The Cyber Ranch Podcast

Cyber Civics and Voting with Kirsten Davies - SPECIAL EDITION! Oct 30, 2024

Howdy, y'all! With American presidential elections already under way, Allan and Drew decided that scrambling to get Kirsten Davies on the show for this week's show (the last one before formal Election Day) was paramount. Kirsten has been on our potential guest list for years now, as she is a multiple-times Fortune 500 CISO.

But now Kirsten is CEO and Founder of The Institute for Cyber Civics, a non-partisan non-profit aimed at empowering poll workers and poll volunteers to recognize and deal with cyber attacks on the voting process.

Hear about Kirsten's charter, mission, vision, goals and capabilities in this SPECIAL EDITION! episode!

Y'all be good now!

Social Media & Community Engagement with Technically__Rose Oct 23, 2024

Our guest today is Babbette Jackson, aka Technically__Rose of YouTube and Instagram fame!

Babbette is in DLP and Insider threat analysis. She has worked in places as far flung as Edward Jones, Juniper Networks, and Bank of America. More importantly, Babbette is quite involved in the intersection of social media and community engagement.

How do we use social media to engage others across generations and to and encourage community participation?

Allan, Drew and Babbette discuss:

We’ve been talking to others about how they arrived in and either struggled or flourished in Cyber. What is your story?
What inspired you to embrace social media as you have? What kind of results are you seeing from this engagement?
We’ve seen your content on LinkedIn and on Instagram, it’s very creative but also very relatable. How do you decide what topics to cover, how to frame them for the right audience, come up with the structure of your messages, etc.? How many times do you re-do them?
You’ve mentioned social capital. Tell us about that concept, how you build it, how and when you use it, etc.
What is something established leadership in the field should understand about dealing cross generationally that we often get wrong?

It is a wonderful show, and Babbette is a wonderful guest who is willing to share the insights behind her success. Y'all be good now!

You Don't Own "You", and "You" Are Being Altered with Sam Rad Oct 16, 2024

Who and what you are, your personality, your style, your thoughts... That’s all about to change. For one thing you are already a product on “free to use” social media. You don’t really own things you think you own (We're looking at you, Steam!) Even your intellectual property is up for grabs now in ways you can’t see coming. Hollywood actors are selling the rights to their digital likenesses, and meanwhile, others are stealing such rights via technological loopholes. All media exists, according to Drew, to draw you towards the advertisements… And your deepfake could be used to do just that to others. Some of these fakes are good enough to fool yourself even.

Join Allan and Drew as they interview Sam Rad, a premier futurist and humanist, who freely admits that there is now an inherent tension between those two philosophies.

The conversations about the governance, ethics, and security of all this new media and technology are woefully behind the curve.

Many members of the TikTok generation has a 4-second attention span and require multiple simultaneous input streams at any given time to feel satisfied. Is this a deliberate attack on the Western human nervous system? Cyberattacks are certainly killing people already, why not go straight for their brains?

Are the peasants coming with pitchforks and torches to destroy Frankenstein’s newest monster? How about the striking dockworkers? The terrorists destroying 5G towers? Do peasants with pitchforks ever win? Ned (mistakenly called “Jason” by Allan) Ludd and the Luddites failed in a big way to stop technology from replacing their jobs in the late 1700s (mistakenly referred to as the having happened in the Victorian era by Allan)

This show is peppered with others such historical and cultural references such as the cultures and economies in Second Life, Picasso’s mass production of his own paintings, Rousseau’s evolving concepts of property, Mary Shelly and her Frankenstein’s monster, Hegel’s model of “thesis, antithesis, synthesis”, the Butlerian Jihad from the “Dune” series, and William Gibson’s maxim that, “The street finds its uses for things”.

We’re not even coping with all of this, and now we have the AI conversation thrust upon us as well… Your content is training data, and can be mimicked with uncanny accuracy as well.

Check out Sam’s book, “Radical Next” and her docuseries “Illicit Economies of the Shadowverse” to learn more about the positives and negatives of all of these trends in humanity.

Good luck out there. Stay safe. Who you are and what you own is irretrievably altered at this point. Cybersecurity is really just “security” now. But hopefully all this mess will create the next cultural and creative Renaissance.

Y'all be safe now...

A Cybersecurity Program to Emulate? A Powerful Formula with Jason Shockey Oct 09, 2024

Jason Shockey, CISO of Cenlar FSB, and 25 year veteran of cybersecurity, has a formula for running an excellent cybersecurity program.

He studied a great deal in his various cybersecurity roles before leaping into a CISO role, and the studying paid off!

Jason and Allan and Drew discuss the following:

Identifying Common Pitfalls
Promoting Team Well-Being and Efficiency
Engaging and Education the Board
Strategies for Effective Program Design

ALL in the span of one rapid-fire show! Do give it a listen, as you will learn about many valuable approaches and resources to help your program succeed.

Y'all be good now!

Cyber and Social Media as Warfare with Dave Schroeder Oct 02, 2024

Cyber as precursor to kinetic warfare? What about cyber AS warfare? And social media infiltration and propaganda? Join Allan and Drew as they invite Dave Schroeder, a renowned expert in this field, to discuss the active use of cybersecurity and social media as warfare between the Western World and China, Iraq, Russia and North Korea. They cover:

Insertion of fake IT employees into key companies
Political influence operations (divide and conquer)
Precursors to kinetic war being the smallest tip of the iceberg
Philosophical differences between nations and governments serving themselves
Cultures of trust in the West, and how those are not so self-serving

This one is very sobering and perhaps the most important show of the year...

Y'all be good now!

The Case for Regulation with Tim Brown Sep 25, 2024

Howdy, y’all, and welcome to The Cyber Ranch Podcast! Our guest today is Tim Brown. If you don’t’ know who Tim Brown is, he is the CISO at SolarWinds, and as such, is one of us.

Or maybe in a way, he is all of us, really. Tim advises and has held various other roles in the past, including product roles, which our listeners know are well-respected skills down at the 'Ranch.

The topic today is cyber regulation. It can range from self-regulation to associations, principles, practices, lobbying – all the way up to full government regulation. What works? What’s required?

Topics covered:

What is the case for regulation?
What are the basics rules to provide us coverage and clarity?
Not knowing the rules makes people nervous and afraid...
Document your own processes, procedures, JDs, what you do, what you don't do. Make it clear!
Rigorous banking industry regulations exist already. How onerous are they? How badly would they fit the rest of us?
Perhaps a GAAP (generally accepted accounting principles) equivalent is desired?
Process/procedure vs. 'Thou shalt never have a vulnerability!'
Heavy-handed governmental oversight - defining standard of care and turning that into something people can stand behind?
Remember that Sarbanes and Oxley were people. Real people.
Is regulation required to create a more positive environment in the way SOX does?
What does the public-private partnership need so that the rules created are good and realistic and improve cybersecurity for the world?
REGULATION IS COMING! THE CISO COMMUNITY MUST BE A PART OF THAT REGULATION!
Have we had a cyber Enron, and do we need one? That was the real catastrophe that launched SOX...
Regarding GAAP, accounting is deterministic vs. dynamic - Can a cyber GAPP ever exist given how dynamic we are?
The compliance world: principles based vs. rules based regulation - a more practical model. It may not move the bar enough, but it's a good starting point.
Should a whole field of security auditors existing like accounting auditors do?
We are youngsters in this craft still...
Is the accounting world really the best metaphor? Auditors, forensic accountants, etc.?
Another model is the medical world - malpractice, specific rules and regulations on specific surgical practices?
What about a national CISO board or association like the NACD or the American Psychological Association?
What about boards like medical review boards that approve specialties?
Lobbying
How to fund this?
Who should be doing the doing? Inclusivity vs. sound gatekeeping.
A barber has to be licensed to cut hair - should we get licensed?
This conversation was around with software engineers long before it was with cyber folks. We learned that self-policing did not really work...
The challenge is one of not shackling the business, or at least not appearing to, and the subsequent pushback.

The call to action is ultimately this: If you don't have a seat at the table, folks will do things to you rather than with you. So get involved!

Y'all be good now!

You're Hiring Wrong! with 3 Guests New to the Industry Sep 18, 2024

What can we established cybersecurity practitioners ACTUALLY do to help those new in the field besides blathering back and forth about the problem in the echo chamber that is LinkedIn?

Drew got the clever idea of inviting three folks who are brand new to the field or barely started on their cyber journey, and, get this: ASKING them what they're experiencing and what they need! Clever, huh? It's an eye-opening show for a CISO.

We are join on this week's episode by Amé Venter, May Ferreira, and Bryce Hill, who share their perspectives from their early stages in this field. It's a sobering perspective.

To a certain extent, they've all been lied to and led on, and that's all of our faults.

Key takeaways:

Prodsec/Appsec might get you out of being a cost center in cybersecurity, but no intro programs seem to show folks how to get there.
Certs aren't enough. Education is not enough. It is HARD to get started.
Internships sound great, but even after you have secured one or two of them, entry-level positions remain elusive. Especially "entry-level" positions that require experience.
Innovative programs like the one Bobby Ford is doing over at Hewlett Packard Enterprise are a huge leg up, but such programs are few and far between.
There are a lot of folks standing outside the doors to our industry who were told this was the promised land. But there they are, still standing and peering in, waiting for an invitiation.

CISOs, please listen to this show. Please re-think your hiring strategies!

Y'all be good now!

Data-Driven Cybersecurity with Wade Baker Sep 11, 2024

Howdy, y’all! Our guest today is Wade Baker, cybersecurity researcher, entrepreneur, professor… Wade is a Board of Directors member of the FAIR Institute, was an Advisory Board Member at the RSA Conference, was VP of Strategy & Risk Analytics at ThreatConnect, and is now Co-Founder of Cyentia Institute, which aims to advance cybersecurity knowledge and practice through data-driven research. Wade joins Drew and Allan to talk about (go figure!) data-driven cybersecurity. The three smash through a lot of assumptions and get to the heart of what is really going on in cybersecurity.

Questions covered:

What is the Information Risk Insights Study (IRIS)? (cyentia.com/iris/)
What is a good summary of the IRIS Ransomware report?
How organizations out there can be more data-driven?
Analyst whitepapers vs. real data research – what are the differences?
Who else can mine data like this?
What truths do people resist or what do they fail to embrace?
What are the sacred cows and the “inflatable cows”?
Is the cyber job shortage a real, data-backed problem?
The desire for “flat math” vs. curves (the 5x5 grid) …
Measuring the problem side vs the solution side…
Actual best practices vs. common practices…
Insurance industry data and why they don’t share it…
Much of what we do does not affect the realities of our cyber risk.
Stepping back from all of this, what is the value in data-driven industry analysis of this sort?
How does one sponsor IRIS publications?

Y’all be good now!

Successful Clarity & Successful Communication with Michael Santarcangelo Sep 04, 2024

Howdy, y’all, and welcome to The Cyber Ranch Podcast! Our guest is Michael Santarcangelo, Founder and President at Security Catalyst. He’s a former podcaster – co-creator of Business Security Weekly, he even did a stint on Down the Security Rabbit Hole with Raf and James. True fact, hearing Santa (as his friends call him) and Paul Asadoorian on Business Security Weekly is what inspired Allan to become a podcaster in the first place! But "Santa" (as his friends call him) has done the practitioner and the leader things as well, and got his start way back on the Global Security Team at Andersen Consulting… Santa joins Drew and Allan to discuss effective communication…

The communication problem we’re trying to solve is not the one we think it is!
“Communicating the value of cybersecurity” - What doe that mean really?
Clarity vs. Communication, Message received and understood... It’s clarity of thinking, action, and outcomes that create the ability to communicate effectively.
If that is the case, then what matters is how do OTHERS measure our success and how is that aligned or not with our own perceptions?
How do we measure success in communication? Is is how they measure it?
What is the goal of communication? (And why do we say that instead of ‘the goal of good communication’?
How do we get perspectives? (We ask).

Y'all be good now!

What Is In Your Commercial Software? with Sasa Zdjelar Aug 28, 2024

Your organization runs on commercial software far more than it does open source. But all you are delivered is binaries. What is your technical control to ensure that you are safe from this software?

Such software is composed of:

Open source libraries
Proprietary code
3rd-party proprietary libraries

You need to be able to see it, understand it, probe it for malware, backdoors, corruption, CVEs, KEVs, etc. Well now you can. SBOMs are just the beginning...

Allan and Drew are joined by Sasa Zdjelar, Chief Trust Officer at ReversingLabs, who have spent 15 years solving this highly specific and highly challenging problem in cybersecurity.

The show is not sponsored by ReversingLabs. Allan and Drew wanted the world to know that they exist, and that this capability is now in-hand...

Y'all be good now!

People, Process & Technology: Technology with Ross Young Aug 21, 2024

This is our third and final episode of this miniseries. In this episode we are joined by Ross Young, a well-established member of the cybersecurity community with a storied background and penchant for giving back via various means. Ross joins Allan and Drew in exploring the role of technology in the People, Process and Technology triad.

Questions covered:

The traditional triad of people, process, technology has been with us since 1964, from an era when digital systems were in their infancy and computing as we know it today was science fiction. Is PPT still the right way to look at business problems?
Has technology taken its place as "first amongst equals", or are we still right to say "cyber isn't a technology problem"?
Given the evolution of technology and even more so with what is on the horizon with AI and other autonomous systems, are we moving past "technology enables humans" to "technology replaces humans" for some parts of the cyber challenge?
How do you see the technology portfolio developing over the next 5 years?
What is the future of data science?

Thanks as always for listening. Y'all be good now!

People, Process & Technology: Process with Malcolm Harkins Aug 14, 2024

Howdy, y'all! In part two of our three-part miniseries, we tackle Process with Malcolm Harkins. Malcolm is former CISO at Intel, a good friend of Allan's, former Cylance Chief Trust and Security Officer, member of the board of director over at TrustMAPP (where Allan used to be COO), and is now at Hidden Layer, working to secure AI. Hidden Layer did not sponsor this show.

Allan, Drew and Malcolm discuss the following:

People, process technology – what is the role of process in that triad?
How do we craft good process? What part of process definition is capturing the as-is state vs. being aspirational?
How do we ensure good process is followed?
When should technology drive process vs process drive technology? Where does process traditionally fall short?
What would you improve about process in general?
Tell us a bit about Hidden Layer, as this is some very new technology...

Thank you for listening! Y'all be good now!

No Show This Week - Black Hat 2024 Is Afoot! Aug 07, 2024

Thanks for listening, y'all! Our next show is all about Process (we already did a show on People) and after that comes Technology.

Y'all be good now!

People, Process & Technology: People with Jeremiah Roe Jul 31, 2024

Jeremiah Roe has held many roles in cybersecurity: Field CISO, Red Teamer, Advisor, Consultant, Etc. He currently advises for OffSec, who provide quality cybersecurity training. Drew Simonis and Allan Alford determined that Jeremiah would be a great guest for launching a 3-part mini series - each of the three shows exploring People, Process and Technology respectively.

The three cover the following topics in a lively conversation that journeys into several aspects of People as they relate to cybersecurity:

People, Process, and Technology - Which is most important?
If they knew what we knew about cybersecurity, would they behave differently?
How to leverage training budges for a win-win-win.
People gonna peop, businesses gonna biz.
Incentivization, Positive Reinforcement and Deputization
Enabling camaraderie - not just good culture
Groupthink and Tribalism

Join the three as they ride the cyber trails of "People" in the PPT triad!

Y'all be good now!

Practical Security Architecture with SABSA with Andrew Townley Jul 24, 2024

Drew and Allan were skeptical about SABSA, as it is a model one CISO friend described as being "only good for a graduate student writing a paper!" Another CISO pointed out that SABSA was designed long before modern engineering practices.

Andrew Townley, a long-term SABSA consultant, on the other hand, gets straight to the practicality of it. There is indeed an academic and theoretical foundation behind SABSA, but it is most definitely leveraged for one purpose - to achieve desirable business outcomes.

Drew and Allan ask:

What is SABSA's purpose?
Is Andrew's specific practically applied methodology a deviation from the official SABSA cannon?
How can prove its effectiveness? What are the practical business outcomes?

Both Allan and Drew walk away with enough curiosity to dig into SABSA more.

Note that Andrew several times also cites the work of Russell Ackoff, another academician who enjoyed a rather brilliant career as a business consultant - grounding his systems theory into meaningful business practicality.

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Things We Believe But Cannot Prove w/ Drew Simonis Jul 19, 2023

In this episode, Allan and Drew tackle and interesting subject that was suggested by Drew and that Allan posted for the LinkedIn community to gather around: things we believe in cybersecurity that we cannot prove.

The LinkedIn conversation was phenomenal, and Drew and Allan do a great job of summarizing it and calling out the underpinnings behind much of what we believe in this industry.

Questions Allan asks Drew:

What inspired this topic?
What were some of your favorites from the LinkedIn thread?
What are the underlying themes here?
Is BYOD security really a thing?
Are third-party risk assessments useful?

Special thanks to LinkedIn posters:

Peter Schawacker
John Prokap
Duane Gran
Brian Campbell
Matthew Dimmick
Graham Lewendon
Marcus W.
Dmitriy Sokolovskiy
And everyone who participated in a very lively thread...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Board Reporting with Kate Kuehn Jul 12, 2023

Kate is a legend in our industry, is a multiple times board member herself as well as having reported to boards in a wide variety of roles. She is currently Chief Trust Officer at Aon. Allan and Kate have intended to get her down to The Cyber Ranch for some time, but the stars finally aligned in this fantastic episode jam-packed with great advice.

Do please forgive the sound quality on this one. It was recorded on the road, and the conversation was too amazing to re-record despite the quality issues.

Kate and Allan cover:

Best human approaches in board communicating – everything but the presentation itself
How to get to know your board both individually and collectively
What to present
What not to present
Best tips and tricks overall

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Allan Answers LinkedIn Questions Jul 06, 2023

This week Allan flies solo and tackles a variety of questions that came in from LinkedIn - including his origin story.

Allan tackles the following questions:

How does a CISO protect themselves from prosecution?
How does one get value from a cybersecurity assessment?
How should one pick a cybersecurity solution or company?
How do you "disconnect" from cybersecurity?
How to start and sustain a cybersecurity podcast - why and why not?
Allan's orgin story
Allan argues with himself over two issues

NOTE: Allan states: "I have no idea why anyone would want to hear my origin story, but here it is. You can skip it if you like. It runs from roughly 19 minutes to 24 minutes."

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

The Real Implications of Contemporary Exploits with Anne Marie Zettlemoyer Jun 28, 2023

The MOVEit breach has been top of mind, especially with Solar Winds and Colonial Pipeline and log4j and all the others having been so recent. It is easy to blame the victims. It is easy to make excuses that nobody can defend against a Zero Day. There are a lot of easy responses to these kinds of affairs.

But what Allan and Anne Marie Zettlemoyer get into in this episode is a variety of questions around the assumptions:

Start with a quick summary of the MOVEit exploit and Clop.
How does this attack compare to SolarWinds?
What can we do to prepare for zero-day exploits?
Is society (and the business world) getting jaded to ransomware attacks and breaches? Is this affecting their investments in cyber?
Is a post-breach CISO really rolling in the assets and resources the way so many assume?
What are the long-term implications for a business, its stock prices, and its CISO investment?

This is another episode that strives to get deeper than the surface. We hope you learn something from it, and we hope you enjoy it as well. Y'all be good now!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Zero Trust & DSPM with Claude Mandy - SPECIAL LIVE EDITION Jun 22, 2023

This episode was recorded LIVE at the 2023 Symmetry Systems Unconference on Zero Trust, adjunct to RSAC 2023.

Allan is joined by his friend Claude Mandy, former CISO, former analyst, and now Chief Evangelist at Symmetry Systems. Like Allan, Claude is a Zero Trust enthusiast. The podcast was the capstone to a long day of Zero Trust presentations, panels, book reviews and other great topics and conversations.

Join Allan and Claude at this live recording that covers:

- How does DSPM fit into Zero Trust?

- Allan's victory at a recent Digital Fight Club event where he championed Zero Trust

- Overcoming Zero Trust marketing hype

- Is Zero Trust a framework, an architecture, or something else? Hint: Claude says it's something else.

- What are the biggest challenges in implementing Zero Trust?

- What are the benefits to the business of Zero Trust?

- Security is about the intersection of Data & Entities - not about Assets

- What are the most exciting aspects of RSAC 2023 for Claude and Allan?

Money with Nick Vigier Jun 21, 2023

Money is the hardest thing for a CISO to acquire. As with last week's show on Time, Money has to be spent wisely as well. Perhaps the tricks to spend it wisely directly relate to how we can acquire more the next cycle to achieve the mission we know we need to achieve. In this episode we cover:

- What are the best methods for securing a budget?

- How do you structure your budget to align with business costs (COGS, R&D, CAC...)?

- What are some good ways to save money as a CISO?

- How do you best lower vendor costs for the long term?

- How can a CISO help make money for the business?

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Time w/ Paul Robinson Jun 14, 2023

Time is one of our most precious commodities as security practitioners. And yet we have traditional time sinkholes where we waste time, lose time, and spend time. Join Allan and Paul Robinson, Founder and Managing Director at Tempus Network, as they explore several of these areas and give concrete tips on how to save time as security practitioners:

- Keeping up with industry trends

- Managing cyber incidents

- Third-party questionnaires (both directions!)

- Vendor onboarding

- Work from home vs. going into the office

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

FedRAMP, StateRAMP, TX-RAMP with Jay Adams Jun 07, 2023

Join Allan and his guest Jay Adams, CISO @ Enchoice and former security architect for several large private and public sector efforts - from M&A activities to massive public portals.

Jay is going through TX-RAMP right now, and both he and Allan have done research on FedRAMP and StateRAMP as well.

What are the differences? Why might you choose one over the other? What are the gotchas?

This is a great show and you'll get to learn a bit about Allan's brief foray into state government as well...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

RSAC 2023 Special Edition Campfire Chats - Part 2 Jun 05, 2023

This is Part 1 of an incredible series of interviews Allan conducted live at RSA 2023. Guests include:

Gary Hayslip, CISO @ Softbank Investment Advisers
Michael Calderin, CISO @ YAGEO Group
David Cross, CISO @ Oracle SaaS Cloud
Audra Streetman, Security Strategist @ Splunk
Adrian Peters, CISO @ Vista Equity Partners
Robin Sundaram, CISO @ RELX
Merritt Baer, Office of the CISO @ AWS
Rob Wood, CISO @ Centers for Medicare & Medicaid Services
Bryan Green, CISO Americas @ ZScaler
Stephanie Derdouri, Sr. Manager, Information Security and Technology Risk Management @ Capital Group
Andres Andreu, CISO @ 2U
Paul Love, CISO & Chief Privacy Officer @ Co-op Solutions
Royce Markose, former CISO
Bob Schuetter, CISO @ Ashland
Susan Thomas, CEO @ 10Fold
Brian Markham, CISO @ EAB
Ken Foster, VP of IT GRC @ FLEETCOR
Elizabeth Martinez, Account Exec @ ThreatLocker
Josiah Dykstra, Senior Fellow, Office of Innovation @ The NSA
Kevin Brown, CEO @ Innit
Brent Deterding, CISO @ Afni
Audra Streetman, Security Strategist @ Splunk
Wendy Whitmore, SVP, Unit 42 @ Palo Alto Networks

I ask my guests several questions including:

How do you impact the top and bottom line?
What topics are you tired of in cybersecurity?

There are also some special interviews at the end - discussions about the RSA conference itself, tech stack sprawl, and personal branding and marketing for CISOs. Oh - and a question about how vendors and CISOs can work better together AND a conversation about how government and industry can work together in cybersecurity.

Give this one a listen! It's jam-packed with great insights!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

RSAC 2023 SPECIAL EDITION Campfire Chats - Part 1 May 22, 2023

This is Part 1 of an incredible series of interviews Allan conducted live at RSA 2023. Guests include:

Chris Kennedy, CISO @ Citadel
Gary Hayslip, CISO @ Softbank Investment Advisers
Michael Calderin, CISO @ YAGEO Group
Reet Kaur, CISO @ Portland Community College
Rob LaMagna-Reiter, CISO @ Hudl
Matthew Lang, vCISO
David Cross, CISO @ Oracle SaaS Cloud
Audra Streetman, Security Strategist @ Splunk
Vishal Amin, General Manager of Security Solutions (Federal) @ Microsoft
Adrian Peters, CISO @ Vista Equity Partners
Kelly Shortridge, Author of “Security Chaos Engineering: Sustaining Resilience in Software and Systems”
Robin Sundaram, CISO @ RELX
Merritt Baer, Office of the CISO @ AWS
Tim Rohrbaugh, former CISO & Industry Leader
Rob Wood, CISO @ Centers for Medicare & Medicaid Services
Bryan Green, CISO Americas @ ZScaler
Stephanie Derdouri, Sr. Manager, Information Security and Technology Risk Management @ Capital Group
Andres Andreu, CISO @ 2U
Paul Love, CISO & Chief Privacy Officer @ Co-op Solutions
Royce Markose, former CISO
Bob Schuetter, CISO @ Ashland

I ask my guests several questions:

What is the best part of RSAC 2023 for you?
What is the single most critical skill a security leader needs?
What's missing in cybersecurity?
What is your take on Purple Teaming and MITRE ATT&CK?
How do you co-lead the organization?

There is also a VERY special interview with James Stanley, Chief of Product Development at CISA at the end. Don't miss it!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Security Chaos Engineering with Kelly Shortridge May 10, 2023

What is security chaos engineering? You may remember Kelly Shortridge, our very first guest, who came on the show to talk about behavioral economics and cybersecurity. Well Kelly is back to talk about her new book, "Security Chaos Engineering: Sustaining Resilience in Software and Systems".

Security chaos engineering is derived from chaos engineering, a relatively new discipline in software development that seeks to test distributed computing systems to ensure that they withstand unexpected disruptions. It's all about resilience, in other words. Security chaos engineering seeks to do the same for the security of such software systems.

Kelly breaks down her book during a lively conversation featuring an opinion or two her cat, Link (yes, a Zelda reference!):

Who should read this book?
Resilience in software and systems
Systems-oriented security
Architecting and designing
Building and delivering
Operating and observing (Allan's favorite chapter as it intersects with one of his Zero Trust tenets)
Responding and recovering
Platform resilience engineering
Security chaos experiments (a very fun chapter!)
Case studies

Note that the book is peppered with references and quotes from other disciplines. We would expect no less from Kelly.

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

The 9-Layer Cybersecurity Program Cake with Bryan Liebert May 03, 2023

Bryan Liebert is one smart cookie. Who bakes cybersecurity cakes. But seriously, Bryan has been a CISO, consultant, architect, and has served many other roles in cybersecurity. His specialty is creating simple to digest (we could not help it, sorry!) models for managing and reporting on cybersecurity programs and practices.

Join Bryan and Allan as they serve up (we're still doing it!) a lively and informative episode!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Four Problems with Cybersecurity with Adrian Wright Apr 26, 2023

Adrian Wright, "The Cynical CISO" of LinkedIn fame, joins Allan to discuss four areas where cybersecurity is perhaps getting it wrong:

Cybersecurity viewed as a necessary evil, related to The Twilight Zone
Ownership, Authority, Accountability: Inventory and Means of Control
Are WE the baddies?
(Largely) Forgotten Security Principles

Allan and Adrian dissect cybersecurity practice in this great episode!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

The Cloud and the Big Bang of Data with Cecil Pineda and Gene Moore Apr 24, 2023

Join us for a SPECIAL EDITON! episode of The Cyber Ranch Podcast LIVE! from CISO XC in Dallas-Fort Worth, Texas!

The topic is data security: its challenges and how to overcome them.

Joining Allan are Cecil Pineda of R1 ("Cecil the CISO") and Gene Moore of Securiti.

The conversation is live and lively, recorded as-is and delivered to you.

Enjoy!

Sponsored by Securiti - https://securiti.ai/

The Blurring of Personal & Corporate Security with Leigh Honeywell Apr 19, 2023

We always think of cybersecurity startups as companies who contribute to the tech stack in an organizational environment - usually the enterprise. We also think of personal cybersecurity in terms of protecting Grandma or our kids from the bad guys. But these two worlds intersect far more than you would think, and the techniques for addressing these problems intersect as well.

This week Allan is joined by Leigh Honeywell, CEO at Tall Poppy, to discuss these intersections. Leigh is uniquely qualified, as her non-traditional startup addresses "personal security outside the firewall", which includes executive protection...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Design Partnerships with Emily Heath Apr 12, 2023

Emily Heath is a well-known and well-respected figure in cybersecurity. She has been a CISO three times in a variety of industries, including software and a major airline. She has been in law enforcement, is a partner at a VC firm, and serves on boards of directors as well.

With this wealth of experience she has come to value design partnerships - working with small startups to help craft their solutions to meet hers and their needs.

But what are some of the challenges in design partnerships? Allan and Emily tackle the following questions:

What inspires one towards design partnerships?
How can a practitioner design partner help a first-time founder?
Where does the innovation come from in this model?
Does the vast amount of cyber vendors help or hinder the design partnership model?
What are the pros and cons of alternatives to design partnership?
How does a practitioner get started with design partnership?

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

All About Advisory Boards with Karla Reffold Apr 05, 2023

This week Allan is joined by Karla Reffold, COO at Orpheus Cyber. Yes, that makes her a vendor, but, yes, she follow's the show's rules: She is a friend, not a sponsor; she is not all vendory; and most importantly she is a subject matter expert on this week's topic: advisory boards!

In fact, Karla has written an ebook on the subject which is available here:

https://karlareffold.co.uk/advisory-boards-guide-book

Topics covered in the show:

- The ethical entanglements of being on an advisory board

- Paid vs. unpaid advisory board roles (and cash vs. equity)

- Advisory board roles as kickbacks (yes, it happens)

- Advisors who are customers vs. advisors who are not

- Do advisory board roles help or hurt a CISO's career?

Enjoy! Y'all be good!

CISO vs. Individual Contributor Perspectives w/ William Klusovsky Mar 29, 2023

Becoming a CISO means changing a lot of perspectives. Individual contributors need to learn this, and the CISO is the best one to teach them. "They're never going to get it!" is a mantra used by both sides of that dialogue, and that is not a solution. Will and Allan discuss:

- What precepts really are "obvious"

- How does one onboard leadership and business perspectives?

- What should CISOs do to ensure their teams gain those perspectives?

- What can individual contributors do to ensure that they gain those perspectives?

- The value of self-teaching and mentorship

- Beliefs we should get rid of

It's a great conversation! Ya'll enjoy it!

How to Trust Your Vendors - A Scary Case Study with Paul Moreno Mar 22, 2023

This episode is a story about an entire vendor encounter gone horribly wrong. Allan is joined by Paul Moreno, VP of InfoSec at Catawii, formerly SVP of Cybersecurity at Adyen, investor and advisor. Paul found a cybersecurity vendor. Paul found good references. Paul got referrals from peers. Paul did a PoC. And after that, it all went downhill. Paul was kind enough to share his story as he and Allan pick apart the failings and deliberate on ways we can all avoid such encounters.

Topics covered are:

- How to spot lies

- Vetting the vendor's internal security landscape

- ISO 27001 Statement of Applicability

- Breaches and whistleblowing

- GDPR violations in charging to delete data

It is a story you will want to hear, and the analysis just might save you some pain down the road...

Sponsored by Allan Alford Consulting https://allanalford.com/about

Tech Teams, GRC Teams, and the CISO with Dr. Mike Brass Mar 15, 2023

Join Allan and Dr. Mike Brass (whose degree is in archaeology!) as they jointly explore the technical side of the house vs. the GRC side of the house, noting that GRC can be a great path to CISO.

Hear Mike's journey from IT technician to GRC to CISO.

Topics Allan and Mike cover:

The tension between tech teams and GRC teams, and how a CISO can bridge the two teams
Reasons why GRC makes such a great background for the CISO role (and how to get there)
What engineering/architecture folks should know about GRC
What GRC folks should know about the tech side of the house
What the rest of the business should know about GRC

You also get to hear Mike's journey, which has spanned small and large companies, government think tanks and more!

Sponsored by Allan Alford Consulting https://allanalford.com

How Do We Embrace Imperfection with Robin Sundaram Mar 08, 2023

We have this idea that we can be perfect. And we know that idea is unsound. So we settle for imperfection. But are we doing that purposefully? Do we have a conscious plan for embracing imperfection? How can we, as cyber professionals, embrace our imperfection meaningfully and with intent?

Join Allan and Robin Sundaram as they explore this topic, covering areas such as:

NIST CSF is all about imperfection
Embracing CMDB imperfection
Vulnerability Management and Patch Management
Product/Project Rollouts
Dev teams and the pipeline
Imperfection and GRC

It's a great conversation and you are sure to learn a thing or two!

Sponsored by Allan Alford Consulting: https://allanalford.com

Technical Case vs. Business Case with Omkhar Arasaratnam Mar 01, 2023

In this episode, Allan is joined by Omkhar Arasaratnam, a force in the industry and an expert in the intersection of software and security (you may remember Omkhar from an earlier show about supply chain security).

They challenge each other to a game, "Technical Case vs. Business Case", where they must provide both arguments for a given technology deployment. The real subtext here is that whenever these two get together, they always lean towards a technical conversation, so they are challenging themselves.

Topics Covered:

MFA
Service Accounts
Refresh Cycles
Token Expiration
Recovery Emails
Regulatory Mandates
Biometrics
SBOM

It's a lively conversation and we hope you will find value in it!

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs. Find out more at https://trustmapp.com

The Implications of ChatGPT and AI with Shaun Marion and ChatGPT Feb 22, 2023

Join Allan, Shaun Marion (CISO of McDonald's) and ChatGPT itself for a lively conversation about the implications of this new tool, AI in general, and nuances about ChatGPT's usage.

Even after controls were put into place to prevent ChatGPT from helping the bad guys, Allan and Shaun were able to trick it into giving up details on hacking, authoring phishing emails and more.

Shaun and Allan explore the potential for abuse and the positive promise and excitement that this new era of AI is ushering in.

What are the societal implications of ChatGPT?

What are the positive advances of AI?

Should we be cautious with what we feed ChatGPT?

Hear answers to these questions and more on this week's lively episode.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs. Find out more at https://trustmapp.com

Breach Communications with Heather Noggle Feb 15, 2023

How important are communications after your company has been breached? They can make or break customer perception, and the perception of the world. Bad communications are perceived as bad intent.

Joining Allan this week is Heather Noggle, owner of Codistac - a company that specializes in cyber communications, advocacy and awareness. She studied communications in college, and takes this stuff very seriously.

The pair cover LastPasss, Okta and Reddit breaches, comparing the bad to the good.

Topics covered:

Poor editing of communications
Willful non-communication
Obfuscation
Apologies
Letting the lawyers have their say - but not the last say
The balance between speed and accuracy

It's a great conversation and a great show.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs. Find out more at https://trustmapp.com

BISO Bonanza with Ann Hines, James Binford and Matt Winkeler Feb 08, 2023

Do you want to be a CISO one day? Are you a CISO today who wants to strengthen your ties into the rest of the business? The Business Information Security Officer (BISO) role is one you should explore.

The role can vary quite a bit, as you will hear on this episode with not one, not two, but three BISOs joining Allan Alford to discuss the role and its nuances: where it fits, what is required, how it is best positioned and managed.

Allan has been a BISO himself and has managed BISOs as well, so the conversation is rapid and productive.

Join Allan along with Ann Hines (BISO @ USAA), James Binford (BISO @ Humana) and Matt Winkeler (BISO @ Equifax) as the explore the BISO role.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs. Find out more at https://trustmapp.com

Developing and Fostering Good Leadership with Joey Rachid and Scott Moser Feb 01, 2023

Joining Allan today are two folks who are passionate about leadership – not just practicing good leadership, but instilling good leadership in future generations. Joey Rachid is CISO in the ecommerce and financial services industry, is on advisory boards, has worked for the Big Four, and more importantly is a former US Marine (although all the Marines will tell you there is no such thing as a former Marine!)

Scott Moser is SVP and CISO at Sabre Corporation, has also been a CISO for Caesar’s (the gaming and hospitality company), and has held some very interesting military roles of his own. In a joint branches capacity, Scott has been a CIO in Alaska. For the US Air Force, Scott has been a Commander and an IT Director, all over the world. He has also worked for the Joint Staff in Washington, DC as a branch chief.

These two gentlemen speak about leadership holistically - how to exhibit excellent leadership yourself, how to train for good leaderships, and how to foster it in others.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs. Find out more at https://trustmapp.com

Are We Protecting People, Data, or Business? with Nipun Gupta Jan 25, 2023

This week Allan is joined by Nipun Gupta, and industry veteran who has been a consultant, practitioner, vendor, advisor and investor.

The topic is "What are we really protecting in cyber?" and the nuances of that question are explored in depth - as well as the interrelationships.

Is "protect the business" a guardrail statement while "protect data and people" is the mission?

How do we tie protecting people to protecting the business? For the people? For the business?

How do we map data to the business mission?

How far do we go to protect data?

What about this new DevOps, application-centric world?

Enjoy this conversation! It's a lively one.

Influences from Outside of Cybersecurity with Peter Schawacker Jan 18, 2023

This week, Allan is joined by Peter Schawacker, CEO @ Nearshore Cyber, former CISO, advisor to MSPs, etc. Another one of Allan's illustrious guests with 25 years in cyber. (https://www.linkedin.com/in/schawacker/). The topic started as all that the two have learned outside of cybersecurity that has helped them in cyber. But it gets way more esoteric than that, and quickly. Detailed show notes and links are provided below because this show is all over the place!

02:11 Point MOOt, Texas: MOO-based virtual city with virtual economy, virtual stock market, various political models of governance and high preponderance of highly interactive bots used for practical and administrative purposes.
http://linguafranca.mirror.theinfo.org/9405/moo.html
https://archive.nytimes.com/www.nytimes.com/books/first/l/leonard-bots.html

04:49 A fast tour of the the age of the universe, Planet Earth, and humans' presence on the planet, industrial revolution and the Internet

05:45 The Annex BBS in LA
https://annex.net/about-us/

05:28 IRC
https://en.wikipedia.org/wiki/Internet_Relay_Chat

06:12 - Arthur C. Clarke - "Any sufficiently advanced technology is indistinguishable from magic."
https://lab.cccb.org/en/arthur-c-clarke-any-sufficiently-advanced-technology-is-indistinguishable-from-magic/

07:12 - Iranian refugees, educated folks who spoke 5 languages and had 4 passports

07:49 - Dungeons and Dragons
https://dnd.wizards.com/

08:05 - Life demands more of us than just having a job

08:16 - Karl Marx, Shakespeare, Julius Caesar, Poetry

08:43 - TI-99 4A and the BASIC language on the Commodore PET
https://en.wikipedia.org/wiki/TI-99/4A
https://en.wikipedia.org/wiki/BASIC
https://en.wikipedia.org/wiki/Commodore_PET

09:02 - Earthlink
https://www.encyclopedia.com/economics/encyclopedias-almanacs-transcripts-and-maps/earthlink-inc#:~:text=Earthlink%20Network%20was%20founded%20in,would%20be%20providing%20customer%20service.

09:24 - Tech Writing and List Making

09:41 - Running a SOC for Citi

10:20 - Jack of all trades and the value of curiosity and love, surprises and exploration

11:04 - There is no one cybersecurity - we don't even know what it is yet

11:40 - Cyber as nascent field with great opportunity to leverage other disciplines

13:02 - TOGAF and the CIO's organization and functions and the CISO reporting into the CIO
https://en.wikipedia.org/wiki/The_Open_Group_Architecture_Framework

14:02 - Nobody knows what a CISO does

14:39 - We can't have it both ways - to have a seat at the table we must own risk and have accountability. Authority can't exist without accountability.

15:13 - Do CISOs know how to buy stuff? Lack of budgeting process.

15:45 - Eff around and find out - security incidents - order out of chaos - crisis management

16:34 - Pen testing as games (game theory):
https://en.wikipedia.org/wiki/Game_theory

17:11 - The influence of playing music

18:48 - Wagner's invention of instruments
https://www.californiasymphony.org/2018-19-season/epic-bruckner/whats-a-wagner-tuba/

19:12 - The influence of getting sober

19:30 - Chuck Anderson - Best guitar teacher on the planet?
https://truefire.com/educators/chuck-anderson/e4187

19:45 - Dissonance and consonance; inverse ratio between complexity and power

20:17 - Entrepreneurial spirit in the music business and an illegal booking company

20:48 - Everything applies everywhere; metaphor and the origins of ideas

21:21 - Marx and Engels - revolutions get stuff done

21:43 - Rothko's artwork compared to The Ramones
https://en.wikipedia.org/wiki/Mark_Rothko#:~:text=Mark%20Rothko%20(%2F%CB%88r%C9%92,a%20Latvian%2DAmerican%20abstract%20painter.

22:14 - The subconscious produces genius; we are all geniuses

22:51 - The mathematical concept of Aleph-0 and George Cantor as inventor of discrete math
https://mathworld.wolfram.com/Aleph-0.html#:~:text=is%20often%20pronounced%20%22aleph%2Dnull,spelled%20%22aleph%2Dnought.%22

23:40 - Wittgenstein's refutation of Cantor despite computing being based on discrete math
https://en.wikipedia.org/wiki/Ludwig_Wittgenstein

24:05 - Divine revelation or bipolar disorder?

24:33 - "The Aleph" short story by Jorge Luis Borges
https://web.mit.edu/allanmc/www/borgesaleph.pdf

25:13 - "Weaving the Web" by Tim Berners Lee and Borges foreshadowing hyperlinks
https://www.amazon.com/Weaving-Web-Original-Ultimate-Destiny/dp/006251587X

25:51 - We need heroes - mentoring without heroes is not possible

27:08 - Learning from the masters in cybersecurity; maybe we will be in history books

29:42 - Gaining sobriety, learning to reach out for help - valuable in cybersecurity

31:10 - Raising children; paternalism and cyber careers

32:32 - Edward de Bono - Lateral Thinking
https://www.amazon.com/Lateral-Thinking-Creativity-Step/dp/0060903252

33:13 - "Flow" by Mihaly Csikszentmihalyi
https://www.amazon.com/Flow-Psychology-Experience-Perennial-Classics-ebook/dp/B000W94FE6

Managing Careers with Luis Valenzuela Jan 11, 2023

This episode is jam-packed with wisdom that is delivered at a rapid pace. Some folks will find themselves rewinding and taking notes. Luis Valenzuela, Director of Data Loss Prevention and Data Governance at InComm Payments, joins Allan Alford to talk about managing careers - how to manage your own, and, for leaders, how to help your team manage theirs. Topics include:

- Pivotal career transitions

- Is a plan _really_ required?

- Principles, foundations, and successful behaviors

- Practical steps and resources

- Is the power of envisioning enough?

- Tactical and other tips

Y'all enjoy this one, now!

100th Episode Call-In Special with 21 Guests! Jan 04, 2023

To celebrate the 100th episode, Allan decided to let the audience participate in the show. 21 people called in and answered a wide variety of questions about cybersecurity. It is a fantastic show and it is very fun to hear all the different perspectives from folks who have just about every role in cybersecurity you can imagine:

00:00:58 - Brent Deterding - What can practioners do to show more love to vendors?
00:03:07 - Evgeniy Kharam - How important are soft skills in cybersecurity?
00:03:54 - Evgeniy Kharam - What are we doing wrong in cybersecurity?
00:05:17 - Andy Ellis - what are we doing right and what are we doing wrong?
00:07:15 - Nipun Gupta - What needs to happen to get cybersecurity practitioners to trust cybersecurity vendors?
00:10:29 - Brent Forest - What is the value of mentorship in cybersecurity?
00:13:48 - Heather Noggle - How do you get small organizations to take cybersecurity more seriously?
00:17:34 - Karla Reffold - What piece of advice would you give somone trying to get into cybersecurity?
00:19:16 - Will Lin - Where do you think this whole cybersecurity thing is headed?
00:22:37 - Jack Powell - What are we doing in cybersecurity that we should not be doing?
00:29:17 - Dutch Schwartz - What is missing in cybersecurity?
00:36:13 - Kevin Pope - What is your best piece of advice for those entering the cybersecurity field?
00:42:42 - Julian Cohen - How do we prioritize our defenses?
00:45:22 - Benjamin Corll - What do you love most about being in cybersecurity?
00:47:05 - Special Appearance by Chis Cochran and Ron Eddings of Hacker Valley Media
00:50:07 - Chris Patteson - How worried should we be about post-quantum cryptography?
00:54:03 - Peter Schawacker - What are we doing right in cybersecurity?
01:01:45 - Adrian Sanabria - What is it we are not doign in cybersecurity that we should be doing?
01:08:38 - Chris Foulon - Where is this whole cybersecurity thing headed?
01:13:52 - Claude Mandy - What are we getting wrong in cybersecurity?
01:18:25 - Gary Hayslip - What is the trend towards a data-centric security model?
01:26:17 - Kirsten Davies - What is going to change with threat intelligence in 2023?
01:30:58 - Special Appearnce by Dr. Ursula Alford (Allan's wife)

Can We Even Measure Risk? with Andy Ellis and Chris Roberts - EXPLICIT Dec 14, 2022

This is another "'E' for explicit" show as this one is another LIVE! show from the CISO XC conference in Dallas-Fort Worth. Why the 'E'? Because halfway through Allan Alford's conversation with Andy Ellis (CISO at Orca, Operating Partner at YL Ventures, former CISO at Akamai), Chris Roberts (CISO at Boom Supersonic) joins the stage with some fine whisky and his own clever takes on measuring risk.

Join Allan, Andy, and Chris as they deconstruct risk, extolling its virtues, and hopefully change the way you think about risk altogether. Is likelihood times impact valid? Is the 5x5 grid valid? What is plausibility vs. probability? Find out on this great LIVE! episode!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Is It Even Our Job to Make Them Care About Cybersecurity? with Yaron Levi Dec 07, 2022

In this episode, Allan Alford plays Devil's advocate - challenging the practitioner community to refute the idea that we should quit trying to make the organization care and simply make suggestions and accept the organization's level of risk tolerance.

Allan posted this topic on LinkedIn and it created quite a buzz. The show features quotes from Simon Goldsmith, Kevin Pope, Malcolm Harkins, and others.

Listen to hear a deconstruction of this position, and hear some great arguments both for and against it. We'll give away the ending - the argument is ultimately refuted - but it is a great thought exercise and a wonderful journey getting to that conclusion. Hint: The show's ending is more apt than ever: "Ya'll be good now!"

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Building Cybersecurity Community with Scott Schindler Nov 30, 2022

Scott Schindler, veteran CISO, vCISO, and adjunct professor joins Allan at the ranch to talk about how to build, strengthen, participate in, contribute to and benefit from a cybersecurity community. Allan chose Scott for this show because of his incredible community focus and the high level of participation and engagement he demonstrates in his own career.

How can we, as privacy and security professionals, overcome our paranoia in order to build community?

How do we, as new members of cybersecurity, break into the community?

How do I start a local community?

How do we welcome others?

What is wrong with the cybersecurity community today that we need to fix?

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Geopolitics, APTs and Cybersecurity with Dan Holden Nov 16, 2022

Dan Holden, a 20+ year industry veteran, former vendor, and current CISO at Big Commerce joins Allan Alford at the ranch to talk about the BIG picture. Join them on this wild trail ride that goes as far back as the Monroe Doctrine of 1823, the pre-cursors to WWI, Regan-era cyber doctrine, cyber and modern warfare, lessons learned from the COVID economy (hint: GDP is now part of critical infrastructure), famous APT heists, modern global imperialism... This show ties these threads together into a forward-looking vision for cybersecurity that includes shifts in global prioritization of cybersecurity, federal regulations, and changes to the VC investment landscape. Saddle up and get ready for a wild ride!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

3 Very Practical Tips with Duane Gran Nov 09, 2022

This week Allan Alford is joined by Duane Gran, Director of Information Security at Converge Technology Solutions to discuss three different aspects of the CISO craft -- and to offer practical, concrete guidance on how to achieve the right outcomes:

Eliminating the culture of "No!"
Managing Third-Party Risk
Building a "No Blame" Culture

The common thread behind all of these themes is relationship building and goodwill - but the details are well worth the listen!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Should the CISO...? with Andy Bennett Nov 02, 2022

In this week's show, Allan and his guest Andy Bennett (a very clever CISO with a heck of a pedigree) decide to tackle some thought exercises with a series of questions that all start with "Should the CISO...?"

Should the CISO be the one to decide whether to report breaches?
Should the CISO own the SOC?
Should the CISO report to the CIO?
Should the CISO have an MBA?
Should the CISO be mentoring individual contributors in their team?
Should the CISO be sharing the political realities of “upstairs”?
Should the CISO own Identity?

Enjoy this fantastic conversation that goes to a lot of surprising places!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Tired Topics in Cybersecurity - Part Two with Michael Santarcangelo and Rich Mason Oct 26, 2022

Once again, Allan, Rich, and Michael dissect topics in our community that are, well, tired. Topics are brought up to spur online debate, but for which a conclusion is never reached. Topics that bifurcate our community without moving our industry forward. Topics that cause us to overly rotate on the wrong areas.

In this show we address:

Defining terms: zero trust, ML, AI, hacker vs. cracker, cybersecurity vs information security

How to pronounce "CISO"

Work from home vs coming to the office

Do we deserve a seat at the table or is it earned?

Hopefully, these three are stepping beyond the tired answers to these topics and are raising the bar on how we should approach the information security profession. You be the judge...

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Tired Topics in Cybersecurity - Part One with Rich Mason and Michael Santarcangelo Oct 19, 2022

We have all seen the conversations on LinkedIn where someone starts with a hotly debated topic, and the debate goes on and on, nothing is concluded, and then the next week, someone else posts the same topic and starts the gerbil wheel spinning again. We have seen this phenomenon with common complaints too. These are, in short, tired conversations.

Join Allan Alford, Rich Mason, and Michael Santarcangelo as they rope in some of these tired topics and propose alternative ways of looking at them.

This one runs a bit longer than usual because the conversation is that good. Also, there are a few naughty words...

In this Part One episode they offer some alternative takes on the following tired topics:

Who should the CISO report to?
Users as the weakest link
Talent Shortage
CISO Burnout
Imposter Syndrome
Awards Marketing
Bad Vendor Behavior

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

One Tool to Rule Them All with Derly Gutierrez Oct 12, 2022

CISOs and other security executives have relied on spreadsheets to perform a great deal of the management functions of their programs. What if there was a better way? Derly Gutierrez is back on the ranch for a third time now to discuss his alternative - the humble ticketing system. It might seem obvious in some cases, but Derly has pushed the use cases far beyond what you might imagine. Topics Derly and Allan cover include:

Risk Management Lifecycle
Vendor Management Lifecycle
Personnel Onboarding/Offboarding (Joiners, Movers, Leavers)
Data Governance Lifecycle
SOC2 Audits
Internal Audits
UI Considerations
Organizational Familiarity with the Tool
Automation & Integration

In this short but sweet episode, a lot of very practical tips are addressed. Y'all be good now!

Links:

Thank you to our sponsor Axonius for bringing this episode to life!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Cybersecurity Myths & Misconceptions with Josiah Dykstra Oct 05, 2022

Josiah Dykstra, Cybersecurity Technical Fellow at the NSA and Author, kicks up the dust off some previous topics discussed on the Ranch and deepens the conversation on cybersecurity myths and behavioral economics. Prior to the release of his latest book, Cybersecurity Myths and Misconceptions, Josiah breaks down some biases, fallacies, myths, and magical thinking that cybersecurity practitioners fall victim to. Josiah taps into cyber’s psyche and exposes the errors behind practitioners playing make-believe.

Timecoded Guide:

[00:00] Researching cybersecurity psychology & other exciting industry mashups

[09:22] Security logical fallacies: straw man, gambler’s, & ad hominem

[15:19] Cyber cognitive biases: confirmation, omission, and zero risk bias

[19:24] Perverse incentives & cobra effect: security vendors, bug bounties, & cyber insurance

[25:55] Creating an accurate measure of how secure we really are

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

In the context of cybersecurity, what are some examples of magical thinking?

Magical thinking, or the belief that thoughts can influence the material world, appears alongside the most common assumptions in cyber, according to Josiah. Recognizing the harmful practice of cyber practitioners blaming users for bad decisions, Josiah uncovered that many security pros believe the user will make the right choice without any additional training. Unfortunately, this magical thinking only leads to users being unprepared and uneducated.

“We assume users will pick good passwords without providing them education. We can't just think in our heads that things will go right, that never happens. We need to make careful decisions, whether it’s how we configure systems, or develop software, or conduct training.”

Can you walk us through common fallacies in cybersecurity, like the gambler's fallacy?

While the straw man fallacy and ad hominem are often easy to identify in the cyber industry, Josiah explains that the gambler’s fallacy is just as pervasive and detrimental. The gambler’s fallacy involves seeing trends and “hidden” meanings in independent events. Most often, in security, cyber practitioners will believe a breach won’t happen if a company recently had a breach, even though these breaches would have nothing to do with each other.

“Imagine you’re flipping a fair coin, like a penny, and you get heads, heads, heads. Your brain starts to see an error, like, ‘I'm due for tails, if I had so many heads in a row.’ The fact is, the penny doesn't care about the last flip. These are all independent events.”

What about common cyber biases, such as zero risk, confirmation, and omission bias?

The cyber industry is ripe with biases. In fact, over 180 cognitive biases exist. Josiah’s book tackles a select few that appear time and time again, including zero-risk bias. Zero-risk bias is extremely common in cybersecurity. Security is about risk— understanding it, preventing it, and reacting to it. Many cyber companies will put all their eggs in one expensive basket, such as encryption, believing that this will create the impossible scenario of them having “zero” risk.

“We talk in the book a little bit about how you can never get risk to zero, right? Cybersecurity is always about risk management. There is somewhere between more than zero and less than 100% chance that your computer will get infected today.”

“The goal of a security vendor is to keep you secure.” Why is that a misconception?

Just like biases and fallacies, cybersecurity misconceptions can be costly mindset mistakes that lead to easily preventable errors. Josiah wants us to consider that security vendors are not altruistic, they’re running a business and making a sale. While many vendors have a goal to keep customers secure, that will not be the only goal they have. Josiah recommends taking precautions and never assuming the vendor will always put security first.

“The goal of any business is to make money. That's why that business exists. You could argue with me that it isn't an ‘either or.’ They can make money and we can be secured, we can have both, but that's an ideal world. I think, in reality, it's a little bit bumpier than that.”

----------

Links:

Learn more about Josiah Dykstra on his LinkedIn and his website

Check out Josiah’s book,Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls That Derail Us

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Entrepreneurship After the Golden Handcuffs with Christian Espinosa Sep 28, 2022

Christian Espinosa, Author, Speaker, and CEO, comes down to the Ranch to talk about the journey of starting, growing, selling, and moving on from the business he created, Alpine Security. From correcting the problems with his high IQ staff to unshackling himself from the golden handcuffs of a business sale, Christian breaks down the specific conflicts he faced on his entrepreneurial journey— and reveals how these experiences have inspired two books about cybersecurity, business ownership, and life itself.

Timecoded Guide:

[00:00] Finding business coherency in the one-page strategic plan

[08:39] Selling Alpine security & transitioning from leader to participant

[13:46] Escaping the golden handcuffs & embarking on a new career journey

[17:35] Outlining seven steps to emotional intelligence in cyber with his first book

[20:34] Embarking on appreciation of life’s little moments with book number two

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What were the challenges in growing the business you started, and how did you overcome those?

Christian’s inspiration for Alpine Security, his first business, was actually the stress of a conflicted relationship with a CEO he worked with. Feeling misaligned with the company he worked for, Christian left and began his journey towards entrepreneurship, thinking that his work ethic and willingness to do it all would lead to his success. Instead, refusing to delegate and lack of focus on leadership created conflicts between himself and his employees.

“I had to get over myself. Initially, I thought I’d do everything. I thought I could brute force this and make this work. I just tried to do it all myself. If my staff was having problems with something, I would jump in and help, but there's only so many hours in the day.”

Was your intention to sell your business from the beginning? What was the process of selling like?

Although he advises every entrepreneur to have an exit strategy, Christian admits he didn’t initially create one with Alpine Security. After agreeing to a deal with Cerberus, Christian learned the hard way that the process of a business sale can be like a pair of golden handcuffs. Struggling with a lack of control and feeling constantly under scrutiny, Alpine Security eventually lost its founder as Christian embarked on a new journey in his career.

“In my company, I was in charge of the culture, the core values, the emotional intelligence, the touchpoints, the clients, all of that. Now that I was part of the larger organization, I wasn't in charge of that. I had to approach things differently.”

Can you tell us about your first book and the seven-step process it outlines in cybersecurity?

Major struggles during Alpine Security’s founding were due to a lack of emotional intelligence and people skills amongst staff, in Christian’s opinion. These conflicts inspired the 7 steps of emotional intelligence for cybersecurity practitioners that Christian outlines in his first book, The Smartest Person in the Room. These steps include: awareness, mindset, acknowledgement, communication, mono-tasking, empathy, and Kaizen (continuous improvement).

“My first book is really about all the challenges I had in the company I started. 99% of the challenges I had were because of my staff, who were super bright, super high IQ penetration testers that didn't have emotional intelligence or people skills.”

What are you going to do with your new book? Is that also cybersecurity related?

In contrast to his first book, which focused solely on cybersecurity professionals and the struggles they face with people skills in the workplace, Christian’s second book dives deeper into mindset. Focusing more on the value of life and the ideas around mono-tasking, Christian inspires his readers to care more about the micro moments. This second book is all about slowing down, seeing what’s happening around you, and seriously absorbing the information we take in every day— from the big moments to the little moments and everything in between.

“I think a lot of us go through this zombie state in life, going from one thing to the next thing, and we're distracted with our phones and everything else. We're missing a lot of things that are right in front of us.”

----------

Links:

Learn more about Christian Espinosa on his LinkedIn, Twitter, and website

Check out Christian’s book, The Smartest Person in the Room: The Root Cause & New Solutions for Cybersecurity

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

How APIs Expose Business Logic Flaws with Chuck Herrin Sep 21, 2022

Chuck Herrin, CTO at Wib, came down to the Ranch to explain the risks and threats currently facing APIs, or application programming interfaces. Simply put, APIs facilitate people and applications in communicating with other applications, but Chuck sees the lack of protocols, regulations, and security plans laid out for these APIs as a massive security threat. Breaking down the process using an API hack he performed as an example, Chuck talks about what the state of API security is and where it needs to be headed.

Timecoded Guide:

[00:00] Bringing a background in finance into the cybersecurity API world

[05:25] "Hacking" a bank’s API using business logic instead of hacking

[12:17] Implementing standard API protocols and processes

[14:27] Flipping the API language and preparing injection threats

[19:03] Evolving defenses overtime to meet both new needs and new risks

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What does your current role look like and how does it relate to API security?

Chuck began his career in tech and security in the banking industry, and felt particularly concerned over time with the lack of security around APIs and related technology. Now, with his CTO position at Wib, Chuck works with Wib to focus on providing continuous visibility into API attack surfaces. Outside of just the newness and the tech of APId, Chuck explains that there are critical infrastructure and national security ramifications for API security.

“The basic premise is: If you could do it differently, knowing what you know now, what would you build in an API security platform? What I'm bringing to the table is 20 years as a defender in US financial services, where I know what we need from a governance perspective.”

Akamai recently ran a study of internet traffic. What were their findings about APIs?

As someone well researched in his work with APIs, Chuck pays close attention to recent studies, like one from Akamai, that recently claims 91% of their global internet traffic is API traffic. Chuck explains that this is a huge development in the popularity and impact of APIs on global security, especially when relating it to a separate study that estimates 50% of APIs are actually unmanaged. Although this stat seems shocking, many in the industry believe even that estimate is low, and the issue might be even worse than studies are showing.

“91% of the traffic that Akamai handles is API traffic. So, 91% of global internet traffic is API traffic. Another stat which is a little harder to prove estimates that roughly 50% of API's are completely unmanaged.”

You actually performed a hack live on an API, but it wasn't even a hack at all. Can you tell me that story?

At the most recent Black Hat, Chuck dissected and presented a few case studies, one of which was a bank’s API, hacked using a logic-based attack. Using the errors in business logic present within the banking API, Chuck’s team was able to bypass the front-end system and transfer fees, managing to convert money into more valuable currency over and over again. The wildest part, to both Chuck and to presentation attendees, was that this didn’t require tech hacking, it only required exploiting business logic.

“We didn't tear apart the mobile app and find the stored credentials, the API keys, which are probably in there. We didn't crack any passwords. We just abused the logic, and it responded in the way it was designed and here we are.”

If we can’t anticipate every possible business logic flaw or abuse case, how can we reduce the impact and blast radius of API threats?

Reducing the impact of API security threats feels daunting, but Chuck explains that security has to go back to the basics in order to identify and acknowledge what has to change over time. You can't protect what you can't see and our teams have to evolve over time to defend against the changing attackers we might end up facing with APIs. When push comes to shove, Chuck firmly believes in having a defense strongly informed by the offenses and threats around you.

“This was cloud security 10 years ago, and it's API security today, right? History doesn't repeat, but it rhymes. It's the same basics and same fundamentals. Now, you need to change tooling. The attackers evolve over time, and your defenses have to evolve over time.”

----------

Links:

Learn more about Chuck Herrin on LinkedIn and the Wib website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

What Is (And Isn’t) a CISO with Matthew Lang Sep 14, 2022

Matthew Lang, former CISO at SECU, former CISO of 3D Systems, and former Chief Petty Officer in the US Navy, comes on down to the Ranch to talk about what it really means to be a CISO. Many folks wear the title of CISO, but the role itself is still often considered a confusing mixed bag when talking about what it entails and who should have this role. Matthew walks through what a CISO is, what a CISO isn’t, and where the bridges between the CISO role and other roles in the company should be.

Timecoded Guide:

[00:00] Defining what a CISO isn’t in order to discover what a CISO is

[06:45] Finding the bridges between CISO & other company roles

[12:12] Getting things clear between CISO, COO, CIO, and CEO

[16:20] Understanding a CISO’s peers & meeting with security points of contact

[24:49] What the CISO role should be & solidifying the CISO definition

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What is the CISO not?

The role of CISO, or Chief Information Security Officer, is nuanced and occasionally complicated to define. However, in Matthew’s opinion, the things that a CISO absolutely is not is (1) a BISO, or Business Information Security Office, and on the other hand, (2) someone with no experience in information security. The strongest CISOs Matthew has come across know how to combine information security experience with an understanding of business, all while being guided by a desire to protect the company and prevent incidents.

“The CISO is a preventer of something bad happening at the organization. You can't prevent every breach, it's never going to happen, but if the CISO is involved, he can possibly prevent a merger or acquisition that is not in the best interest of the company.”

Who should the CISO be interfacing with as we bridge in and out of that defined role?

To be an effective CISO, Matt believes that you have to build strong relationships with individuals in departments like legal and HR. Referring to them as security points of contact, Matthew explains that keeping in touch with these individuals can give the CISO the full scope of the company. Additionally, Matthew says that a CISO should always be friends with the COO, or Chief Operating Officer, because those roles have essential communication between one another.

“If your company is large enough to have a chief operating officer, the CISO and the COO should be the best of friends, because they rely on each other more than they realize.”

How does the Board of Directors shape and influence what the CISO is and isn't?

The Board of Directors’ involvement with a company’s CISO can be just as nuanced as the CISO role itself. Matt explains that the largest gaps between a CISO and the Board they have to report to are due to either a weak board structure or a misunderstanding of security amongst Board members. In Matthew’s experience, being thorough in security explanations with transparency about topics that members may not know helps to bridge the gap and develop a stronger and more positive relationship between the CISO and Board.

“I think, personally, CISOs struggle a lot with their presentations to the Board of Directors, because they don't really know what information the Board wants and the Board won't ask them questions.”

What should be the role of the CISO?

While a large majority of the conversation in this episode is about what a CISO isn’t, Matthew defines what a CISO is using the words “preventer” and “leader.” A CISO should prevent risky behaviors that are not in the best interest of a company, and they lead the cybersecurity division of a company through establishing security and governance practices. Overall, CISOs help a business to meet goals and go where it wants to go safely and effectively, like a good brake system on a high-end car.

“There's a lot of different responsibilities a CISO could have, but I'm gonna say the role is cybersecurity leadership. They should be responsible for establishing the right security and governance type practices, and a framework to scale the business.”

-------------

Links:

Learn more about Matthew Lang’s work with the SECU

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Fighting the Increase in Cyber Attacks with Leon Ravenna Sep 07, 2022

Leon Ravenna, CISO & CIO at KAR Global, former VP of Security & Compliance at Interactive Intelligence joins Allan this week to talk about the increases in cybersecurity threats and risks - increases in breadth and depth of various attacks and increases in our own problems in dealing with those attacks. It has implications for all of us, as we have not necessarily seen an increase in the right defensive capabilities to maintain parity. COVID and work-from-home have not helped either...

Questions covered this show:

1. You mentioned firewall attacks, social engineering, HR/interview/job fraud. Of course there is ransomware. What else is on the rise?

2. How much has COVID and work-from-home impacted the landscape?

3. What are the vendors doing wrong about this landscape?

4. What are they doing right?

5. So what are the real solutions to these problems? Let’s break it down, starting with ransomware, my personal favorite.

-Firewall attacks

-HR/Interview/Job Fraud

-Phishing

-Insider Threat (another one possibly impacted by work-from-home and COVID)

-Credential Stuffing

-Zero Day Exploits

-1,000 Day Exploits

6. If everything is on the rise, and if spending in cybersecurity is steadily on the rise (it is a rapidly growing industry), then why aren’t we solving the problems?

7. If you could change any one thing in cybersecurity, what would that thing be?

-------------

Links:

Keep up with Leon Ravenna on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Understanding SEC’s Proposal for Cyber Risk Management with Yaron Levi Aug 31, 2022

Yaron Levi, current CISO at Dolby and former CISO at Blue Cross Blue Shield in Kansas City, comes down to the Ranch to talk about the March 2022 proposal from Securities and Exchange Commission (SEC). Titled the Cybersecurity Risk Management Strategy: Governance and Incident Disclosure, this report has huge implications for cybersecurity in any publicly-traded company. Yaron walks through his research into this report and explains what this means in the future for real-world cyber practitioners.

Timecoded Guide:

[00:00] Introducing the Cybersecurity Risk Management Strategy: Governance and Incident Disclosure

[08:45] Explaining filing 8-Ks and 4-day turnaround disclosures

[14:03] Debating the obligations of a third party in an incident (i.e. supply chain)

[16:04] Comparing SEC’s cyber proposal to accounting’s GAAPs

[25:33] Involving the Board of Directors in cyber risk management

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

This is a proposed set of amendments and not a ruling. What does that mean, in terms of the real world?

Although the proposal was initially released in March 2022, Yaron explains these current rulings have been floating around the industry since 2018 and aren’t expected to become solidified until October 2022. In the meantime, many in the industry are curious about what these regulations mean for any and all cyber practitioners. Yaron understands the concerns many have, but also emphasizes that this is a maturity progression for the cyber industry.

“With everything happening around us over the last several years, we see security becoming a higher priority and a higher maturity in many organizations. By and large, organizations understand that security is not a luxury anymore, or something that doesn't apply to them.”

Is this proposal starting to put some real pressure on organizations to not just give lip service to cybersecurity?

Lip service to cyber is an unfortunate commonality among publicly traded companies that want to look safe without putting the effort or expertise into security. Thankfully, Yaron believes this SEC proposal will accomplish a great deal in encouraging companies to develop and mature their cybersecurity teams and protocols. As cyber management roles and board integration becomes a must, lip service will give way to real strategic change and a better understanding of the impacts and implications of security.

“I think, as we mature as an industry, and as we more and more understand the implications and the impacts of security on everything we do, strategy is something that will be very important for us to have. I would assume that every company will need to have one.”

Is this the right time for people to be excited about if there's gonna be a lot more CISO jobs open up, or if there's gonna be more board seats opening up for CISOs?

Yaron believes this SEC proposal will elevate processes and initiatives already in place to continue to elevate the expertise and opportunities within cyber. While many may see an increase in CISO roles and board opportunities, it's important to note that it is not just about roles and jobs, it’s about cyber’s maturity. Our community, not just in cybersecurity but throughout the world, has become dependent on technology and its vital to have individuals leading with maturity and competence to keep these technical processes secure.

“Overall, I think these strategies are a really positive move, in terms of elevating the conversation, educating, providing more expertise, providing more knowledge, which ultimately, all of us will benefit from. All of us, and community and society in general.”

Do you have any closing thoughts or comments on this SEC proposal?

While Yaron breaks down individual elements of the Securities and Exchange Commission proposal with Allan, he understands that the most essential impact of the proposal is the potential it has to elevate the industry. Maturity and legitimacy is desperately needed in order to create cybersecurity’s own version of generally accepted practices. In the same way that accounting has GAAP, Yaron hopes this SEC proposal is a sign of the cyber industry growing up, coming into its own, and creating more secure processes in risk assessment.

“These proposals are part of our maturity progression and are part of our growing up as an industry and as a practice. This is something that we have to evolve into. We can probably look at other industries and figure out what we can learn and leverage from them.”

-------------

Links:

Keep up with Yaron Levi on Twitter and LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Ask CISO Allan Alford Anything pt. 2 Aug 24, 2022

Allan Alford, CISO/CTO and host of the Cyber Ranch podcast, resumes his session of AMA, or “ask me anything,” to cover the remaining questions left by curious cybersecurity practitioners on his LinkedIn. Previously, Allan posed two questions: If you could ask a 5-time CISO any question, what would it be? How about a cybersecurity startup CTO? Using the responses he received, Allan continues to walk through every topic under the cybersecurity umbrella and give further insight into what it means to be a CISO.

Timecoded Guide:

[00:00] Avoiding FUD (fear, uncertainty, and doubt) in your next cyber risk discussion

[06:10] Facing stressful ransomware situations without proper preparation

[12:11] Hiring hackers as team members & debating the ethics of black hat hackers

[21:20] Addressing cyber risk in an accessible way for your organization's board

[26:41] Understanding the past, present, & future of cybersecurity insurance

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Are you comfortable turning on the light in a dark room so we can see what we’re really dealing with? [from: Karen Andersen]

There’s a perception (and not a wrong one) that the CISO’s role is to turn on the light in a dark room and show a company what their biggest cybersecurity risks truly are. However true this may be, Allan wants to point out that explaining and socializing team members to the risks has to be done without inspiring FUD. FUD, also known as fear, uncertainty, and doubt, creates panic around the risks an organization faces every day and only succeeds in unnecessarily stressing out practitioners without a solution in sight.

“It’s very important not to fall into the trap of FUD: fear, uncertainty, and doubt. There’s a difference between socializing what’s wrong, and scaring people with what’s wrong. If you’re going to bring up the risks, at least bring up the beginnings of a solution.”

How effective do you think it would be to hire an actual hacker as a team member? [from: Jaden Turner]

With open positions, skills gaps, and labor shortages in cyber, the answer to the industry’s problems might either fall into the category of people outside of the industry or people who were once on the “wrong” side of it. Although Allan has worked with black hats in the past, he explains that hiring former black hat hackers is still a morality question for a lot of c-suite executives. Their work is often highly skillful and impactful, Allan explains, but many still question what it means to hire professionals that have moved from black hat to white hat.

“I think the bad guys probably have honed their skills better than the red team or the white hats, but then, you get into the morality questions. Do I want to support somebody who was once on the wrong side? Do I believe in reform and giving people a second chance?”

What’s the most difficult decision that you’ve had to make as a CISO that was not directly security related? [from: Brad Voris]

As Allan has gone through five different positions now as a CISO, he has seen it all on the cybersecurity side and the business side. While the cybersecurity decisions are stressful and high risk, Allan explains that there are very difficult decisions to make from a business point of view. Sometimes, a CISO has to make a choice to do what’s right for the business, even if that means that budget, personnel, or materials will be taken away from their security team.

“As a CISO, treating the business as a separate entity makes no sense to me. You have to be part of the business and actively accept that part of your role. There are business decisions that I've had to make that were right for the business and wrong for the security side, per say.”

How do you help other board members make sense of the cyber threat landscape? Why is addressing cyber risks crucial to any company? [from: Ulrich Baum]

Although reporting to a board is an often essential responsibility of any CISOs role, Allan explains that making sense of the cyber threat landscape relies on you being flexible— not your board. The board of your company requires a certain level of reporting and often responds best to a specific format. Instead of fearing a change, embrace the current board you have and learn what makes them tick. Addressing cyber risks is crucial to any company, and having the board understand you fully ensure success for your security team.

“There’s a board that was there before you were there, and you need to learn their ways and means. You need to learn what their concepts of risk are and you need to tailor your cyber risks to fit into that model.”

-------------

Links:

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Ask CISO Allan Alford Anything Aug 17, 2022

Allan Alford, CISO/CTO and host of the Cyber Ranch podcast, changes things up this week with a session of AMA, or “ask me anything”. Instead of hosting a guest, Allan takes center stage. On LinkedIn, Allan posed two questions: If you could ask a 5-time CISO any question, what would it be? How about a cybersecurity startup CTO? Using the responses he received, he walks through every topic under the cybersecurity umbrella and gives further insight into what it means to be a CISO.

Timecoded Guide:

[00:00] Seeing the best of the job in the often thankless role of CISO

[06:04] Building teams through learning strengths vs the negative perception of employee poaching

[09:50] Starting out in IT & transitioning to CISO through consistent skill-building

[15:18] Learning from past CISO mistakes & embracing business first, risk second, cyber third

[27:23] Understanding the industry with a technical CISO point of view & a hacker’s mindset

[38:06] Managing the many highs and lows of becoming a CISO

Sponsor Links:

Axonius gives his customers a comprehensive, always up-to-date asset inventory, helps uncover security gaps, and automates as much of the manual remediation as you want. Give your team's time back by checking out Axonius at axonius.com/platform/cybersecurity-asset-management

What skills and education level helped you land your first CISO position? [from: John Rosario]

Although he’s taken numerous CISO roles since his first position, Allan is quick to admit that he never applied for his first CISO gig. Instead, he was tapped on the shoulder and asked. Beginning his career in IT, Allan found opportunities when the company he was working for seemed to be lacking in the security space. Diving into product security after his roles in IT, Allan found himself asked by a CIO to combine his backgrounds and become a CISO.

“I was always the guy that played with the security stuff back in those days. I had a good product security background, and ultimately, parlayed those into a combined role when I became a CISO.”

Talking to your younger self: What’s the most important thing you would do differently after the knowledge you have from five gigs? [from: Ori Stein]

Compromise is king, even in the C suite, but Allan didn’t understand this as an early-stage CISO. Instead, Allan feels regret in recalling his lack of willingness to see other business concerns beyond security. He feels as if a successful, impactful CISO needs to not only prioritize security as their mission, but also needs to see the bigger picture of why a budget line or resource has to be used for something other than security at certain points in time.

“I think that was probably my single biggest failing as an early CISO: taking the security mission to be the penultimate mission of the company and refusing to acknowledge there were other business pressures and needs, where perhaps security had to take a backseat.”

What keeps you going in the field beyond passion for security, amidst the talent shortage, lack of cultural understanding, internal corporate budget challenges, and high stress? [from: Stephan Timler]

Cybersecurity is already a high-stakes, high-stress industry. However, pressures from staffing shortages, skills gaps, and budgeting challenges (all of which got worse during the pandemic) create an environment that burns out employees, including CISOs. For Allan, keeping himself going relies on a combination of his calling to help others, his love for the industry, and his own hacker-mindset curiosity to find out not only how something works, but also how to make it work in his favor.

“Number one, for me, is that it truly is a noble calling. I don't think we should ever lose sight of that. We are the good guys doing the right thing for the right players and the right people. It's a noble calling.”

What's the best and worst thing about being a CISO? [from: Ofer Shaked]

There’s a great deal of ups and downs that come from being a CISO, but thankfully, a major positive has been being able to answer the noble calling to help organizations become more secure. When a CISO can look back and see how well an organization has done because of them, Allan describes this feeling as invaluable. On the unfortunate flipside, being a CISO for an organization that doesn’t understand the role and only wants someone to check boxes can be extremely disheartening. Allan warns that he’s yet to meet a CISO that hasn’t encountered that at some point in their career.

“When you can look back on your body of work, and see that it had a meaningful impact; you can look at this organization and know this place is more secure than it was when you walked in the door…that’s probably the best feeling [for a CISO].”

-------------

Links:

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

When a CISO Writes a Book with George Finney & Robert Pace Aug 10, 2022

Cybersecurity practitioners give back to the community by recording Youtube videos, interviewing in magazines, or creating podcasts— just like this one. However, books remain a fantastic method of delivering info and impacting lives that shouldn’t be forgotten with the rise of social media. Allan tallied it up and thus far, nine of his friends have written books. He has been approached about writing one himself, and he wanted to get the inside track on the process. George Finney, CISO at SMU, and Robert Pace, CISO at Invitation Homes, explain the ups and downs of writing books from a cyber perspective. This interview with George and Robert was recorded LIVE! at the CISO XC 2022 conference.

Timecoded Guide:

[00:00] Introducing the cybersecurity and the personal books George and Robert write

[08:28] Overcoming writing challenges in order to help others with your book

[15:16] Understanding the monetary gains and losses of book writing

[23:59] Being purposeful, intentional, and useful with the book you write

[30:02] Advising potential writers on if they should write their book or not

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What made you choose books as your way to give back to the cyber community?

There’s numerous ways to give back to the cybersecurity community, including more modern methods of online videos and social media posts. However, books offered George and Robert a means of expressing their feelings and beliefs about cyber and about life that felt unique and special to them. For George, writing books fulfills his dream of being a writer, a passion he’s had since he was a kid, and allows him to combine that dream with his passion for bettering the cybersecurity industry.

“My passion is really around cybersecurity. I really wanted to bring these two things (cybersecurity and writing) together in my life, and do something that I think only I can do, from my unique experiences, my unique perspective." — George Finney

What were the biggest challenges you faced while writing your book?

Writing a book takes time and requires vulnerability. George and Robert are very familiar with those challenges. Facing these challenges often involves facing yourself, your wants, and your experiences. Robert especially felt challenged in writing his book because it was a personal story about losing his mother. Stepping out of his comfort zone to write about his personal life felt like a massive leap of faith, but he’s enjoyed impacting others with this story.

“Writing necessarily means that the time you dedicate to it is going to be spent in isolation. If you're spending 10 hours or 20, that's time you're not with your family, that's not time where you're going out, having fun. That's time you're on your own alone.” — George Finney

When you look at the time and effort that went into it, was writing a book worth it?

As Allan shares, podcasting with the Cyber Ranch podcast has offered him an avenue of success, but book writing does not always pay off monetarily. George and Robert have found other ways of seeing the value in their work, but as George especially explains, there are a lot of costs associated with writing a book that many aspiring writers don’t consider. Marketing especially requires a high volume of costs that many don’t expect when writing their first book.

“Mine has not proven to be successful to where I can retire from the job, but there is a feeling of richness that you can get from helping folks along the way. That has been a very fulfilling point.” — Robert Pace

If somebody wants to write a book, what's the best piece of advice you have for them?

If you want to write a book, Robert and George genuinely believe you should go for it. A writer doesn’t have to know everything to write a book, but they do need to understand their audience and intentions with the book they want to author. Aspiring authors, according to Robert, need to be especially cautious of how pride can negatively impact the writing process. Don’t be afraid to ask for help, Robert says, but don’t let pride get in the way of accepting that help, especially from editors and other educated writers.

“I will say when you want to write a book, remove your pride because it will get hurt if you keep it out there. Everyone is not going to like what you write. We're coming from a cyber perspective, we don't write like the guys that have majored in English.” — Robert Pace

-------------

Links:

Learn more about George Finney on LinkedIn and buy George’s books, Well Aware, No More Magic Wands, and Project Zero Trust

Keep up with Robert Pace on LinkedIn and buy Robert’s book, I Understand… You Forgot to Say Goodbye.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Doing More by Doing Less with Drew Simonis Aug 03, 2022

Drew Simonis, CISO at Juniper Networks, discusses the debate of doing more by doing less. So often in cybersecurity, practitioners think they have to do it all and view themselves as the smartest people in the room. The fact of the matter is that none of us are the smartest in the room and we have to learn to trust each other. Drew believes a collaborative, trusting environment will bring us to a place of doing less and seeing better results because of it.

Timecoded Guide:

[00:00] Introducing the foundations of Drew’s “do more by doing less” mindset

[07:03] Doing more by doing less, specifically in tech stack and GRC teams

[15:00] Revamping the cybersecurity and IT vendor ecosystem

[20:43] Understanding consumer and CISO impact on the cyber vendor market

[32:34] Reshaping the command and control security mindset

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

How can security teams be more successful by enabling good decision making, versus trying to keep everyone from falling off a cliff?

The cybersecurity industry is stuck in a helicopter parent mindset, where practitioners don’t trust their colleagues in IT and feel the need to do the work for them. Drew explains that this is a low trust environment, where more work is created and no one thrives. If the industry works towards a high trust mindset, individuals are able to do their jobs and make decisions based on their knowledge, and even face normal consequences for their decisions, too.

“[We think] we're the smartest people in the room. There's always this very dismissive, very condescending approach to our colleagues, who have very important jobs to do on their own. In a low trust culture, you get to the point where you have to be watching over everybody.”

How do vendors do more by doing less? How do they fit the trust and parenting model?

The bifurcation of the cybersecurity vendor system into cyber and IT has created more work for everyone involved, and has produced a lot of unideal results. With a lack of integrated solutions, organizations and departments suffer from simply not being able to have products that do everything they need them to do. There’s little cross-functionality and there’s often too many products happening at once to have one vendor making their intended impact.

“Why can't it all just work together? I think the whole notion of security as a buying center, separate from IT, created this opportunity for vendors to pursue a separate budget pot. In my opinion, it disincentivizes them from creating integrated solutions.”

What are we doing wrong as consumers that's encouraging this “do less by doing more” system instead of doing more by doing less?

Sometimes, the only thing that can be done is starting over. The current system thrives off of an “us” vs “them” mindset and a business vs technology mentality, where trust is low and doing more results in actually doing less. Roles need to be rethought and reconsidered in cybersecurity organizations and executive leaders need to step out of the ivory tower of leadership to re-educate themselves and better understand their own roles.

“The whole separation of the cyber technologists from the IT technologists comes back to that trust issue as well. I can't trust IT to do the right things, I can't trust them to patch, so I've got to sit over here over their shoulder and scan.”

What's the revenue and business argument for everything we've discussed?

There’s always the pressure of revenue metrics and tangible results, especially if a process or role has to change within a cybersecurity team. How does doing more by doing less show up as a tangible result and outcome? It turns out, that all depends on transparency. Knowing the outcome that’s being looked for allows for a better understanding between practitioners and business leaders when the business argument for doing more by doing less has to be made.

“As CISO, I can't take your problem and try to make it my own and then solve it. I've got to trust you to solve it, and I've got to empower you, with the right tools, the right processes, the right policies, so that you have safe guidelines to solve that problem within.”

-------------

Links:

Learn more about Drew Simonis on LinkedIn

Check out Juniper Networks on LinkedIn and the Juniper Networks website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Getting Back to the Basics with Sonja Hammond Jul 27, 2022

Sonja Hammond, Vice President & CISO at National Veterinary Associates, brings her love of animals and more importantly her love for security basics down to the Ranch this week. The buzz around new cyber technology and security protocols can easily warp our perspective on what’s most important for CISOs. Sonja spends some time in this episode explaining why cybersecurity organizations instead need to focus on simple tech and strong security processes and training protocols.

Timecoded Guide:

[00:00] Breaking down basics of people, process, and technology

[06:59] Where tech stack is failing us and how to keep the vendor community on hold

[10:31] Building a good GRC team with a focus on NIST CSF

[14:13] Training the right way for GRC and cyber professionals

[19:30] Understanding the end user and setting your cyber team up for success

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What does that mean to you, in cyber specifically, getting back to the basics?

Getting back to the basics is a common theme no matter your industry, but Sonja’s focus on it feels especially surprising when so much of the security world isn’t simple at all. Sonja explains throughout the episode that NVA strives for simple yet effective, not for something shocking or eye-catching. Especially considering Sonja’s work contains sensitive client data, she emphasizes that a basics-centric approach keeps the animals in NVA’s care and the people who love these animals safe. Although it may not be flashy, Sonja is proud of the well-oiled machine of her team and the security of their data.

“You have to get rid of your tech debt and bring your environment to current. You want modern, supportable technology. That's really key in order to keep everything secure.”

What's the opposite of your "get back to the basics" vision there?

Cybersecurity technology is often far from simple, but adding unnecessary bells and whistles only succeeds in further complicating things. Sonja’s back to the basics mindset encourages tools that cut out the unnecessary and strive for a streamlined approach. Sonja sees the appeal of a fun product to add to any protocols, but warns that fun rarely means secure. When there’s too much focus on the new and the shiny, that often means that focus is turned away from what’s most important: keeping data safe and preventing vulnerabilities from being exploited.

“There are groups that are implementing some security tools that are shiny, new, and lots of fun, but they still have those basic security holes, so they get compromised.”

What are we doing right when it comes to the people in our organizations, and what aren’t we doing right?

Sonja is happy to separate NVA from the pack by explaining their focus on involving cybersecurity practitioners in the everyday operations of their organization. Many companies keep these roles separate, letting tech and cyber professionals remain in their own roles without context of what their end user might be experiencing on their end. Instead, NVA strives to put cybersecurity employees in the shoes of their end users and day-to-day employees, giving them further context around the people they impact and the roles they influence, as well as providing them further insight into potential security risks that might be slipping through the cracks of daily operations.

“Get the cybersecurity people exposed to what really happens in the day-to-day, because if they can walk in the end users’ shoes, then they can understand where there are security implications.”

For the people that are checking in the patients and taking them back, how much do they learn about security?

It’s one thing to train security professionals in the day-to-day of an organization, and another to train other employees about the world of cybersecurity. To combat the often frustrating process of checking security compliance boxes, Sonja tries to change up training tactics with employees by sending playful videos and short informational emails. Keeping things short highly raises your chances of the content actually being read, Sonja explains, and it also limits the monotonous moments in the training process for employees who have very little experience in cyber protocols.

“We try to make it not quite so obvious that [our employees] are always getting training. We certainly do the traditional online CBT type stuff, to check the compliance boxes, but then we try to do some other things, like funny videos…Just simple things to remind them.”

-------------

Links:

Learn more about Sonja Hammond on LinkedIn

Check out National Veterinary Associates on LinkedIn and the NVA website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Debunking Cyber Myths with Adrian Sanabria Jul 20, 2022

Adrian Sanabria, Director of Product Management at Tenchi Security, arrives at the Ranch this week to debunk cyber myths and expose industry lies. Using his background running Security Weekly Labs at Cyber Risk Alliance, Adrian explains the lack of cohesive product testing happening in the cyber world, and delves into the research he’s done to get to the bottom of cyber’s most elusive statistics. Do 60% of small businesses go out of business after a breach? Adrian has an answer that just might surprise you.

Timecoded Guide:

[00:00] Introducing Adrian and his journey with Cyber Risk Alliance

[06:47] Buying awards and lying about customers

[13:24] Finding the source of fake cyber statistics

[24:28] The lies of vulnerability management and security awareness training

[30:58] Explaining Adrian’s It’s Time to Kill the Pen Test talk

[40:41] Creating a money-making concept for debunking cyber myths

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Can you tell me about your product testing lab with Cyber Risk Alliance?

We often hear the startup motto of “fake it ‘til you make it,” but Adrian wasn’t aware of how pervasive that concept was in cyber until he began his work with 451 Security. After encountering numerous professionals that expressed complaints and confusion with products on the market, Adrian wanted to break into the world of product testing— and the Security Weekly Labs were born. With a focus on external attack surface management and network vulnerability scanners, Adrian sought to find the truth behind the product vendors were selling him— and what he discovered strongly influenced his future.

“When we talk about myths and lies, it's not just straight up lies, right? At some point, they're faking it till they make it, and they get to a point where it's just too late to turn back. And then, it starts to get a little bit more insidious.”

Are vendors going far enough to fake customers and awards?

Not only are vendors “faking it” in a startup sense, some vendors have gotten right to the point of lying about the awards they’ve received and the high profile customers they’ve worked with. Adrian explains that buying and lying about awards has become a common practice within the cyber world, where certain businesses have let the marketing of winning an award override the legitimacy of their own success. While some companies may ignorantly feel drawn in by meaningless awards, more insidious industry liars have already mastered pulling out their credit card to buy what they want to win

“You can actually even fill in the name of the category you want to win an award for, you can just make up your own category. You drop a credit card and they send you a trophy. Some of these fake awards even have award ceremonies.”

Where do these cybersecurity statistics come from, and how do we validate them?

60% of small businesses go out of business after a breach— but do they really? Adrian’s exposition of cyber lies leaves no stone unturned, even when it comes to mystery statistics. Where did these numbers come from, and why would millions of businesses be more impacted by security breaches than fraud? After interacting with statistics like this with a shocking frequency, Adrian has even taken to Twitter on numerous occasions to call out companies marketing with fake stats and reveal his own research findings.

“There are people that have just hinged their reputations and their careers on some of these myths…And it's not that companies don't get hurt by breaches, but it benefits no one to make up stats, or to push this narrative.”

Is it time to kill the pen test?

There’s a lot of things done in cyber that might not have a place for everyone. Pen testing is near the end of Adrian’s list, but he’s quick to point out that the pen test process needs to change. Unfortunately, the bulk of what any organization is paying for when they run a pen test are vulnerability scans and report paperwork. Explaining a concept he developed with his friend and co-founder Kyle at Savage Security, Adrian explains that the modern-day pen test needs to look more like purple teaming and focus on prioritizing what really needs to be fixed.

“A lot of companies have pen tests, because they don't know what else to do with their security budget. You could apply that more broadly. A lot of people have a security budget, and they buy what they see their peers buy and do what analysts tell them to do.”

-------------

Links:

Learn more about Adrian Sanabria on LinkedIn and Twitter

Check out Tenchi Security on LinkedIn and the Tenchi Security website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Privacy Professionals & Regulatory Headaches with Adam Stone Jul 13, 2022

Adam Stone, Chief Privacy Officer at TrustMAPP, brings his decades of security and privacy knowledge to the Ranch this week to talk about the disciplines of security and privacy. Where do they intersect? What makes security professionals and privacy professionals different? And, maybe most important of all: How can these two disciplines work together within an organization without being perceived as useless regulatory headaches?

Timecoded Guide:

[00:00] Comparing and contrasting security and privacy responsibilities

[08:30] Privacy, GRC, and building trust with stakeholders

[15:28] Coordinated and cooperative efforts of security and privacy teams

[20:57] Security awareness training vs the lack of awareness of privacy

[27:26] Drawing the line with privacy laws for security professionals

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Where do privacy and security intersect? Where don’t they intersect?

Privacy professionals need the security professionals within their organization to make privacy work and implement a certain protocol within a privacy policy. Although each group may want to draw division, there needs to be a healthy and divided dose of both privacy and security within a company, and they cannot just be handled by one person tagged in for both. The main reason this shared responsibility of privacy and security under one roof doesn’t work is the differences in priorities. While Adam points out that both seek to serve stakeholders, security professionals are protecting property with technology and privacy professionals are protecting individuals with processes.

“Information security professionals are in place to protect property. Namely, they are in place to protect the property of their sponsor, usually a corporation…The privacy professional is protecting the individual from the accesses of a corporation, or from a larger entity.”

What does an information security professional need to know about privacy?

Within the world of security, privacy regulations and laws are often seen as a headache. However, according to Adam, privacy is misunderstood by many security professionals, who group privacy policies with the same technical protocols they use throughout their work. Privacy is administrative and reliant on how someone behaves within their workplace. Although technology may aid in privacy policies, the steps companies have to go through to maintain privacy for their customers is dependent on individuals and on the ways they are able to enforce strict protective privacy protocols on these individuals.

“What security professionals need to understand about privacy is that many, if not most, of the solutions to privacy problems, are not technological. They are process. They are administrative.”

If security awareness training is a norm, why isn't there privacy awareness training?

There are a lot of perceptions about privacy, and Adam admits that many of them are unfortunately negative. Between the headache of privacy law and the lack of privacy awareness within companies and organizations, what are people supposed to think about privacy? In Adam’s opinion, the perspective on privacy needs to shift and companies need to better understand that privacy is a customer service concern. Caring about how you market to someone, how you sell your wares, and the impact you have on your customers is a way to build trust with them and to provide them a higher quality of customer service, and all of that falls under the umbrella of privacy.

“In my view, [privacy awareness] is awareness of how you are communicating, how you are selling, how you are marketing, that potentially endangers the privacy of the individual.”

How do you keep up with the myriad of privacy laws that are constantly coming out and changing?

Adam has heard from security and privacy professionals alike about the anxiety of changing privacy laws, but his answer to the concern is to point out that someone simply can’t keep up with these privacy law changes on their own. Whether relying on the International Association of Privacy Professionals, or IAPP, or calling in the counsel of a legal team or privacy lawyer, there are numerous resources available for privacy and security professionals to learn about privacy laws, study them, and come to the conclusion of where to draw the lines and what decisions to make about privacy policies.

“There’s a line to be drawn between interpreting and operationalizing statutes and regulations, versus interpreting a given statute or regulation for purposes of defending oneself in court. That is where we really need the expertise and the authority that a lawyer brings to the table.”

-------------

Links:

Learn more about Adam Stone on LinkedIn and the TrustMAPP website.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

The Overrated in Cybersecurity with Jerry Perullo Jul 06, 2022

Jerry Perullo, former CISO of the NYSE, former chairman of the board off the FS-ISAC, founder, professor, and host of the Life After CISO podcast, comes down to the Cyber Ranch to discuss the many roles he’s had throughout his career and the many highly unique opinions he has on the cyber industry. Together, Jerry and Allan break down what’s overrated in cybersecurity, from patching to dark web to vulnerability departments, and every detail and concept in between.

Timecoded Guide:

[01:53] Taking on a variety of roles in the cyber industry and breaking down which elements of cybersecurity are overrated

[08:48] Recognizing when encryption is needed and when it is overrated or overemphasized as something you need in cybersecurity

[15:43] Service-level agreement timelines, addressing critical risks, and engaging with the 80/20 rule

[24:17] Understanding when to separate data about different vulnerabilities and attacks, and when to report on them in the same conversation (i.e. board meetings)

[29:58] Other overrated elements of cybersecurity, such as IoCs, dark web, and, of course, what Jerry would change in cyber if he had a magic wand...

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonius comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Why is patching overrated?

While Jerry acknowledges the importance of patching in certain contexts, he also explains that it’s often overemphasized in its ability to provide cyber solutions. For patching to make an impact, the vulnerability has to be known and understood. In Jerry’s experience, patching doesn’t solve many of the problems in cybersecurity and can instead create a false sense of security, especially in the case of in-house coding errors. Although patching can create a long-term solution, you may only overcome that weakness for a moment and end up coming back to the same issue a few months later.

“When I say it's overrated is, first of all, patching is to address a known vulnerability in a piece of software, right? That means that the vulnerability has to already be out there, has to be profiled, has to be understood, and the manufacturer has to have actually created some kind of fix for it.”

What about encryption? Is that also overrated?

The idea of encryption comes from the idea of keeping information and vulnerabilities out of your enemies’ hands. However, too much focus on encryption blinds us to other issues and other tools that can be used against us. Although certain vulnerabilities around encryption are exploited, Jerry points out that you rarely, if ever, hear about the threats that we’re warned about when we’re sold on the concept and idea of encryption. With so many other ways to be hacked and exploited, Jerry says our focus on encryption keeps us in the dark about what the reality of online safety is.

“In any event, we spend so much time worrying about encryption and encrypting things, and whether it's encryption at rest, or whether it's in transit, or anything else like that, that I think sometimes we blind ourselves, especially on internal tools.”

Are short SLAs (service level agreements) for addressing critical risk overrated?

In Jerry’s mind, the timeframe of your SLA doesn’t matter if you need a problem fixed immediately. Whether it’s a 48 hour turnaround, a 29 day, or a 364 day window, critical threats need immediate fixes and your service team should understand that. If the response to a necessary and urgent request is for your team to inquire about the SLA, you have a much bigger problem than the time it will take. Instead you have a toxic culture problem, something that cannot be fixed with simple tweaks to your SLA.

“I always would just preach that you don't want to ever undermine your credibility. You don't want to bring weak sauce. Gotta be able to reproduce everything, have a video, all of that, and if you don't, then yeah, you people are gonna abuse your SLAs and push it to the edge.”

What’s your thoughts on departments with “vulnerability” in their name?

Although Jerry has had vulnerability departments and teams in previous companies he’s worked with, adding vulnerability to a department name rarely has the impact beyond specifying that they run the vulnerability scanners. Beyond running the scanners, processing these results and reporting them is a completely different beast. Rarely is a vulnerability department able to process and report these results without making data ten times more complicated and time consuming for your board to understand. They’re tool-focused, it’s in their name, but it may not be what you really need when you’re assessing risk.

“I think it's really important that you just speak about them all collectively, in a tool agnostic fashion. So, I feel the vuln scanner results, the bug bounty results, the attack service management results, the employees raising their hand and volunteering info…they need to be portrayed in parallel in one communication.”

-------------

Links:

Learn more about Jerry Perullo on LinkedIn and listen to his podcast #lifeafterCISO

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Better User Awareness Training with Tim Silverline Jun 29, 2022

Tim Silverline, VP of Security at Gluware, joins host Allan Alford on the Ranch this week for a discussion about user awareness training and the latest and greatest (as well as not the greatest) methods around phishing simulations. Tim and Allan get into the nitty gritty of how your company can improve user awareness results through avoiding basic click-through models, considering advanced warning for certain training exercises, and understanding risk quantification when evaluating employee metrics.

Timecoded Guide:

[04:30] Running the right phishing simulation for your user base and gauging your results appropriately

[10:08] Pushing boundaries in the tactics used in phishing exercises and making employees pay attention more closely to their everyday emails

[15:10] Calling out unlikely and unhelpful phishing strategies and simulations, including the harm of impersonating employees without any warning

[21:04] Realizing which methods of user awareness are no longer effective and shifting away from the mindset of just “checking the box” in these training exercises

[25:54] Changing security for the better with increased awareness and a better understanding around the value of risk exposure amongst employees

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What, to you, are the biggest highlights, the high points, the critical bits of user awareness training?

Tim has seen the good and the bad of user awareness training, and has found the best results for his users in interactive training sessions, especially when paired with gamification. Allan compares this method and approach to modern virtual escape room sessions, and Tim agrees that the more interactive and hands-on a training can be, the better the learning experience will be. Instead of framing our user awareness and phishing exercises around checking boxes for cyber insurance companies, we should be striving for active learning engagements that demonstrate the value of security to our users.

“After those trainings, users have come up to me and talked to me about how they weren't aware of this particular risk and hearing about it in a real-world use-case was very effective for them to really understand why it's important and why they should be behaving in a slightly different manner.”

If the users never fall prey to attacks, is there a reason to continue performing them?

Hearing Tim talk about his success, Allan was curious about how he chooses to approach successful user bases. If someone isn’t falling for Tim’s phish, does he still see the need to perform these exercises? The short answer was yes, but Tim explains that user awareness training should be customized to the needs of a user base. Testing new employees is a must, along with refreshing successful users on their skills a few times a year. Additionally, scheduling out different exercises that hone in on different phishing simulations exposes employees to a variety of learning opportunities and encourages them to see this beyond just a yearly test where they might as well “get it over with.”

“If you've tested all your existing employees, and they haven't fallen or been susceptible to it, that doesn't mean that the next employee you hire is also going to be of that same mindset.”

What ineffective methods are there in security awareness?

Throughout the episode, Tim and Allan keep coming back to the simple fact that checking boxes no longer works. Having employees read or watch through videos and take “common sense” knowledge tests makes user awareness training a distracting activity that feels more like grunt work than a learning experience. While you never want to disrupt the workflow of your employees, stepping outside of the box with interactive activities that are explained in advance shows the value of these exercises to your users instead of making them feel that you’re yet again wasting their time with another gift card scam.

“I find that there's the typical thing a lot of people do to hit compliance, which is having their users watch videos, and answer questionnaires. My feeling is that most people just try to get that done. Their goal is really to get it completed, so they can check the box and their company stops bothering them to complete it.”

You are given a magic wand and you are told you can wave it and change any one thing in cybersecurity you want to change. What do you change?

There’s so much in cybersecurity that Tim and Allan would love to change, especially when we look at cutting edge approaches to user awareness training. However, Tim makes one thing clear: if he could change anything, he would change our mindset. Instead of seeing security as just someone’s job, we should encourage our users to see themselves as an instrumental part of their company’s security. When everyone concerns themselves with following the right protocols and caring about security beyond simulations, companies will find themselves in a much stronger, less vulnerable place.

“I think ultimately, a lot of the weaknesses inside of our organization are our users. If I could just increase the level of carefulness, or the level of interest that everybody has in keeping their own companies secure, I think we would overall improve the posture of all companies.”

-------------

Links:

Learn more about Tim Silverline on LinkedIn and the Gluware website.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

The Founder-Angel Investor Connection with Sameer Sait & John Stewart Jun 22, 2022

Allan invites a founder and an angel investor to the ranch this week to talk about how founders and angel investors really connect. Meet Sameer Sait, former CISO at Amazon Whole Foods and now founder of BalkanID, and John Stewart, former CISO at Cisco and investor at Talons Ventures. Together, these gentlemen offer a lot about both sides of the investment story, from evaluation to the decision to work together, and what a mutually beneficial founder and angel investor relationship looks like.

Timecoded Guide:

[01:23] Exploring John and Sameer’s backgrounds in cyber and how they developed their own unique founder-angel investor connection

[04:53] Understanding the triggering aspects that caused someone like John to become an angel investor in BalkanID and how BalkanID selected their investors

[08:20] Delving into the uniqueness of different founder-investor relationships and how John (vs other BalkanID investors) makes his impact on Sameer’s work as a founder

[13:30] Giving expert advice and explaining lessons learned in founding your first company and in investing in startups

[22:12] Exploring how other experiences in life, outside of cybersecurity and investing, has informed John and Sameer’s work with BalkanID and with solving cyber issues

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone.

What inspired you to become a founder of BalkanID, Sameer?

As the former CISO of Amazon Whole Foods and an investor at numerous cybersecurity companies, Sameer has a great resume to show off. However, his work with BalkanID offered him the opportunity to be a founder, something that Sameer had never done before. When asked what inspired him to be a first-time founder, he tells us that he continuously encountered the same problems over and over again, and wasn’t seeing anyone coming up with the right solution. Continuing to move forward with so much at stake with this issue of entitlements felt like a missed opportunity, and with the right investors and co-founders on his side, BalkanID was born.

“I knew that we could do better, right? And I knew the existing solutions were not scaling. And I think the last inspiration was really finding the right co-founders to go at this with. That was the biggest inspiration of all.” - Sameer Sait

John, what were the triggering factors that made you decide to invest in BalkanID?

Just like Sameer, John has some incredible experience to show off in the tech world and in the investment world. But why BalkanID? A simple answer would be the connection between these two men, having met numerous times throughout their careers, developing a strong working relationship. However, John sees so much potential in BalkanID and in Sameer beyond just their work friendship. John believes that you don’t invest in tech, you invest in people, and the qualities he sees in Sameer as a founder and a leader in the tech world excites him and he felt he could lend his expertise to BalkanID in a beneficial way.

“Sameer is very self-aware. These things matter. He knows what he knows, he knows what he doesn't know, he's comfortable bringing in people that complement his skills and make a stronger team around him. In the end, that's why I say you bet on people, not on tech.” - John Stewart

What advice do you have for potential investors looking to get involved in startups, John?

Being an investor isn’t always easy, and John has made some mistakes that taught him the hard way about how to be a good investor. With a hands-on approach and now tons of projects under his belt, John is asked to give some advice to future investors. A hugely important piece of advice from John is to know your founder, know their wants and needs, and to see ahead of what their future holds. You’re an investor, but it is their company, and you have to be aligned in order to produce a mutually beneficial relationship.

“As an investor, I follow out and look for all of those things. I look at how optionality is, how CEOs think, how many chances they have, what directions could they go. Are they strategically capable of looking beyond today's decision and thinking about what might happen in the future?” - John Stewart

Sameer, what advice would you give fellow founders?

Despite his experiences at other companies, BalkanID is Sameer’s first founding experience so far. His biggest lesson to date? Not getting caught up in the buzz and the hype. BalkanID’s approach to their audience and their product has been to focus on their customer and work backwards to find their problem and their ideal solution. This takes time, and it’s easy to fall into the trap of comparing your revenue, launches, products, and marketing tactics of other companies. This only hurts your brand in the long-run because you’ll no longer be focused on your customer’s problem.

“As an early stage, first-time entrepreneur, a part of me would get nervous. ‘Oh, my God, look what's happening out there. Oh, we're so slow.’ I think of taking a step back and saying, ‘Well, we are on our journey,’ right? We have supporters, we have backers, we have a real problem we're solving. The fact that other people want to solve the same problem is validation that it's a real problem.” - Sameer Sait

-------------

Links:

Stay in touch with Sameer Sait on LinkedIn and the BalkanID website.

Stay in touch with John Stewart on LinkedIn.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Open Door Security w/ James Allan-McLean Jun 15, 2022

“When people come to Security and tell you everything they are doing, that’s a real win.” - James Allan-McLean

Allan is joined by James Allan-McLean, Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military, to talk about his ‘Open Door Security’ method and the benefits of transparent, no-strings-attached approach to security. In this episode, Allan and James take a deep dive into this methodology and address questions such as:

-What is Open Door Security?

-What does a successful Open Door Security program look like?

-How to go about tackling security implications within your org

-The philosophy behind James’ ‘handrail’ metaphor

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

James is a highly effective and motivated information security leader with extensive experience in a range of sectors. He is a Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military.

Links:

Stay in touch with James Allan-McLean on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

DevSecOps w/ Chris Hughes Jun 08, 2022

Allan is joined by Chris Hughes, CISO & Co-founder at Aquia and adjunct professor at UMGC, to talk about all things DevSecOps (Development, Security and Operations). They explore the DevSecOps phrase itself, as well as why security should be treated as an integral component and not a separate entity. In this episode, Allan and Chris take a deep dive into the subject and bring clarity to questions, such as:

-What roles help achieve security in DevOps?

-What are the cultural barriers to implementing secure DevOps?

-What are some common mistakes as well as best tips?

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Chris Hughes is a proven Cloud/Cybersecurity leader with nearly 20 years of experience in both the Federal and commercial industries. Chris has a dynamic skill set, with a blend of IT, Cyber/Cloud Security and DevSecOps experience. He enjoys working across interdisciplinary teams to solve complex organizational and industry-wide problems to achieve technological transformation securely.

Additional Resources:
Google SLSA framework: https://slsa.dev/
CSCRM – NIST Appendix F : https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdfOpen SSF – OSS Mobilization Plan: https://8112310.fs1.hubspotusercontent-na1.net/hubfs/8112310/OpenSSF/White%20House%20OSS%20Mobilization%20Plan.pdf?hsCtaTracking=3b79d59d-e8d3-4c69-a67b-6b87b325313c%7C7a1a8b01-65ae-4bac-b97c-071dac09a2d8
Sounil/Andy Debate: https://www.securityweek.com/video-civil-discourse-sboms

Links:

Stay in touch with Chris Hughes on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Board Reporting Metrics Pt. 2 w/ Andy Ellis Jun 01, 2022

Andy Ellis, CISO at Orca Security, is back for part 2 of this series on Board Reporting Metrics. In Episode 1, Andy and host Allan Alford addressed some of the most common questions posed by the board and shared their perspective on what the board needs to know from a cybersecurity standpoint. In this episode, they continue the conversation by fielding questions from LinkedIn on topics such as:

-Vulnerability and threat hunting metrics

-Top 3 metrics to report to the board and why

-Breach reporting implications and much more!

Check out part 1 of Board Reporting Metrics here

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Andy Ellis is a visionary technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. A graduate of MIT and former US Air Force officer, Andy designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business. In his twenty year tenure, Andy led Akamai’s information security team from a single individual to a 90+ person team, over 40% of whom were women. In running Akamai’s security program, Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs, Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision making.

Additional Links:

Stay in touch with Andy Ellis on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Board Reporting Metrics Pt. 1 w/ Andy Ellis May 25, 2022

In this episode, Allan is joined by the CISO at Orca Security, Andy Ellis, to share his thoughts on board reporting metrics. What does the board need to know from a cybersecurity perspective? One of the questions is often: “Are we secure?” Is that even the right question? How much should you talk about compliance? Do you speak of IT assets? What about speaking to specific controls? Listen to this episode to hear the common questions posed by the board and how to answer them with metrics. In some cases, it is teaching them to ask different questions. This episode is a master class in board communication in cybersecurity, and the conversation went into such depth that a Part 2 is already being planned.

Check out Andy’s previous episode here

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Andy Ellis is a visionary technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. A graduate of MIT and former US Air Force officer, Andy designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business. In his twenty year tenure, Andy led Akamai’s information security team from a single individual to a 90+ person team, over 40% of whom were women. In running Akamai’s security program, Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs, Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision making.

Additional Links:

Stay in touch with Andy Ellis on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Getting a Seat at “The Table” w/ Brent Deterding May 18, 2022

“Having a seat at the table doesn’t mean getting your way all the time. It means having a seat and I think that is very important to understand.” - Brent Deterding

In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CISOs can earn and keep their seat at the executive table. Brent was a fan of the Learned Helplessness episode of The Cyber Ranch Podcast with Steve Mancini, and furthered the conversation as it relates to the often espoused topic of CISOs needing a seat at “the table.” Brent discusses the power of shifting your mindset, how lack of confidence has created a cycle of self sabotaging, and ways we can collectively improve our current standing.

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Brent is an Executive CISO whose mission is to enable Afni and its global workforce to support their customers securely and confidently. Prior to being a CISO, for over 20 years, he was a security practitioner with a security vendor specializing in threat detection, incident response, and security strategy. His efforts helped hundreds of organizations detect, respond to, and mitigate attacks.

Additional Links:

Stay in touch with Brent Deterding on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

All About SBOMs w/ Chris Castaldo May 11, 2022

“Knowing what’s in your software, in your organization, can help you quickly determine if you are impacted by a new vulnerability.” - Chris Castaldo

In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software Bills of Materials (SBOMs) and their potential implications and use. Chris explains the concept and purpose of SBOMs, his tips for signing and securing SBOMs in terms of the CI/CD pipeline, and his thoughts on SBOMs being a roadmap for “bad guys.” Lastly, he shares advice on managing and understanding contracts.

Listen to Chris Castado’s previous Cyber Ranch episode here and be sure to grab a copy of his book!

Guest Bio:

Chris Castaldo is the author of “Start-up Secure: Baking Cybersecurity into your Company from Founding to Exit”. He is an experienced and industry recognized CISO with over 20 years of experience in cybersecurity. Chris is an expert in building cybersecurity programs from the ground up and specializes in applying cybersecurity in start-ups from seed to exit. He is also a Visiting Fellow at the National Security Institute (NSI) at George Mason University's Antonin Scalia Law School.

Links:

Sponsored by our good friends at Axonius

Stay in touch with Chris Castaldo on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Total Greenfield Innovation w/ Guillaume Ross May 04, 2022

What would you do if you could build your security program from scratch?

In this episode, Allan is joined by the Head of Security at Fleet, Guillaume Ross, to talk about his time building out an innovative and out-of-the-box security program and the steps he took to make it all happen. Guillaume walks us through how he developed and maintained a serverless, container based environment, his tips for securing PCs and Macs within a serverless environment, and how to establish department and business buy-in and overall cooperation. Lastly, he details steps to ensure resilience in an ‘everything as code’ security model.

Some of what he builds might seem obvious – other parts will genuinely surprise you!

Guest Bio:

Guillaume Ross is the Head of Security at Fleet Device Management. He likes securing organizations, clouds, products and more, by refusing to implement the same things that have been tried and failed thousands of times already.

Links:

Sponsored by our good friends at Axonius

Stay in touch with Guillaume Ross on LinkedIn and Twitter

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Securing Cryptocurrency and NFTs w/ Nick Percoco Apr 27, 2022

What are the security implications of cryptocurrency and NFTs and what do we need to know in order to transact safely? In this episode, Allan is joined by the Chief Security Officer at Kraken, Nick Percoco, to talk about securing the cryptocurrency and NFT spaces. Allan and Nick reflect on the events of the Mt. Gox bitcoin breach of 2013, address some of the most common misconceptions about crypto assets, and explore the biggest security challenges users and retail investors face when navigating the space. Lastly, Nick considers what cybersecurity lessons can be drawn from the security practices within the cryptocurrency ecosystem.

Guest Bio:

Nicholas Percoco has more than 25 years of security & technology experience, and is the Chief Security Officer at Kraken - a global digital asset exchange - where he is responsible for Security, IT, Technical Project Management, Operational Resiliency and Engineering.

Links:

Stay in touch with Nick Percoco on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

”Playing Well With Others” - The Tech Stack w/ Tommy Todd Apr 20, 2022

Allan is joined by the Vice President of Security at Code42, Tommy Todd, to talk about how the tech stack can “play well with others”. In this episode, Tommy takes a deep dive into exploring how APIs and automation can help solve our needs in cybersecurity – from incident response to the tech stack. The two discuss how to evaluate security products during a Proof Of Concept (POC) for integration capabilities and tips on addressing ROI concerns.

Guest Bio:

Tommy Todd has over 20 years of cybersecurity experience, primarily focused on data privacy and data protection strategies. Prior to Code42, he served in security roles at Symantec, Ionic Security, and Optiv as well as many other firms. Throughout his career, he has acted as a leader, mentor, engineer, architect, and consultant to solve difficult data protection challenges.

Links:

Stay in touch with Tommy Todd on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Thriving In A Male Dominated Industry w/ Ashley Rose Apr 13, 2022

Allan is joined by the founder and CEO of Living Security, Ashley Rose, to speak about her experiences as a female entrepreneur and leader in a male dominated industry. She details the story behind her non-traditional route into cybersecurity and how she leverages her unique skills and vision to disrupt and transform the community. Ashley shares how she overcomes bias and business challenges in the field as well as the inspiration behind her creative marketing strategies. Lastly, the two highlight the lack of diversity and representation in the space and give advice to young entrepreneurs and females in, and breaking into, cybersecurity.

Guest Bio:

As the CEO of Living Security, Ashley has been the driving force behind the company’s rapid growth. Since its founding in 2017, Living Security has raised more than $20 million for growth and product development and accelerated revenue growth for three consecutive years. Ashley is also continually working to build a diverse and inclusive organization around the belief that the team should reflect the community at large.

Links:

Stay in touch with Ashley Rose on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Why CISOs and CIOs Don’t Get Along w/ Nick Vigier Apr 06, 2022

This episode of the Cyber Ranch Podcast was recorded LIVE on stage at the CISO 360 Conference in New York City, hosted by Pulse Conferences. Nick Vigier, a seasoned CISO and former CIO, joins Allan in addressing the elephant in the room: Why don’t CISOs and CIOs don’t get along?

Nick draws on his experience in both positions to share his unique perspective on the CISO and CIO relationship. In this episode, Allan and Nick highlight the operating differences between the two positions and explore the opposing interests that exist around topics such as budgets and reporting structure. Lastly, Nick shares why engaging in empathetic conversations around metrics, business impact, and risk management is the ultimate key to a more harmonious relationship.

Guest Bio:

Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization.

Links

Stay in touch with Nick Vigier on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Learned Helplessness in Cybersecurity w/ Steve Mancini Mar 30, 2022

This topic couldn’t be more relevant given recent events in the security community. Allan Alford is joined by Steve Mancini, CISO at Eclypsium, to have a refreshing conversation about the negative messaging, thinking, and tropes in cybersecurity - not just the stuff that the press says about us, or even the stuff we say about each other - but the self-defeating stuff we think and say to ourselves.

Steve addresses the reinforcement of negative catchphrases and how it affects the psyche of the community and explores how burnout is creating a culture of sleepless nights and masochistic badges of honor. Lastly, they emphasize the importance of empathy and support within the community and remind us that humans are our greatest asset, not our weakest links.

Guest Bio:

Steve Mancini is the CISO at Eclypsium, former Deputy CISO at Cylance, and an advisory board member for several cyber companies.

Links:

Stay in touch with Steve Mancini on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Leveraging Employee Strengths for Cyber Roles w/ Nick Vigier Mar 23, 2022

There are numerous personality tests available to help identify personality traits, but many of them have very little scientific validity or reliability. Such tests often aspire to explain what you are good at and what you are bad at, and miss the mark. In this episode, Allan is joined by his friend and owner of Rising Tide Security, Nick Vigier, to explore CliftonStrengths – a personality measurement that focuses less on ability, and more upon your predilections - what energizes you, and what and drains you - and with a pretty good degree of scientific validity and reliability. Nick and Allan explore what makes CliftonStrengths different from the other personality assessments and how Nick leverages that information to better understand his team and colleagues, and to help folks find the right role in cybersecurity. The two sit down to dissect Allan’s own assessment results to identify his top 5 energizers, as well as his top energy drainers. And lastly, Nick shares why he favors the idea of personality development plans vs professional development plans in the workplace.

Guest Bio:

Nick Vigier is the Owner of Rising Tide Security and former CISO at ID.me, DigitalOcean, and former CIO at Gemini. Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization.

Links:

Stay in touch with Nick Vigier on LinkedIn and Twitter. Take the CliftonStrengths assessment here

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

A Full Data Approach w/ Paola Saibene Mar 16, 2022

In the episode, Allan is joined by the Principal at Teknion Data Solutions, Paola Saibene, to bring clarity to an often misunderstood topic: data governance. Paola helps to distinguish the difference between data governance and data management, examines the intersection between data ethics and cybersecurity, and explores the best methodology for applying risk frameworks. Lastly, she takes time to express the importance of being people focused and “humanizing” cybersecurity.

Guest Bio:

Paola Saibene is the Principal at Teknion Data Solutions, Former CISO, CEO, VP of Enterprise Risk Management, Data Privacy Officer, Strategy Officer, CTO, and CIO.

Links:

Stay in touch with Paola Saibene on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

The Great Resignation & Cybersecurity w/ Jessie Bolton Mar 09, 2022

With a looming skills/people gap in cybersecurity and retention at an all time low, it begs the question: Where is everyone? In this episode, Allan Alford and guest Jessie Bolton sit down to discuss the elusive “Great Resignation” and how it is affecting the cybersecurity community. Tune in to get the answers to the questions we are all asking ourselves, like: why are people resigning, how has the pandemic shifted our perspectives on work and boundary setting, how is the “great resignation” impacting security organizations, and how can we attempt to solve this issue?

Links:

Follow Jessie Bolton on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

How Old is Data Risk Management? w/ G. Mark Hardy Mar 02, 2022

In this episode, Allan is joined by the President at National Security Corporation, Navy veteran, and host of the CISO Tradecraft podcast, G. Mark Hardy. This show takes a fascinating dive into the origins of data risk management, measurement, and quantification. G Mark explores the stories and advice given from some of the greatest leaders in this space – whose advice still rings true today.

Key Takeaways:

01:52 G Mark’s bio

06:43 FIPS-65 - the “grandaddy” of risk management

11:34 The ALE method, explained!

14:35 Oldies, but STILL goodies

18:12 A stroll down risk management memory lane

28:56 Revering “the greats”

37:22 What do you value and what’s your currency?

Links:

Stay in touch with G. Mark Hardy on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

CISOs as Caretakers w/ Randy Potts Feb 23, 2022

In this episode of The Cyber Ranch Podcast, Allan is joined by the CISO at Real Time Resolutions, Randy Potts. The two sit down to have a refreshing and raw conversation about the caretaking, responsibility, and code of ethics for CISOs - or lack thereof, and how to get back in touch with our “why” and mission.

Disclaimer: This episode briefly mentions pornography and gambling within an important and relevant context, and has therefore been categorized as explicit.

Key Takeaways:

01:43 Randy’s bio

03:08 Caring for “the people”

09:08 Stewards and custodians of data

14:10 Servant leadership

16:57 CISOs as caretakers

18:53 Doing the right thing

21:18 CISO code of conduct - or lack thereof

24:55 How do we fix this?

29:06 It’s nice to be nice

Links:

Stay in touch with Randy Potts on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Uptycs

Practical Trust-Centric Security w/ Omar Khawaja Oct 27, 2021

Omar Khawaja is an experienced CISO with a strong technical background, who managed to find some very creative ways to manage his security program that go against his engineering instincts. Join Allan and Omar as they discuss why trust-based security is the more suitable option to have a fundamentally better security program and team. Hear why Omar and Allan believe that investing in people will pay far more dividends than the latest tech tool. And more importantly, gain some very practical and concrete tips for managing and measuring your security program.

Key Takeaways:

01:19 Bio

03:26 What is wrong with tech-centric security?

06:00 Using tech tools as nothing more, and using them appropriately

12:22 Trust, then risk, then control

14:30 Customer first, always

19:02 Helping foster a trust-centric culture

28:40 Culture = mindset = best measurable quality

29:33 What surprises Omar in cyber security?

32:50 The “change agent network”

Links:

Learn more about Omar on Twitter and LInkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Uptycs

CISO in the Supply Chain w/ Emilio Escobar Oct 20, 2021

Allan is joined this week by Emilio Escobar, CISO at Data Dog and former VP of Information Security at Hulu. He is also a long-term developer of Ettercap, a comprehensive suite for man-in-the-middle attacks.

Like many of us, Emilio started his journey in infosec as a hacker kid, exploring the world through modems and BBSs. Emilio is not a security vendor CISO, but is a CISO for a company that is in the supply chain for many other companies. He has to balance internal and external duties as a result.

Come listen as Allan and Emilio discuss the B2B CISO life, the skills required, business alignment, facing customers, and how all of these skills just might define "the modern CISO".

And, yes, they even tackle the age-old question, "How technical should a CISO be?"

Key Takeaways:

01:27 Bio

03:10 Security questionnaires and interactions

05:49 Is there a fix to solving vendor risk?

07:17 Utilizing machines for questionnaires

09:33 Leveraging skills

12:50 How technical should a CISO be?

18:01 Understanding other roles in the business

23:48 Balancing internal and external customers

28:17 What surprises you the most in cybersecurity?

Links:

Learn more about Emilio on LinkedIn, and Twitter, and learn about Ettercap

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Uptycs

Is Resilience Even the Goal? Antifragility w/ Sounil Yu Oct 14, 2021

Allan is joined by Sounil Yu, one of cybersecurity's most well-known contributors. Sounil has a long history in cybersecurity, and is also the inventor of The Cyber Defense Matrix and the DIE Triad.

Sounil and Allan discuss cyber resilience and contrast it with "antifragility", a notion introduced by Nassim Nicholas Taleb. Sounil argues that in cybersecurity, antifragility should be the goal, and not resilience.

Antifragility allows for stronger data protection, as it does not just survive stresses and attacks, but actually encourages them. Sounil explains how antifragility also neatly dovetails with his DIE (Distributed, Immutable, Ephermeral) Triad of data protection, which he contrasts with the CIA (Confidentiality, Intregrity, Avaiability) Triad in the context of the "pets vs. cattle" model.

Join Allan as he learns a great deal in a short amount of time from Sounil...

Key Takeaways:

01:23 Bio

02:20 Cyber Defense Matrix

03:10 Is cyber resilience the wrong idea?

04:17 Backups do not equal resilience

05:58 What is antifragility?

09:31 The DIE Triad

14:32 Pets vs. Cattle

18:12 Practical implementation?

20:40 Focusing on recovery

24:28 The Barbell Strategy

27:58 What surprises you in cyber security?

Links:

Learn more about Sounil on LinkedIn, and Twitter, and learn about the Cyber Defense Matrix

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Uptycs

Is the SOC Dead? w/ Erik Bloch Oct 07, 2021

Allan's guest this week is Erik Bloch. Erik Bloch is a cyber security leader, influencer, and pioneer. He currently sits as Senior Director of Detection and Response at Sprinklr, but has held many rolls in cybersecurity, including being a product manager for SIEM products more than once.
This last point is relevant, because it makes it even more surprising that Erik is convinced that the SOC's utility has passed...
Join Allan and Erik as they dive deep into why he thinks SOC is failing, the alternatives, what it takes to make an impactful change in incident response, and who to aim it towards.
This conversation began when Allan read Erik's article on LinkedIn, “RIP SOC. Hello D-IR".
Key Takeaways:
01:16 Bio
02:18 Erik’s article: why is SOC failing?
05:01 What is the alternative?
07:29 Implementing fundamentals where it counts
10:15 Cloud Integration
17:45 Cloud agnostic tooling solution
23:27 The inevitability of a one-stop solution
27:20 Targeting the right audience
28:17 What surprises Erik in cyber security?
30:24 Letting go is not easy
Links:
Learn more about Erik on LinkedIn, and Twitter, and read his LinkedIn article
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

The Value of Threat Intelligence w/ Samara Williams Sep 29, 2021

Allan's guest is Samara Williams, Manager of Threat Operations at Cardinal Health, speaker, advocate and passionate member of the threat intelligence community.
Samara broke into cyber via a rotational program, sampling many cyber jobs at many cyber companies in a short order - a fantastic start in cyber that turbocharged her maturity and experience. She quickly developed a passion for threat intelligence, and has worked in that space ever since.
Join Samara and Allan for a deep dive into threat intel, its pros and cons, its value, and its potential...
Key Takeaways:
01:28 Bio
02:56 The love/hate relationship with threat intel: yay or nay?
06:07 The steps to threat intel – breaking it dow
15:14 How threat intel can help bridge tactical & operational Practices
19:57 Having a successful SOC program
22:18 Managing the unknown and practicing the fundamentals
26:17 Making a case for prioritizing threat intel
27:55 What surprises Samara in cyber security?
Links:
Learn more about Samara on LinkedIn, and check out her TedX talk
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Practical Realities of Ransomware Management w/ Bryan Hurd Sep 22, 2021

This week, Allan is joined by Bryan Hurd. Bryan is a multi-talented cyber security professional who has founded and operated programs dating back to the early nineties. Currently Chief of Office for Stroz Friedberg (AON Cyber), he started his career in NCIS, founding the Navy’s first ever cyber counterintelligence program in 1993.
Join Bryan and Allan for a masterclass on ransomware, incident response, and preparedness. Having both consulted on ransomware situations many times, they offer a wealth of practical tips, do’s, don’ts, and gotchas. You can also hear their perspectives on the roles and processes in taking appropriate action when crisis hits.
This is a longer than usual episode, but that is because it is filled with practical advice based on a great deal of experience.
Key Takeaways:
01:20Bio
02:58Is ransomware still the #1 threat to an organization?
07:30Having your incident response team ready and prepared
12:16The roles, processes, and fundamentals of incident response
22:57Modern ransomware extortion components
25:01Encryption & decryption – dealing both strategically
27:10Using software provided by attackers
30:18Response as an executive – being transparent
35:02Public communications
38:41What surprises Bryan in cyber security?
Links:
Learn more about Bryan on LinkedIn and on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

WHY We Measure Risk w/ Sameer Sait Sep 15, 2021

In this episode Allan interviews his friend Sameer Sait, former CISO at Amazon, Forcepoint and Arrow Electronics, who joins Allan for a discussion about WHY we measure risk.
It is about more than just asking for money. (And who are you actually asking money from? Hint: It is not the Board).
How does risk measurement change in the beginning of the CISO’s journey vs. later when the program is more mature?
What is the goal of good risk metrics? What is the role of cyber insurance in all this? What about business traction and cooperation with other department’s goals and objectives?
And finally, how does measuring risk affect disposition or risk?
Key Takeaways:
01:20 Sammer's bio
02:30 Asking for money - it's not from the Board
05:58 Measuring risk: inside-out vs. outside-in
11:20 Approaching management with an objective, not a story
12:38 Working with your team, as a team
14:12 The effects of measuring risk
18:36Analyzing the priorities and their consequences
24:36 Good governance vs. good management
26:22 Transference, remediation, and acceptance
30:57 What surprise Sameer in cybersecurity?
Links:
Learn more about Sameer on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

What Comes After the CISO Role? w/ Helen Patton Sep 08, 2021

Host Allan Alford interviews his friend Helen Patton, advisory CISO at Cisco, and former CISO at Ohio State University. Helen and Allan discuss the career path of the CISO – specifically what comes after the CISO role has been fulfilled - and how there is not a clear path defined for the post-CISO career.
Allan and Helen discuss several models for post-CISO life that they themselves have explored, and that other CISO friends have as well, such as: shifting back and forth from CISO to vendor, shifting back and forth between CISO and advisory CISO roles at VC’s and other entities, becoming CIOs or CTOs, etc.
Helen explains how there is no clearly defined path for a post-CISO life, how no mentors are available to aid with that transition, but also how CISOs can decide to simply change their roles as a CISO. She explains a little bit more about her advisory CISO life and the internal and emotional differences between it and a conventional practitioner CISO role.
Key Takeaways:
0:26 – Intro
1:12 – Helen briefly explains about her background in cyber and about her day job.
2:55 – Helen explains what is the post-CISO life?
5:54 – What are Helen’s thoughts on the different roles of CISOS?
9:21 – How many people are changing from CISO to a consultancy role?
11:04 – Has Helen seen anyone making such transitions and being successful over time?
12:48 – Hypothetically what would happen if there was a major technology shift, but a CISO wasn’t there to supervise it due to being in a non-practitioner role at the time. Would she be missing out on it on critical CISO skills?
15:12 – Helen explains a little bit more about her advisory CISO life.
18:07 – What happens when Helen gets approached by startups who want feedback? Does she see them as competition? Are they up for having conversations with her?
20:47 – Can a CISO become a CEO?
22:37 – Who should the CISO be reporting to and why?
25:34 – What other post-CISO activities are there for CISOS that may not be a fulltime role, such as boards, teaching, writing, speaking?
28:32 – What surprises Helen the most in cyber security?
Links:
Learn more about Helen on LinkedIn and Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Humans Are Not the Weakest Link in Cybersecurity w/ George Finney Sep 01, 2021

Allan is joined by George Finney, CSO at Southern Methodist University and author of the book Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future.

George’s mission is clear: unite the cybersecurity community through proven strategy, and help preserve and leverage the humanity within cybersecurity.

He believes that the community as a whole under-plays the human role, and he and Allan discuss potential changes to the way we view security awareness training and the role of users in general.

Key Takeaways:

00:18 Intro/Bio

01:25 George’s story

04:27 Humans are not the weakest link in cybersecurity

07:17 How habits affect security awareness

08:30 The 9 habits and forming your cybersecurity personality

14:05 How secret keepers build a community

17:30 Potential improvements to security awareness training

22:22 The origin of the nine habits

26:50 What surprises George about cybersecurity still?

Links:

Learn more about George on LinkedIn and on Twitter and buy his book!

Follow Allan Alford on LinkedIn and Twitter

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Uptycs

Does SOAR Meet Its Promises? w/ Benjamin Corll Aug 25, 2021

Host Allan Alford interviews Benjamin Corll, VP of Cybersecurity and Privacy at Coats, about security orchestration, automation, and response (SOAR).
Bejamin and Allan critique SOAR's promises and premises, what else it could be doing, its pricing and overhead, and lack of standards as well.
But it is not all negative - Benjamin does share stories as well of SOAR's successes in his shop, and of the things it does do well...
Come on down the ranch and give this show a listen!
Key Takeaways:
0:09 – Intro
0:55 – Benjamin's background and day job
3:46 – The premise and the promises of SOAR
6:32 – What else could be automated?
9:25 – Benjamin explains about the trouble ticket system and the change management system
11:57 – The standards for SOAR today
17:19 – How do we improve the cyber posture of all our organizations, making them more secure?
19:34 – Has SOAR managed to stay affordable for those who need it?
22:54 – What SOAR does well, the benefits and the value
26:35 – What has surprised Benjamin the most in information security
Links:
Learn more about Benjamin Corll on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

The Modern CISO w/ James Azar Aug 18, 2021

Host Allan Alford interviews guest James Azar, host of the CyberHub CISO Talk Podcast, and CISO in the financial services space. James and Allan discuss the techniques and approaches of the modern CISO, and contrast this with some of the older approaches of the job. James defines the cultural shift between the old and new as having taken place since September, 2017 (the Equifax breach).
James and Allan discuss the impact on the team, business, clients, customers, and shares their thoughts and experience on how to stay modern. “What keeps you going in cybersecurity?” as the signature final question for each guest has been replaced with “What surprises you the most in cybersecurity?” James is the first guest to answer that question, and his answer is a bit of surprise itself…
Key Takeaways:
0:16 – Intro
1:04 – Bio
2:00 – The modern CISO contrasted with the older CISO
4:46 – What does the modern CISO mean to the team, business, clients and customers?
7:10 – How to interact with the business: building relationships, teams, meetings…
11:18 – How James Azar puts forward a message of security for the company
11:52 – Security Questionnaires and what is wrong with them
12:20 – Picking on SOC 2
12:39 – Operationalizing security within a client customer relationship
14:11 – Shared responsibility model (cloud) and CMMC replacing SOC 2 and SIG and other older standards: 5 or 6 questions
17:50 – How the word “no” keeps the business and team from moving forward
18:06 – CISO choosing business over security and ignoring the subsequent notions of career risk
19:40 – Automation on the technology front and how it changes the modern CISO’s perspective
20:30 - COVID-mandated lockdown and the implications for workers in countries around the world
23:19 - Automating all entry-level positions and bringing entry-level people up
25:45 – What surprises James Azar the most about cyber security
Links:
Learn more about James Azar on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Frameworks Over Time w/ Derly Gutierrez, Mustapha Kebbeh and Patrick Benoit Aug 11, 2021

In this, the very first LIVE episode, Allan Alford interviews guests Derly Gutierrez, Head of Information Security at 1010Data, Patrick Benoit, BISO at CBRE, and Mustapha Kebbeh, CISO at Brinks, as they discuss the use of security frameworks in general and over time.
Regarding framework compliance, do we choose one or do we choose many? Do we embrace them fully or partially? What changes our approach to frameworks over time?
Security strategies are explained throughout the episode, along with the notions of business adaptation and adoption, regulation and other requirements, and "minimum viable security" approaches that don't require frameworks at all.
Key Takeaways:
0:43 – Intro
1:53 – Question to Mustapha: pick and choose from a framework or embrace a framework all in one go?
2:47 – Patrick discusses his own approach to Mustapha’s statement
3:26 – The evolution of CFS adoption briefly discussed and the importance of protection
6:59 – Discussion of a possible "least viable security" approach that doesn’t depend on the frameworks at all
9:50 – Maturity models
13:32 – Security strategies
19:56 – The guests answer: What were the toughest challenges working with a framework?
21:56 – The guests share their best success story with frameworks
23:51 – The guests share their journey on business integration
27:56 – The influence of regulation and other requirements
Links:
Learn more about Derly on LinkedIn and Twitter
Learn more about Mustapha on LinkedIn
Learn more about Patrick on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Burnout, Toxicity, and Overcoming Obstacles w/ Marilise de Villiers Aug 04, 2021

On this episode, Allan invites Marilise de Villiers, Founder and CEO at ROAR! Coaching & Consulting, to come on down to the ranch and discuss how to deal with toxic situations, how to overcome obstacles in the workplace, how to avoid burnout, and how to spot our own negative behaviors that interfere with our success.
Marilise and Allan cover toxic workplaces and bosses, share personal stories, and discuss the internal mechanisms which allow external toxicity to harm us, as well as the internal behaviors to prevent that.
They discuss obstacles, and how big obstacles should be embraced. They also talk about "exercising the resilience muscle".
This is a fantastic show with some open and vulnerable moments, as well as with some very practical advice for avoiding burnout and dealing with problems most of us have faced or will face in our information security careers.
Key Takeaways:
1:11 How Marilise got into information security
2:29 About her coaching and consulting practice for information security professionals
3:53 Avoiding CISO burnout despite our intrinsic challenges
5:08 External forces but also our own self-defeating behaviors
7:01 Clarity on who you are and why you are here
9:31 "I am" is the first negative step towards internalizing toxicity around us (neuro plasticity)
11:03 Allan's former toxic boss who "showed him a carnival house mirror" and led to negative internalization
12:21 Marilise has a similar story
14:29 Facing futility and hopelessness in information security
15:19 Caring too much vs. business problems as a control and communication problem
18:23 How to perceive our biggest obstacles
19:28 Get professional help to strengthen your resilience muscle
20:17 Shout-out to Chris Cochran of Hacker Valley Studio and his 'find your super powers' coaching (and other trusted coaches)
21:49 Your best life is on the other side of your biggest obstacle
21:59 There is always another obstacle
23:22 Living your best life TODAY
24:15 The value of resilience and embracing big obstacles
24:57 Marilise's reason for being in cybersecurity
Links:
Learn more about Marilise on LinkedIn and on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Migrating from Monolithic to Cloud w/ Greg Rogers Jul 28, 2021

In this episode, Allan interviews Greg Rogers, CISO at Legal & General America, about migrating legacy, monolithic, internally facing, manually tested, waterfall applications to Cloud, CI/CD with automation, customer-facing applications, all with modern development languages and environments.
Greg migrated just about everything legacy to just about everything modern across a series of monolithic applications. In this episode he gives tips on the technical aspects of his journey, tools and techniqes for overcoming cultural barriers as well.
Greg outlines what he did in-house, and what he leveraged from out-of-house - from code to services.
Ultimately, Greg was able to pull of this transition piece by piece, and he shares how he was able to do it.
Lastly, Greg closes with what keeps him going in cybersecurity...
Key Takeaways:
1:19 How Greg got into cyber
4:12 An overview of the challenge
6:39 Greg's biggest security challenges with the project, both cultural and techincal
8:06 The value of engagement and relationship building
8:41 Targeted security awareness training
9:10 Make security fit with what they are already doing for their day jobs
9:25 Regulation as a driver for change
11:32 The challenges posed by regulation
12:06 The challenges of remote access
13:50 How to eat the elephant one bite at a time
14:11 VDI to migrate portions to the cloud
15:29 Identity & Access Management, CASB, SASE, etc.
16:53 Leveraging outside help
18:13 Selecting and settling on a good MSSP
20:21 In-house development vs. off-the-shelf and leveraging external developers
22:43 What the CISO provides in this scenario
24:02 Focusing on the 'gray' areas of security over the black and white
25:25 Improving the security culture and CISO relationships
26:49 What keeps Greg going in cybersecurity
Links:
Learn more about Greg on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Credential Stuffing w/ Dr. Sam Small Jul 21, 2021

In this episode, Allan's friend Dr. Sam Small, CISO of Zero Fox, joins us to chat about credential stuffing, its implications and the defenses against it.
Several statistics are given from a few industry reports on credential stuffing, including the Verizon DBIR and F5's report.
Several techniques to foil credential stuffing are explored, as well as common traps when combatting credential stuffing. OWASP provides some guidance in this area.
The criminal's abilities vis a vis breach sharing and botnet as a service are discussed as well.
Finally, Sam explains what keeps him going in cybersecurity...
Key Takeaways:
1:08 Sam's background and education in cyber
2:41 Sam defines credential stuffing and explains why we should care about it
4:17 The origins of the term 'credential stuffing' vs. its history
4:39 Is ransomware the end goal of every single kind of cyber attack?
5:22 Botnets as a service to drive credential stuffing attacks
6:33 Allan cites statistics from the Verizon Data Breach Incident Report
7:23 The DDoS aspects and related cloud costs of credential stuffing
8:48 Sam's theory about F5 report statistics on credential stuffing being interestingly somewhat contradictory
10:43 Anecdotally anyway, password reuse appears to be a huge problem still
11:51 Comabating credential stuffing and common traps in doing so
13:23 Credential stuffing and data breaches are not the same thing
14:17 Getting credential stuffers shut down by way of their service providers
15:25 Practical tips from OWASP for preventing credential stuffing in your environment
19:10 The difference between a comprehensive defense and not
20:32 Are obscure usernames useful in the fight?
22:06 Proposal for user-centric federation to monitor account usage everywhere
23:06 Obligations of those who suffered a breach of credentials
25:14 Criminals share data on their side
26:09 What keeps Sam going in cybersecurity
Links:
Learn more about Sam on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

”Ugly Exits” w/ Naomi Buckwalter Jul 14, 2021

On today’s episode with Allan, we talk “Ugly Exits” with Naomi Buckwalter, Director of Information Security. Of course, to start the episode, Naomi answers Allan’s question of how she got started in cyber.
They circle back to the topic at hand, “Ugly Exits”. Under this umbrella are: being fired, laid off, "burning bridges", or being encouraged to leave in a "voluntary" manner. Allan shares statistics for some of these categories, including a substantial statistic on those who have been outright fired.
When it comes to burning bridges, so many people walk away from a company that is behaving in an unethical manner and putting their employees in unethical situations. To Naomi, this is a frightening common thread. It’s scary how many unethical employers are out there.
Naomi shared a personal story of her ugly exit, and the fact that it was deserved to some extent. She has owned that experience, has learned from it, and has grown as a result.
Allan shares his personal “burned bridge” story which continues to follow him through the industry here and there. He feels his reputation is sullied with a certain small segment of the industry, and that it most likely won’t ever change. But he also takes ownership for how he mishandled the situation.
Rounding out the show, Naomi and Allan talk about earning their stripes and realizing it is all about growth, resiliency and grit. In fact, as humans, they feel sometimes we don’t appreciate the bad things that happen to us, so we can appreciate the grown and the improvements we have made throughout our lives. Reflect back and think about all that you have survived in your past. Out that self-awareness comes the opportunity to improve.
A large portion of growth, whether personal or work, comes from self-reflection. One can learn from it, grow from it and figure out how to navigate the situation should it arise again. Could it be that thinking we are the hero of our own stories is hurting us?
Key Takeaways
1:25 Getting into Cyber
3:22 Burning Bridges
8:56 Mismatches
14:18 Reflecting
19:43 Humanity
23:28 The Firing and One’s Value
28:45 What Keeps You Going
Links:
Learn more about Naomi on LinkedIn and on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Uptycs

Agile for Security Programs w/ Tim Rohrbaugh Jul 07, 2021

On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.
Tim got into cyber through the military. From the military he went into consulting and ended up at JetBlue. At JetBlue that he is always trying to find ways to invest dollars in security programs to balance what is going on. Along with that, he strives to keep his team motivated and moving forward.
Agile is a software programming methodology, and it replaced Waterfall. Waterfall was the traditional model of development, where large chunks of code had to flow from developers to QA, back to developers several times, and finally to release.
Agile, on the other hand, works off user-centric stories, which roll up to bigger stories called epics. Stories are small, discrete goals, met with smaller, discrete chunks of code released in what are called 'sprints'. QA is very rapid as well, leading to rapid release. Agile is characterized by daily 'standup meetings' where literally nobody sits in an effort to keep the meetings as short as possible.
In Agile, product owners come up with ideas and thread those through marketing and development. In appplying this paradigm to running a security teamm, Tim replaces product owners with threat intelligence folks.
This unique approach towards managing a security program means that all decisions are threat-informed, and that small incremental wins are a constant.
But Tim does not stop there. Anyone on the team can create and manage a story to address any specific and immediate security need...
Key Takeaways
1:10 Tim’s background and day job
2:08 JetBlue
2:39 Introduction of Agile
3:57 Tim’s approach
6:15 How Agile is used
8:31 Threats addressed
9:46 Story sourcing
11:03 Creating the story
12:48 Narrative skill
14:08 Metrics
15:53 Risk management aspect
19:00 Not using risk
21:38 Positives
23:20 What keeps Tim going in cyber
24:42 What Tim is looking forward to in cyber
Links:
Learn more about Tim on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ

All About Analysts w/ Christina Richmond Jun 30, 2021

With us today is Christina Richmond program Vice President at IDC. She's an industry analyst, and she's here to talk to us all about the analyst lifestyle.
Allan starts the episode asking Christina to share all about how she got into cyber and what her day job is like. Christina actually began by working in the storage space, and discovered security. To her it was like a drug. What does she do throughout her days? Partakes in hundreds and hundreds of calls with companies who need help with launches and marketing, specifically in growing areas of cybersecurity. In essence, there is a lot to being an analyst. But to be successful, you have to be curious!
The best way to put Christina’s job in words, is “learning the whole from the parts.” She talks with individual players, studies market trends, and then circles around again to piece it together. One big feedback loop.
On a side note, Christina would like everyone to know she is looking to hire at the director level! If you know anyone, send them her way. There are certain aspects necessary, and they are: First, understanding the technology. Next, either having been an analyst before or being in market research of some kind. Finally, the soft skills or executive presence.
Christina admits she is not a technologist, but she also says there's a benefit to having a non-technologist covering this space. She thinks it's important to know that analysts take all shapes and sizes, and there is a benefit from bringing in somebody who thinks about the market differently.
In one word, she describes the plight of the analyst as “overwhelmed”. There aren’t enough people, and some people just don’t have enough skills. The skills gap is real. One of the top skills that is missing for practitioners is cloud security, and that is true for analysts as well.
The bottom line for Christina is helping; it is her favorite thing to do. When it comes to changing things, Christina wouldn't throw anything out but would have more people doing more of the work. Because really, there is a resource shortage in the analyst realm.
Finally, Allan as the one question he asks of all his guests, “What keeps you going in cyber, why do you hop out of bed in the morning, jump in your shoes and say, all right, another day of cyber.”
Christina responds, “Every day, there's a new breach, every day someone is suffering because a Florida Water system was poisoned or because the oil the gas pipeline has been interrupted, and we're not going to have gas at our gas stations or because you name it. There are so many reasons to get up every morning. And, I think every cyber security person needs a mission. I'm here to help, I'm the one helping make sure the message gets out. And that's really important to me.”
Key Takeaways
1:17 Christina’s background
3:02 An analyst’s day job
6:02 Learning the whole from the parts
7:46 We’re hiring
11:02 Staying informed and in the game
13:05 Non-technologist
14:22 Plight of the analyst
16:38 Favorite part of the job
18:44 What would Christina change
19:35 How to get the best engagement
23:11 Storytime
25:55 What keeps Christina going
Links:
Learn more about Christina on LinkedIn and Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

The Journey to Passwordless Authentication w/ Derly Gutierrez Jun 23, 2021

With us today is Derly Gutierrez, Head of Security at 1010 Data, and veteran. Derly is here with us today to talk about the journey to passwordless authentication and the flaws and strenghts of today's authentication methoods.
Allan and Derly refer to studies and surveys about the problems with passwords and the challenges of implementing passwordless approaches.
Derly emphasizes the need for other complementary technologies such as Role-Based Access Control (RBAC), Privileged Access Management (PAM), and system-to-system communications.
The two discuss corporate and personal use of passwordless solutions, talk about legal precedence and the future of passwordless approaches.
Key Takeaways
1:14 How Derly got into cyber
1:58 About Derly's day job as Head of Security
2:34 Allan quotes the 2017 Verizon DBIR on how many breaches involve weak or stolen passwords
3:35 Allan cites NIST 800-63b
4:15 Derly talks about CAC cards in the US DoD
4:50 Derly sides with vendor innovations over NIST guidance
5:56 Allan clarifies the distinction between PINs and passwords
6:52 Derly points out the flaws with biometrics in terms of reliability and assurance
9:09 Allan cites a survey regarding WHY organizations choose passwordless
9:52 How many 'passwordless' solutions still include shared secrets
10:38 Derly talks about corporate vs. personal passwordless solutions and shared secrets as backup for reliability issues
11:37 Derly emphasizes a lack of RBAC and PAM foiling all authentication approaches
13:06 Allan points out the value of Identity and Access Management solutions
13:44 Allan references three vendor approaches towards passwordless for legacy systems such as RADIUS
14:50 Derly takes these methods apart
16:05 Many companies are not doing Role-Based Acces Control, system-to-system communication and Privileged Access Management correctly
17:02 Allan brings up the presence of push attacks
17:38 Allan's definiton of true passwordless authentication
17:56 Derly's definition of true passwordless authentication
21:29 For personal use of biometrics, Allan brings up a disturbing precedent of law enforcement accessing an individual's phone with forced facial recognition
23:17 Derly emphasizes that applications on your phone should have a different authentication factor than access to the phone itself
23:47 "Your home is your castle" has become "Your phone is your castle"
25:06 Allan cites one last survey as to how many of us really are passwordless
26:02 How long before we got to passwordless?
28:06 What keeps Derly going in cyber
Links:
Learn more about Derly on LinkedIn and Twitter Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Application Security w/ Taylor Lehmann Jun 16, 2021

With us today is Taylor Lehmann, former ciso several times over in the healthcare sector, and currently Americas leader for security, networking, identity, and compliance solution architecture at AWS.
Taylor and Allan talk about application security: why it's important, who are the personas, the value of threat modeling, infrastructure as code, how to get started, and relationships with developers.
Taylor, a Boston boy, starts the show trying to say, "Howdy!" correctly. Taylor started at PWC and grew into a healthcare CISO. He has now transitioned to AWS.
Key Takeaways
1:40 How Taylor got into Cyber
2:58 Taylor’s day job
4:30 Appsec Defined
5:49 Taylor's favorite appsec frameworks
7:48 Why appsec is important
8:55 The personas and roles
11:22 Security training in appsec
12:27 Threat modeling
15:11 Infrastructure as code
20:46 How to get started in appsec
24:12 Devs already know and care about security
25:38 Where does the trope come from that devs don't care?
26:52 Why "DevSecOps" is a bad term
28:00 What keeps Taylor going in cybersecurity
Links:
Learn more about Taylor on LinkedIn and Twitter Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Solving The Global Cyber Problem w/ Ian Thorton-Trump Jun 09, 2021

With us today is Ian Thornton-Trump, Chief Information Security Officer at Cyjax and an ITIL-certified IT professional with 25 years of experience in IT security and information technology.
Ian shares his background which started back in the Canadian military. During those times, "IT" was called "automated data processing", and it is quite clear how far this has advanced. He joined the Royal Canadian Mounted Police and spent a year working on criminal intelligence. Soon after he became a consultant and made his way to the UK in 2015.
Oftentimes organizations have not planned or prepared for risk, and that includes cyber. In that sense, cyber can be compared to the environmental landscapes and infrastructure, which Ian finds eerily similar. A lot of problems created in cyber mimic a lot of the environment problems we face in today’s world. One example is the recent failure of the Texas power grid during a very harsh winter. Investment in cybersecurity is critical.
Allan feels there are a lot of environmental laws, but there are also already some pretty strict cyber laws as well. However, they seem more aimed at the anonymous or extrajurisdictional perpetrators and end up useless when their anonymity is involved. And some cyber laws seem to punish the victim as well - after suffering ransomware you are now penalized for not being prepared for it in the first place? How can we get laws in place that are helping the situation and not blaming the victim?
Ian suggest that positive incentives are the answer. If we can just get companies to do a bare minimum cyber hygiene, by incentivizing them through tax breaks, Ian thinks we could move the ball up more forward, without making it too onerous, to meet some sort of regulatory standard. How do we possibly extend our stretch? Because at the end of the day, the root cause is the “bad guys”, so how do we get to them? America is already doing a lot, but other countries need to put their money where their mouth is.
Ian and Allan discuss President Biden's Executive Order on Cybersecurity. This can enforce behavior in the government, but only suggest behavior in the private sector. To sum up, we're nowhere, and we need to get somewhere because what we've done, at the federal and state level in the United States, is taken a lot of dollars, put them in parking lots, and set fire to them. And then after we finished that exercise, we asked for more dollars. We have to change the entire system from the ground up. And we have to incentivize cyber security.
Key Takeaways
1:10 How Ian got into Cyber
2:21 Ian’s day job
4:18 Issues with infrastructure and environment
7:38 Meaningful laws
12:47 Getting to the bad guys
16:35 Catching “Fred Smith” or someone like him
17:43 Rewards
21:17 Preparedness and helplessness
23:43 Einstein program
26:24 What keeps Ian going
Links:
Learn more about Ian Thorton-Trump on LinkedIn and Twitter Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

FAIR from the Trenches w/ Drew Brown Jun 02, 2021

With us today is Drew Brown, IT Security Manager at the Commonwealth of Pennsylvania. Drew is here to talk about FAIR and his real-world usage of it and testing it in the trenches.
Drew shares a little bit about his background in cyber, and a little bit about his day job. He spent 15 years in IT. That opened the door then for him to be the CISO for one of the state agencies. Now his title is IT Security Manager but essentially he is responsible for communicating security and risks and working within a law enforcment agency to make sure that what is implemented is secure, it's compliant, and it meets all of the agency objectives.
With FAIR, you start by asking some very basic questions: What is the asset? What is the thing of value that you're trying to protect? Once you understand what that is, you then ask who is going to come after that asset: cyber criminals, nation state, some kind of industrial espionage, hacktivist, or whatever. Or maybe it's Doris in accounting. Either way, you start to work through who might come after that information.
The probability of a guy sitting in his basement, ordering pizzas on your credit card is a different probability than a nation state. On the impact side, we look at six different categories of risk, there's loss to productivity, there's losses in terms of response, how much money are we going to spend? Or do we have to spend to resolve that loss event that incident?
The six forms of loss are productivity, response, replacement, fines and judgments, competitive advantage and reputation. We start looking at what those dollar amounts actually are. But we want to concern ourselves with the most likely and what's the loss magnitude at that most likely value? Now we can go to that executive and say, “Okay, do you want to build a new parking lot? Or do you want to resolve this risk?” Then we can have a business conversation about it.
Allan asks, “What drove you to FAIR?” Drew states that one of the biggest arguments against FAIR that he always hears is, “We don't have enough data points to do this." Drew decided FAIR can help make better decisions about risk. And that is the goal of FAIR anyway - to make better business decisions, better risk decisions.
Digging a little deeper, Allan asks, “Are you confident that it achieved the goals you set out to achieve with it?” In short, the answer is absolutely!
Where FAIR falls shorts comes up. After reflecting, Drew says that it is in the controls analysis piece.
Allan asks Drew what keeps him going in cyber. With a laugh, Drew gives a quick answer of "coffee" and then follows with, “I enjoy that a relationship with my counterparts and then also establishing those relationships with the business and seeing the problems solved.”
What’s coming over the horizon? According to Drew, it’s seeing the normalizing of cybersecurity and making it less of a burden to hire new and diverse talent.
Key Takeaways
1:15 Drew shares his background and day job
2:20 FAIR model
2:56 How FAIR works
5:13 Probability
8:45 What drove you to FAIR
11:42 Goal of FAIR
13:30 Selling to the board
18:16 The honest hat
22:17 RSA announcement
23:32 What keeps Drew going
24:49 What Drew looks forward to
Links:
Learn more about Drew Brown on LinkedIn Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ

Clever Hiring Practices w/ Andy Ellis May 26, 2021

With us today is Andy Ellis, operating partner at YL Ventures, former Akamai CSO and newly inducted member of the CSO Hall of Fame. We're here to talk about nonstandard hiring practices and how Andy has built an amazing team using nonstandard approaches.
Andy began his career in cyber ("I remember back then, you know, we didn't call it cyber, but I think we've all given up and, and that's now the name for our career field.") as an Air Force ROTC cadet, spent 20 years at Akamai, and joined an advisor program at YL Ventures.
Andy found a solution that addresses hiring needs and the talent shortage, while also building a very clever and very innovative team.
For new roles, look and see if you have somebody who's almost senior that you can promote to do that job. And backfill the almost senior person instead. Try not to hire senior people, try to hire the most junior person you can get away with and promote everybody up the chain. The real trick is to figure out how your HR and finance teams are going to operate and play them off against each other.
Now that we have covered your promotion from within strategy, let's talk about hiring some folks for certain roles on the team that at a glance would make no sense at all for a CSO. And yet is really, really effective and repeatable.
Andy’s flagship is hiring librarians. There is an entire career field dedicated to managing libraries and learning technical language to be able to do that.
Everyone is in the business of publishing a report about their data, right? This is just taking technical data and technical jargon and making it consumable to people who've never seen this data before. There's an entire industry that does that. We call it journalism. So, we hire journalists to come in and be those storytellers.
Hire teachers. Put a teacher in a position and to learn how deep do they need to go on a daily basis, and then make sure they get one level deeper. Because you're always going to have problems if you teach exactly to your domain knowledge. So, make sure your domain knowledge is always little bit deeper than whatever your job requires which is usually going to be sufficient to keep you out of trouble.
To wrap the show up, Allan asks, “Why aren't the rest of us catching on because this is some amazing stuff that every single hiring manager in cyber could benefit from.”
According to Andy, the simple answer is it's expensive, and it takes a lot of time to do right.
Allan asks, “What keeps you going in cyber?” Andy answers, “I've always seen myself as improving the systems that I walk through, that when I encounter a system, I want to tweak it and figure out what makes it work and make it work better."
Key Takeaways
1:24 Andy shares his background and how he got to cyber
3:12 Working for a venture capital firm
7:12 Hiring and building a team
12:26 The abnormal hires that just make sense
15:46 Clever role adjustments
17:10 More nonstandard hires
19:03 Confused? Whose confusion is it?
21:02 The academy
24:42 Putting a teacher in
25:21 Budget technique
27:09 Why isn’t everyone hiring this way?
28:30 What keeps you going in cyber?
Links:
Learn more about Andy Ellis on LinkedIn and Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Measuring Risk w/ Richard Seiersen May 19, 2021

Today we talk with Richard Seiersen, co-author of “How to Measure Anything in Cybersecurity Risk”.
Richard shared that at his first CISO position, he was challenged with addressing prioritization of risk, which led to his authoring a book with Doug Hubbard.
What can cyber learn from older risk disciplines? The life table used broadly to measure time-to-event data goes back 500 years.
Businesses keep falling back to the classic 5x5 "likelihood and impact" matrix which is an inconsistent, non-math-based method.
Without math it is really just casting spells in the board room. There are no ratios or explanation of differences, for example.
CISOs are called upon to make a bet about something. We will use subject matter expert opinions, and can make them measurably better. Consistency is key.
Wild guesses can still help constrain the forecast. There are existing models in cyber such as FAIR that provide a more mathematically applied approach.
Statistics came about because people needed to make bets with limited data. Dirty data can be worked with.
Embracing uncertainty is okay. Executives are actually very used to uncertainty.
Cybersecurity as a practice is in its adolescence with a high mortality risk. We need to adopt the grammar of science.
Key Takeaways
0:25 Richard is introduced
1:20 Richard talks about his cyber journey and his day job
3:02 Book talk
5:19 What can cyber learn from older style risk tactics
8:04 5x5 risk matrix
10:05 Improving accuracy
17:00 Gathering an accurate view
19:20 Monte Carlo simulations
22:04 The belief
25:17 Board-ready presentations
26:58 What keeps Richard going in cyber security
28:09 Why statistics were invented
Links:
Learn more about Richard Seiersen on LinkedIn and Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Becoming a CISO w/ Accidental CISO May 12, 2021

With us today, is a very special guest, Accidental CISO, of Twitter fame. His anonymity on Twitter, allows him to be a little more “truthy” about the CISO game than a lot of us can afford to be on social media. We have distorted his voice a bit to protect that anonymity.
“Accidental” shares how he got into cyber, and that is a culmination of being in a career where he had to fill “all” the hats. He stepped away from his CISO role a few years ago and is now in consulting where he has the opportunity to help other people realize they need to build security programs when they have never done it or know how.
How did he become the “Accidental CISO”? Simply by trying to help during the course of going through an audit. They had to identify who was the CISO, and he made the mistake of asking who the security officer was for the company. The answer was, “That’s you.”
Accidental CISO doesn’t think becoming a CISO accidentally is all that uncommon. When going through audits, etc., someone has to be named, someone ends up drawing the short straw.
The role is different than what people think. You can draw on your technical background, but you have to be able to focus on the “why” for the business and all the nuts and bolts that come with it. One must understand this is not a technical role.
Allan shares his pivotal moment in becoming a CISO and realized all he had to do was recognize the business as the system he was hacking.
When Allan asked Accidental CISO about guidance for building a team and getting started, Accidental had one word, “Pray.” In reality, you need to know the skills you need.
Allan and Accidental CISO discuss “selling the functions”. It is tied to the business objectives in so many ways, and companies need a human to seal the endpoints. As they close this discussion loop, Accidental shares how to get the practice off the ground and the importance of relationships.
Sometimes, believe it or not, not having all the knowledge and knowing all the details is a benefit. In addition, being the first CISO for a company is all about educating, communicating and painting a picture.
And of course, Accidental CISO answers Allan’s final question, “Why are you motivated to get out of bed and do more of it?”
Key Takeaways
0:30 Introduction of Accidental CISO of Twitter fame
1:37 How Accidental CISO got into cyber
2:14 Accidental CISO talks about his day job
3:33 The background of Accidental CISO
4:49 The security tool Accidental CISO embraces
5:20 Accidental CISO is not an uncommon “thing”
6:37 Advice to becoming a CISO
9:28 Allan shares a pivotal moment
10:15 Guidance on building and getting a team started
13:58 Selling the functions
16:55 Getting the practice off the ground
20:13 Importance of relationships and letting go
22:24 Being “their” first CISO
26:47 Building a security council
27:49 Why Accidental CISO is motivated to get out of bed each day and do more of it
Links:
Learn more about Accidental CISO on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Breach & Attack Simulation w/ Marlys Rodgers May 05, 2021

Today we talk with Marlys Rodgers, who has been in cyber for over 20 years. She currently is CISO for CSAA Insurance Group and is running security for the company as well as running governance risk and compliance for technology. She shares that it feels like she is constantly balancing assessing with preventing.
Allan brings up breach and attack simulation (BAS), and when it is most appropriate to implement in the context of the maturity of a security program. Marlys feels BAS is most effective when some, or most, of the intended controls are in place so you can focus on areas you need to strengthen. For her company, she was glad they did it earlier rather than later. They had a pretty good lead time to get systems to integrate.
The way you use BAS, especially along with threat intelligence, is really important. If you don’t have a purple team, or a red and blue team how does one start or how do you reorganize? Hear how Marlys did just that. Tag-teaming works best!
How has BAS helped in conversations with the audit team as well as the GRC team? More data gets shared with Audit and they become strong allies. Everyone is happy when fed real-world, real-time information.
BAS is truly changing mindsets, and will ultimately alter prioritization and enhancing and inter-team communications as well.
To wrap up the show, Marlys shares what about her job keeps her getting up in the morning and what she is looking forward to in cyber.
Key Takeaways
0:21 Welcome Marlys
1:13 Short comical discussion on how one should pronounce BAS
1:29 Marlys shares her background and day job
3:35 When BAS comes into the picture
5:00 The trick
6:05 Allan asks Marlys how she stays up with it
8:52 Marlys explains why more time should be spent on extending capabilities
9:38 Suggestions are shared to roll out BAS
12:21 Importance of human elements
13:45 If you don’t have teams, what happens?
16:18 How BAS affects conversations with teams
20:00 Importance of transparency
21:27 Changing people, process and technology with BAS
25:00 Marlys shares the reason she is motivated to stay in cyber
26:01 Marlys shares when she is looking forward to in cyber
Links:
Learn more about Marlys on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ

Enterprise Security Architecture: A $110b Case Study w/ John Petrie Apr 28, 2021

With us today is John Petrie, Counselor to the NTT Global CISO. He is responsible for managing the growing internal security challenges for the NTT operating companies across the globe.
Retired in 1996 from the Marines John began his career in multiple security positions. He shares that his major responsibility of today is creating the enterprise security architecture (“ESA”) for NTT.
Allan used to work for NTT DATA Services, and shares that John is working for the ultimate parent company of the NTT global conglomerate – a full 3 companies of inheritance between John’s company and Allan’s former company. John shares just how big NTT really is throughout 180 countries. Altogether there are 986 companies worldwide, generating over $110 billion in revenue each year. NTT is #62 on the Global Fortune 500.
John shares the full gamut of what an enterprise security architecture really is, how important it is and what it does. There are nine principles to building his ESA, and John outlines them while acknowledging that it is different for every company. Nowadays, the systems designed are for mobility, usability, management, and innovation around the core. Simplicity and resilience are a must!
Further on down the show, Allan and John discuss the 3-year cycle of both technology and business planning, and that not everything is a “one size fits all”. In addition, they talk about mixing and matching popular ESA models, and what that means to the framework.
There is a bit of discussion surrounding what it means to “have a seat at the table” as an information security executive. Everyone needs to be on the same page, to have business buy-in and to create strong business relationships. Security is one of those business voices, and everyone is in it together.
In closing, Allan and John talk about how the focus is not only on technology but on governance and training to get ready for implementation. Along with this, there are fundamental strategic decisions to be made, but ultimately on the large scale it is all about execution and governance.
Key Takeaways:
0:24 Introduction of John Petrie
1:27 How John broke into cyber and how his job looks today
3:08 We get the lo-down on how big NTT really is
4:55 Everything you need to know about ESA
6:46 John shares the 9 principles that provide a foundation for his ESA
6:55 “Aligned Independence”
7:44 “Standards-Based”
7:53 “Manage the Risk”
8:15 “Platform-Based Architecture”
9:49 “Design for Mobility and Usability”
10:00 “Innovate Around ‘The Core’”
10:32 “Simplicity and Resilience”
10:36 Global Remote Work at nearly 100%
11:30 “Supporting Digital Transformation & Strategic Plan”
13:04 Allan and John discuss 1-, 3-, and 5-year cycles
14:40 Not everything is one size fits all
17:02 Length of the process John is currently in
19:15 What occurs during this process
20:44 John shares the plan goal
22:33 The one directive from their CEO
24:16 Fundamental strategic decision
26:41 The large scale
27:31 The key takeaway from this entire discussion according to John
Links:
Learn more about John on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Programs for Women & Veterans in Cyber w/ WiCyS - SPECIAL EDITION Apr 26, 2021

With us today are Lynn Dohm, Executive Director of Women in Cybersecurty (WiCyS) and Martha Laughman, Veterans Iniative Lead at WiCyS and Director of Workforce Development at Smoothstack. Lynn and Martha are here to talk about the amazing programs for women and women veterans at WiCyS.
WiCyS is so much more than a conference for women in cybersecurity. Its presence spans the globe and its programs are myriad. Mentorship, student scholarships, training, special interest groups, job boards, veterans' assistance, and apprenticeships are all available.
Smoothstack is a partner of WiCyS, and has created a program for women veteran apprenticeships designed to benefit all parties involved.
The program is based on attitude, aptitude and intitial assessments, but requires no cybersecurity knowledge at the start. Apprentices are paid, trained, and qualified when they come out, working for employers on a two-year contract at a minimum. The program addresses employers' fears over being the first ones to hire and train new talent only to lose them.
WiCyS is a phenomenal organization, and there are ample opporutnities for allies - not just women - to join.
Key Takeaways
0:24 Allan Introducs Lynn and Martha
1:18 Lynn gives an overview of WiCyS' origins
2:06 Lynn explains the many WiCyS worldwide programs outside of the conference itself
6:45 Lynn introduces the veterans' assistance program
7:33 Lynn explains the origins of the veterans' apprenticeship program
8:54 Lynn explains why WiCyS chose Smoothstack and its program for women veterans' apprenticeships
10:14 Lynn explains the specific challenges and needs of women veterans
11:51 Martha shares a bit about her past, and her personal motivations
15:05 Martha elaborates on the program at Smoothstack with a very human story
17:14 Martha outlines the full process of the apprenticeship program
18:10 Martha outlines the tests for entry into the program
20:44 Martha states that employers hiring new talent suffer training overhead followed by attrition
21:40 The Smoothstack/WiCyS program pays candidates to get trained to readiness and guarantees employers two years minimum
23:40 Martha explains that cybersecurity has become a sellers' market and that jobs remain open because employers cannot pay enough
26:20 Lynn explains her motivation and drive to build such programs
27:23 Martha asks our listeners to join WiCyS, noting that membership is very affordable
28:23 Lynn echoes Martha's advice and recommends browsing the WiCyS website
28:47 Allan asks listeners to dontate to WiCyS
Links:
Learn more about WiCyS at www.wicys.org and on Twitter and on LinkedIn
Learn more about Smoothstack at smoothstack.com
Learn more about Lynn Dohm on LinkedIn and on Twitter
Learn more about Martha Laughman on LinkedIn and on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Data Risk Governance w/ Patrick Benoit Apr 21, 2021

Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas.
To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders.
Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging.
They discuss briefly various rules for dealing with older data and various means of risk measurement.
Ultimately their model is designed to work over a three-year or five-year period, encompassing all data in the organiztion by that time.
Key Takeaways
0:23 Allan introduces Patrck
1:36 Patrick shares his cyber background and his jay job
4:10 Patrick introduces his model of Data Risk Governance, which began as a sales/marketing tool and evolved into a "real" practice
5:59 Patrick introduces the precursors to setting up a proper Data Risk Governance program, which includes data classification among others
8:01 Allan explains how data disocvery and classification can be expensive and yet still only partially succesful
9:12 Patrick advocates his 'one bite at a time' method based at first on broad strokes of known valuable/risky data
10:45 Allan describes multiple data loss stories from his past
12:10 Patrick delineates in more detail the 'big chunks of data' method and his firewall analogy of allow/deny
13:23 Patrick notes that classification followed by tagging is a great approach
13:57 Allan proposes a new-data-only go-forward plan and Patrick agrees
15:56 Patrick talks about how the legal department owns data retention rules
17:30 Talks about how chat messages should be volatile
19:00 Allan proposes usese tagging to manage destruction and retention
21:00 Patrick notes that reducing risk by tagging some of your data is better than tagging none of it
23:30 Patrick discusses his model for quantifying risk vs investment as an 'orders of magnitude' problem with dollars as unit of measure
25:17 Allan proposes the car insurance model to counter Patrick's life insurance model
26:00 Allan talks about accurizing risk measurement and discusses briefly models like FAIR and Bayesian math vs. Patrick's orders of magnitude method
27:09 Patrick uses the 5x5 method not as a specific measurement but more as a visual aid and heatmap
29:11 Patrick explains what keeps him going in information security
Links:
Learn more about Patrick Benoit on LinkedIn and on Twitter
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Vishing, Smishing and STIR/SHAKEN w/ Mike Manrod Apr 14, 2021

Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Mike Manrod, CISO at Grand Canyon Education. Mike has done quite a bit of research on vishing, smishing and the upcoming STIR/SHAKEN legislation meant to combat those two.
To start the conversation, Allan asks Mike to share a little about himself, his background in information security and what he does at his day job. Mike started as an IT technologist who orginally resented the security team for slowing down technology projects. Then a friend took him to a security conference, and the rest is history.
Mike explains what vishing and smishing are, contrasting them to traditional phishing. Mike and Allan discuss personally targeted vishing and smishing vs. attacks targeted at organizations.
Allan and Mike cover the new STIR/SHAKEN legislation and related RFCs, along with the technical limitations inherent in the approach.
Finally, Allan asks Mike what keeps him going in cybersecurity, including technical challenges and a strong infosec community.
Key Takeaways
0:24 Allan introduces Mike
1:05 Mike explains how he got into cybersecurity and what his daily CISO life is like.
2:48 Mike explains what vishing and smishing are.
3:32 Mike explains the unethical vishing vs. truly illegal vishing and how they might target an organization vs. an individual.
7:18 Mike explains how most smishing is targeted at individuals. SIM swapping and other techniques are generally what is used against enterprises.
8:00 Mike says that smishing is most often used to introduce malware or harvesting user credentials.
9:31 Mike says that smishing, vishing and robocalling definitely mimic the ransomware world where lower-level, even non-technical criminals run the front line of attack.
11:34 Mike compares STIR/SHAKEN to the anti-phishing technologies DKIM, DMARC and SPF.
11:49 Allan explains that those email technologies are opt-in and only effective if all parties choose to opt in.
12:31 Mike explains what STIR/SHAKEN stand for and how they work - they are based on a series of RFCs.
13:43 Mike explains the FCC June 30, 2021 deadline for IP-based carriers to adhere to STIR/SHAKEN. TDM and Cellular networks are asked to implement in good faith.
15:48 Mike says that STIR/SHAKEN is a great step in the right direction. The nature of the problem is that the 'from' value is user-controlled in telco communications.
17:29 Mike sas that an enforced heirachy of tokens will solve the problem ultimately.
18:15 Mike recommend RFC 7340 as the best definition of the problem statement for the telephony challenged end-to-end.
18:45 Mike explains how STIR/SHAKEN also impacts smishing - noting that iMessage and other SMS-derived technologies already offer better security than voice technologies.
19:29 Mike states that a paradigm with certificates bound to number ranges or account ranges is the real solution to the problem.
21:01 Mike explains that fun technical challenges are why he stays in information security - a lack of bordeom.
21:58 Mike also names community as another reason he stays in infosec.
Links:
Learn more about Mike Manrod on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Maturing Purple Teaming w/ Gabe Lawrence Apr 07, 2021

Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Gabe Lawerence, General Manager of Cyber Security Protection at Toyota Motor North America. Gabe has seen the good and bad of purple teaming, and we’re here today to discuss what a mature purple teaming organization looks like.
To start the conversation, Allan asks Gabe to share a little about himself, his background in information security and what he does at his day job. His path to security hasn’t been linear - he has been a developer, an entrepreneur and a startup owner, slowly making his way to different levels of management in the security space. Gabe runs Enterprise Security at Toyota North America and is responsible for the technical side of the business and manufacturing environment.
When discussing what successful purple teaming looks like, Gabe points to the heightened alert of fidelity being among its greatest benefits. Rather than a red versus blue mindset, purple teaming encourages community and collaboration. Then, Allan asks Gabe to share a specific time he found unexpected success in purple teaming. Gabe gives an example reiterating the advantage of having a red and blue team working collaboratively.
In managing an enterprise, Gabe says there is always something changing. Validating your controls, alerts and responses are just a few of many tasks best tackled in smaller chunks. Embedding the automation from purple teaming as the ongoing environment keeps things in a high functioning state and serves as a persistent health check. Gabe explains how a buffer overflow isn’t exactly instantaneous and combatting lingering attacks.
Though purple teaming has many great benefits, it requires a bit of maturity. Having different teams interact together as they mature ensures they understand each other's roles and can effectively work together. Gabe urges people in the industry to think of themselves not only as part of a specific team, but as a part of a broader collective. In the hiring process, he describes seeking candidates with experience in software development and scripting. Additionally, it’s crucial to be willing and excited to learn and have keen problem solving abilities. In closing, Gabe looks forward to working in server-less spaces like the Cloud in the future and says his favorite thing about his career field is that it never fails to offer something new.
Key Takeaways
0:21 - Host Allan Alford welcomes listeners to the show and introduces Gabe Lawerence.
1:12 - Allan asks Gabe to share about his background and day job.
2:40 - What is successful purple teaming?
4:30 - Gabe shares both positive and negative personal experiences in purple teaming.
9:42 - How do you automate purple teaming?
14:11 - Fine tuning the deployment of the controls.
19:20 - How Gabe designs and hires for his team.
26:20 - What keeps Gabe in Information Security?
Links:
Learn more about Gabe Lawrence on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ

Interview with a Vendor w/ Dutch Schwartz Mar 31, 2021

In this episode, host and CISO Allan Alford interviews his friend Dutch Schwartz, Principal Security Specialist at Amazon Web Services. Dutch is a vendor, but do not press 'stop' just yet! Dutch is an empathetic outsider, an observor, and a constant learner and researcher. He brings some unique insights to our practice.
Dutch talks about his encounters with CISOs and their direc staffs, and opines on the debate as to how technical a CISO should be (versus business-oriented).
Allan and Dutch discuss healthy vs. unhealthy (Dutch prefers the term 'challenging') security cultures.
Dutch talks about all security efforst aligning with business initiatives, and Allan espouses his theory that all CISO actions should ties to business initiatives, risk reduction, and maturity improvement.
Dutch remains enthused about cybersecurity because of conversations like this very interview.
Key Takeaways
1:32 - Dutch shares his cyber origin story - stumbling into cyber after a militiary career as an officer, and working an integrator for a VAR.
4:54 - Today Dutch works at AWS and supports the largest customers as a cloud security strategist, working with CISOs and their staffs.
5:47 - With Dutch's Fortune 50 customers, he meets wit the CISO on a monthly or bi-monthly basis, depending upon how hands-on the CISOs are. Daily he meets with the CISOs direct reports.
7:04 - Dutch explains that over the years the CISOs' have changed from a more technical bent to a more business and risk-management orientation. Some struggle with this growth.
12:15 - Allan describes his CISOs communication philosophy of "Business Terms First, Risk Terms Second, Technology Terms Third".
13:23 - Allan talks about CISOs asking each other whether they are more technical or business/softskills-oriented.
15:00 - Dutch says that how technical a CISO is depends partially upon risk tolerance.
18:02 - Dutch elaborates that a bad security culture results in more breaches.
19:18 - Dutch explains how a company's culture can be measured.
19:54 - Dutch says culture is not what the leadership preaches, but rather what the factory worker in a remote location believes it to be.
20:16 - Dutch says challenging cultures are the ones where leadership is not aligned.
21:53 - Dutch starts his conversations with his clients by talking first and foremost about business initiatives.
23:40 - Dutch often compares security to quality when getting his clients to understand the overarching perspective.
26:50 - Allan says all CISO initiatives should be tied to business objectives, reduction of known risks, and how his actions might improve maturity.
29:29 - Conversations like this one are what keeps Duth in information security.
Links:
Learn more about Dutch Schwartz on LinkedIn and Twitter.
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Advancing Cybersecurity Careers w/ Christophe Foulon Mar 24, 2021

In this episode, host and CISO Allan Alford interviews his friend Chris Foulon, Sr. Manager of Cybersecurity at a leading fintech compnay, and co-host of the "Breaking into Cybersecurity" podcast.
Chris has 15 years in information security, having started at the helpdesk years ago. His biggest desire in infosec is helping others. In his day job Chris gets to work with every part of the business.
On the subject of the personnel shortage in cybersecurity, Chris believes that there is no shortage. Rather, he suggests that hiring managers limit their choices by holding out for too high an experience level, and by neglecting diversity and inclusion.
His advice for those who are entering the profession is to combine experience, certifications and education as suited to themselves and the roles they are applying for. He suggests reserach and listening to podcasts like this one. Chris suggests finding a mentor has well.
Chris and Allan discuss diversity, inclusion and allyship at length, going into such details as how job descriptions can discourage diverse candidates.
Chris' motivation in cybersecurity is the fact that the industry is ever-evolving and always presents opportunities for creative problem solving.
Key Takeaways
1:18 - Chris shares his history with cybersecurity
3:20 - Chris describes why he thinks there is no infosec personnel shortage
4:43 - Chris describes how to write a job description to generate more candidates
6:28 - Chris tells people with other backgrounds not to start over in cyber but to move in laterally and learnd the tech
8:02 - Chris explains how to get experience and subject matter expertise before you start you first job
12:35 - Chris talks about certifications
16:11 - Chris talks about including neurodiverse candidates
17:52 - Chris describes how hiring managers can clean their job descriptions to encourage diverse candidates
24:24 - Chris describes the benefits of mentoring
25:24 - Chris describes what motivates him in infosec
26:24 - Chris describes what he is looking forward to in infosec
Links:
Learn more about Chris Foulon on LinkedIn and Twitter.
Chris' coaching site is CPF Coaching
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

Developing Leadership w/ Gary Hayslip Mar 17, 2021

Today, host and CISO Allan Alford interviews friend and fellow CISO Gary Hayslip. Besides being a brilliant business leader, Gary is an author, mentor, and one of the best all-around humans Allan knows!
To start the conversation, Allan asks Gary to share about himself and his background in cybersecurity. While he had a natural interest in computers and technology more generally, Gary’s formal entrance to the cybersecurity field came during his time in the military. He developed a love for security, and as he’s climbed within the industry in the years after his military service, he’s also developed a strong network as a colleague and mentor. Allan tapped into this shared community through one of its most-used platforms, LinkedIn, to find out what others in the field would most like to learn from Gary.
The first questions deal with topics of leadership and training, and Gary explains his own practices of educating himself and his team. In his own life, he is committed to maintaining up-to-date knowledge of his rapidly changing field through research and reading; such knowledge is necessary if Gary is to lead as effectively as he can. Gary also provides opportunities for his staff to receive continuing education, and he does not worry that he might train employees beyond their roles. Rather, he embraces the privilege of partnering with his staff to see them succeed on their career paths.
There is a lot that goes into Gary’s practice of crafting and leading a team, and the COVID-19 pandemic has caused him to make some coaching changes. One-on-one meetings and conversations about family are more frequent, but the emphasis on building team trust and leading team members to own the business strategy remain constant. Gary assigns team members to take the lead on and complete briefings for different aspects of the strategy, and also expects them to back each other up.
This practice not only fosters ownership of business processes and development of employee skills, but also shapes the kind of culture Gary insists his team have. He requires team members to possess certain soft skills, be people of honesty who take personal responsibility, and be comfortable in team and group contexts. Gary tries to care for his workers by taking harder hours on himself than he expects them to work, but as the conversation wraps up, he explains that he is mainly motivated in his work by love for the community and people in the field!
Key Takeaways
0:21 - Host Allan Alford welcomes listeners to the show and introduces Gary Hayslip.
1:08 - Allan asks Gary to share about his background.
2:08 - The first questions deal with continuing education for Gary and his team.
6:58 - How has Gary’s coaching changed because of COVID-19?
10:54 - What are Gary’s methods for helping his team take on pieces of his strategy?
17:55 - COVID-19 also raises new questions about work-life balance.
21:45 - The next question deals with how Gary develops team culture.
25:39 - What keeps Gary going in cybersecurity?
Links:
Learn more about Gary Hayslip on LinkedIn.
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius

The Post-COVID Reckoning w/ Dr. Rebecca Wynn - SPECIAL EDITION Mar 15, 2021

In this show, host Allan Alford interviews Dr. Rebecca Wynn about information security decisions made during COVID and what the 2021 "reckoning" might look like. Dr. Wynn is a well-recognized CISO and Chief Privacy Officer, who faced some large-scale challenges during 2020. Allan welcomes Dr. Wynn to the cyber ranch!
The show starts with Allan asking Dr. Wynn to introduce herself and to tell the listeners a bit about her background. Dr. Wynn has received quite a lot of recognition in the field.
Allan and Rebecca Wynn share a wealth of connections in the CISO community, and both have consulted with numerous companies over 2020. This positions them to be able to talk to the broad spectrum of COVID-related actions and reactions taken during 2020.
Moving workers to home all over the world resulted in an increased attack surface and increased privacy concerns as well. Security quesionnaires were on the rise, as were deeper investigations into PCI, SOC2, etc. report. COVID, in other words, really emphasized the supply chain risk posture.
Allan and Dr. Wynn discuss the challenges and variety of preparedness for Zero Trust architectures - VPN, VDI, cellular dongles, taking desktop computers home, etc.
Allan and Dr. Wynn talk about supply chain risk, contracts, penalties, and other facets of post-COVID third-party risk.
To close the podcast, Dr. Wynn shares that she loves information security because of great companies out there who are forward-looking and paying real attention to security.
Key Takeaways:
1:18 - Dr. Wynn tells the audience about her information security background and recognitions.
2:43 - Dr. Wynn had to move 10,000 people to work-from-home for COVID.
4:31 - Dr. Wynn tells her clients to check the PCI, SOC2, etc. reports in detail for their supply chain.
5:37 - Allan points out that supply chain questionnaires were on the rise due to COVID.
6:45 - Dr. Wynn elaborates on Zero Trust architectures deployed during COVID and states that Zero Trust is not "one and done".
8:20 - Dr. Wynn encourages her clients to really dig into the risk associated with the supply chain.
9:12 - Allan points out that the Solarwinds breach was really a post-COVID phenomenon in terms of its impact and how folks responded.
10:40 - Allan shares that some companies were not ready for Zero Trust at all vs. those who were so well prepared.
12:49 - Dr. Wynn encourages auditors to go back and visit their 3rd-party risk.
14:34 - Dr. Wynn points and Allan talk about the strength and significance of contracts in the cultures of various companies.
16:50 - Dr. Wynn tells her clients to attach assessments to the contract and asks for transparency.
19:40 - Dr. Wynn encourages her clients to ask their supply chain about end-of-life and end-of-service posture for the technical estate.
23:05 - Allan advocates that vendors have honest conversations with their customers to be transparent about what new risks COVID onboarded.
25:08 - Dr. Wynn predicts that 2021 will be the reckoning for companies who took shortcuts during COVID.
25:42 - Dr. Wynn loves working for forward-looking companies and loves working for the greater good.
26:48 - In Information Security, Dr. Wynn predicts growth and evolution and hopes for a real investment.
Links:
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Learn more about Dr. Rebecca Wynn on LinkedIn.
Sponsored by our good friends at Axonius

Business-Oriented Security w/ Chris Castaldo Mar 10, 2021

In this show, host Allan Alford interviews his friend Chris Castaldo about how to align information security with the business. Chris is the CISO at Crossbeam, and is also the author of the book "Start-Up Secure: Baking Cybersecurity into Your Company from Founding to Exit", available for pre-order at Amazon. Chris, like Allan, views himself as a very business-oriented CISO. Allan welcomes Chris down to the ranch to discuss business orientation and alignment of information security in detail.
The show starts with Allan asking Chris to introduce himself and to tell the listeners a bit of his background. Chris's book fills the void in books for founders that seemed to utterly lack any reference to cybersecurity. Allan recommends the book, as he was one of the lucky few to review the book before its release.
But that is not what they are here to chat about today... Allan asks Chris what it means to be a business-oriented CISO - and what does it look like to NOT be a business-oriented CISO?
Allan asks Chris how a CISO can affect both the bottom line and the top line as well. Allan and Chris discuss the nuances of that conversation in the context of business-to-consumer ("B2C") businesses vs. business-to-business ("B2B") businesses.
Allan and Chris discuss the challenges of striking the balance between meeting the business' security needs and being agile enough to quickly respond to the dynamic and ever-changing nature of the business.
To close the podcast, Chris shares that he loves information security because of its always offering something new, and because of it evolving towards a user-centric approach.
Key Takeaways:
0:36 - Chris tells the audience about his security book for founders.
2:19 - Chris talks about his day job as CISO at Crossbeam.
3:08 - Chris talks about what it means to be a business-oriented CISO - it's mostly about understanding the rest of the business.
6:05 - Chris walks through how a CISO's impact to the top and bottom line varies for startups vs. mature businesses.
7:16 - Chris compares security aspects of a non-security offering to airbags in a car.
9:02 - Allan shares his past as a product security professional and how business-aligned product security in tech companies is.
12:00 - Chris compares B2C to B2B and how business-alignment for the CISO varies across the two.
14:41 - Allan talks about expectations of security vs. liability caps for failing to deliver it: B2B vs. B2C.
18:24 - Chris discusses how to enable security without putting the brakes on the business.
22:40 - Allan explains how some of his basic security controls that also accelerate the business.
25:17 - Chris explains why he loves working in information security.
26:21 - Chris is looking forward to user-oriented cyber security.
Links:
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Learn more about Chris Castaldo on LinkedIn.
Sponsored by our good friends at AttackIQ

Supply Chain Security w/ Omkhar Arasaratnam Mar 03, 2021

Today, host and CISO Allan Alford interviews Omkhar Arasaratnam, a veteran of the cybersecurity industry, on the topic of supply chain security. With a career in security going all the way back to 2004, and with experience working for IBM and several financial institutions before becoming an Engineering Director at Google, Omkhar brings much hard-earned insight to the table!
Looking to tap into that insight, Allan poses two questions for Omkhar. First, how would he characterize or define supply chain security and its implications? And second, how would he explain the SolarWinds breach and its fallout? Omkhar centers his thoughts on the SolarWinds situation, a costly breach in which hackers manipulated a code base and used it as a leverage point to gain access to high-worth targets. This attack required precision and focus, and is of the first public breaches; however, Allan and Omkhar imagine that there will be copycat attacks to come, and that the attack is a wake up call for all those with access to client data to step up their supply chain security.
Both providers and consumers with a hand in supply chain security have a responsibility to tighten their controls. Supplier checks should be more frequent, software suppliers need to be very buttoned-down in how they control their entire build architecture, and those overseeing supply chain security need to carefully navigate the available vehicles for managing supply chain risk. These vehicles, including questionnaires, right to audit, open source/credit-check style tools, and GRC tools, all have benefits and drawbacks, and no company manages supply chain security perfectly.
With a lot of sympathy for SolarWinds, though, Allan and Omkhar think that further work needs to be done in the cybersecurity space to bolster supply chain security measures. Omkar details his own “black box” idea, which he imagines would be a strong component of a more comprehensive security protocol. Allan explains how this comprehensive protocol could function, and while making such a system an international standard is far off, Omkar and Allan agree that there are tools in place for cybersecurity professionals to move toward a better system. There are issues of risk to weigh, myriad solutions to compare, and precursor tasks to address, but it’s time to get a conversation going that will ideally lead to change!
Key Takeaways:
1:10 - Allan asks Omkhar to share about his background before jumping into the main topic.
1:53 - Allan has two questions for Omkhar.
5:09 - Consumers and providers have a responsibility to step up their game.
7:41 - The conversation shifts toward the vehicles for managing supply chain risk.
9:05 - What’s Omkhar’s take on the open source/credit score-style check?
11:55 - Allan and Omkhar turn to Omkhar’s black box idea.
17:22 - Omkhar thinks highly of Allan’s comprehensive approach, but there are obstacles.
21:50 - What are these obstacles, and what is the needed precursor work?
26:20 - As the conversation ends, Allan asks about Omkhar’s motivation and passion.
Links:
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Learn more about Omkhar Arasaratnam on LinkedIn.
Sponsored by our good friends at AttackIQ

Startups & VCs in InfoSec w/ Will Lin Feb 24, 2021

In this show, host Allan Alford interviews his friend Will Lin about startups and venture capital. Will Lin is a venture capitalist with ForgePoint Capital, focusing exclusively on the information security space. First and foremost, Will views his current role as a way to help others. Allan welcomes Will on to the show to help his listeners learn more about the startup world, the venture capital world, and how those two intersect.
The show starts with Allan asking Will why he thinks startups are such a prevalent force in the cyber security world. Will is not sure, but his hypothesis is that this is in large part due to the ever-changing nature of cyber security. Since needs are constantly changing and each organization has unique needs, startups have popped up to address those specialties and change based on the different needs that arise. His second hypothesis is that there always need to be organizations prepared to address new and emerging threats to security.
For VCs, Will shares that companies and startups go through very natural progression in terms of maturity depending on their framework. Regardless, what it all boils down to is where in their life cycle any organization finds itself. Once the VC is able to identify where the company is in their life cycle, then they can begin to make informed decisions about the company. This will determine the type of funding that VCs will decide to provide. For example, usually when a company is around 10-20 members, they will be looking for series A funding. Typically, series A funding is around 10-25 million dollars, series B is 20-40 million and series C is 50 million and above. By evaluating the total of the investment, observers can estimate the valuation of the company.
While most companies only do a few rounds of fundraising, some companies will experience several late rounds of fundraising and Will advises that this is typically a good thing. The best indicator of health is the number of employees. If the number of employees is going down, that is one of the clearest indicators of regression. Once a VC comes in, though, that is where they are able to lend their experience to help with advising the business, which is Will’s favorite part of his job.
To close the podcast, Will shares that being able to help people and add value to their companies is the thing that keeps him energized and engaged in his position.
Key Takeaways:
0:24 - Listeners are introduced to Allan Alford and his guest, Will Lin.
1:27 - Why do so many people in the security industry rely on startups?
3:29 - What does Will do in his job and how has his background led to his current role?
5:36 - From Will’s perspective, what is the critical split between the first round of angel funding
9:33 - What is the expectation for funding in each different series of investments?
15:19 - What does the VC ownership look like from the perspective of the company?
21:22 - Does Will offer specific advice to the startups that he works with?
24:00 - What is Will’s opinion on startups that grow without any assistance from VCs?
25:48 - What keeps Will energized in his job?
Links:
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Learn more about Will Lin on LinkedIn.
Sponsored by our good friends at Axonius

Storytelling in InfoSec w/ Chris Cochran & Ron Eddings of Hacker Valley Feb 22, 2021

On this episode of The Cyber Ranch Podcast, host Allan Alford is joined by Ron Eddings and Chris Cochran from Hacker Valley Studio. The episode begins with Ron and Chris sharing how they came to cyber security and the roles they’ve held in the space.
While they came up in the cyber security space through different channels, they now work together at Marqeta, Ron as a Security Architect Leader and Chris as the Director of Security Engineering. Additionally, together they host the Hacker Valley Podcast. Allan is curious how the podcast affects their day jobs and their day jobs influence the podcast. Ron and Chris explain that it has given them wider contacts with people in the security industry and the opportunity to speak with them about their interests and expertise.
Allan asks Ron and Chris how they stay passionate about their work. Chris says both he and Ron believe in getting better everyday, even if it’s in small increments. Reading books, taking classes, speaking to mentors are all ways that he improves himself and makes sure he stays sharp. Ron shares that he is a collector, and it has led him to collecting experiences. Through these experiences, he is also able to continue getting better and improving himself.
They both share that through the podcast and their jobs, they need to continue learning and working. They’ve taken voice coaching and storytelling lessons to keep on the cutting edge of podcasting. Everyone has a story and the ability to share your own and help others share theirs is essential not only to impeccable podcasting but also being an empathetic and engaged human. In threat intelligence and user awareness training along with other technical skills storytelling is integral to meeting people where they’re at.
As the episode ends, Allan asks Ron and Chris about the future for them and their podcast.
Key Ideas:
:22 - Chris and Ron are introduced.
4:46 - How the podcast influences their day jobs and vice versa.
12:08 - Allan asks Chris and Ron about infusing passion in their work.
16:39 - The importance of storytelling in podcasting.
24:00 - What does the future look for Ron, Chris, and the podcast?
Links:
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Follow Chris Cochran on LinkedIn and Twitter
Follow Ron Eddings on LinkedIn and Twitter
Support Hacker Valley Studio on Patreon.
Sponsored by our good friends at Axonius

Vulnerability Management w/ Anne Marie Zettlemoyer Feb 10, 2021

Allan Alford interviews Anne Marie Zettlemoyer about the topic of vulnerability management. Anne Marie is a visiting fellow with the National Security Institute at George Mason University, and one of the all-around sharpest minds Allan knows in information security!
Anne Marie is deeply entrenched in the world of information security, and she loves her work. She began her career in accounting and finance, but by serendipity was introduced to security through a position updating a company’s payment system. From there, she was recruited into the Secret Service, where she developed a passion for the information security field - a field she hasn’t left since! Anne Marie is driven by the energy and nobility of her profession, and she values work as a protector and defender. At the same time, she feels a high level of responsibility to her company and her customers to navigate information security well.
The baseline for security work, Anne Marie says, is the fundamentals. The first line of a security officer’s responsibility is to maintain this sort of system hygiene; this is why Anne Marie is passionate about vulnerability management. In a changing threat landscape, vulnerability management is a basic necessity to keep products and clients safe. Of course, this does not make vulnerability management an easy task.
Practitioners of vulnerability management must also attend to a variety of factors, from issues of regulation and compliance, to CVSS scores and tooling for contextualization, to determining the way in which vulnerability management should be situated within their broader security program (often as a key driver). Within the world of information security, vulnerability management is one of many complex pieces to juggle together, and people like Anne Marie stand at the center of the balancing act. Anne Marie leaves listeners with an idea of how best to approach information security today, but she also leaves them with the prospect of exciting changes on the horizon in the areas of data governance and bridging the gap between speed and security.
Key Takeaways
0:17 - Listeners are introduced to Allan Alford and his guest, Anne Marie Zettlemoyer.
1:12 - Allan asks Anne Marie to walk through her day job.
1:56 - Why is vulnerability management important to Anne Marie?
4:13 - Allan shifts to the subject of motivating people to fix vulnerabilities.
6:26 - Anne Marie’s broad experience gives her a unique experience.
8:41 - Remediations must be obtainable.
10:27 - Overall, fundamentals, partnership, and understanding are needed.
11:27 - Allan and Anne Marie turn to metrics, tooling, and context.
14:38 - Within the security program, where does vulnerability management fit?
18:00 - How did Anne Marie get into vulnerability management?
20:15 - Her job and its responsibilities require certain things.
20:56 - What keeps Anne Marie in the game?
22:20 - What is she looking forward to in the field?
Learn more about Anne Marie Zettlemoyer and connect with her on Twitter and LinkedIn.
Learn more about Allan Alford and connect with him on Twitter and LinkedIn.
Learn more about The Cyber Ranch Podcast, part of the Hacker Valley Studio family.
Learn more about podcast sponsor Axonius.
Support Hacker Valley Studio on Patreon.
Follow Hacker Valley Studio on Twitter.

Behavioral Economics & InfoSec w/ Kelly Shortridge Feb 03, 2021

Behavioral Economics has altered our perceptions of what actually motivates human beings. How do these theories about our more primitive behaviors as well as our intellectual biases apply to information security? Allan Alford & Kelly Shortridge discuss in the context of infosec programs and events in a whirlwind of conversation. Sponsored by our friends at AttackIQ
Podcast: The Cyber Ranch Podcast Episode 2: Behavioral Economics and InfoSec with Kelly Shortridge
On this episode of The Cyber Ranch Podcast, host Allan Alford is joined by Kelly Shortridge, VP of Product Management at Capsule8. Their conversation begins with Kelly introducing herself and her work. She works in products for a security vendor, and she’s done research into applying behavioral economics to security. Kelly says she grew up with a love of computers, but was mostly about building gaming rigs side of things. Her career in information security began in the investment banking industry, which led her to fall in love with security.
Next, Allan asks Kelly about her work in behavioral economics. Economics is the study of choice, behavioral economics looks at the way humans actually behave by conducting experiments and observing natural occurrences. Humans don’t always behave in the rational, textbook way, but Kelly explains that often their choices are rational when you factor in competing priorities. In information security, this shows up when folks find themselves reacting to threats that have the most attention, rather than those that are proven to be the most pressing. Information security is also affected by hindsight and outcome biases. Kelly explains how our brains try to trick us into blaming a single factor in a crisis, but that is not how the real world or cyber attacks work.
Now that behavioral economics has clued us in to the biases formed by what Kelly affectionately refers to as our “lizard brains,” Allan wonders if we should be optimistic about how we may think and prevent attacks in the future. Kelly isn’t so sure. She explains that changing some systems to be more compatible with our lizard brain has been effective, however knowing how we think doesn’t help people think differently. In InfoSec, there are opportunities to continue making the secure way the easiest way, and circumvent the lizard brain. Other industries have been designing systems and workloads based on the way people behave; Kelly says InfoSec is just behind the curve.
As the episode ends, Allan asks Kelly what keeps her still in InfoSec. Kelly says it is spite. There are still inefficiencies and an industry that pats itself on the back for doing little, that makes her spiteful she says. She wants to be an industry member that adds value to organizations and highlights the user.
Follow Kelly on Twitter as @swagitda_ or on LinkedIn at Kelly Shortridge
Learn more about Allan and the Cyber Ranch Podcast at Hacker Valley Studio
Sponsored by our good friends at AttackIQ

1-Minute Introduction Jan 15, 2021

A one minute introduction to the show and its format

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected