This is the end of the trail for The Cyber Ranch Podcast.

Drew and Allan offer final parting thoughts and conduct brief interviews with 3 folks whose presence was vital to the show:  Chris Cochran, Ron Eddings, and Rich Salim.

It's been an amazing journey and we thank ALL of you who ever listened to even just one snippet of one episode.

Y'all stay good now!

More importantly, WHY do we all keep doing the same things over and over, saying the same things over and over, and expecting better results?

WHAT  can we change?

Join Allan Alford, many times CISO, and cybersecurity podcaster of many years now.  Joining Allan is Drew Simonis, who has been co-hosting the show now for 21 episodes, and a guest a few times before that.

This show is a chance to understand the premise of the show better, to understand Drew better, and to find out why we're all here.  Drew's bonafides:

• CISO @ Juniper Networks
• Former CISO and Deputy CISO @ HPE
• CISO @ Willis
• And various other roles including an industry role at Symantec

Drew joined as co-host because he’s a deep thinker, and because he applies that deep thinking to challenging the status quo.

Allan's WHY? Is very simple.  We’ve not grown or progressed as an industry in years now.  Which means we are clearly doing something wrong.  Mostly, IMHO, resting on our laurels, making the same assumptions, trying the same techniques, and not questioning any of it.

Drew offers a more nuanced take on the idea of "speaking the language of the business".  It's a great show.  Y'all be good now!

Our guest this week is Joe Stradinger, Founder and CEO of EdgeTheory, who are out to understand and leverage the conversations that shape our world.  Specifically, social media campaigns and presences.  Think threat intelligence but at a global/sociopolitical level.  Joe has been an investor, he has worked in DC, and he has a lot of academic ties as well.  His knowledge in this space is immense, and we are tickled pink to have him here at the ‘Ranch.

We ask Joe:

• What are the goals of a robust threat intelligence program?
• What is narrative intelligence and why does it matter?
• Compare and contrast this to traditional threat intelligence?
• How do adversaries influence the narratives?  Is this the realm of bots and deepfakes?
• Does narrative intelligence replace, complement, or improve on traditional approaches?
• How can narrative intelligence enable you to get in front of problems?

It's an excellent conversation, well worth a listen.

Y'all be good now!

• Tell us about your early career, did you start in security or as a technologist?
• What are the key priorities for someone with a CTO title? 
• As someone who has held both CTO and CSO titles, how does the pressure to deliver revenue impacting products differ from the pressure cyber leaders face?
• What does it feel like to be on the receiving end of security requirements which are often developed in the abstract or for the general case?
• When you are assessing future trends and technology shifts, what are the different lenses you use to make the security evaluation vs the more functional and integration-oriented evaluation?
• What is something you have learned which surprised you?  What do you wish other CSOs understood better?  What is a piece of advice…
• You’ve been involved in Defcon and other cyber events for many years, what changes have you seen during that time?

Y'all be good now!

• We see consolidation and platform creation, but also continued development and evolution of point products. Are we better to view cyber as a single market or is this a combination of several related but distinct markets?
• It looks like money is flowing into startups again, is that so? If so, what factors are driving the renewed interest in cyber products? And what is the difference between a startup and a scaleup
• Is VC money leading the development of new solutions or is it in a phase of fast following?
• Aside from AI, what types of solutions are heating up and where is it seeing more stable maturity? Any areas that have fallen off the map?
• Speaking of AI, are you seeing predominately new solutions or reframing of existing solutions to fit the new challenges that AI poses?
• Two ends of a spectrum, security using AI and securing AI. Which is most interesting? Which is more likely to produce a big breakthrough? Which is a more solvable problem?

Y'all be good now!

The conference was outstanding - no sales pitches, no nonsense, just many experts speaking on the topic of securing identity.  Entra ID, Okta, AD folks all were present, and it was amazing.

Allan got to interview some AMAZING guests from all walks of identity life, including one gentleman whose pedigree includes a rather critical national role right out the White House...

Listen in as Allan asks the following questions (one of which Drew answers too!)

• Why does identity matter?
• How do we protect the intersection of identity and data?
• How do you protect uptime (availability) of identity?
• What should be the single source of truth in identity?
• Who should own identity?  CISO?  CIO?  CTO?
• What is the role of cybersecurity in identity?
• What is the best directory services of all time?
• How do you manage identity sprawl?

Y'all be good now!

• Flavors and incarnations of AI - GenAI, Expert Systems, ML...
• Biomimicry and Allan's weird sea cucumber references
• Practical LLM deployment - Tim's maxims
• Offline or online?  Open or proprietary models?
• Precision, accuracy, asking the right questions in the first place
• Your smartest employee as your limiting factor
• Probabilistic vs. deterministic outcomes
• Hallucinations - not necessarily a negative term
• How long before we get the person out of the loop?
• The actual skills required to be a "GenAI engineer"
• Getting started at home - hardware and models
• Fabric AI and patterns

It's a great show and you will most definitely learn a lot!  Thank you Tim, thank you, listeners!  Y'all be good now!

But now Kirsten is CEO and Founder of The Institute for Cyber Civics, a non-partisan non-profit aimed at empowering poll workers and poll volunteers to recognize and deal with cyber attacks on the voting process.

Hear about Kirsten's charter, mission, vision, goals and capabilities in this SPECIAL EDITION! episode!

Y'all be good now!

Babbette is in DLP and Insider threat analysis.  She has worked in places as far flung as Edward Jones, Juniper Networks, and Bank of America.  More importantly, Babbette is quite involved in the intersection of social media and community engagement.

How do we use social media to engage others across generations and to and encourage community participation?

Allan, Drew and Babbette discuss:

• We’ve been talking to others about how they arrived in and either struggled or flourished in Cyber.  What is your story?
• What inspired you to embrace social media as you have?  What kind of results are you seeing from this engagement?
• We’ve seen your content on LinkedIn and on Instagram, it’s very creative but also very relatable.  How do you decide what topics to cover, how to frame them for the right audience, come up with the structure of your messages, etc.?  How many times do you re-do them?
• You’ve mentioned social capital.  Tell us about that concept, how you build it, how and when you use it, etc.  
• What is something established leadership in the field should understand about dealing cross generationally that we often get wrong?

It is a wonderful show, and Babbette is a wonderful guest who is willing to share the insights behind her success.  Y'all be good now!

Join Allan and Drew as they interview Sam Rad, a premier futurist and humanist, who freely admits that there is now an inherent tension between those two philosophies.

The conversations about the governance, ethics, and security of all this new media and technology are woefully behind the curve.

Many members of the TikTok generation has a 4-second attention span and require multiple simultaneous input streams at any given time to feel satisfied.  Is this a deliberate attack on the Western human nervous system?  Cyberattacks are certainly killing people already, why not go straight for their brains?

Are the peasants coming with pitchforks and torches to destroy Frankenstein’s newest monster?  How about the striking dockworkers?  The terrorists destroying 5G towers?  Do peasants with pitchforks ever win?  Ned (mistakenly called “Jason” by Allan)  Ludd and the Luddites failed in a big way to stop technology from replacing their jobs in the late 1700s (mistakenly referred to as the having happened in the Victorian era by Allan)

This show is peppered with others such historical and cultural references such as the cultures and economies in Second Life, Picasso’s mass production of his own paintings, Rousseau’s evolving concepts of property, Mary Shelly and her Frankenstein’s monster, Hegel’s model of “thesis, antithesis, synthesis”, the Butlerian Jihad from the “Dune” series, and William Gibson’s maxim that, “The street finds its uses for things”.

We’re not even coping with all of this, and now we have the AI conversation thrust upon us as well…  Your content is training data, and can be mimicked with uncanny accuracy as well.

Check out Sam’s book, “Radical Next” and her docuseries “Illicit Economies of the Shadowverse” to learn more about the positives and negatives of all of these trends in humanity.

Good luck out there.  Stay safe.  Who you are and what you own is irretrievably altered at this point.  Cybersecurity is really just “security” now.  But hopefully all this mess will create the next cultural and creative Renaissance.

Y'all be safe now...

He studied a great deal in his various cybersecurity roles before leaping into a CISO role, and the studying paid off!

Jason and Allan and Drew discuss the following:

• Identifying Common Pitfalls
• Promoting Team Well-Being and Efficiency
• Engaging and Education the Board
• Strategies for Effective Program Design

ALL in the span of one rapid-fire show!  Do give it a listen, as you will learn about many valuable approaches and resources to help your program succeed.

Y'all be good now!

• Insertion of fake IT employees into key companies
• Political influence operations (divide and conquer)
• Precursors to kinetic war being the smallest tip of the iceberg
• Philosophical differences between nations and governments serving themselves
• Cultures of trust in the West, and how those are not so self-serving

This one is very sobering and perhaps the most important show of the year...

Y'all be good now!

Or maybe in a way, he is all of us, really.  Tim advises and has held various other roles in the past, including product roles, which our listeners know are well-respected skills down at the 'Ranch.

The topic today is cyber regulation.  It can range from self-regulation to associations, principles, practices, lobbying – all the way up to full government regulation.  What works?  What’s required?

Topics covered:

• What is the case for regulation?
• What are the basics rules to provide us coverage and clarity?
• Not knowing the rules makes people nervous and afraid...
• Document your own processes, procedures, JDs, what you do, what you don't do. Make it clear!
• Rigorous banking industry regulations exist already.  How onerous are they?  How badly would they fit the rest of us?
• Perhaps a GAAP (generally accepted accounting principles) equivalent is desired?
• Process/procedure vs. 'Thou shalt never have a vulnerability!'
• Heavy-handed governmental oversight - defining standard of care and turning that into something people can stand behind?
• Remember that Sarbanes and Oxley were people.  Real people.
• Is regulation required to create a more positive environment in the way SOX does?
• What does the public-private partnership need so that the rules created are good and realistic and improve cybersecurity for the world?
• REGULATION IS COMING!  THE CISO COMMUNITY MUST BE A PART OF THAT REGULATION!
• Have we had a cyber Enron, and do we need one?  That was the real catastrophe that launched SOX...
• Regarding GAAP, accounting is deterministic vs. dynamic - Can a cyber GAPP ever exist given how dynamic we are?
• The compliance world: principles based vs. rules based regulation - a more practical model. It may not move the bar enough, but it's a good starting point.
• Should a whole field of security auditors existing like accounting auditors do?
• We are youngsters in this craft still...
• Is the accounting world really the best metaphor?  Auditors, forensic accountants, etc.?
• Another model is the medical world - malpractice, specific rules and regulations on specific surgical practices?
• What about a national CISO board or association like the NACD or the American Psychological Association?
• What about boards like medical review boards that approve specialties?
• Lobbying
• How to fund this?
• Who should be doing the doing?  Inclusivity vs. sound gatekeeping.
• A barber has to be licensed to cut hair - should we get licensed?
• This conversation was around with software engineers long before it was with cyber folks.  We learned that self-policing did not really work...
• The challenge is one of not shackling the business, or at least not appearing to, and the subsequent pushback.

The call to action is ultimately this: If you don't have a seat at the table, folks will do things to you rather than with you.  So get involved!

Y'all be good now!

Drew got the clever idea of inviting three folks who are brand new to the field or barely started on their cyber journey, and, get this: ASKING them what they're experiencing and what they need! Clever, huh? It's an eye-opening show for a CISO.

We are join on this week's episode by Amé Venter, May Ferreira, and Bryce Hill, who share their perspectives from their early stages in this field. It's a sobering perspective.

To a certain extent, they've all been lied to and led on, and that's all of our faults.

Key takeaways:

• Prodsec/Appsec might get you out of being a cost center in cybersecurity, but no intro programs seem to show folks how to get there.
• Certs aren't enough. Education is not enough. It is HARD to get started.
• Internships sound great, but even after you have secured one or two of them, entry-level positions remain elusive. Especially "entry-level" positions that require experience.
• Innovative programs like the one Bobby Ford is doing over at Hewlett Packard Enterprise are a huge leg up, but such programs are few and far between.
• There are a lot of folks standing outside the doors to our industry who were told this was the promised land. But there they are, still standing and peering in, waiting for an invitiation.

CISOs, please listen to this show. Please re-think your hiring strategies!

Y'all be good now!

Questions covered:

1. What is the Information Risk Insights Study (IRIS)? (cyentia.com/iris/)
2. What is a good summary of the IRIS Ransomware report?
3. How organizations out there can be more data-driven?
4. Analyst whitepapers vs. real data research – what are the differences?
5. Who else can mine data like this?
6. What truths do people resist or what do they fail to embrace?
7. What are the sacred cows and the “inflatable cows”?
8. Is the cyber job shortage a real, data-backed problem?
9. The desire for “flat math” vs. curves (the 5x5 grid) …
10. Measuring the problem side vs the solution side…
11. Actual best practices vs. common practices…
12. Insurance industry data and why they don’t share it…
13. Much of what we do does not affect the realities of our cyber risk.
14. Stepping back from all of this, what is the value in data-driven industry analysis of this sort?
15. How does one sponsor IRIS publications?

Y’all be good now!

• The communication problem we’re trying to solve is not the one we think it is!
• “Communicating the value of cybersecurity” - What doe that mean really?
• Clarity vs. Communication, Message received and understood...  It’s clarity of thinking, action, and outcomes that create the ability to communicate effectively.
• If that is the case, then what matters is how do OTHERS measure our success and how is that aligned or not with our own perceptions?
• How do we measure success in communication?   Is is how they measure it?
• What is the goal of communication? (And why do we say that instead of ‘the goal of good communication’?
• How do we get perspectives?  (We ask).

Y'all be good now!

Such software is composed of:

• Open source libraries
• Proprietary code
• 3rd-party proprietary libraries

You need to be able to see it, understand it, probe it for malware, backdoors, corruption, CVEs, KEVs, etc.  Well now you can.  SBOMs are just the beginning...

Allan and Drew are joined by Sasa Zdjelar, Chief Trust Officer at ReversingLabs, who have spent 15 years solving this highly specific and highly challenging problem in cybersecurity.

The show is not sponsored by ReversingLabs.  Allan and Drew wanted the world to know that they exist, and that this capability is now in-hand...

Y'all be good now!

Questions covered:

• The traditional triad of people, process, technology has been with us since 1964, from an era when digital systems were in their infancy and computing as we know it today was science fiction.  Is PPT still the right way to look at business problems?
• Has technology taken its place as "first amongst equals", or are we still right to say "cyber isn't a technology problem"?
• Given the evolution of technology and even more so with what is on the horizon with AI and other autonomous systems, are we moving past "technology enables humans" to "technology replaces humans" for some parts of the cyber challenge?
• How do you see the technology portfolio developing over the next 5 years?
• What is the future of data science?

Thanks as always for listening.  Y'all be good now!

Allan, Drew and Malcolm discuss the following:

1. People, process technology – what is the role of process in that triad?
2. How do we craft good process?  What part of process definition is capturing the as-is state vs. being aspirational?
3. How do we ensure good process is followed?
4. When should technology drive process vs process drive technology?  Where does process traditionally fall short?
5. What would you improve about process in general?
6. Tell us a bit about Hidden Layer, as this is some very new technology...

Thank you for listening!  Y'all be good now!

Y'all be good now!

The three cover the following topics in a lively conversation that journeys into several aspects of People as they relate to cybersecurity:

• People, Process, and Technology - Which is most important?
• If they knew what we knew about cybersecurity, would they behave differently?
• How to leverage training budges for a win-win-win.
• People gonna peop, businesses gonna biz.
• Incentivization, Positive Reinforcement and Deputization
• Enabling camaraderie - not just good culture
• Groupthink and Tribalism

Join the three as they ride the cyber trails of "People" in the PPT triad!

Y'all be good now!

Andrew Townley, a long-term SABSA consultant, on the other hand, gets straight to the practicality of it.  There is indeed an academic and theoretical foundation behind SABSA, but it is most definitely leveraged for one purpose -  to achieve desirable business outcomes.

Drew and Allan ask:

• What is SABSA's purpose?
• Is Andrew's specific practically applied methodology a deviation from the official SABSA cannon?
• How can prove its effectiveness?  What are the practical business outcomes?

Both Allan and Drew walk away with enough curiosity to dig into SABSA more.

Note that Andrew several times also cites the work of Russell Ackoff, another academician who enjoyed a rather brilliant career as a business consultant - grounding his systems theory into meaningful business practicality.

More on Russell Ackoff here:

https://en.wikipedia.org/wiki/Russell_L._Ackoff

You probably know about corporate social responsibility initiatives.

Did you know that it's not a a new idea in the history of capitalism, but rather a throwback?

Before shareholder capitalism, there was stakeholder capitalism:

Stakeholder capitalism proposes that corporations should serve the interests of all their stakeholders, and not just shareholders. Stakeholders can include investors, owners, employees, vendors, customers, and the general public at large. The focus is on long-term value creation, not merely enhancing shareholder value.

Drew walks Allan through some very compelling arguments in favor of this model, and Drew and Allan together tie it to how CISOs can implement and fund cybersecurity...

Random highlights:

1. The short-sightedness of quarter-over-quarter thinking

2. Comparison to the Chinese Communist Party, who gets a big thumbs down from both Drew and Allan, but who do get credit for being able to enact truly long-term plans.

3. Jack Welch and other prominent CEOs advocating for aspects of stakeholder capitalism

4. Random tie-ins to cybersecurity all throughout.

Allan is stoked to have Drew join him as co-host, and this show is most definitely one of the more philosophical episodes, while still grounding itself in the practicalities of running cybersecurity programs.

Y'all be good now!

Questions

• The elephant in the room is Gartner’s newest category in this space. Some say ASPM fits into: CTEM, which is Continuous Threat Exposure Management for those behind on eating their alphabet soup.  Tomer, what’s your perspective on that?
• Let’s talk about the problem in the ASPM/CTEM space: noise / too much data, no context, limited visibility from code to cloud and everything in between. For real, most solutions suck, as their single pane of glass is a very, very dirty pane of glass, and no amount of Windex is going to help.  And our listeners know we believe in 3-4 “single” panes anyway.   Is there such a thing as a single pane of glass in the ASPM space?  Do we want a single pane?  How does it play nicely with my “single” panes from other spaces?
• Here comes the can of worms: Can AI help with this?
• Gartner says by 2026 40% of enterprises will have an ASPM solution - do you agree?
• And then there’s good ol’ UVM - Unified Vulnerability Management. Feels like a past promise that didn’t deliver.  And it hasn’t addressed DevOps or even Dev very well at all IMHO.  What’s your take?
• How should CISOs be thinking about all of these technologies and practices? It can get very complicated very fast and if it’s not done right the devs will run screaming.
• Where is this all headed? What’s the ideal future state in this space?
• Here’s your chance to tell thousands of CISOs and other high-level practitioners what you want them to know. What do you want them to know?

Check out Dazz at https://dazz.io

Leadership can exist both by designation, and dynamically, as manifested by folks who may not have an official leader title.

And yet we don't measure followership, and our measurements of leadership leave something to be desired...

Join Allan Alford as he flies solo this week exploring these topics and suggesting a better way forward.

Y'all be good now!

1. What do you mean when you say “There is no such thing as security!”?
   1. Nate outlines declares it as way to judge risk
2. If security is a way to judge risk, then what about the judging? There are metrics there, and some kind of end state, yes?
3. So you’re saying our feelings about managing the unmanageable is really where the sense of security comes from? That ‘security’ = ‘feelings about risk management results’?
4. How do I know what I don’t know? How does that relate to this definition of security?
5. Let’s get concrete – What changes are needed for tools and tech to get past this false sense of security?
6. If security is a description of a thing, or a specific action, where does this leave us?

Omkhar Arasaratnam “How do we leverage LLMs for our own use in cybersecurity?” "How do you challenge your own precepts and assumptions to stay current in your role?"

Ofer Klein “How do you describe what you do in cybersecurity to someone at a cocktail party who knows nothing about cyber?" "How do you explain to the business the value you bring and the risks you solve?"

Rick Doten "What message do you have for your fellow CISOs?" "In this cybersecurity community there is hostility between vendors and practitioners.  What is your best moment with a vendor?"

Sahil Agarwal “How do you measure and articulate the risk that AI represents to the business?" "Governance, Risk Management and Compliance - Where should the priority be?"

Roger Brotz "What would you like your fellows CISOs to know?" "What are we still getting wrong in cybersecurity?"

Tyson Martin "How do we take on more accountability as business leaders?" "How do we overcome our defaults, precepts and assumptions?  How do you get past your own biases and blind spots?"

Sponsored by our good friends at Semperis.

It's a great series of a guests, and a great series of answers.  Y'all be good now!

Chris "Cpat" Patteson

“Why do so many CISOs think cybersecurity insurance is snake oil?”

Johann Balaguer

“People, process, technology - Which is the most important and why?”

"What do you want your fellow community of CISOs to know?"

Lee Krause

“What are we still doing wrong in cybersecurity?"

Ken Foster

“What are we still doing wrong in cybersecurity?"

"How do we articulate risk to the business?"

Marty Momdjian

"Walk me through how to solvie the nightmare of repeat incidents?"

Michael Calderin

“IA&M: Who should own it, and why?  CIO?  CISO?”

"What is the definition of progress in cybersecurity?  Is there an end state?"

Mike Britton

"People, Process, Technology: Which is the most important?"

"I&AM: Who should own it?  CISO or CIO?"

"What's your favorite part of the RSA conference?"

Sponsored by our good friends at Semperis.

It's a great series of a guests, and a great series of answers.  Y'all be good now!

Dr. Deanna Caputo

“How do you measure and articulate risk to the business?”

“People, process or technology?”

Carlos Guerrero

“How do we foster community in cybersecurity?”

Elliott Franklin

“Governance, Risk Management, and Compliance – Which of the three is most important?”

“What does progress look like in cybersecurity?”

Corey Bodzin

“With regards to AI & LLM, what is the impact to infrastructure?”

Evgeniy Kharam

“How integral is Identity & Access Management to the cybersecurity mission?”

“How well is traditional DLP technology meeting its mission and what else can we do?”

Gary Hayslip

“What does RSA mean to you?”

Kelly Shortridge

“What does progress mean to you in cybersecurity?”

“What is the end goal of cybersecurity?”

George Kamide & George Al-Koura

“What are you getting out of RSA?”

Kevin Jackson

“What are we doing wrong in cybersecurity?”

Sponsored by our good friends at Semperis.

It's a great series of a guests, and a great series of answers.  Y'all be good now!

WARNING: Some naughty language

WARNING:  Some naughty language this episode.

Drew and Allan share some real-world stories where they put security on hold for the benefit of the business:

1. VP of R&D had been told he had to get a new product off the ground that was only quasi-planned for. He had properly allocated headcount, but realized his cloud costs were going to rise dramatically.  At the time Allan had a big security initiative he was pushing for out-of-bandwidth.  They met and talked.  His out-of-bandwidth need was stronger than Allan's in terms of benefits to the business.  Allan backed him AND also made sure that his extra cloud spend included a few more security features in AWS.  Win-win.  Drew has a similar tale.
2. Flat-out, Top line was declining and we could not figure out specifically why. New competitor explained some of it, but not all of it.  Market fatigue?  But that was not all of it.  CRO wanted more sales folks to throw at the problem.  CISO backed him and agave away project budget to support him.
3. Company had a mismanaged an expansion. Building was paid for, but nobody had thought about the IT costs and headcount.  CIO was trying to figure out where to get bodies to populate the new site.  Allan gave up 2 headcount for 2 more quarters.
4. Startup: CISO took on Marketing department temporarily when head of Marketing left. Slowed down the security focus, but Marketing needed some hands-on attention beyond what the CEO could give.  It paid off for the business.
5. CISO Joined forces with head of Pro Services to push through a security initiative that benefited key customers for him (contracts he could now secure), but also gave me some more generalized security comfort.
6. Spent huge amount of what could have been security operations time training sales teams on security as differentiator in the market. Benefited top line.

Drew and Allan share many more stories and break down why in each of these cases, deprioritizing daily security operations was the right thing to do!

Y'all be good now!

It's more than attending sales calls.

It's more than security questionnaires

Listen for some clever new tips on driving business growth!

Melanie is here at the 'Ranch to talk specifically about the fact that so many CISOs feel they are in organizations that simply don’t care about cybersecurity.  She’s got some good insights into this one, and it’s the perfect topic for her expertise.

Allan asks Melanie:

1. Allan put up a LinkedIn poll asking folks “Do you feel organizations properly prioritize cybersecurity?” The results were pretty sobering.  What are your thoughts?
2. Is the problem really the organization or is it us? Probably a mix of the two, or maybe one or the other depending upon the environment and the individual CISO?
3. Assuming it’s the organization, how can a CISO avoid such organizations in the first place? How do you vet a company for its commitment to cybersecurity?
4. If you find yourself in a company that does not seem to care about cybersecurity, what should be your next steps?
5. Allan has emphasized over the years that all CISOs are salespeople times two. We sell the problem, then we sell the solution.  Is that a fair perspective in your mind?  How many other leaders have to sell their mission in general?  I think we all end up selling specifics…
6. What communication skills can improve the situation for CISOs?

He deconstructs the types of CISOs and the "selling" they must do.  Sometimes you really are selling, but most of the time you should be solving business problems.

Allan speaks to:

• Business objectives met
• Business risks reduced
• Maturity

And also deconstructs the art of selling itself.

Hint: Business Impact Analysis is a valuable tool in this whole process.

Special thanks to Helen Patton and Melanie Ensign for prompting this exploration.

Y'all be good now!

Allan asks Jonathan, in a VERY lively conversation:

1. What is SecDataOps?
2. What is its focal point?
3. Who should be in charge?
4. What skills are required to participate?
5. Who has those skills?
6. What about the trifecta of people/process/technology?
7. What is wrong in the community with our approach?

Y'all be good now!

The lineup of guests covers ADHD, Autism, challenges unique to women with neurodiversity, how leaders should manage neurodivergent team members and more.

Y'all be good now!

Allan asks Geoff:

1. You say the first step is prioritizing clarity in communication. What does that mean to you?
2. Your next step is developing strategic storytelling. Can you elaborate on that one?
3. How do we enhance crisis communication?
4. How do we engage stakeholders proactively?
5. What about data? How do we leverage it in decision making?
6. How does one bolster their leadership presence?
7. How do you implement a feedback loop?
8. What practical tools and strategies can be utilized for effective communication?

It's a fantastic show full of great insights, and you will thoroughly enjoy listening to it.

Y'all be good now!

Conference highlights are discussed as well, including hacker activities, hacker demonstrations, incredible talks, etc.

Allan also learns all about The Tech Degenerates, and organization furthering partnership and comradery amongst cybersecurity vendors, MSPs, MSSPs, CISOs, etc. (Allan has since joined their Discord group!)

Another great highlight is a chat with Carlos Rodriguez about the vCISO life.

This show is sponsored by our good friends at ThreatLocker - visit https://threatlocker.com and tell them you heard about them down here at the 'Ranch!

Y'all be good now!

Allan tries to keep up in this episode that jumps from topic to topic, but all with a zero trust underpinning.

It's another LIVE! episode recorded at Zero Trust World 2024 in Orlando.

Sponsored by our good friends at ThreatLocker.

Y'all be good now!

James Keeler of LMT Technology Solutions has a steady hand on the incident response wheel and a lot of experience under his belt as well.  After seeing James speak on a panel at Zero Trust World, Allan asked him to be on the show.

Join Allan as he asks James to walk us through his philosophy of incident response, the underpinnings, the steps and just about everything else about Incident Response as well.

This show is sponsored by our good friends at ThreatLocker - visit https://threatlocker.com and tell them you heard about them down here at the 'Ranch!

Allan in fact, has been recently diagnosed as being on the autism spectrum, albeit 'high functioning' (as the diagnosis indicates) or 'low support needed' (as the autism community prefers to call it).

With his recent diagnosis, Allan decided to reach out to friends in the neurodiverse community to discuss:

1. The positives of neurodivergence
2. Neurotypical responses and stereotypes about the ND community
3. Cybersecurity-specific benefits to being ND
4. Tips/Advice/Support for those who suspect or know that that they are ND

CPUs, BIOS, Firmware, embedded Linux, FPGAs, UEFI, PXE...  The list goes on an on.  What are we supposed to do about that?

Allan asked Yuriy to come down to the 'Ranch to discuss this issue with him.  Yuriy is CEO at Eclypsium, member of the Forbes Technology Counsel, Founder of the open source CHIPSEC project, former head of Threat Research at McAfee, form Senior Principle Engineer at Intel…  He is uniquely qualified to discuss these issues.

Full DISCLAIMER: Allan is CISO at Eclypsium.  Note that he asked Yuriy to come on the show, not the other way around.  Nobody knows this space like Yuriy and his team.

Allan asks Yuriy about:

• The history of CPU exploits
• Unauthorized code in chips in network gear
• The various hacks available at this layer
• The role of SBOM in all this
• The open source CHIPSEC project

It's an eye-opening show to say the least.

Y'all be good now!

• "We have all the accountability and none of the authority!"
• "We don't own the risk - we advise the business"

Allan is refuting both of these claims.

Allan calls up examples such as project managers, contract lawyers, CFOs in his argument.

He also demonstrates that we have far more authority than we think, and also that we can earn even more.

As to advising the business, and the business owning the risk, we have here two contradictions to one of the show's mantras: "BE the business!"

You will hopefully come away from this show with some different perspectives on these two claims.

Y'all be good now! 

Hopefully we pulled it off.

Join Allan and Jim McConnell, Principal at Ask McConnell, LLC and former Fellow in Corporate Security Protection Operations at Verizon, as they take on the challenge of solving this common lament.

There is a fierce round of "answer pong" as they throw out suggestions on how to earn that seat, but they also cover:

• What does it mean to have a seat at the table?
• Ownership vs. advising
• Bridging the chasm between the two
• Supplier/Vendor to the business - is that a good model?
• BE the business (yes, that always comes up!)
• How to become a business expert

And of course, the aforementioned game of Answer Pong as to how to earn that seat.

Y'all enjoy the show, and y'all be good now!

Allan has often thought about doing this as well, so he got Pat on the mic to talk about his whole experience:

1. Why did you do it?
2. How hard was it?
3. What was involved?
4. What do you hope to get out of it?
5. Did you farm around for alternatives?
6. Is there more you plan to do?

As topics for shows go, this one is short and sweet.  But Pat, as always, spins a very human tale that will keep you engaged.

Y'all be good now!

1. So we talk about the role of the CISO in business enablement all the time. Allan argues, based on the wise words of Scott McCool, a friend and mentor, that we are not here to enable the business.  Rather we are here to BE the business.  The distinction is that enablement still puts the CISO off to the side of the goings on.  Being the business means that the CISO is part of the process, in there with sleeves rolled up alongside CRO, CMO, CFO, CEO, COO, etc.  So let’s ask the question twice:
   1. In a B2B context, what are three things a CISO can do to enable the business?
   2. In a B2B context what are three things a CISO can do to BE the business?
      1. Presumably one of these involves being part of the sales cycle?
   3. Let’s drill in on the company’s products/services. Not talking about sales, but rather the products and services themselves, how can we as security practitioners be an integral part of products and/or services?  What are three ways we can be the business there?
   4. What about the relationships? How do we strengthen being the business with regards to relationships with our peers?
   5. What about customer-facing activities beyond sales? How do we be the business with regards to our customers?
   6. Challenge round, what about B2C? Melanie Ensign in a panel she was part of said that one way Cybersecurity can help B2C is by reducing support tickets.  This is pure genius.  Any other B2C tips?
   7. You have your own podcast, and a newsletter, book…. Tell our listeners all about what you offer the cybersecurity world...

Y'all be good now!

Marketing!?!!?  Say what!?!?

Yup!  Allan went down to Austin to catch up with industry players and to participate in the conference as a "creator", i.e., podcaster.

While there Allan ran into his friend Tom LeDuc, CMO at Semperis, and he got Tom to hop on the mic with him to discuss leadership challenges such as conflict, territorialism, jurisdictional disputes, startup mindset vs. bigger mindset...  The two of them cover quite a lot of territory.

Some of Tom's story is obviously CMO-specific, but Allan and Tom both universalize the topics and get to the heart of what matters for all leaders.

This show is not sponsored by Semperis, but Allan wants to clarify and be transparent about the fact that he is an advisor to Semperis.

Allan says: "Tom is just a great guy and is fun on the mic!"

Y'all be good now!

Questions Allan asks John:

1. Without revealing any secrets, what was your experience investigating the Zero Trust model for such a large organization?
2. What are the misfits of Zero Trust?
3. What’s are some examples of what you have dubbed as “2nd world affectations”?
4. What’s are some examples of what you call “3rd world affectations”?
5. Where do we go from here?
6. Where would you suggest highest priorities?
7. Is Zero Trust here to stay?
8. What comes next?

Thank you, listeners, for dropping by the 'Ranch!  Y'all be good now!

Questions Allan asks Luke:

1. What is the difference between traditional attacks and the new SaaS cyber kill chain?
2. Where is the new perimeter in a fully SaaS/remote company? Is it cloud identities?
3. What is it we’re actually protecting in a fully SaaS/remote company? The data landscape is very distributed now…
4. You’ve mentioned that certain protective technologies are so good that they have inspired new methods of attack. This is the classic arms race metaphor.  What drove the bad guys into attacking SaaS-native companies?
5. Walk me through the modern kill chain in a SaaS-native company. I’m thinking in terms of recon, access, lateral, escalation – the old model has changed, has it not?
6. Let's pick specific attacks from the matrix and review them

Sponsored by our good friends at Push Security.

Check then out at:

https://pushsecurity.com/ranch

After our first chat with Adam, Allan really got to thinking about this idea we bandy about that “identity is the new perimeter!”  Is that the right model? Is it a complete model?  Are there better models to describe our SaaS sprawl security problem?  Allan posted his ideas on LinkedIn and LinkedIn got very vigorously into the conversation.  We thought Adam and Allan could record a show and hash some of these concepts out, and Adam agreed, so here we are!

1. In one sense, vulnerable Internet-facing credentials have ALWAYS been a problem.  In other words, Identity is not the new perimeter, but is a rather old one.  What are your thoughts?
2. What is happening in the wild?  What do the attacks actually look like?
3. Allan Alford Consulting subscribes to over twenty SaaS applications, and Allan is literally a one-man company.  How many SaaS apps are used by the average enterprise?  What percentage of those are in the SSO fold?  This is truly scary.
4. How do we get everything behind SSO?  How do we get SSO locked down and secure?
5. What’s our best possible world?  Everything behind SSO with a Yubikey?  Next best is everything behind SSO with Smartphone MFA app?
6. Back to this perimeter thing:  J. David Christensen agrees with the idea that identity is not a new perimeter.  He says it has always been THE perimeter!  Jamir Fisher agreed.  Robert Mithcell points out that if and identity provider can be compromised, then identity is the M&M defense after all (hard shell, soft center).  Our friend Abhishek Singh says authZ and authN combine to form Zero Trust.  Once you have zero trust, he says, like it or lump it, identity becomes the attack surface.  What are your thoughts on that formula?  We found it to be a rather tidy summation, as did our other friend Dan Holden.  Thoughts?
7. Lastly, when we talk identity, we always feel the need to point out that humans are just some of the identities crawling our digital world.  Are the solutions we’re crafting for humans using SaaS also good for machine accounts?  Application accounts?  API-to-API connections?

Sponsored by our good friends at Push Security.

Check then out at:

https://pushsecurity.com/ranch

1. Tell us about your history and relationship with NIST CSF
2. Let’s talk briefly about the role of frameworks in cybersecurity.  I’m thinking of the “compliance != security” mantra here.
3. 0 vs 1.1 – what are the highlights?
   1. GV (Govern) Function added
   2. Implementation Examples (Long overdue IMHO!)
   3. What else?
4. Changes to categories – 2 less overall, but other changes as well…
5. I was glad to see supply chain called out in specific.  That was overdue.  What else was overdue?
6. What should have been in there that is not?
7. Describe the process if you would for generating a CSF – we have already seen draft and call for public feedback.  What’s next?

Y'all be good now!

• Cecil Pineda
• Jaimin Shah
• Randy Potts

CISO XC is the only conference for CISOs (and their reports) that is put on my a team of 3 CISOs and an awesome all-CISO advisory board.

And the amount of money CISO XC gives to charity is MIND BOGGLING.  Hint:  This years's goal is greater than some CISO's salaries!!!

In this brief SPECIAL EDITION! you can hear more about CISO XC, its take on it's 3 priorities: Charity,  Community and Collaboration.

AND you can learn how to sign up for the biggest event yet in March, 2024.  That's right!  CISO XC is going nationwide!

https://registration.socio.events/e/cisoxcspring2024

This spring you can meet Randy, Jaimin and Cecil as well as Allan and a host of other Dallas-Fort Worth security folks.  Practitioners attend free, and the conference will be a blast!

Allan will also be giving out a limited number of cowboy hats to those who can answer trivia questions about CISO XC (hints will be provided).

Y'all be good now!

He asks a unique question of each guest, who represent a great deal of breadth in our industry:

• Dave Belanger, CISO at Bestow Insurance - What is the most effective way to demonstrate and communicate security program progress to the board?
• Tera Davis, CEO at CyberOne Security – How does a vendor forge relationships with a customer to be a strategic advisor and not just another vendor?
• Andrew Woolen – Account Executive at Semperis – What do you wish CISOs knew about the vendor side of the fence?
• Fred Clayton – Vice President Information Security at GI Alliance – What are you doing to develop talent in your teams?
• Mickey Disabato – vCISO at Booz Allen Hamilton – What are the big differences between vCISO and CISO?
• Alain Espinosa – Global Director Security Operations at Upbound Group – What is the one thing you would change in cybersecurity today?
• Josh Kleen -  Enterprise Solutions Architect at Rubrik – As a vendor, how do you see your role in this whole “We’re here to fight the bad guys” thing?
• Pat Benoit – Global CISO at Brinks – Why are you sleeping well?
• Russell Swinney – CIO & CISO at Infrastructure, Inc. – What is your secret for good staff retention?
• Richard Weiss – CISO at AccentCare, Inc. – What are the most unusual, nontraditional cyber skills you have on your team?
• Sam Baxter – Global CISO and Data Privacy Officer at AppSpace – What are your favorite sources for staying up to date in this industry?
• Michael Anderson – CISO and Deputy CTO at Dallas Independent School District – Outside of the security space, there are inspirations to be had everywhere.  What is the one that has most inspired you in cybersecurity?

Y'all be good now!

For those who don't track it, there is no Cyber Ranch Podcast four times  a year:

• American Thanksgiving week
• Christmas week
• Black Hat week
• RSA week

That gives Allan enough breaks throughout the year to preserve his sanity.

Y'all be good now!

The challenge was issued!!!! Allan teamed up with TWO other podcasts to take on the insufferable marketing that floods the cybersecurity industry in the month of October! Who won???

"Won"?

That's right!  Allan, along with George  K and George A from Bare Knuckles & Brass Tacks joined forces with Aaron Pritz and Cody Rivers of Simply Solving Cyber! Together, this trifecta of podcasters weighed in on the October bonanza that is Cybersecurity Awareness Month. While the month started humbly to raise awareness for the general public, it has now become an excuse for vendors to inundate infosec professionals' inboxes with inane messaging. Introducing: The Cyber Community Month challenge! Vendors: we challenged you to come up with campaigns that give back to the customer community rather than sending awareness spam. Client-side practitioners: We asked you to show us how you engage local communities, volunteer at schools, help nonprofits, etc. to spread cyber knowledge! This is the conclusion and awards ceremony!

Shout-outs to our winners, all of whom did something special for the community.

Carlos Guerrero (deserves special note as a truly committed community builder!)

Gerson Rodriguez

Guidepoint Security

Bugcrowd

Enjoy the show, and y'all be good now!

• What kind of lawyer is Evan and why can he speak on this topic?
• What does disclosure mean, how does this change disclosure?
• What is the role of the CISO in all this?
• Key Takeaways?
• What countries do not have extradition treaties with the USA?  (Obviously a tongue in cheek question!)

1. Allan maintains that the cybersecurity budget should be tied to specific risks identified vs. specific business processes and/or assets as determined by Business Impact Analysis. In other words, we identify WHAT we care about, use BIA to tell ourselves HOW MUCH we care, and then we chart the risks to those processes and assets.  We then stack rank the risks based on impact but also plausibility (see prior show with Andy Ellis and Chris Roberts as to why Allan uses plausibility and not probability).  We then can sit down with the business and say:
   1. For $x we can address these top 5 risks
   2. For $y we can address these top 7 risks
   3. Etc, etc.
   4. Budgets are tight? Lower the risks addressed.  It’s that simple!

NOTE: Allan is cheating here with this simplification.  Run rate matters.  Our existing tech stack is already in play before we address specific risks.  So there is accretion there that must be acknowledged.  And the question is also begged:  How much does the already established run rate actually tackle specific risks vs. broad strokes?  EDR, for example, should already be present.  Do we say that EDR addresses the ransomware risk or the data leakage risk of HR data or the data theft risk of customer data, and/or…  You get the point.  Allan's model is not perfect.  But what Allan has ALWAYS stood against is the idea that the cyber budget should simply be expressed as percentage of revenue or percentage of IT budget or percentage of anything external to cybersecurity, really.

2. Tim, disagrees and finds flaws in Allan's model:
   1. Should we be tied to IT budget at all?  Tim says YES!
   2. Should we only be a percentage of revenue or overall organizational budget?  Tim says YES!
3. What is the value in capping budget via external measures like %age of IT spend or %age of revenue?
4. How do we tackle run rate vs. specific projects in your model? How does one choose what remains and what gets cut from the to-do list when budget tightening occurs?
5. What other benefits exist to Tim's model?
6. Is there a way to reconcile the two models? Is that reconciliation even necessary?

Topics covered in this show:

1. The new ruling and tell me its highlights
   1. Disclosure
   2. Risk Management
   3. Board expertise
2. What are the implications of the disclosure rules?  What are the challenges businesses face?  What tools can be leveraged?
3. It seems that “materiality” is the key term upon which all of this pivots. That term has definition and precedence in financial circles, but how is a cybersecurity professional to interpret it?
4. What are the implications of the Risk Management rule? If you work with a cybersecurity framework like NIST CSF, for example, you’ve already got at least the basics in place?
5. And now we get to Board Expertise… CISOs are all anticipating getting board roles overnight, but it’s not that easy. NACD in conjunction with CISA put some material together.
6. How should CISOS prepare themselves to be ready for a possible board role?

• What are the hallmarks of an excellent team?
• How do you measure results?

The two tackle some of the most sensitive pain points on both sides of the fence, and get into solutioning some of the most common CISO/vendor problems.  All while donating to Black Girls Code whenever a buzzword gets used.

Their ultimate conclusion?  We'd better figure out how to lock arms, as the bad guys have no problems coordinating with each other.

Come together.  Right now.  Over The Cyber Ranch Podcast.

Sponsored by Palo Alto Networks XSIAM.

Find out more at a workshop near you!

• What are the fundamental tenants of proper permissions management?
• What are the goals?
• What does the tech stack look like? different categories you're going to pursue?
• What are the differences between mid-market and enterprise when it comes to permissions management?
• What is missing still in permissions management?
• What does next 3-5 years look like?
• How does permissions lifecycle tie into identity lifecycle?
• What is broken with RBAC?

The below points are mostly followed, but the pair also get into CISOs embracing risk, CISOs owning risk, and buying 'lemons' in the cybersecurity market:

1. So Cybersecurity Ventures says 2023 spending is growing 15% year over year. Between awareness training and tech stack, they are estimating $198+ billion in spend this year on cybersecurity.  Techcrunch analyzed the estimated shrinkage of budgets this year based on economic conditions:  45% of budgets remain unchanged or even increased.  3% of budgets were cut by an average of 21.2%.  So these figures hold close to steady despite the economic downturn.   We spend more and more on cybersecurity every year.  When does this end?
2. Conversely, InfoSecurity Magazine says ransomware attacks surged by 74% in 2023. Wired reports an increase for 2023 as well.  We can dig into Verizon and IBM annual reports to see generally trends of year-over-year increases as well.  Verizon shows 13% increase with a curve that’s trending upward more quickly each year.  What gives?
3. How do we solve this? How do we bridge this gap?
4. Tactically, we have tech stacks and awareness training and GRC. What is our spend story there vs. this looming threat landscape?
5. Is the solution to spend less, but more intelligently? In other words, crafty rationalization where we still get full coverage, but spend less?
6. If we can never close the gap between spend and threat, what are we to do?

Sponsored by our good friends at Seraphic Security.

Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.

Challenge issued!!!! Allan has teamed up with TWO other podcasts to take on the insufferable marketing that floods the cybersecurity industry in the month of October! Who among you will win???

Win?

That's right!  Allan, along with George  K and George A from Bare Knuckles & Brass Tacks joins forces with Aaron Pritz and Cody Rivers of Simply Solving Cyber! Together, this trifecta weighs in on the October bonanza that is Cybersecurity Awareness Month. While the month started to raise awareness for the general public, it’s now become an excuse for vendors to inundate infosec professionals' inboxes with inane messaging. Introducing: The Cyber Community Month challenge! Vendors: we’re challenging you to come up with campaigns that give back to the customer community rather than sending awareness spam. Client-side practitioners: Show us how you engage local communities, volunteer at schools, help nonprofits, etc. to spread cyber knowledge! We’re awarding prizes in November. Share your efforts on social media with the hashtag #CyberCommunityChallenge

Sponsored by our good friends at Entitle.

Entitle is how cloud-forward companies provide employees with granular and just-in-time access within their cloud infrastructure and SaaS applications.  Whether it's providing access to production for on-cal engineers or granting access to customer data when a support ticket is opened, Entitle easily integrates with your stack, offering self-serve access requests, instant visibility into your cloud entitlements and making user access reviews a breeze.  Learn more at entitle.io

And yet...

• 36% of small businesses have no concern whatsoever about cyberattacks. Another 59% of small business owners who have no cybersecurity believe that their company is too minuscule to be targeted.

• 47% of businesses that have less than 50 employees don’t allocate any funds towards cybersecurity. While 51% of small businesses don’t utilize any IT security measures.

The threat is real, but preparedness is not.  Join Allan and Georges Merchak as they tackle the nuances of protecting small organizations.  Georges is an industry veteran who has held many full-time practitioner roles, but also consulting roles.  Georges has served small business.

Together they address:

1. Vs. bigger businesses, what are the challenges and benefits for the small guys? Are there any benefits?
2. Is there value for a CISO to consult with these guys?
3. What is different about their attack surface?
4. So security is their least concern, and yet it sure seems like it should be a big concern. How do we educate them?
5. What’s the maturity rollout? There is no way you can tackle a small business’ entire cyber problem in one go…
6. What are the low-hanging fruit? Some very practical steps?

Y'all enjoy!

Sponsored by our good friends at Seraphic Security.

Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.

Imagine for some reason you needed to bury a treasure where nobody would ever find it.  In today's society, how could you even do that?  How can you get from Point A to Point B without being observed or tracked in some way?

Did you know that you can be listened to through smart lightbulbs?

This episode features the infamous and always gracious Chris Roberts, back again on the 'Ranch during this LIVE! recording from the HIP Global 2023 conference in NYC.

Chris and Allan talk about these subjects and more in an eye-opening show about just how much folks can see you and hear you.

Join in and become just a little more paranoid...

Sponsored by our good friends at Seraphic Security.

Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.

It might have made you grown, but it might have inspired you and others.

It might have represented what we do well enough that you can refer people to it who ask after our craft.  Or maybe the portrayal was so bad it was laughable.

Join Allan and George LIVE! at Black Hat as they pick apart their favorites and take suggestions from the audience as well... Hack the Planet!

Sponsored by our good friends at Seraphic Security.

Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.

Did you get to attend Black Hat this year?  See if your experience was as amazing as Allan's!  This show is LIVE and untarnished.  It's the real Black Hat experience!

In this episode, Allan talks to (in alphabetical order, with timestamps):

1:02 - Dani Woolf, Founder & CEO at Audience 1st

3:06 - Daniel Blackford, Manager of Threat Research @ Proofpoint

6:48 - Dean Sysman, CEO @ Axonius

8:19 - Deepen Desai, Global CISO & Head of Security Research @ ZScaler

15:39 - G. Mark Hardy, host of the CISO Tradecraft Podcast

18:42 - Glen Pendley, CTO @ Tenable

23:54 - Kayne McGladrey, Field CISO @ Hyperproof

24:52 - Leigh Honeywell, CEO @ Tall Poppy

25:52 - Masha Sedova, CEO @ Elevate Security

28:47 - Nate Warfield, Director of Research @ Eclypsium

31:43 - Rich Berthao, Cybersecurity Leader, Planner, and Innovator

32:41 - Rob Labbé, CEO and CISO in Residence for the Mining and Metals ISAC

This show captures an amazing week!

Sponsored by our good friends at Seraphic Security.

Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.

We'll catch y'all next week!

1. What is the OpenSSF and how does it relate to the Linux Foundation?
2. What is the organization's mission?
3. What is the organization's vision?
4. What exciting projects are taking place (and a sneak peek about some upcoming announcements at Black Hat!)
5. What mark do you want to leave on the OpenSSF as Managing Director?

Omkhar is an expert in DevOps and CI/CD.  He is an expert in security.  His passion is supply chain security.  You can see where all of this can come together in his new role and make amazing things happen for your industry.  Y'all enjoy, and y'all be good now!

Tunde Oni-Daniel is a grizzled veteran in our industry who has managed to maintain his enthusiasm, passion and energy for the job.  Tunde is an expert on cloud remediation and together he and Allan discuss:

• Cloud lifecycle
• Challenges when findings happen
• Drift management
• Bugs vs vulnerabilities
• Sec/Dev/Ops relationships with regards to remediation
• What works, what's fast?
• The next 3-5 years of cloud remediation

This one is a phenomenal show packed full of practical tips and high energy.

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

The LinkedIn conversation was phenomenal, and Drew and Allan do a great job of summarizing it and calling out the underpinnings behind much of what we believe in this industry.

Questions Allan asks Drew:

1. What inspired this topic?
2. What were some of your favorites from the LinkedIn thread?
3. What are the underlying themes here?
4. Is BYOD security really a thing?
5. Are third-party risk assessments useful?

Special thanks to LinkedIn posters:

• Peter Schawacker
• John Prokap
• Duane Gran
• Brian Campbell
• Matthew Dimmick
• Graham Lewendon
• Marcus W.
• Dmitriy Sokolovskiy
• And everyone who participated in a very lively thread...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Do please forgive the sound quality on this one.  It was recorded on the road, and the conversation was too amazing to re-record despite the quality issues.

Kate and Allan cover:

• Best human approaches in board communicating – everything but the presentation itself
• How to get to know your board both individually and collectively
• What to present
• What not to present
• Best tips and tricks overall

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Allan tackles the following questions:

1. How does a CISO protect themselves from prosecution?
2. How does one get value from a cybersecurity assessment?
3. How should one pick a cybersecurity solution or company?
4. How do you "disconnect" from cybersecurity?
5. How to start and sustain a cybersecurity podcast - why and why not?
6. Allan's orgin story
7. Allan argues with himself over two issues

NOTE: Allan states: "I have no idea why anyone would want to hear my origin story, but here it is.  You can skip it if you like.  It runs from roughly 19 minutes to 24 minutes."

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

But what Allan and Anne Marie Zettlemoyer get into in this episode is a variety of questions around the assumptions:

1. Start with a quick summary of the MOVEit exploit and Clop.
2.  How does this attack compare to SolarWinds?
3. What can we do to prepare for zero-day exploits?
4. Is society (and the business world) getting jaded to ransomware attacks and breaches? Is this affecting their investments in cyber?
5. Is a post-breach CISO really rolling in the assets and resources the way so many assume?
6. What are the long-term implications for a business, its stock prices, and its CISO investment?

This is another episode that strives to get deeper than the surface.  We hope you learn something from it, and we hope you enjoy it as well.  Y'all be good now!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Allan is joined by his friend Claude Mandy, former CISO, former analyst, and now Chief Evangelist at Symmetry Systems.  Like Allan, Claude is a Zero Trust enthusiast.  The podcast was the capstone to a long day of Zero Trust presentations, panels, book reviews and other great topics and conversations.

Join Allan and Claude at this live recording that covers:

- How does DSPM fit into Zero Trust?

- Allan's victory at a recent Digital Fight Club event where he championed Zero Trust

- Overcoming Zero Trust marketing hype

- Is Zero Trust a framework, an architecture, or something else?  Hint: Claude says it's something else.

- What are the biggest challenges in implementing Zero Trust?

- What are the benefits to the business of Zero Trust?

- Security is about the intersection of Data & Entities - not about Assets

- What are the most exciting aspects of RSAC 2023 for Claude and Allan?

- What are the best methods for securing a budget?

- How do you structure your budget to align with business costs (COGS, R&D, CAC...)?

- What are some good ways to save money as a CISO?

- How do you best lower vendor costs for the long term?

- How can a CISO help make money for the business?

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

- Keeping up with industry trends

- Managing cyber incidents

- Third-party questionnaires (both directions!)

- Vendor onboarding

- Work from home vs. going into the office

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Jay is going through TX-RAMP right now, and both he and Allan have done research on FedRAMP and StateRAMP as well.

What are the differences?  Why might you choose one over the other?  What are the gotchas?

This is a great show and you'll get to learn a bit about Allan's brief foray into state government as well...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

• Gary Hayslip, CISO @ Softbank Investment Advisers
• Michael Calderin, CISO @ YAGEO Group
• David Cross, CISO @ Oracle SaaS Cloud
• Audra Streetman, Security Strategist @ Splunk
• Adrian Peters, CISO @ Vista Equity Partners
• Robin Sundaram, CISO @ RELX
• Merritt Baer, Office of the CISO @ AWS
• Rob Wood, CISO @ Centers for Medicare & Medicaid Services
• Bryan Green, CISO Americas @ ZScaler
• Stephanie Derdouri, Sr. Manager, Information Security and Technology Risk Management @ Capital Group
• Andres Andreu, CISO @ 2U
• Paul Love, CISO & Chief Privacy Officer @ Co-op Solutions
• Royce Markose, former CISO
• Bob Schuetter, CISO @ Ashland
• Susan Thomas, CEO @ 10Fold
• Brian Markham, CISO @ EAB
• Ken Foster, VP of IT GRC @ FLEETCOR
• Elizabeth Martinez, Account Exec @ ThreatLocker
• Josiah Dykstra, Senior Fellow, Office of Innovation @ The NSA
• Kevin Brown, CEO @ Innit
• Brent Deterding, CISO @ Afni
• Audra Streetman, Security Strategist @ Splunk
• Wendy Whitmore, SVP, Unit 42 @ Palo Alto Networks

I ask my guests several questions including:

• How do you impact the top and bottom line?
• What topics are you tired of in cybersecurity?

There are also some special interviews at the end - discussions about the RSA conference itself, tech stack sprawl, and personal branding and marketing for CISOs.  Oh - and a question about how vendors and CISOs can work better together AND a conversation about how government and industry can work together in cybersecurity.

Give this one a listen!  It's jam-packed with great insights!

Sponsored by AttackIQ & Semperis.

AttackIQ offers a new fully managed breach and attack simulation service.  They are the premier provider of MITRE ATT&CK-based security control validation.  https://attackiq.com

Semperis provides the industry's most comprehensive Active Directory and Azure AD cyber resilience platform, supported by specialized AD incident response expertise.  https://semperis.com

Allan picked 6 chapters that resonated with him in particular and got Andy to elaborate:

• Chapter 1 - “Personal improvement is a prerequisite to leading professionally”
• Chapter 6 - “Gift kindness where it isn’t expected”
• Chapter 8 – “An uncompelled apology unburdens everyone”
• Chapter 13 - "Your wellness is one of the greatest assets you control" (Listen as Andy hits Allan straight in the feels on this topic)
• Chapter 24 – "People need to see versions of themselves to feel welcome"
• Chapter 35 - "In general, be vague"

The book is amazing, these particular chapters are amazing, and Andy's expounding upon them is amazing as well!

Y'all be good now!

Premise One: Given how many organizations that are vulnerable and that have NOT been breached, the bad guys are suffering the same skills gap we are.

Premise Two: Exploit attacks (think of exploits as ransomware, data hostage situations, threats to publish breached data, etc.) can benefit from LLM AI.

It's really that simple a connecting of the dots.  Adrian and Allan deconstruct the steps of an exploit attack, analyze the capabilities of LLM AI and cross-reference the two.

If they are right, then we have a burden of leveraging and learning LLM AI ourselves, as quickly as possible...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

• Chris Kennedy, CISO @ Citadel
• Gary Hayslip, CISO @ Softbank Investment Advisers
• Michael Calderin, CISO @ YAGEO Group
• Reet  Kaur, CISO @ Portland Community College
• Rob LaMagna-Reiter, CISO @ Hudl
• Matthew Lang, vCISO
• David Cross, CISO @ Oracle SaaS Cloud
• Audra Streetman, Security Strategist @ Splunk
• Vishal Amin, General Manager of Security Solutions (Federal) @ Microsoft
• Adrian Peters, CISO @ Vista Equity Partners
• Kelly Shortridge, Author of “Security Chaos Engineering: Sustaining Resilience in Software and Systems”
• Robin Sundaram, CISO @ RELX
• Merritt Baer, Office of the CISO @ AWS
• Tim Rohrbaugh, former CISO & Industry Leader
• Rob Wood, CISO @ Centers for Medicare & Medicaid Services
• Bryan Green, CISO Americas @ ZScaler
• Stephanie Derdouri, Sr. Manager, Information Security and Technology Risk Management @ Capital Group
• Andres Andreu, CISO @ 2U
• Paul Love, CISO & Chief Privacy Officer @ Co-op Solutions
• Royce Markose, former CISO
• Bob Schuetter, CISO @ Ashland

I ask my guests several questions:

• What is the best part of RSAC 2023 for you?
• What is the single most critical skill a security leader needs?
• What's missing in cybersecurity?
• What is your take on Purple Teaming and MITRE ATT&CK?
• How do you co-lead the organization?

There is also a VERY special interview with James Stanley, Chief of Product Development at CISA at the end.  Don't miss it!

Sponsored by Semperis & AttackIQ.

Semperis provides the industry's most comprehensive Active Directory and Azure AD cyber resilience platform, supported by specialized AD incident response expertise.  https://semperis.com

AttackIQ offers a new fully managed breach and attack simulation service.  They are the premier provider of MITRE ATT&CK-based security control validation.  https://attackiq.com

Dazz has completed a Series A investment round.  Semperis a Series C.  It turns out that the skills each CEO needs are still remarkably the same.

Saddle up for another episode, where Allan asks his guests:

1. What’s the coolest thing that has happened for you or to you as a startup CEO?
2. What has been the biggest single challenge?
3. What are your top 3 tenets of leadership?
4. What is the purpose of vision and how clear must it be?
5. What is the purpose of mission and how clear must it be?
6. What is your advice to those who would want to become a startup CEO?

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Security chaos engineering is derived from chaos engineering, a relatively new discipline in software development that seeks to test distributed computing systems to ensure that they withstand unexpected disruptions.  It's all about resilience, in other words.  Security chaos engineering seeks to do the same for the security of such software systems.

Kelly breaks down her book during a lively conversation featuring an opinion or two her cat, Link (yes, a Zelda reference!):

• Who should read this book?
• Resilience in software and systems
• Systems-oriented security
• Architecting and designing
• Building and delivering
• Operating and observing (Allan's favorite chapter as it intersects with one of his Zero Trust tenets)
• Responding and recovering
• Platform resilience engineering
• Security chaos experiments (a very fun chapter!)
• Case studies

Note that the book is peppered with references and quotes from other disciplines.  We would expect no less from Kelly.

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

Join Bryan and Allan as they serve up (we're still doing it!) a lively and informative episode!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

1. Cybersecurity viewed as a necessary evil, related to The Twilight Zone
2. Ownership, Authority, Accountability: Inventory and Means of Control
3. Are WE the baddies?
4. (Largely) Forgotten Security Principles

Allan and Adrian dissect cybersecurity practice in this great episode!

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

The topic is data security: its challenges and how to overcome them.

Joining Allan are Cecil Pineda of R1 ("Cecil the CISO") and Gene Moore of Securiti.

The conversation is live and lively, recorded as-is and delivered to you.

Enjoy!

Sponsored by Securiti - https://securiti.ai/

This week Allan is joined by Leigh Honeywell, CEO at Tall Poppy, to discuss these intersections.  Leigh is uniquely qualified, as her non-traditional startup addresses "personal security outside the firewall", which includes executive protection...

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

With this wealth of experience she has come to value design partnerships - working with small startups to help craft their solutions to meet hers and their needs.

But what are some of the challenges in design partnerships?  Allan and Emily tackle the following questions:

1. What inspires one towards design partnerships?
2. How can a practitioner design partner help a first-time founder?
3. Where does the innovation come from in this model?
4. Does the vast amount of cyber vendors help or hinder the design partnership model?
5. What are the pros and cons of alternatives to design partnership?
6. How does a practitioner get started with design partnership?

Sponsored by our good friends at Dazz:

Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.

In fact, Karla has written an ebook on the subject which is available here:

https://karlareffold.co.uk/advisory-boards-guide-book

Topics covered in the show:

- The ethical entanglements of being on an advisory board

- Paid vs. unpaid advisory board roles (and cash vs. equity)

- Advisory board roles as kickbacks (yes, it happens)

- Advisors who are customers vs. advisors who are not

- Do advisory board roles help or hurt a CISO's career?

Enjoy!  Y'all be good!

- What precepts really are "obvious"

- How does one onboard leadership and business perspectives?

- What should CISOs do to ensure their teams gain those perspectives?

- What can individual contributors do to ensure that they gain those perspectives?

- The value of self-teaching and mentorship

- Beliefs we should get rid of

It's a great conversation!  Ya'll enjoy it!

Topics covered are:

- How to spot lies

- Vetting the vendor's internal security landscape

- ISO 27001 Statement of Applicability

- Breaches and whistleblowing

- GDPR violations in charging to delete data

It is a story you will want to hear, and the analysis just might save you some pain down the road...

Sponsored by Allan Alford Consulting https://allanalford.com/about

Hear Mike's journey from IT technician to GRC to CISO.

Topics Allan and Mike cover:

• The tension between tech teams and GRC teams, and how a CISO can bridge the two teams
• Reasons why GRC makes such a great background for the CISO role (and how to get there)
• What engineering/architecture folks should know about GRC
• What GRC folks should know about the tech side of the house
• What the rest of the business should know about GRC

You also get to hear Mike's journey, which has spanned small and large companies, government think tanks and more!

Sponsored by Allan Alford Consulting https://allanalford.com

Join Allan and Robin Sundaram as they explore this topic, covering areas such as:

• NIST CSF is all about imperfection
• Embracing CMDB imperfection
• Vulnerability Management and Patch Management
• Product/Project Rollouts
• Dev teams and the pipeline
• Imperfection and GRC

It's a great conversation and you are sure to learn a thing or two!

Sponsored by Allan Alford Consulting: https://allanalford.com

They challenge each other to a game, "Technical Case vs. Business Case", where they must provide both arguments for a given technology deployment.  The real subtext here is that whenever these two get together, they always lean towards a technical conversation, so they are challenging themselves.

Topics Covered:

• MFA
• Service Accounts
• Refresh Cycles
• Token Expiration
• Recovery Emails
• Regulatory Mandates
• Biometrics
• SBOM

It's a lively conversation and we hope you will find value in it!

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs.  Find out more at https://trustmapp.com

Even after controls were put into place to prevent ChatGPT from helping the bad guys, Allan and Shaun were able to trick it into giving up details on hacking, authoring phishing emails and more.

Shaun and Allan explore the potential for abuse and the positive promise and excitement that this new era of AI is ushering in.

What are the societal implications of ChatGPT?

What are the positive advances of AI?

Should we be cautious with what we feed ChatGPT?

Hear answers to these questions and more on this week's lively episode.

 Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs.  Find out more at https://trustmapp.com

Joining Allan this week is Heather Noggle, owner of Codistac - a company that specializes in cyber communications, advocacy and awareness.  She studied communications in college, and takes this stuff very seriously.

The pair cover LastPasss, Okta and Reddit breaches, comparing the bad to the good.

Topics covered:

• Poor editing of communications
• Willful non-communication
• Obfuscation
• Apologies
• Letting the lawyers have their say - but not the last say
• The balance between speed and accuracy

It's a great conversation and a great show.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs.  Find out more at https://trustmapp.com

The role can vary quite a bit, as you will hear on this episode with not one, not two, but three BISOs joining Allan Alford to discuss the role and its nuances:  where it fits, what is required, how it is best positioned and managed.

Allan has been a BISO himself and has managed BISOs as well, so the conversation is rapid and productive.

Join Allan along with Ann Hines (BISO @ USAA), James Binford (BISO @ Humana) and Matt Winkeler (BISO @ Equifax) as the explore the BISO role.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs.  Find out more at https://trustmapp.com

Scott Moser is SVP and CISO at Sabre Corporation, has also been a CISO for Caesar’s (the gaming and hospitality company), and has held some very interesting military roles of his own.  In a joint branches capacity, Scott has been a CIO in Alaska.  For the US Air Force, Scott has been a Commander and an IT Director, all over the world.  He has also worked for the Joint Staff in Washington, DC as a branch chief. 

These two gentlemen speak about leadership holistically - how to exhibit excellent leadership yourself, how to train for good leaderships, and how to foster it in others.

Sponsor Links:

Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business objectives and cross-references them to remediation costs.  Find out more at https://trustmapp.com

The topic is "What are we really protecting in cyber?" and the nuances of that question are explored in depth - as well as the interrelationships.

Is "protect the business" a guardrail statement while "protect data and people" is the mission?

How do we tie protecting people to protecting the business?  For the people?  For the business?

How do we map data to the business mission?

How far do we go to protect data?

What about this new DevOps, application-centric world?

Enjoy this conversation!  It's a lively one.

02:11 Point MOOt, Texas: MOO-based virtual city with virtual economy, virtual stock market, various political models of governance and high preponderance of highly interactive bots used for practical and administrative purposes. http://linguafranca.mirror.theinfo.org/9405/moo.html https://archive.nytimes.com/www.nytimes.com/books/first/l/leonard-bots.html

04:49 A fast tour of the the age of the universe, Planet Earth, and humans' presence on the planet, industrial revolution and the Internet

05:45 The Annex BBS in LA https://annex.net/about-us/

05:28 IRC https://en.wikipedia.org/wiki/Internet_Relay_Chat

06:12 - Arthur C. Clarke - "Any sufficiently advanced technology is indistinguishable from magic." https://lab.cccb.org/en/arthur-c-clarke-any-sufficiently-advanced-technology-is-indistinguishable-from-magic/

07:12 - Iranian refugees, educated folks who spoke 5 languages and had 4 passports

07:49 - Dungeons and Dragons https://dnd.wizards.com/

08:05 - Life demands more of us than just having a job

08:16 - Karl Marx, Shakespeare, Julius Caesar, Poetry

08:43 - TI-99 4A and the BASIC language on the Commodore PET https://en.wikipedia.org/wiki/TI-99/4A https://en.wikipedia.org/wiki/BASIC https://en.wikipedia.org/wiki/Commodore_PET

09:02 - Earthlink https://www.encyclopedia.com/economics/encyclopedias-almanacs-transcripts-and-maps/earthlink-inc#:~:text=Earthlink%20Network%20was%20founded%20in,would%20be%20providing%20customer%20service.

09:24 - Tech Writing and List Making

09:41 - Running a SOC for Citi

10:20 - Jack of all trades and the value of curiosity and love, surprises and exploration

11:04 - There is no one cybersecurity - we don't even know what it is yet

11:40 - Cyber as nascent field with great opportunity to leverage other disciplines

13:02 - TOGAF and the CIO's organization and functions and the CISO reporting into the CIO https://en.wikipedia.org/wiki/The_Open_Group_Architecture_Framework

14:02 - Nobody knows what a CISO does

14:39 - We can't have it both ways - to have a seat at the table we must own risk and have accountability.  Authority can't exist without accountability.

15:13 - Do CISOs know how to buy stuff?  Lack of budgeting process.

15:45 - Eff around and find out - security incidents - order out of chaos - crisis management

16:34 - Pen testing as games (game theory): https://en.wikipedia.org/wiki/Game_theory

17:11 - The influence of playing music

18:48 - Wagner's invention of instruments https://www.californiasymphony.org/2018-19-season/epic-bruckner/whats-a-wagner-tuba/

19:12 - The influence of getting sober

19:30 - Chuck Anderson - Best guitar teacher on the planet? https://truefire.com/educators/chuck-anderson/e4187

19:45 - Dissonance and consonance; inverse ratio between complexity and power

20:17 - Entrepreneurial spirit in the music business and an illegal booking company

20:48 - Everything applies everywhere; metaphor and the origins of ideas

21:21 - Marx and Engels - revolutions get stuff done

21:43 - Rothko's artwork compared to The Ramones https://en.wikipedia.org/wiki/Mark_Rothko#:~:text=Mark%20Rothko%20(%2F%CB%88r%C9%92,a%20Latvian%2DAmerican%20abstract%20painter.

22:14 - The subconscious produces genius; we are all geniuses

22:51 - The mathematical concept of Aleph-0 and George Cantor as inventor of discrete math https://mathworld.wolfram.com/Aleph-0.html#:~:text=is%20often%20pronounced%20%22aleph%2Dnull,spelled%20%22aleph%2Dnought.%22

23:40 - Wittgenstein's refutation of Cantor despite computing being based on discrete math https://en.wikipedia.org/wiki/Ludwig_Wittgenstein

24:05 - Divine revelation or bipolar disorder?

24:33 - "The Aleph" short story by Jorge Luis Borges https://web.mit.edu/allanmc/www/borgesaleph.pdf

25:13 - "Weaving the Web" by Tim Berners Lee and Borges foreshadowing hyperlinks https://www.amazon.com/Weaving-Web-Original-Ultimate-Destiny/dp/006251587X

25:51 - We need heroes - mentoring without heroes is not possible

27:08 - Learning from the masters in cybersecurity; maybe we will be in history books

29:42 - Gaining sobriety, learning to reach out for help - valuable in cybersecurity

31:10 - Raising children; paternalism and cyber careers

32:32 - Edward de Bono - Lateral Thinking https://www.amazon.com/Lateral-Thinking-Creativity-Step/dp/0060903252

33:13 - "Flow" by Mihaly Csikszentmihalyi https://www.amazon.com/Flow-Psychology-Experience-Perennial-Classics-ebook/dp/B000W94FE6

- Pivotal career transitions

- Is a plan _really_ required?

- Principles, foundations, and successful behaviors

- Practical steps and resources

- Is the power of envisioning enough?

- Tactical and other tips

Y'all enjoy this one, now!

00:00:58 - Brent Deterding - What can practioners do to show more love to vendors? 00:03:07 - Evgeniy Kharam - How important are soft skills in cybersecurity? 00:03:54 - Evgeniy Kharam - What are we doing wrong in cybersecurity? 00:05:17 - Andy Ellis - what are we doing right and what are we doing wrong? 00:07:15 - Nipun Gupta - What needs to happen to get cybersecurity practitioners to trust cybersecurity vendors? 00:10:29 - Brent Forest - What is the value of mentorship in cybersecurity? 00:13:48 - Heather Noggle -  How do you get small organizations to take cybersecurity more seriously? 00:17:34 - Karla Reffold - What piece of advice would you give somone trying to get into cybersecurity? 00:19:16 - Will Lin - Where do you think this whole cybersecurity thing is headed? 00:22:37 - Jack Powell - What are we doing in cybersecurity that we should not be doing? 00:29:17 - Dutch Schwartz - What is missing in cybersecurity? 00:36:13 - Kevin Pope - What is your best piece of advice for those entering the cybersecurity field? 00:42:42 - Julian Cohen - How do we prioritize our defenses? 00:45:22 - Benjamin Corll - What do you love most about being in cybersecurity? 00:47:05 - Special Appearance by Chis Cochran and Ron Eddings of Hacker Valley Media 00:50:07 - Chris Patteson - How worried should we be about post-quantum cryptography? 00:54:03 - Peter Schawacker - What are we doing right in cybersecurity? 01:01:45 - Adrian Sanabria - What is it we are not doign in cybersecurity that we should be doing? 01:08:38 - Chris Foulon - Where is this whole cybersecurity thing headed? 01:13:52 - Claude Mandy - What are we getting wrong in cybersecurity? 01:18:25 - Gary Hayslip - What is the trend towards a data-centric security model? 01:26:17 - Kirsten Davies - What is going to change with threat intelligence in 2023? 01:30:58 - Special Appearnce by Dr. Ursula Alford (Allan's wife)

Join Allan, Andy, and Chris as they deconstruct risk, extolling its virtues, and hopefully change the way you think about risk altogether. Is likelihood times impact valid? Is the 5x5 grid valid? What is plausibility vs. probability? Find out on this great LIVE! episode!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Allan posted this topic on LinkedIn and it created quite a buzz. The show features quotes from Simon Goldsmith, Kevin Pope, Malcolm Harkins, and others.

Listen to hear a deconstruction of this position, and hear some great arguments both for and against it. We'll give away the ending - the argument is ultimately refuted - but it is a great thought exercise and a wonderful journey getting to that conclusion. Hint: The show's ending is more apt than ever: "Ya'll be good now!"

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

How can we, as privacy and security professionals, overcome our paranoia in order to build community?

How do we, as new members of cybersecurity, break into the community?

How do I start a local community?

How do we welcome others?

What is wrong with the cybersecurity community today that we need to fix?

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

1. Eliminating the culture of "No!"
2. Managing Third-Party Risk
3. Building a "No Blame" Culture

The common thread behind all of these themes is relationship building and goodwill - but the details are well worth the listen!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

• Should the CISO be the one to decide whether to report breaches?
• Should the CISO own the SOC?
• Should the CISO report to the CIO?
• Should the CISO have an MBA?
• Should the CISO be mentoring individual contributors in their team?
• Should the CISO be sharing the political realities of “upstairs”?
• Should the CISO own Identity?

Enjoy this fantastic conversation that goes to a lot of surprising places!

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

In this show we address:

Defining terms: zero trust, ML, AI, hacker vs. cracker, cybersecurity vs information security

How to pronounce "CISO"

Work from home vs coming to the office

Do we deserve a seat at the table or is it earned?

Hopefully, these three are stepping beyond the tired answers to these topics and are raising the bar on how we should approach the information security profession.  You be the judge...

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Join Allan Alford, Rich Mason, and Michael Santarcangelo as they rope in some of these tired topics and propose alternative ways of looking at them.

This one runs a bit longer than usual because the conversation is that good. Also, there are a few naughty words...

In this Part One episode they offer some alternative takes on the following tired topics:

• Who should the CISO report to?
• Users as the weakest link
• Talent Shortage
• CISO Burnout
• Imposter Syndrome
• Awards Marketing
• Bad Vendor Behavior

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

• Risk Management Lifecycle
• Vendor Management Lifecycle
• Personnel Onboarding/Offboarding (Joiners, Movers, Leavers)
• Data Governance Lifecycle
• SOC2 Audits
• Internal Audits
• UI Considerations
• Organizational Familiarity with the Tool
• Automation &  Integration

In this short but sweet episode, a lot of very practical tips are addressed.  Y'all be good now!

Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

Timecoded Guide:

[00:00] Researching cybersecurity psychology & other exciting industry mashups

[09:22] Security logical fallacies: straw man, gambler’s, & ad hominem

[15:19] Cyber cognitive biases: confirmation, omission, and zero risk bias

[19:24] Perverse incentives & cobra effect: security vendors, bug bounties, & cyber insurance

[25:55] Creating an accurate measure of how secure we really are 

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley

In the context of cybersecurity, what are some examples of magical thinking? 

Magical thinking, or the belief that thoughts can influence the material world, appears alongside the most common assumptions in cyber, according to Josiah. Recognizing the harmful practice of cyber practitioners blaming users for bad decisions, Josiah uncovered that many security pros believe the user will make the right choice without any additional training. Unfortunately, this magical thinking only leads to users being unprepared and uneducated.

“We assume users will pick good passwords without providing them education. We can't just think in our heads that things will go right, that never happens. We need to make careful decisions, whether it’s how we configure systems, or develop software, or conduct training.”

Can you walk us through common fallacies in cybersecurity, like the gambler's fallacy?

While the straw man fallacy and ad hominem are often easy to identify in the cyber industry, Josiah explains that the gambler’s fallacy is just as pervasive and detrimental. The gambler’s fallacy involves seeing trends and “hidden” meanings in independent events. Most often, in security, cyber practitioners will believe a breach won’t happen if a company recently had a breach, even though these breaches would have nothing to do with each other.

“Imagine you’re flipping a fair coin, like a penny, and you get heads, heads, heads. Your brain starts to see an error, like, ‘I'm due for tails, if I had so many heads in a row.’ The fact is, the penny doesn't care about the last flip. These are all independent events.”

What about common cyber biases, such as zero risk, confirmation, and omission bias?

The cyber industry is ripe with biases. In fact, over 180 cognitive biases exist. Josiah’s book tackles a select few that appear time and time again, including zero-risk bias. Zero-risk bias is extremely common in cybersecurity. Security is about risk— understanding it, preventing it, and reacting to it. Many cyber companies will put all their eggs in one expensive basket, such as encryption, believing that this will create the impossible scenario of them having “zero” risk.

“We talk in the book a little bit about how you can never get risk to zero, right? Cybersecurity is always about risk management. There is somewhere between more than zero and less than 100% chance that your computer will get infected today.”

“The goal of a security vendor is to keep you secure.” Why is that a misconception?

Just like biases and fallacies, cybersecurity misconceptions can be costly mindset mistakes that lead to easily preventable errors. Josiah wants us to consider that security vendors are not altruistic, they’re running a business and making a sale. While many vendors have a goal to keep customers secure, that will not be the only goal they have. Josiah recommends taking precautions and never assuming the vendor will always put security first.

“The goal of any business is to make money. That's why that business exists. You could argue with me that it isn't an ‘either or.’ They can make money and we can be secured, we can have both, but that's an ideal world. I think, in reality, it's a little bit bumpier than that.” 

----------

Links:

Learn more about Josiah Dykstra on his LinkedIn and his website

Check out Josiah’s book, Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls That Derail Us

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Finding business coherency in the one-page strategic plan

[08:39] Selling Alpine security & transitioning from leader to participant

[13:46] Escaping the golden handcuffs & embarking on a new career journey

[17:35] Outlining seven steps to emotional intelligence in cyber with his first book

[20:34] Embarking on appreciation of life’s little moments with book number two

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What were the challenges in growing the business you started, and how did you overcome those?

Christian’s inspiration for Alpine Security, his first business, was actually the stress of a conflicted relationship with a CEO he worked with. Feeling misaligned with the company he worked for, Christian left and began his journey towards entrepreneurship, thinking that his work ethic and willingness to do it all would lead to his success. Instead, refusing to delegate and lack of focus on leadership created conflicts between himself and his employees.

“I had to get over myself. Initially, I thought I’d do everything. I thought I could brute force this and make this work. I just tried to do it all myself. If my staff was having problems with something, I would jump in and help, but there's only so many hours in the day.”

Was your intention to sell your business from the beginning? What was the process of selling like?

Although he advises every entrepreneur to have an exit strategy, Christian admits he didn’t initially create one with Alpine Security. After agreeing to a deal with Cerberus, Christian learned the hard way that the process of a business sale can be like a pair of golden handcuffs. Struggling with a lack of control and feeling constantly under scrutiny, Alpine Security eventually lost its founder as Christian embarked on a new journey in his career.

“In my company, I was in charge of the culture, the core values, the emotional intelligence, the touchpoints, the clients, all of that. Now that I was part of the larger organization, I wasn't in charge of that. I had to approach things differently.”

Can you tell us about your first book and the seven-step process it outlines in cybersecurity?

Major struggles during Alpine Security’s founding were due to a lack of emotional intelligence and people skills amongst staff, in Christian’s opinion. These conflicts inspired the 7 steps of emotional intelligence for cybersecurity practitioners that Christian outlines in his first book, The Smartest Person in the Room. These steps include: awareness, mindset, acknowledgement, communication, mono-tasking, empathy, and Kaizen (continuous improvement).

“My first book is really about all the challenges I had in the company I started. 99% of the challenges I had were because of my staff, who were super bright, super high IQ penetration testers that didn't have emotional intelligence or people skills.”

What are you going to do with your new book? Is that also cybersecurity related?

In contrast to his first book, which focused solely on cybersecurity professionals and the struggles they face with people skills in the workplace, Christian’s second book dives deeper into mindset. Focusing more on the value of life and the ideas around mono-tasking, Christian inspires his readers to care more about the micro moments. This second book is all about slowing down, seeing what’s happening around you, and seriously absorbing the information we take in every day— from the big moments to the little moments and everything in between.

“I think a lot of us go through this zombie state in life, going from one thing to the next thing, and we're distracted with our phones and everything else. We're missing a lot of things that are right in front of us.”

----------

Links:

Learn more about Christian Espinosa on his LinkedIn, Twitter, and website

Check out Christian’s book, The Smartest Person in the Room: The Root Cause & New Solutions for Cybersecurity

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Bringing a background in finance into the cybersecurity API world

[05:25] "Hacking" a bank’s API using business logic instead of hacking

[12:17] Implementing standard API protocols and processes

[14:27] Flipping the API language and preparing injection threats

[19:03] Evolving defenses overtime to meet both new needs and new risks

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What does your current role look like and how does it relate to API security?

Chuck began his career in tech and security in the banking industry, and felt particularly concerned over time with the lack of security around APIs and related technology. Now, with his CTO position at Wib, Chuck works with Wib to focus on providing continuous visibility into API attack surfaces. Outside of just the newness and the tech of APId, Chuck explains that there are critical infrastructure and national security ramifications for API security. 

“The basic premise is: If you could do it differently, knowing what you know now, what would you build in an API security platform? What I'm bringing to the table is 20 years as a defender in US financial services, where I know what we need from a governance perspective.”

Akamai recently ran a study of internet traffic. What were their findings about APIs?

As someone well researched in his work with APIs, Chuck pays close attention to recent studies, like one from Akamai, that recently claims 91% of their global internet traffic is API traffic. Chuck explains that this is a huge development in the popularity and impact of APIs on global security, especially when relating it to a separate study that estimates 50% of APIs are actually unmanaged. Although this stat seems shocking, many in the industry believe even that estimate is low, and the issue might be even worse than studies are showing. 

“91% of the traffic that Akamai handles is API traffic. So, 91% of global internet traffic is API traffic. Another stat which is a little harder to prove estimates that roughly 50% of API's are completely unmanaged.”

You actually performed a hack live on an API, but it wasn't even a hack at all. Can you tell me that story? 

At the most recent Black Hat, Chuck dissected and presented a few case studies, one of which was a bank’s API, hacked using a logic-based attack. Using the errors in business logic present within the banking API, Chuck’s team was able to bypass the front-end system and transfer fees, managing to convert money into more valuable currency over and over again. The wildest part, to both Chuck and to presentation attendees, was that this didn’t require tech hacking, it only required exploiting business logic. 

“We didn't tear apart the mobile app and find the stored credentials, the API keys, which are probably in there. We didn't crack any passwords. We just abused the logic, and it responded in the way it was designed and here we are.”

If we can’t anticipate every possible business logic flaw or abuse case, how can we reduce the impact and blast radius of API threats?

Reducing the impact of API security threats feels daunting, but Chuck explains that security has to go back to the basics in order to identify and acknowledge what has to change over time. You can't protect what you can't see and our teams have to evolve over time to defend against the changing attackers we might end up facing with APIs. When push comes to shove, Chuck firmly believes in having a defense strongly informed by the offenses and threats around you.

“This was cloud security 10 years ago, and it's API security today, right? History doesn't repeat, but it rhymes. It's the same basics and same fundamentals. Now, you need to change tooling. The attackers evolve over time, and your defenses have to evolve over time.”

----------

Links:

Learn more about Chuck Herrin on LinkedIn and the Wib website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Defining what a CISO isn’t in order to discover what a CISO is

[06:45] Finding the bridges between CISO & other company roles  

[12:12] Getting things clear between CISO, COO, CIO, and CEO

[16:20] Understanding a CISO’s peers & meeting with security points of contact

[24:49] What the CISO role should be & solidifying the CISO definition 

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What is the CISO not? 

The role of CISO, or Chief Information Security Officer, is nuanced and occasionally complicated to define. However, in Matthew’s opinion, the things that a CISO absolutely is not is (1) a BISO, or Business Information Security Office, and on the other hand, (2) someone with no experience in information security. The strongest CISOs Matthew has come across know how to combine information security experience with an understanding of business, all while being guided by a desire to protect the company and prevent incidents. 

“The CISO is a preventer of something bad happening at the organization. You can't prevent every breach, it's never going to happen, but if the CISO is involved, he can possibly prevent a merger or acquisition that is not in the best interest of the company.”

Who should the CISO be interfacing with as we bridge in and out of that defined role?

To be an effective CISO, Matt believes that you have to build strong relationships with individuals in departments like legal and HR. Referring to them as security points of contact, Matthew explains that keeping in touch with these individuals can give the CISO the full scope of the company. Additionally, Matthew says that a CISO should always be friends with the COO, or Chief Operating Officer, because those roles have essential communication between one another. 

“If your company is large enough to have a chief operating officer, the CISO and the COO should be the best of friends, because they rely on each other more than they realize.”

How does the Board of Directors shape and influence what the CISO is and isn't?

The Board of Directors’ involvement with a company’s CISO can be just as nuanced as the CISO role itself. Matt explains that the largest gaps between a CISO and the Board they have to report to are due to either a weak board structure or a misunderstanding of security amongst Board members. In Matthew’s experience, being thorough in security explanations with transparency about topics that members may not know helps to bridge the gap and develop a stronger and more positive relationship between the CISO and Board. 

“I think, personally, CISOs struggle a lot with their presentations to the Board of Directors, because they don't really know what information the Board wants and the Board won't ask them questions.”

What should be the role of the CISO?

While a large majority of the conversation in this episode is about what a CISO isn’t, Matthew defines what a CISO is using the words “preventer” and “leader.” A CISO should prevent risky behaviors that are not in the best interest of a company, and they lead the cybersecurity division of a company through establishing security and governance practices. Overall, CISOs help a business to meet goals and go where it wants to go safely and effectively, like a good brake system on a high-end car. 

“There's a lot of different responsibilities a CISO could have, but I'm gonna say the role is cybersecurity leadership. They should be responsible for establishing the right security and governance type practices, and a framework to scale the business.” 

-------------

Links:

Learn more about Matthew Lang’s work with the SECU

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Questions covered this show:

1. You mentioned firewall attacks, social engineering, HR/interview/job fraud.  Of course there is ransomware.  What else is on the rise?

2. How much has COVID and work-from-home impacted the landscape?

3. What are the vendors doing wrong about this landscape?

4. What are they doing right?

5. So what are the real solutions to these problems? Let’s break it down, starting with ransomware, my personal favorite.

   -Firewall attacks

   -HR/Interview/Job Fraud

   -Phishing

   -Insider Threat (another one possibly impacted by work-from-home and COVID)

   -Credential Stuffing

   -Zero Day Exploits

   -1,000 Day Exploits

6. If everything is on the rise, and if spending in cybersecurity is steadily on the rise (it is a rapidly growing industry), then why aren’t we solving the problems?

7. If you could change any one thing in cybersecurity, what would that thing be?

-------------

Links:

Keep up with Leon Ravenna on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Introducing the Cybersecurity Risk Management Strategy: Governance and Incident Disclosure

[08:45] Explaining filing 8-Ks and 4-day turnaround disclosures

[14:03] Debating the obligations of a third party in an incident (i.e. supply chain)

[16:04] Comparing SEC’s cyber proposal to accounting’s GAAPs

[25:33] Involving the Board of Directors in cyber risk management 

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

This is a proposed set of amendments and not a ruling. What does that mean, in terms of the real world?

Although the proposal was initially released in March 2022, Yaron explains these current rulings have been floating around the industry since 2018 and aren’t expected to become solidified until October 2022. In the meantime, many in the industry are curious about what these regulations mean for any and all cyber practitioners. Yaron understands the concerns many have, but also emphasizes that this is a maturity progression for the cyber industry.

“With everything happening around us over the last several years, we see security becoming a higher priority and a higher maturity in many organizations. By and large, organizations understand that security is not a luxury anymore, or something that doesn't apply to them.”

Is this proposal starting to put some real pressure on organizations to not just give lip service to cybersecurity?

Lip service to cyber is an unfortunate commonality among publicly traded companies that want to look safe without putting the effort or expertise into security. Thankfully, Yaron believes this SEC proposal will accomplish a great deal in encouraging companies to develop and mature their cybersecurity teams and protocols. As cyber management roles and board integration becomes a must, lip service will give way to real strategic change and a better understanding of the impacts and implications of security.

“I think, as we mature as an industry, and as we more and more understand the implications and the impacts of security on everything we do, strategy is something that will be very important for us to have. I would assume that every company will need to have one.”

Is this the right time for people to be excited about if there's gonna be a lot more CISO jobs open up, or if there's gonna be more board seats opening up for CISOs?

Yaron believes this SEC proposal will elevate processes and initiatives already in place to continue to elevate the expertise and opportunities within cyber. While many may see an increase in CISO roles and board opportunities, it's important to note that it is not just about roles and jobs, it’s about cyber’s maturity. Our community, not just in cybersecurity but throughout the world, has become dependent on technology and its vital to have individuals leading with maturity and competence to keep these technical processes secure. 

“Overall, I think these strategies are a really positive move, in terms of elevating the conversation, educating, providing more expertise, providing more knowledge, which ultimately, all of us will benefit from. All of us, and community and society in general.”

Do you have any closing thoughts or comments on this SEC proposal?

While Yaron breaks down individual elements of the Securities and Exchange Commission proposal with Allan, he understands that the most essential impact of the proposal is the potential it has to elevate the industry. Maturity and legitimacy is desperately needed in order to create cybersecurity’s own version of generally accepted practices. In the same way that accounting has GAAP, Yaron hopes this SEC proposal is a sign of the cyber industry growing up, coming into its own, and creating more secure processes in risk assessment. 

“These proposals are part of our maturity progression and are part of our growing up as an industry and as a practice. This is something that we have to evolve into. We can probably look at other industries and figure out what we can learn and leverage from them.”

-------------

Links:

Keep up with Yaron Levi on Twitter and LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Avoiding FUD (fear, uncertainty, and doubt) in your next cyber risk discussion 

[06:10] Facing stressful ransomware situations without proper preparation

[12:11] Hiring hackers as team members & debating the ethics of black hat hackers

[21:20] Addressing cyber risk in an accessible way for your organization's board

[26:41] Understanding the past, present, & future of cybersecurity insurance

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Are you comfortable turning on the light in a dark room so we can see what we’re really dealing with? [from: Karen Andersen]

There’s a perception (and not a wrong one) that the CISO’s role is to turn on the light in a dark room and show a company what their biggest cybersecurity risks truly are. However true this may be, Allan wants to point out that explaining and socializing team members to the risks has to be done without inspiring FUD. FUD, also known as fear, uncertainty, and doubt, creates panic around the risks an organization faces every day and only succeeds in unnecessarily stressing out practitioners without a solution in sight. 

“It’s very important not to fall into the trap of FUD: fear, uncertainty, and doubt. There’s a difference between socializing what’s wrong, and scaring people with what’s wrong. If you’re going to bring up the risks, at least bring up the beginnings of a solution.”

How effective do you think it would be to hire an actual hacker as a team member? [from: Jaden Turner]

With open positions, skills gaps, and labor shortages in cyber, the answer to the industry’s problems might either fall into the category of people outside of the industry or people who were once on the “wrong” side of it. Although Allan has worked with black hats in the past, he explains that hiring former black hat hackers is still a morality question for a lot of c-suite executives. Their work is often highly skillful and impactful, Allan explains, but many still question what it means to hire professionals that have moved from black hat to white hat.

“I think the bad guys probably have honed their skills better than the red team or the white hats, but then, you get into the morality questions. Do I want to support somebody who was once on the wrong side? Do I believe in reform and giving people a second chance?”

What’s the most difficult decision that you’ve had to make as a CISO that was not directly security related? [from: Brad Voris]

As Allan has gone through five different positions now as a CISO, he has seen it all on the cybersecurity side and the business side. While the cybersecurity decisions are stressful and high risk, Allan explains that there are very difficult decisions to make from a business point of view. Sometimes, a CISO has to make a choice to do what’s right for the business, even if that means that budget, personnel, or materials will be taken away from their security team.

“As a CISO, treating the business as a separate entity makes no sense to me. You have to be part of the business and actively accept that part of your role. There are business decisions that I've had to make that were right for the business and wrong for the security side, per say.”

How do you help other board members make sense of the cyber threat landscape? Why is addressing cyber risks crucial to any company? [from: Ulrich Baum]

Although reporting to a board is an often essential responsibility of any CISOs role, Allan explains that making sense of the cyber threat landscape relies on you being flexible— not your board. The board of your company requires a certain level of reporting and often responds best to a specific format. Instead of fearing a change, embrace the current board you have and learn what makes them tick. Addressing cyber risks is crucial to any company, and having the board understand you fully ensure success for your security team.

“There’s a board that was there before you were there, and you need to learn their ways and means. You need to learn what their concepts of risk are and you need to tailor your cyber risks to fit into that model.”

-------------

Links:

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Seeing the best of the job in the often thankless role of CISO

[06:04] Building teams through learning strengths vs the negative perception of employee poaching

[09:50] Starting out in IT & transitioning to CISO through consistent skill-building

[15:18] Learning from past CISO mistakes & embracing business first, risk second, cyber third

[27:23] Understanding the industry with a technical CISO point of view & a hacker’s mindset

[38:06] Managing the many highs and lows of becoming a CISO

Sponsor Links:

Axonius gives his customers a comprehensive, always up-to-date asset inventory, helps uncover security gaps, and automates as much of the manual remediation as you want. Give your team's time back by checking out Axonius at axonius.com/platform/cybersecurity-asset-management 

What skills and education level helped you land your first CISO position? [from: John Rosario]

Although he’s taken numerous CISO roles since his first position, Allan is quick to admit that he never applied for his first CISO gig. Instead, he was tapped on the shoulder and asked. Beginning his career in IT, Allan found opportunities when the company he was working for seemed to be lacking in the security space. Diving into product security after his roles in IT, Allan found himself asked by a CIO to combine his backgrounds and become a CISO.

“I was always the guy that played with the security stuff back in those days. I had a good product security background, and ultimately, parlayed those into a combined role when I became a CISO.”

Talking to your younger self: What’s the most important thing you would do differently after the knowledge you have from five gigs? [from: Ori Stein]

Compromise is king, even in the C suite, but Allan didn’t understand this as an early-stage CISO. Instead, Allan feels regret in recalling his lack of willingness to see other business concerns beyond security. He feels as if a successful, impactful CISO needs to not only prioritize security as their mission, but also needs to see the bigger picture of why a budget line or resource has to be used for something other than security at certain points in time.

“I think that was probably my single biggest failing as an early CISO: taking the security mission to be the penultimate mission of the company and refusing to acknowledge there were other business pressures and needs, where perhaps security had to take a backseat.”

What keeps you going in the field beyond passion for security, amidst the talent shortage, lack of cultural understanding, internal corporate budget challenges, and high stress? [from: Stephan Timler] 

Cybersecurity is already a high-stakes, high-stress industry. However, pressures from staffing shortages, skills gaps, and budgeting challenges (all of which got worse during the pandemic) create an environment that burns out employees, including CISOs. For Allan, keeping himself going relies on a combination of his calling to help others, his love for the industry, and his own hacker-mindset curiosity to find out not only how something works, but also how to make it work in his favor. 

“Number one, for me, is that it truly is a noble calling. I don't think we should ever lose sight of that. We are the good guys doing the right thing for the right players and the right people. It's a noble calling.”

What's the best and worst thing about being a CISO? [from: Ofer Shaked] 

There’s a great deal of ups and downs that come from being a CISO, but thankfully, a major positive has been being able to answer the noble calling to help organizations become more secure. When a CISO can look back and see how well an organization has done because of them, Allan describes this feeling as invaluable. On the unfortunate flipside, being a CISO for an organization that doesn’t understand the role and only wants someone to check boxes can be extremely disheartening. Allan warns that he’s yet to meet a CISO that hasn’t encountered that at some point in their career.

“When you can look back on your body of work, and see that it had a meaningful impact; you can look at this organization and know this place is more secure than it was when you walked in the door…that’s probably the best feeling [for a CISO].”

-------------

Links:

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Introducing the cybersecurity and the personal books George and Robert write

[08:28] Overcoming writing challenges in order to help others with your book

[15:16] Understanding the monetary gains and losses of book writing 

[23:59] Being purposeful, intentional, and useful with the book you write

[30:02] Advising potential writers on if they should write their book or not

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What made you choose books as your way to give back to the cyber community? 

There’s numerous ways to give back to the cybersecurity community, including more modern methods of online videos and social media posts. However, books offered George and Robert a means of expressing their feelings and beliefs about cyber and about life that felt unique and special to them. For George, writing books fulfills his dream of being a writer, a passion he’s had since he was a kid, and allows him to combine that dream with his passion for bettering the cybersecurity industry.

“My passion is really around cybersecurity. I really wanted to bring these two things (cybersecurity and writing) together in my life, and do something that I think only I can do, from my unique experiences, my unique perspective." — George Finney

What were the biggest challenges you faced while writing your book? 

Writing a book takes time and requires vulnerability. George and Robert are very familiar with those challenges. Facing these challenges often involves facing yourself, your wants, and your experiences. Robert especially felt challenged in writing his book because it was a personal story about losing his mother. Stepping out of his comfort zone to write about his personal life felt like a massive leap of faith, but he’s enjoyed impacting others with this story.

“Writing necessarily means that the time you dedicate to it is going to be spent in isolation. If you're spending 10 hours or 20, that's time you're not with your family, that's not time where you're going out, having fun. That's time you're on your own alone.” — George Finney

When you look at the time and effort that went into it, was writing a book worth it? 

As Allan shares, podcasting with the Cyber Ranch podcast has offered him an avenue of success, but book writing does not always pay off monetarily. George and Robert have found other ways of seeing the value in their work, but as George especially explains, there are a lot of costs associated with writing a book that many aspiring writers don’t consider. Marketing especially requires a high volume of costs that many don’t expect when writing their first book.

“Mine has not proven to be successful to where I can retire from the job, but there is a feeling of richness that you can get from helping folks along the way. That has been a very fulfilling point.” — Robert Pace

If somebody wants to write a book, what's the best piece of advice you have for them?

If you want to write a book, Robert and George genuinely believe you should go for it. A writer doesn’t have to know everything to write a book, but they do need to understand their audience and intentions with the book they want to author. Aspiring authors, according to Robert, need to be especially cautious of how pride can negatively impact the writing process. Don’t be afraid to ask for help, Robert says, but don’t let pride get in the way of accepting that help, especially from editors and other educated writers. 

“I will say when you want to write a book, remove your pride because it will get hurt if you keep it out there. Everyone is not going to like what you write. We're coming from a cyber perspective, we don't write like the guys that have majored in English.” — Robert Pace

-------------

Links:

Learn more about George Finney on LinkedIn and buy George’s books, Well Aware, No More Magic Wands, and Project Zero Trust

Keep up with Robert Pace on LinkedIn and buy Robert’s book, I Understand… You Forgot to Say Goodbye.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Introducing the foundations of Drew’s “do more by doing less” mindset

[07:03] Doing more by doing less, specifically in tech stack and GRC teams

[15:00] Revamping the cybersecurity and IT vendor ecosystem 

[20:43] Understanding consumer and CISO impact on the cyber vendor market

[32:34] Reshaping the command and control security mindset

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

How can security teams be more successful by enabling good decision making, versus trying to keep everyone from falling off a cliff?

The cybersecurity industry is stuck in a helicopter parent mindset, where practitioners don’t trust their colleagues in IT and feel the need to do the work for them. Drew explains that this is a low trust environment, where more work is created and no one thrives. If the industry works towards a high trust mindset, individuals are able to do their jobs and make decisions based on their knowledge, and even face normal consequences for their decisions, too. 

“[We think] we're the smartest people in the room. There's always this very dismissive, very condescending approach to our colleagues, who have very important jobs to do on their own. In a low trust culture, you get to the point where you have to be watching over everybody.”

How do vendors do more by doing less? How do they fit the trust and parenting model?

The bifurcation of the cybersecurity vendor system into cyber and IT has created more work for everyone involved, and has produced a lot of unideal results. With a lack of integrated solutions, organizations and departments suffer from simply not being able to have products that do everything they need them to do. There’s little cross-functionality and there’s often too many products happening at once to have one vendor making their intended impact.

“Why can't it all just work together? I think the whole notion of security as a buying center, separate from IT, created this opportunity for vendors to pursue a separate budget pot. In my opinion, it disincentivizes them from creating integrated solutions.”

What are we doing wrong as consumers that's encouraging this “do less by doing more” system instead of doing more by doing less? 

Sometimes, the only thing that can be done is starting over. The current system thrives off of an “us” vs “them” mindset and a business vs technology mentality, where trust is low and doing more results in actually doing less. Roles need to be rethought and reconsidered in cybersecurity organizations and executive leaders need to step out of the ivory tower of leadership to re-educate themselves and better understand their own roles.

“The whole separation of the cyber technologists from the IT technologists comes back to that trust issue as well. I can't trust IT to do the right things, I can't trust them to patch, so I've got to sit over here over their shoulder and scan.”

What's the revenue and business argument for everything we've discussed?

There’s always the pressure of revenue metrics and tangible results, especially if a process or role has to change within a cybersecurity team. How does doing more by doing less show up as a tangible result and outcome? It turns out, that all depends on transparency. Knowing the outcome that’s being looked for allows for a better understanding between practitioners and business leaders when the business argument for doing more by doing less has to be made.

“As CISO, I can't take your problem and try to make it my own and then solve it. I've got to trust you to solve it, and I've got to empower you, with the right tools, the right processes, the right policies, so that you have safe guidelines to solve that problem within.”

-------------

Links:

Learn more about Drew Simonis on LinkedIn

Check out Juniper Networks on LinkedIn and the Juniper Networks website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Breaking down basics of people, process, and technology

[06:59] Where tech stack is failing us and how to keep the vendor community on hold

[10:31] Building a good GRC team with a focus on NIST CSF

[14:13] Training the right way for GRC and cyber professionals

[19:30] Understanding the end user and setting your cyber team up for success

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What does that mean to you, in cyber specifically, getting back to the basics?

Getting back to the basics is a common theme no matter your industry, but Sonja’s focus on it feels especially surprising when so much of the security world isn’t simple at all. Sonja explains throughout the episode that NVA strives for simple yet effective, not for something shocking or eye-catching. Especially considering Sonja’s work contains sensitive client data, she emphasizes that a basics-centric approach keeps the animals in NVA’s care and the people who love these animals safe. Although it may not be flashy, Sonja is proud of the well-oiled machine of her team and the security of their data.

“You have to get rid of your tech debt and bring your environment to current. You want modern, supportable technology. That's really key in order to keep everything secure.”

What's the opposite of your "get back to the basics" vision there?

Cybersecurity technology is often far from simple, but adding unnecessary bells and whistles only succeeds in further complicating things. Sonja’s back to the basics mindset encourages tools that cut out the unnecessary and strive for a streamlined approach. Sonja sees the appeal of a fun product to add to any protocols, but warns that fun rarely means secure. When there’s too much focus on the new and the shiny, that often means that focus is turned away from what’s most important: keeping data safe and preventing vulnerabilities from being exploited. 

“There are groups that are implementing some security tools that are shiny, new, and lots of fun, but they still have those basic security holes, so they get compromised.”

What are we doing right when it comes to the people in our organizations, and what aren’t we doing right?

Sonja is happy to separate NVA from the pack by explaining their focus on involving cybersecurity practitioners in the everyday operations of their organization. Many companies keep these roles separate, letting tech and cyber professionals remain in their own roles without context of what their end user might be experiencing on their end. Instead, NVA strives to put cybersecurity employees in the shoes of their end users and day-to-day employees, giving them further context around the people they impact and the roles they influence, as well as providing them further insight into potential security risks that might be slipping through the cracks of daily operations.

“Get the cybersecurity people exposed to what really happens in the day-to-day, because if they can walk in the end users’ shoes, then they can understand where there are security implications.”

For the people that are checking in the patients and taking them back, how much do they learn about security? 

It’s one thing to train security professionals in the day-to-day of an organization, and another to train other employees about the world of cybersecurity. To combat the often frustrating process of checking security compliance boxes, Sonja tries to change up training tactics with employees by sending playful videos and short informational emails. Keeping things short highly raises your chances of the content actually being read, Sonja explains, and it also limits the monotonous moments in the training process for employees who have very little experience in cyber protocols.

“We try to make it not quite so obvious that [our employees] are always getting training. We certainly do the traditional online CBT type stuff, to check the compliance boxes, but then we try to do some other things, like funny videos…Just simple things to remind them.”

-------------

Links:

Learn more about Sonja Hammond on LinkedIn

Check out National Veterinary Associates on LinkedIn and the NVA website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Introducing Adrian and his journey with Cyber Risk Alliance

[06:47] Buying awards and lying about customers

[13:24] Finding the source of fake cyber statistics

[24:28] The lies of vulnerability management and security awareness training

[30:58] Explaining Adrian’s It’s Time to Kill the Pen Test talk 

[40:41] Creating a money-making concept for debunking cyber myths

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life! Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Can you tell me about your product testing lab with Cyber Risk Alliance? 

We often hear the startup motto of “fake it ‘til you make it,” but Adrian wasn’t aware of how pervasive that concept was in cyber until he began his work with 451 Security. After encountering numerous professionals that expressed complaints and confusion with products on the market, Adrian wanted to break into the world of product testing— and the Security Weekly Labs were born. With a focus on external attack surface management and network vulnerability scanners, Adrian sought to find the truth behind the product vendors were selling him— and what he discovered strongly influenced his future. 

“When we talk about myths and lies, it's not just straight up lies, right? At some point, they're faking it till they make it, and they get to a point where it's just too late to turn back. And then, it starts to get a little bit more insidious.” 

Are vendors going far enough to fake customers and awards? 

Not only are vendors “faking it” in a startup sense, some vendors have gotten right to the point of lying about the awards they’ve received and the high profile customers they’ve worked with. Adrian explains that buying and lying about awards has become a common practice within the cyber world, where certain businesses have let the marketing of winning an award override the legitimacy of their own success. While some companies may ignorantly feel drawn in by meaningless awards, more insidious industry liars have already mastered pulling out their credit card to buy what they want to win

“You can actually even fill in the name of the category you want to win an award for, you can just make up your own category. You drop a credit card and they send you a trophy. Some of these fake awards even have award ceremonies.”

Where do these cybersecurity statistics come from, and how do we validate them?

60% of small businesses go out of business after a breach— but do they really? Adrian’s exposition of cyber lies leaves no stone unturned, even when it comes to mystery statistics. Where did these numbers come from, and why would millions of businesses be more impacted by security breaches than fraud? After interacting with statistics like this with a shocking frequency, Adrian has even taken to Twitter on numerous occasions to call out companies marketing with fake stats and reveal his own research findings. 

“​​There are people that have just hinged their reputations and their careers on some of these myths…And it's not that companies don't get hurt by breaches, but it benefits no one to make up stats, or to push this narrative.”

Is it time to kill the pen test? 

There’s a lot of things done in cyber that might not have a place for everyone. Pen testing is near the end of Adrian’s list, but he’s quick to point out that the pen test process needs to change. Unfortunately, the bulk of what any organization is paying for when they run a pen test are vulnerability scans and report paperwork. Explaining a concept he developed with his friend and co-founder Kyle at Savage Security, Adrian explains that the modern-day pen test needs to look more like purple teaming and focus on prioritizing what really needs to be fixed.

“A lot of companies have pen tests, because they don't know what else to do with their security budget. You could apply that more broadly. A lot of people have a security budget, and they buy what they see their peers buy and do what analysts tell them to do.”

-------------

Links:

Learn more about Adrian Sanabria on LinkedIn and Twitter

Check out Tenchi Security on LinkedIn and the Tenchi Security website

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[00:00] Comparing and contrasting security and privacy responsibilities

[08:30] Privacy, GRC, and building trust with stakeholders

[15:28] Coordinated and cooperative efforts of security and privacy teams

[20:57] Security awareness training vs the lack of awareness of privacy

[27:26] Drawing the line with privacy laws for security professionals

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Where do privacy and security intersect? Where don’t they intersect?  

Privacy professionals need the security professionals within their organization to make privacy work and implement a certain protocol within a privacy policy. Although each group may want to draw division, there needs to be a healthy and divided dose of both privacy and security within a company, and they cannot just be handled by one person tagged in for both. The main reason this shared responsibility of privacy and security under one roof doesn’t work is the differences in priorities. While Adam points out that both seek to serve stakeholders, security professionals are protecting property with technology and privacy professionals are protecting individuals with processes.

“Information security professionals are in place to protect property. Namely, they are in place to protect the property of their sponsor, usually a corporation…The privacy professional is protecting the individual from the accesses of a corporation, or from a larger entity.”

What does an information security professional need to know about privacy?

Within the world of security, privacy regulations and laws are often seen as a headache. However, according to Adam, privacy is misunderstood by many security professionals, who group privacy policies with the same technical protocols they use throughout their work. Privacy is administrative and reliant on how someone behaves within their workplace. Although technology may aid in privacy policies, the steps companies have to go through to maintain privacy for their customers is dependent on individuals and on the ways they are able to enforce strict protective privacy protocols on these individuals.

“What security professionals need to understand about privacy is that many, if not most, of the solutions to privacy problems, are not technological. They are process. They are administrative.”

If security awareness training is a norm, why isn't there privacy awareness training? 

There are a lot of perceptions about privacy, and Adam admits that many of them are unfortunately negative. Between the headache of privacy law and the lack of privacy awareness within companies and organizations, what are people supposed to think about privacy? In Adam’s opinion, the perspective on privacy needs to shift and companies need to better understand that privacy is a customer service concern. Caring about how you market to someone, how you sell your wares, and the impact you have on your customers is a way to build trust with them and to provide them a higher quality of customer service, and all of that falls under the umbrella of privacy.

“In my view, [privacy awareness] is awareness of how you are communicating, how you are selling, how you are marketing, that potentially endangers the privacy of the individual.”

How do you keep up with the myriad of privacy laws that are constantly coming out and changing? 

Adam has heard from security and privacy professionals alike about the anxiety of changing privacy laws, but his answer to the concern is to point out that someone simply can’t keep up with these privacy law changes on their own. Whether relying on the International Association of Privacy Professionals, or IAPP, or calling in the counsel of a legal team or privacy lawyer, there are numerous resources available for privacy and security professionals to learn about privacy laws, study them, and come to the conclusion of where to draw the lines and what decisions to make about privacy policies.

“There’s a line to be drawn between interpreting and operationalizing statutes and regulations, versus interpreting a given statute or regulation for purposes of defending oneself in court. That is where we really need the expertise and the authority that a lawyer brings to the table.”

-------------

Links:

Learn more about Adam Stone on LinkedIn and the TrustMAPP website.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[01:53] Taking on a variety of roles in the cyber industry and breaking down which elements of cybersecurity are overrated

[08:48] Recognizing when encryption is needed and when it is overrated or overemphasized as something you need in cybersecurity

[15:43] Service-level agreement timelines, addressing critical risks, and engaging with the 80/20 rule

[24:17] Understanding when to separate data about different vulnerabilities and attacks, and when to report on them in the same conversation (i.e. board meetings)

[29:58] Other overrated elements of cybersecurity, such as IoCs, dark web, and, of course, what Jerry would change in cyber if he had a magic wand...

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonius comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

Why is patching overrated?

While Jerry acknowledges the importance of patching in certain contexts, he also explains that it’s often overemphasized in its ability to provide cyber solutions. For patching to make an impact, the vulnerability has to be known and understood. In Jerry’s experience, patching doesn’t solve many of the problems in cybersecurity and can instead create a false sense of security, especially in the case of in-house coding errors. Although patching can create a long-term solution, you may only overcome that weakness for a moment and end up coming back to the same issue a few months later.

“When I say it's overrated is, first of all, patching is to address a known vulnerability in a piece of software, right? That means that the vulnerability has to already be out there, has to be profiled, has to be understood, and the manufacturer has to have actually created some kind of fix for it.”

What about encryption? Is that also overrated?

The idea of encryption comes from the idea of keeping information and vulnerabilities out of your enemies’ hands. However, too much focus on encryption blinds us to other issues and other tools that can be used against us. Although certain vulnerabilities around encryption are exploited, Jerry points out that you rarely, if ever, hear about the threats that we’re warned about when we’re sold on the concept and idea of encryption. With so many other ways to be hacked and exploited, Jerry says our focus on encryption keeps us in the dark about what the reality of online safety is. 

“In any event, we spend so much time worrying about encryption and encrypting things, and whether it's encryption at rest, or whether it's in transit, or anything else like that, that I think sometimes we blind ourselves, especially on internal tools.”

Are short SLAs (service level agreements) for addressing critical risk overrated?

In Jerry’s mind, the timeframe of your SLA doesn’t matter if you need a problem fixed immediately. Whether it’s a 48 hour turnaround, a 29 day, or a 364 day window, critical threats need immediate fixes and your service team should understand that. If the response to a necessary and urgent request is for your team to inquire about the SLA, you have a much bigger problem than the time it will take. Instead you have a toxic culture problem, something that cannot be fixed with simple tweaks to your SLA. 

“I always would just preach that you don't want to ever undermine your credibility. You don't want to bring weak sauce. Gotta be able to reproduce everything, have a video, all of that, and if you don't, then yeah, you people are gonna abuse your SLAs and push it to the edge.”

What’s your thoughts on departments with “vulnerability” in their name? 

Although Jerry has had vulnerability departments and teams in previous companies he’s worked with, adding vulnerability to a department name rarely has the impact beyond specifying that they run the vulnerability scanners. Beyond running the scanners, processing these results and reporting them is a completely different beast. Rarely is a vulnerability department able to process and report these results without making data ten times more complicated and time consuming for your board to understand. They’re tool-focused, it’s in their name, but it may not be what you really need when you’re assessing risk. 

“I think it's really important that you just speak about them all collectively, in a tool agnostic fashion. So, I feel the vuln scanner results, the bug bounty results, the attack service management results, the employees raising their hand and volunteering info…they need to be portrayed in parallel in one communication.”

-------------

Links:

Learn more about Jerry Perullo on LinkedIn and listen to his podcast #lifeafterCISO 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[04:30] Running the right phishing simulation for your user base and gauging your results appropriately

[10:08] Pushing boundaries in the tactics used in phishing exercises and making employees pay attention more closely to their everyday emails 

[15:10] Calling out unlikely and unhelpful phishing strategies and simulations, including the harm of impersonating employees without any warning

[21:04] Realizing which methods of user awareness are no longer effective and shifting away from the mindset of just “checking the box” in these training exercises

[25:54] Changing security for the better with increased awareness and a better understanding around the value of risk exposure amongst employees

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at Axonius.com/Get-A-Tour

What, to you, are the biggest highlights, the high points, the critical bits of user awareness training?

Tim has seen the good and the bad of user awareness training, and has found the best results for his users in interactive training sessions, especially when paired with gamification. Allan compares this method and approach to modern virtual escape room sessions, and Tim agrees that the more interactive and hands-on a training can be, the better the learning experience will be. Instead of framing our user awareness and phishing exercises around checking boxes for cyber insurance companies, we should be striving for active learning engagements that demonstrate the value of security to our users.

“After those trainings, users have come up to me and talked to me about how they weren't aware of this particular risk and hearing about it in a real-world use-case was very effective for them to really understand why it's important and why they should be behaving in a slightly different manner.”

If the users never fall prey to attacks, is there a reason to continue performing them? 

Hearing Tim talk about his success, Allan was curious about how he chooses to approach successful user bases. If someone isn’t falling for Tim’s phish, does he still see the need to perform these exercises? The short answer was yes, but Tim explains that user awareness training should be customized to the needs of a user base. Testing new employees is a must, along with refreshing successful users on their skills a few times a year. Additionally, scheduling out different exercises that hone in on different phishing simulations exposes employees to a variety of learning opportunities and encourages them to see this beyond just a yearly test where they might as well “get it over with.”

“If you've tested all your existing employees, and they haven't fallen or been susceptible to it, that doesn't mean that the next employee you hire is also going to be of that same mindset.”

What ineffective methods are there in security awareness?

Throughout the episode, Tim and Allan keep coming back to the simple fact that checking boxes no longer works. Having employees read or watch through videos and take “common sense” knowledge tests makes user awareness training a distracting activity that feels more like grunt work than a learning experience. While you never want to disrupt the workflow of your employees, stepping outside of the box with interactive activities that are explained in advance shows the value of these exercises to your users instead of making them feel that you’re yet again wasting their time with another gift card scam.

“I find that there's the typical thing a lot of people do to hit compliance, which is having their users watch videos, and answer questionnaires. My feeling is that most people just try to get that done. Their goal is really to get it completed, so they can check the box and their company stops bothering them to complete it.”

You are given a magic wand and you are told you can wave it and change any one thing in cybersecurity you want to change. What do you change?

There’s so much in cybersecurity that Tim and Allan would love to change, especially when we look at cutting edge approaches to user awareness training. However, Tim makes one thing clear: if he could change anything, he would change our mindset. Instead of seeing security as just someone’s job, we should encourage our users to see themselves as an instrumental part of their company’s security. When everyone concerns themselves with following the right protocols and caring about security beyond simulations, companies will find themselves in a much stronger, less vulnerable place.

“I think ultimately, a lot of the weaknesses inside of our organization are our users. If I could just increase the level of carefulness, or the level of interest that everybody has in keeping their own companies secure, I think we would overall improve the posture of all companies.”

-------------

Links:

Learn more about Tim Silverline on LinkedIn and the Gluware website. 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Timecoded Guide:

[01:23] Exploring John and Sameer’s backgrounds in cyber and how they developed their own unique founder-angel investor connection

[04:53] Understanding the triggering aspects that caused someone like John to become an angel investor in BalkanID and how BalkanID selected their investors

[08:20] Delving into the uniqueness of different founder-investor relationships and how John (vs other BalkanID investors) makes his impact on Sameer’s work as a founder

[13:30] Giving expert advice and explaining lessons learned in founding your first company and in investing in startups 

[22:12] Exploring how other experiences in life, outside of cybersecurity and investing, has informed John and Sameer’s work with BalkanID and with solving cyber issues

Sponsor Links:

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone.

What inspired you to become a founder of BalkanID, Sameer?

As the former CISO of Amazon Whole Foods and an investor at numerous cybersecurity companies, Sameer has a great resume to show off. However, his work with BalkanID offered him the opportunity to be a founder, something that Sameer had never done before. When asked what inspired him to be a first-time founder, he tells us that he continuously encountered the same problems over and over again, and wasn’t seeing anyone coming up with the right solution. Continuing to move forward with so much at stake with this issue of entitlements felt like a missed opportunity, and with the right investors and co-founders on his side, BalkanID was born.

“I knew that we could do better, right? And I knew the existing solutions were not scaling. And I think the last inspiration was really finding the right co-founders to go at this with. That was the biggest inspiration of all.” - Sameer Sait

John, what were the triggering factors that made you decide to invest in BalkanID? 

Just like Sameer, John has some incredible experience to show off in the tech world and in the investment world. But why BalkanID? A simple answer would be the connection between these two men, having met numerous times throughout their careers, developing a strong working relationship. However, John sees so much potential in BalkanID and in Sameer beyond just their work friendship. John believes that you don’t invest in tech, you invest in people, and the qualities he sees in Sameer as a founder and a leader in the tech world excites him and he felt he could lend his expertise to BalkanID in a beneficial way.

“Sameer is very self-aware. These things matter. He knows what he knows, he knows what he doesn't know, he's comfortable bringing in people that complement his skills and make a stronger team around him. In the end, that's why I say you bet on people, not on tech.” - John Stewart

What advice do you have for potential investors looking to get involved in startups, John?

Being an investor isn’t always easy, and John has made some mistakes that taught him the hard way about how to be a good investor. With a hands-on approach and now tons of projects under his belt, John is asked to give some advice to future investors. A hugely important piece of advice from John is to know your founder, know their wants and needs, and to see ahead of what their future holds. You’re an investor, but it is their company, and you have to be aligned in order to produce a mutually beneficial relationship. 

“As an investor, I follow out and look for all of those things. I look at how optionality is, how CEOs think, how many chances they have, what directions could they go. Are they strategically capable of looking beyond today's decision and thinking about what might happen in the future?” - John Stewart

Sameer, what advice would you give fellow founders?

Despite his experiences at other companies, BalkanID is Sameer’s first founding experience so far. His biggest lesson to date? Not getting caught up in the buzz and the hype. BalkanID’s approach to their audience and their product has been to focus on their customer and work backwards to find their problem and their ideal solution. This takes time, and it’s easy to fall into the trap of comparing your revenue, launches, products, and marketing tactics of other companies. This only hurts your brand in the long-run because you’ll no longer be focused on your customer’s problem. 

“As an early stage, first-time entrepreneur, a part of me would get nervous. ‘Oh, my God, look what's happening out there. Oh, we're so slow.’ I think of taking a step back and saying, ‘Well, we are on our journey,’ right? We have supporters, we have backers, we have a real problem we're solving. The fact that other people want to solve the same problem is validation that it's a real problem.” - Sameer Sait

-------------

Links:

Stay in touch with Sameer Sait on LinkedIn and the BalkanID website.

Stay in touch with John Stewart on LinkedIn.

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Allan is joined by James Allan-McLean, Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military, to talk about his ‘Open Door Security’ method and the benefits of transparent, no-strings-attached approach to security. In this episode, Allan and James take a deep dive into this methodology and address questions such as: 

    -What is Open Door Security?

    -What does a successful Open Door Security program look like?

    -How to go about tackling security implications within your org 

    -The philosophy behind James’ ‘handrail’ metaphor

Sponsor Links: 

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

James is a highly effective and motivated information security leader with extensive experience in a range of sectors. He is a Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military.

Links:

Stay in touch with James Allan-McLean on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

    -What roles help achieve security in DevOps?

    -What are the cultural barriers to implementing secure DevOps?

    -What are some common mistakes as well as best tips?

Sponsor Links: 

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Chris Hughes is a proven Cloud/Cybersecurity leader with nearly 20 years of experience in both the Federal and commercial industries. Chris has a dynamic skill set, with a blend of IT, Cyber/Cloud Security and DevSecOps experience. He enjoys working across interdisciplinary teams to solve complex organizational and industry-wide problems to achieve technological transformation securely. 

Additional Resources: Google SLSA framework: https://slsa.dev/ CSCRM – NIST Appendix F : https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdfOpen SSF – OSS Mobilization Plan: https://8112310.fs1.hubspotusercontent-na1.net/hubfs/8112310/OpenSSF/White%20House%20OSS%20Mobilization%20Plan.pdf?hsCtaTracking=3b79d59d-e8d3-4c69-a67b-6b87b325313c%7C7a1a8b01-65ae-4bac-b97c-071dac09a2d8 Sounil/Andy Debate: https://www.securityweek.com/video-civil-discourse-sboms

Links:

Stay in touch with Chris Hughes on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

    -Vulnerability and threat hunting metrics

    -Top 3 metrics to report to the board and why

    -Breach reporting implications and much more! 

Check out part 1 of Board Reporting Metrics here

Sponsor Links: 

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Andy Ellis is a visionary technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. A graduate of MIT and former US Air Force officer, Andy designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business. In his twenty year tenure, Andy led Akamai’s information security team from a single individual to a 90+ person team, over 40% of whom were women. In running Akamai’s security program, Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs, Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision making.

Additional Links:

Stay in touch with Andy Ellis on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Check out Andy’s previous episode here

Sponsor Links: 

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Andy Ellis is a visionary technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. A graduate of MIT and former US Air Force officer, Andy designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business. In his twenty year tenure, Andy led Akamai’s information security team from a single individual to a 90+ person team, over 40% of whom were women. In running Akamai’s security program, Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs, Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision making.

Additional Links:

Stay in touch with Andy Ellis on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CISOs can earn and keep their seat at the executive table. Brent was a fan of the Learned Helplessness episode of The Cyber Ranch Podcast with Steve Mancini, and furthered the conversation as it relates to the often espoused topic of CISOs needing a seat at “the table.” Brent discusses the power of shifting your mindset, how lack of confidence has created a cycle of self sabotaging, and ways we can collectively improve our current standing.

Sponsor Links: 

Thank you to our sponsor Axonius for bringing this episode to life!

Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone

Guest Bio:

Brent is an Executive CISO whose mission is to enable Afni and its global workforce to support their customers securely and confidently. Prior to being a CISO, for over 20 years, he was a security practitioner with a security vendor specializing in threat detection, incident response, and security strategy. His efforts helped hundreds of organizations detect, respond to, and mitigate attacks.

Additional Links:

Stay in touch with Brent Deterding on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software Bills of Materials (SBOMs) and their potential implications and use. Chris explains the concept and purpose of SBOMs, his tips for signing and securing SBOMs in terms of the CI/CD pipeline, and his thoughts on SBOMs being a roadmap for “bad guys.” Lastly, he shares advice on managing and understanding contracts. 

Listen to Chris Castado’s previous Cyber Ranch episode here and be sure to grab a copy of his book! 

Guest Bio:

Chris Castaldo is the author of “Start-up Secure: Baking Cybersecurity into your Company from Founding to Exit”. He is an experienced and industry recognized CISO with over 20 years of experience in cybersecurity. Chris is an expert in building cybersecurity programs from the ground up and specializes in applying cybersecurity in start-ups from seed to exit. He is also a Visiting Fellow at the National Security Institute (NSI) at George Mason University's Antonin Scalia Law School.

Links:

Sponsored by our good friends at  Axonius

Stay in touch with Chris Castaldo on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

In this episode, Allan is joined by the Head of Security at Fleet, Guillaume Ross, to talk about his time building out an innovative and out-of-the-box security program and the steps he took to make it all happen. Guillaume walks us through how he developed and maintained a serverless, container based environment, his tips for securing PCs and Macs within a serverless environment, and how to establish department and business buy-in and overall cooperation. Lastly, he details steps to ensure resilience in an ‘everything as code’ security model. 

Some of what he builds might seem obvious – other parts will genuinely surprise you! 

Guest Bio:

Guillaume Ross is the Head of Security at Fleet Device Management. He likes securing organizations, clouds, products and more, by refusing to implement the same things that have been tried and failed thousands of times already.

Links:

Sponsored by our good friends at  Axonius

Stay in touch with Guillaume Ross on LinkedIn and Twitter

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store 

Continue this conversation on our Discord

Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast

Guest Bio:

Nicholas Percoco has more than 25 years of security & technology experience, and is the Chief Security Officer at Kraken - a global digital asset exchange - where he is responsible for Security, IT, Technical Project Management, Operational Resiliency and Engineering.

Links:

Stay in touch with Nick Percoco on LinkedIn 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Guest Bio:

Tommy Todd has over 20 years of cybersecurity experience, primarily focused on data privacy and data protection strategies. Prior to Code42, he served in security roles at Symantec, Ionic Security, and Optiv as well as many other firms. Throughout his career, he has acted as a leader, mentor, engineer, architect, and consultant to solve difficult data protection challenges. 

Links:

Stay in touch with Tommy Todd on LinkedIn 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Guest Bio:

As the CEO of Living Security, Ashley has been the driving force behind the company’s rapid growth. Since its founding in 2017, Living Security has raised more than $20 million for growth and product development and accelerated revenue growth for three consecutive years. Ashley is also continually working to build a diverse and inclusive organization around the belief that the team should reflect the community at large.

Links:

Stay in touch with Ashley Rose on LinkedIn 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Nick draws on his experience in both positions to share his unique perspective on the CISO and CIO relationship. In this episode, Allan and Nick highlight the operating differences between the two positions and explore the opposing interests that exist around topics such as budgets and reporting structure. Lastly, Nick shares why engaging in empathetic conversations around metrics, business impact, and risk management is the ultimate key to a more harmonious relationship.

Guest Bio:

Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization. 

Links 

Stay in touch with Nick Vigier on LinkedIn 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Steve addresses the reinforcement of negative catchphrases and how it affects the psyche of the community and explores how burnout is creating a culture of sleepless nights and masochistic badges of honor. Lastly, they emphasize the importance of empathy and support within the community and remind us that humans are our greatest asset, not our weakest links.

Guest Bio:

Steve Mancini is the CISO at Eclypsium, former Deputy CISO at Cylance, and an advisory board member for several cyber companies.

Links:

Stay in touch with Steve Mancini on LinkedIn 

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Guest Bio:

Nick Vigier is the Owner of Rising Tide Security and former CISO at ID.me, DigitalOcean, and former CIO at Gemini. Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization. 

Links:

Stay in touch with Nick Vigier on LinkedIn and Twitter. Take the CliftonStrengths assessment here

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Guest Bio:

Paola Saibene is the Principal at Teknion Data Solutions, Former CISO, CEO, VP of Enterprise Risk Management, Data Privacy Officer, Strategy Officer, CTO, and CIO.  

Links:

Stay in touch with Paola Saibene on LinkedIn  

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Links:

Follow Jessie Bolton on LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Key Takeaways:

01:52  G Mark’s bio

06:43  FIPS-65 - the “grandaddy” of risk management

11:34  The ALE method, explained!

14:35  Oldies, but STILL goodies 

18:12  A stroll down risk management memory lane

28:56  Revering “the greats”

37:22  What do you value and what’s your currency? 

Links:

Stay in touch with G. Mark Hardy on LinkedIn  

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at  Axonius

Disclaimer: This episode briefly mentions pornography and gambling within an important and relevant context, and has therefore been categorized as explicit. 

Key Takeaways:

01:43  Randy’s bio

03:08  Caring for “the people”

09:08  Stewards and custodians of data

14:10  Servant leadership

16:57  CISOs as caretakers

18:53  Doing the right thing

21:18  CISO code of conduct - or lack thereof

24:55  How do we fix this? 

29:06  It’s nice to be nice

Links:

Stay in touch with Randy Potts on LinkedIn  

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonis

Key Takeaways: 

01:27  Bio & CISO life

02:57  Let’s define Mentor/Mentee

04:21  What makes cybersecurity mentorship unique?

07:10  Developing a long & short-term strategy 

13:16  Mentors are essential

18:05  Formal vs. organic mentorships

22:10  Get out of your comfort zone

25:55  Advice for newcomers

30:15  Visualizing your success

32:00  Staying humble

Links: 

Stay in touch with David Belanger on LinkedIn  

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Key Takeaways

01:10  Bio

02:36  What is tech stack rationalization?

03:46  Where to get started

06:20  Evaluation - a 3 prong approach

08:08  The security architecture alignment

10:51  What about contractual obligations?

13:18  The “best of breed” strategy 

17:37  Rationalizing the cloud 

21:00  Data analysis - tooling, extraction, metrics

25:24  The 3rd party tool conundrum 

27:50  The future of cloud rationalization 

29:40  How to resolve tech overlap?

32:19  Embracing change

34:37  Mark’s advice on emotional intelligence

Stay in touch with Mark Butler on LinkedIn  

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Key takeaways: 

01:27  Phillip's origin story - wrestling men and bears

03:04  The Pwn School Project

04:47  The Hacker Factory Podcast

06:55  Always a way to cyber

10:18  An opportunity to write

14:08  The Art of Pentesting

17:19  Getting square on terminology

24:42  The limitless child

27:25  The skinny on certs

30:23  Mentors

35:06  Back in the pentesting lab

37:14  When does threat modeling factor?

43:50  Coloring in purple

Follow Phillip Wylie on LinkedIn and Twitter

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius

Key Takeaways:

01:35  Bio

02:36  What are we doing wrong in the SOC?

06:54  Hypothesizing

11:22  How much gets left out when we make a hypothesis?

13:42  Anti-fragility & business outcomes

16:30  Business objective + threat model example

21:09  Lead with the why/ downstream applications

27:06  What outside influence has helped you inside cyber?

Learn more about Yaron on Twitter and  LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

Sponsored by our good friends at Axonius