thanks to our podcast sponsor, TrustMAPP

TrustMAPP delivers Security Performance Management, giving CISOs a real-time view of the effectiveness of their security program. TrustMAPP tells you where you are, where you're going, and what it will take to get there. TrustMAPP gives organizations the ability to manage security as a business, quantifying and prioritizing remediation actions and costs. To learn about the MAPP methodology, download the white paper at https://trustmapp.com/mapp-paper/

In this episode

Which executive could a CISO learn more about risk?
Determining ROI of finance, legal and other execs
Analyzing why its so important to establish the ideal mentorship relationship

Data Destruction Feb 18, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-data-destruction

How do you deal with data at end of life? Holding onto data too long can be very costly and increase risk. So how do you get rid of it... safely?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Shawn Bowen, CISO, Restaurant Brands International (RBI), and our sponsored guest, Frank Milia, partner, (@ITAssetRecvry), IT Asset Management Group.

Thanks to our podcast sponsor, IT Asset Management

Poorly managed IT asset disposal, lack of due diligence, and a disposal program without clearly defined responsible parties has now resulted in millions of dollars in regulatory penalties. Is it clear who is responsible for the performance of your data disposition practice? IT Asset Management Group's free program guide includes tips for establishing stakeholders at your organization and expectations for all practitioners. Download the program guide today at itamg.com/CISO

In this episode

Is the risk of holding onto data greater than the value of keeping it?
Should client data be considered a "toxic byproduct"?
When disposing of client data, how much destruction is enough?
What legal and regulatory requirements should be considered before destroying data?

How to Make Cybersecurity More Efficient Feb 11, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-how-to-make-cybersecurity-more-efficient/

You're a new CISO told to hold headcount even and find the resources to do 20% more work. We're already maxed out. So how do we do more? Coming up next we're getting smart and more efficient with security.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Steve Zalewski, Deputy CISO, Levis, and our guest, Mike Morgan, (@theywerecones) head of information security, infrastructure director, Foster Farms

Thanks to our podcast sponsor, IT Asset Management Group

In this episode

Improving processes right from the beginning of the pipeline
Looking for waste - and knowing what "waste" is
Doing more with less means at some point, something important will break
Delegating and crossing over skills
Watching out for IT sprawl and "new fangled" solutions

Does a CISO Need Tech Skills? Feb 04, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-does-a-ciso-need-tech-skills

Does a CISO need technical skills to be an effective cybersecurity leader? Many CISOs don't have them. Are they still effective and does it affect their ability to lead?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, and guest co-host Ben Sapiro, (@ironfog), CISO, Great-West LifeCo, and our guest, Zach Powers, CISO, Benchling.

Thanks to our episode sponsor, IT Asset Management Group

Poorly managed IT asset disposal, lack of due diligence, and a disposal program without clearly defined responsible parties has now resulted in millions of dollars in regulatory penalties. Is it clear who is responsible for the performance of your data disposition practice? IT Asset Management Group's free program guide includes tips for establishing stakeholders at your organization and expectations for all practitioners. Download the program guide today at itamg.com/CISO.

In this episode

Why having the skills helps with realistic expectations
Being able to see through the nonsense
The value of staying passionate about the profession

How Do You Know if You're Good at Security? Jan 28, 2021

Show notes

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-how-do-you-know-if-youre-good-at-security/

What metrics or indicators signal to you that an organization is "good at security"?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest Justin Berman (@justinmberman), former CISO, Dropbox.

Thanks to our podcast sponsor, Imperva

Face it, your data is everywhere! Imperva Data Security unifies compliance, security and privacy needs for any data store while saving you time and money. No matter where data lives, get confidence about what is happening with data, where it's stored and who's accessing it. Start a free trial now.

In this episode