Defense in Depth
David Spark
Subscribe
Defense in Depth promises clear talk on cybersecurity’s most controversial and confusing debates. Once a week we choose one controversial and popular cybersecurity debate and use the InfoSec community’s insights to lead our discussion.
Available episodes
Newest first
Oldest first
1 day ago
How to Manage Users' Desires for New Technology
All links and images for this episode can be found on CISO Series.
Large language models and generative AI are today's disruptive technology. This is not the first time companies just want to ban a new technology that everyone loves. Yet, we're doing it all over again. Whether its ChatGPT or BYOD, people are going to use desirable new tech. So if our job isn't to stop it, how do we secure it?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our special guest, Carla Sweeney, SVP, InfoSec, Red Ventures.
Thanks to our podcast sponsor, Censys
Censys is the leading Internet Intelligence Platform for Threat Hunting and Exposure Management. We provide the most comprehensive, accurate, and up-to-date map of the internet, which scans 45x more services than the nearest competitor across the world’s largest certificate database (>10B). Learn more at www.censys.com.
In this episode:
* Whether its ChatGPT or BYOD, people are going to use desirable new tech. So if our job isn't to stop it, how do we secure it?
* Are tools like ChatGPT so different from what we've seen before that we can't apply lessons already learned?
* What risks are we solving for with it and where do we go from there?
* Is this just a security issue?
playlist_add
Sep 21, 2023
Cybersecurity Questions Heard Around the Kitchen Table
All links and images for this episode can be found on CISO Series.
What do the people least in the know about cyber, want to know? What are they asking?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our special guest, Caitlin Sarian, AKA cybersecuritygirl on TikTok.
Thanks to our podcast sponsor, DataBee from Comcast Technology Solutions
DataBee™, from Comcast Technology Solutions, is a cloud-native security, risk and compliance data fabric platform that transforms your security data chaos into connected outcomes.
Built by security professionals for security professionals, DataBee enables users to examine the past, react to the present, and protect the future of the business.
In this episode:
* What do the people least in the know about cyber, want to know? What are they asking?
* How important is it to understand what concerns the average person?
* Are these reasonable concerns or do you think they're directed by media pressure?
* How do regular, everyday people know what is safe and best practices without a clear path or studying cybersecurity in depth?
playlist_add
Sep 14, 2023
How to Prime Your Data Lake
All links and images for this episode can be found on CISO Series.
A security data lake, a data repository of everything you need to analyze and get analyzed sounds wonderful. But priming that lake, and stocking it with the data you want to get the insights you need is a more difficult task than it seems.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our sponsored guest, Matt Tharp, Head of Field Engineering, Comcast DataBee.
Thanks to our podcast sponsor, Comcast Technology Solutions
In this episode:
* What exactly is a data lake?
* How are people thinking about and handling the risks?
* If you want security data lakes to be successful, what customer problem are you trying to solve?
* How can you make it both dead simple to use AND highly effective?
playlist_add
Sep 7, 2023
Getting Ahead Of Your Threat Intelligence Program
All links and images for this episode can be found on CISO Series.
A threat intelligence program sounds like a sound effort in any security program. But, can you pull it off? There are so many phases to execute properly. Blow it with any one of them and your threat intelligence effort is moot.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us today is our special guest Jon Oltsik, distinguished analyst and fellow, Enterprise Strategy Group.
Thanks to our podcast sponsor, Comcast
DataBee™, from Comcast Technology Solutions, is a cloud-native security, risk and compliance data fabric platform that transforms your security data chaos into connected outcomes.
Built by security professionals for security professionals, DataBee enables users to examine the past, react to the present, and protect the future of the business.
In this episode:
* A threat intelligence program sounds like a sound effort in any security program. But, can you pull it off?
* Which phase of a threat intelligence program gives you the most trouble, and why?
* What has been your personal experience, and does it change organization to organization?
* How do you measure the success of the program to prove the value of the work being done?
playlist_add
Aug 31, 2023
How Security Leaders Deal with Intense Stress
All links and images for this episode can be found on CISO Series.
When you have an incident and you're engulfed by the stress that lasts more than a day, how do you manage and deal with it? And not only how do you manage your stress, but how do you manage everyone else's?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our special guest, Tim Brown, CISO, Solarwinds.
Thanks to our podcast sponsor, Push Security
Do you have visibility of all the SaaS apps your employees are storing corporate data on? Are employees protecting all their accounts against identity-based attacks?
Discover all the SaaS your employees use - including shadow apps and identities - and secure your data. Find out more at pushsecurity.com.
In this episode:
* When you have an incident and you're engulfed by the stress that lasts more than a day, how do you manage and deal with it?
* And not only how do you manage your stress, but how do you manage everyone else's?
* During a major incident, which stress is more difficult to manage? Your own, or those around you?
* How is this everyone's concern?
playlist_add
Aug 24, 2023
How Do We Influence Secure Behavior?
All links and images for this episode can be found on CISO Series.
We all know that our employees need to be more security aware, but what are the methods to get them there? How can we make our employees more security conscious?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest Jack Chapman, vp, threat intelligence, Egress.
Thanks to our podcast sponsor, Egress
Egress helps organization stop email security risks is by addressing both inbound and outbound threats together,. We recognize that people get hacked, make mistakes, and break the rules. Egress's Intelligent Cloud Email Security suite uses patented self-learning technology to detect sophisticated inbound and outbound threats, and protect against data loss. Learn more at egress.com.
In this episode:
* We all know that our employees need to be more security aware, but what are the methods to get them there?
* How can we make our employees more security conscious?
* What does it take to get security to "stick" with your coworkers?
* Why does security remain so darn difficult?
playlist_add
Aug 17, 2023
Security Concerns with ChatGPT
All links and images for this episode can be found on CISO Series.
Users have tried to upload sensitive company information and PII, personally identifiable information, into ChatGPT. Those who are successful getting the data in, have now made that data free to all. Will people's misuse of these generative AI programs be our greatest downfall to security and privacy?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our special guest Suha Can, CISO, Grammarly.
Thanks to our podcast sponsor, Opal
Opal is building the next generation of intelligent identity. Identity is one of the last great enterprise frontiers. It’s fragmented with legacy architecture. Opal's mission is to empower teams to understand and calibrate access end to end, and to build identity security for scale. Learn more by at www.opal.dev.
In this episode:
* Will people's misuse of these generative AI programs be our greatest downfall to security and privacy?
* Is AI the problem? Or is poor human judgement the problem?
* Is it better to get started with any guardrails until setting up a full policy?
* What are we going to do now?
playlist_add
Aug 10, 2023
Create A Pipeline of Cyber Talent
All links and images for this episode can be found on CISO Series.
The demand for cybertalent is sky high. It's very competitive to get those people with skills. What if you were to train your staff and give them the skills you want? Essentially, what if you were to grow your own unicorn?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our special guest, Jesse Whaley, CISO, Amtrak.
Thanks to our podcast sponsor, Opal
Opal is building the next generation of intelligent identity. Identity is one of the last great enterprise frontiers. It’s fragmented with legacy architecture. Opal's mission is to empower teams to understand and calibrate access end to end, and to build identity security for scale. Learn more by at www.opal.dev.
In this episode:
* What if you were to train your staff and give them the skills you want?
* What if you were to grow your own unicorn?
* What’s the best way to grow your staff?
* How do you figure out the right mix of talent and prioritize the hiring, training, on the job, and other experiences?
playlist_add
Aug 3, 2023
Improving Adoption of Least Privileged Access
All links and images for this episode can be found on CISO Series.
What are we doing to improve access management? Make it too loose and it's the number one way organizations get breached. Put on too many controls and now you've got irritated users just trying to do their job. How does each organization find their sweet spot?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Paul Guthrie (@pguthrie), information security officer, Blend.
Thanks to our podcast sponsor, Opal
Opal is building the next generation of intelligent identity. Identity is one of the last great enterprise frontiers. It’s fragmented with legacy architecture. Opal's mission is to empower teams to understand and calibrate access end to end, and to build identity security for scale. Learn more by at www.opal.dev
In this episode:
* What is the one most significant action you’ve taken to improve access management?
* What are we doing to improve access management?
* What is the correct balance between too many controls and not enough?
* How does each organization find their sweet spot?
playlist_add
Jul 27, 2023
Securing SaaS Applications
All links and images for this episode can be found on CISO Series.
With the growth of business-led IT, does SaaS security need to be a specific focus in a CISO’s architectural strategy?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Steve Zalewski who also hosts Defense in Depth.
Thanks to our podcast sponsor, AppOmni
Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk.
Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.
In this episode:
* With the growth of business-led IT, does SaaS security need to be a specific focus in a CISO’s architectural strategy?
* Is the problem the architecture of the applications themselves or the fact that a non-security group is bringing these applications online? Is it both?
* Is this problem solvable?
* What technical controls can you put in place to mitigate risk from apps you deem risky?
playlist_add
Jul 20, 2023
How Do We Get Better Control of Cloud Data?
All links and images for this episode can be found on CISO Series.
When it comes to data, compliance, and reducing risk, where are we gaining control? Where are we losing control? And what are we doing about that?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. We welcome our sponsored guest Amer Deeba, CEO and Co-founder, Normalyze.
Thanks to our podcast sponsor, Normalyze
Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.
Discover, visualize, and secure your cloud data in minutes with Normalyze Freemium.
In this episode:
* When it comes to data, compliance, and reducing risk, where are we gaining control?
* Where are we losing control? And what are we doing about that?
* Is "losing control" inevitable?
* Is SaaS really extremely difficult to work with at scale?
playlist_add
Jul 13, 2023
Finding Your Security Community
All links and images for this episode can be found on CISO Series.
If you're struggling to get your first job in security or you're trying to get back into the industry after being laid off, you need to lean on your security community. But like networking, you should find it before you need it.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski.
Thanks to our podcast sponsor, Egress
Egress helps organization stop email security risks is by addressing both inbound and outbound threats together,. We recognize that people get hacked, make mistakes, and break the rules. Egress's Intelligent Cloud Email Security suite uses patented self-learning technology to detect sophisticated inbound and outbound threats, and protect against data loss. Learn more at egress.com.
In this episode:
* Are you struggling to get your first job in security or trying…
playlist_add
Jul 6, 2023
Let's Write Better Cybersecurity Job Descriptions
All links and images for this episode can be found on CISO Series.
What should a cyber job description require, and what shouldn't it? What's reasonable and not reasonable?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Rob Duhart (@robduhart), deputy CISO, Walmart.
Thanks to our podcast sponsor, Normalyze
Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.
Discover, visualize, and secure your cloud data in minutes with Normalyze Freemium.
In this episode:
* What should a cyber job description require, and what shouldn't it? What's reasonable and not reasonable?
* Do these completely u…
playlist_add
Jun 29, 2023
How Should Security Better Engage with Application Owners?
All links and images for this episode can be found on CISO Series.
Since so much technology today is not launched by the IT department, but by business units themselves. How do security professionals engage with business and application owners and have a conversation about security policy and procedures?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Harold Byun (@haroldnhoward), chief product officer, AppOmni.
Thanks to our podcast sponsor, AppOmni
Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk.
Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.
In this episode:
* What's you…
playlist_add
Jun 22, 2023
How To Get More People Into Cybersecurity
All links and images for this episode can be found on CISO Series.
There are millions of cybersecurity jobs open. Over time, that number has just been growing. What we're doing now does not seem to be working. So what's it going to take to fill all these jobs quickly?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Rich Gautier, former CISO for the U.S. Department of Justice, Criminal Division.
Thanks to our podcast sponsor, Brinqa
Understand your cyber assets, prioritize vulnerabilities, automate remediation, and continuously monitor cyber hygiene across the entire attack surface — infrastructure, applications and cloud — with Brinqa. See how at brinqa.com.
In this episode:
* There are millions of cybersecurity jobs open. What's it going to take to fill all these jobs quickly?
* Are job description requirements parti…
playlist_add
Jun 15, 2023
How to Create a Positive Security Culture
All links and images for this episode can be found on CISO Series.
How do you create a positive security culture? It's rarely the first concept anyone wants to embrace, yet it's important everyone understands their responsibility. So what do you do, and how do you overcome inevitable roadblocks?
Check out this post and this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest, Jadee Hanson, CISO/CIO for Code42.
Thanks to our podcast sponsor, Code42
Code42 is focused on delivering solutions built with the modern-day collaborative culture in mind. Code42 Incydr tracks activity across computers, USB, email, file link sharing, Airdrop, the cloud and more, our SaaS-based solution surfaces and prioritizes file exposure and data exfiltration events. Learn more at Code42.com.
In this episode:
* How do…
playlist_add
Jun 8, 2023
How Should We Trust Entry Level Employees?
All links and images for this episode can be found on CISO Series.
All experienced security professionals were at one time very green. Entry level status means risk to your organization. That's if you give them too much access. What can you trust an entry level security professional to do that won't impose unnecessary risk? And how can those green professionals build trust to allow them to do more?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Kemas Ohale, vp, global information security, Lippert.
Thanks to our podcast sponsor, Normalyze
Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches.
Discover, visualize, and secure y…
playlist_add
Jun 1, 2023
How Must Processes Change to Reduce Risk?
All links and images for this episode can be found on CISO Series.
What do we need to do to fix our processes to truly reduce risk and vulnerabilities?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Amad Fida (@brinqa), CEO, Brinqa.
Thanks to our podcast sponsor, Brinqa
Understand your cyber assets, prioritize vulnerabilities, automate remediation, and continuously monitor cyber hygiene across the entire attack surface — infrastructure, applications and cloud — with Brinqa. See how at brinqa.com.
In this episode:
* What do we need to do to fix our processes to truly reduce risk and vulnerabilities?
* How to work with all departments to improve process, communication, and motivation?
* Why does security need to be treated as a function of the enterprise risk program?
* What are the elements that make a g…
playlist_add
May 25, 2023
Reputational Damage from Breaches
All links and images for this episode can be found on CISO Series.
Security professionals talk a lot about the reputational damage from breaches. And it seems logical, but major companies still do get breached and their reputation seems spared. What's the reality of what breaches can do to a company's reputation?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Cecil Pineda, CISO, R1.
Thanks to our podcast sponsor, Brinqa
Understand your cyber assets, prioritize vulnerabilities, automate remediation, and continuously monitor cyber hygiene across the entire attack surface — infrastructure, applications and cloud — with Brinqa. See how at brinqa.com.
In this episode:
* Security professionals talk a lot about the reputational damage from breaches, so why do companies still get breached…
playlist_add
May 18, 2023
Do RFPs Work?
All links and images for this episode can be found on CISO Series.
Do RFPs or request for proposals work as intended? It seems they're loaded with flaws yet for some organizations who must follow processes, they become necessary evils for both buyers and sellers. What can we do to improve the process?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Keith McCartney (@kmflgator), vp, security and IT, DNAnexus.
Thanks to our podcast sponsor, TrustCloud
TrustCloud is the all-in-one platform to accelerate sales and security reviews, automate compliance efforts, and map contractual liability across your business. Connect with us to learn how you can transform security from a cost center into a profit driver with TrustCloud’s programmatic risk and compliance verification tools.
In this episode:…
playlist_add
May 11, 2023
Successful Cloud Security
All links and images for this episode can be found on CISO Series.
What are the moves we should be making in cloud to improve our security? What constitutes a good cloud security posture?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Andy Ellis, operating partner, YL Ventures. We welcome our sponsored guest Yoav Alon, CTO, Orca Security.
Thanks to our podcast sponsor, Orca Security
Orca Security is the pioneer of agentless cloud security that is trusted by hundreds of enterprises globally. With continuous first-to-market innovations and expertise, the Orca Platform ensures security teams quickly identify and remediate risks to keep their businesses secure. Connect your first account in minutes by visiting www.orca.security.
In this episode:
* What does successful cloud security look like?
* What are the moves we should be making in the cloud to imp…
playlist_add
May 4, 2023
How Should Security Vendors Engage With CISOs?
All links and images for this episode can be found on CISO Series.
One CISO has had enough of the security vendor marketing emails and cold sales calls. He's blocking them all. But it's not a call to avoid all salespeople. He just doesn't have the time to be a target anymore. So how should vendors engage with such a CISO? And does CISO represent most CISOs today?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Joy Forsythe, VP, Security, Thrive Global.
Thanks to our podcast sponsor, Code42
Code42 is focused on delivering solutions built with the modern-day collaborative culture in mind. Code42 Incydr tracks activity across computers, USB, email, file link sharing, Airdrop, the cloud and more, our SaaS-based solution surfaces and prioritizes file exposure and data exfiltration ev…
playlist_add
Apr 27, 2023
Gartner Created Product Categories
All links and images for this episode can be found on CISO Series.
Do we really need more categories of security products? Every new Gartner magic quadrant complicates the marketplace but at the same time helps us understand the other vectors we need to protect. Do new categories of security products help or hurt the industry?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Corey Elinburg (@celinburg), CISO, CommonSpirit Health.
Thanks to our podcast sponsor, Egress
In this episode:
* Do we really need more categories of security products?
* Does it seem like every new Gartner magic quadrant complicates the marketplace but at the same time helps us understand the other vectors we need to protect?
* Do new categories of security products help or hurt the industry?
* Does this make it hard to keep up to date on all new p…
playlist_add
Apr 20, 2023
How to Always Make a Business Case for Security
All links and images for this episode can be found on CISO Series.
How can security leaders and how do they go about matching business case to every security action you want to take? Is this the right way to sell security to the board?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Sravish Sridhar (@sravish), founder and CEO, TrustCloud.
Thanks to our podcast sponsor, TrustCloud
TrustCloud is the all-in-one platform to accelerate sales and security reviews, automate compliance efforts, and map contractual liability across your business. Connect with us to learn how you can transform security from a cost center into a profit driver with TrustCloud’s programmatic risk and compliance verification tools.
In this episode:
* How can security leaders best make a case for security?
* How do you go about matching busi…
playlist_add
Apr 13, 2023
Do Breaches Happen Because the Tool Fails, or the Tool Was Poorly Configured?
All links and images for this episode can be found on CISO Series.
Security tools are supposed to do a job. Either they need to alert you, protect you, or remediate an issue. But they don't always work and that's why we have breaches. Who's at fault, the tool or the administrators who configured the tool?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Kenneth Foster (@Kennethrfoster1), vp of IT governance, risk and compliance at FLEETCOR.
Thanks to our podcast sponsor, AppOmni
Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk.
Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.
In this episode…
playlist_add
Apr 6, 2023
What We Love About Working in Cybersecurity
All links and images for this episode can be found on CISO Series.
We talk a lot on this show about what makes cybersecurity such a hard job, yet there are so many people who are in it and love it. What draws people to this profession and why do they love it so much?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest David Cross (@MrDBCross), CISO, Oracle SaaS Cloud.
Thanks to our podcast sponsor, Orca Security
Orca Security is the pioneer of agentless cloud security that is trusted by hundreds of enterprises globally. With continuous first-to-market innovations and expertise, the Orca Platform ensures security teams quickly identify and remediate risks to keep their businesses secure. Connect your first account in minutes by visiting www.orca.security.
In this episode:
* We talk a lot…
playlist_add
Mar 30, 2023
Security That Accounts for Human Fallibility
All links and images for this episode can be found on CISO Series.
We expect our users to be perfect security responders even when the adversaries are doing everything in their power to trick them. These scams are designed to make humans respond to them. Why aren't we building our security programs to account for this exact behavior that is simply not going to go away?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Ken Athanasiou, CISO, VF Corporation.
Thanks to our podcast sponsor, Code42
In this episode:
* Why do we expect our users to be perfect security responders even when the adversaries are doing everything in their power to trick them?
* Aren’t these scams designed to make humans respond to them?
* Why aren't we building our security programs to account for this exact behavior that is simply not going to go aw…
playlist_add
Mar 23, 2023
Why You Should Be Your Company's Next CISO
All links and images for this episode can be found on CISO Series.
How do you make the argument that your company needs a CISO, and that YOU should be that leader? What do you need to demonstrate to prove you can be that person?
Check out this post and this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Radley Meyers (@radleymeyers), Partner, SPMB Executive Search.
Thanks to our podcast sponsor, SPMB
SPMB connects top executive talent to the world’s best and fastest growing innovators across the country. A key area we bring extensive knowledge and expertise to is our dedicated Security Practice, leading both functional searches (CISO and VP’s defining security strategy) and building out executive teams at top security software companies.
In this episode:
* How do you make the argument…
playlist_add
Mar 16, 2023
How to Become a CISO
All links and images for this episode can be found on CISO Series.
How do you become a CISO? It doesn't follow a linear pattern as many other professions. There are many different paths and there are many different entry points.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Yabing Wang, CISO, Justworks.
Thanks to our podcast sponsor, SPMB
SPMB connects top executive talent to the world’s best and fastest growing innovators across the country. A key area we bring extensive knowledge and expertise to is our dedicated Security Practice, leading both functional searches (CISO and VP’s defining security strategy) and building out executive teams at top security software companies.
In this episode:
* How do you become a CISO?
* Why doesn't it follow a linear pattern as many other professions?
* Why are there so many dif…
playlist_add
Mar 9, 2023
Can You Build a Security Program on Open Source?
All links and images for this episode can be found on CISO Series.
What would it take to build your entire security program on open source software, tools, and intelligence?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome guest DJ Schleen (@djschleen), distinguished security architect, Yahoo Paranoids.
Thanks to our podcast sponsor, SPMB
SPMB connects top executive talent to the world’s best and fastest growing innovators across the country. A key area we bring extensive knowledge and expertise to is our dedicated Security Practice, leading both functional searches (CISO and VP’s defining security strategy) and building out executive teams at top security software companies.
In this episode:
* What would it take to build your entire security program on open source software, tools, and intell…
playlist_add
Mar 2, 2023
Third Party Risk vs. Third Party Trust
All links and images for this episode can be found on CISO Series.
Businesses grow based on trust, but they have to operate in a world of risk. Even cybersecurity operates this way, but when it comes to third party analysis, what if we leaned on trust more than trying to calculate risk?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and our guest co-host is Yaron Levi (@0xL3v1), CISO, Dolby. Yaron and I welcome Dan Walsh, CISO, VillageMD.
Thanks to our podcast sponsor, TrustCloud
TrustCloud is the all-in-one platform to accelerate sales and security reviews, automate compliance efforts, and map contractual liability across your business. Connect with us to learn how you can transform security from a cost center into a profit driver with TrustCloud’s programmatic risk and compliance verification tools.
In this episode:
* When it comes to third party anal…
playlist_add
Feb 23, 2023
How Can We Improve the Cyber Sales Cycle?
All links and images for this episode can be found on CISO Series
The cybersecurity sales process is so terribly inefficient. And everyone, the targets and cybersecurity leaders, are losing valuable time because of that inefficiency. Where can we start making improvements?
Check out this post for the discussion that's the basis for this podcast episode. This week's Defense in Depth is hosted by me, David Spark (@dspark), producer, CISO Series. Our guest co-host is John Overbaugh, CISO, ASG. John and I welcome our guest, Jerich Beason (@blanketsec), commercial CISO, Capital One.
Thanks to our podcast sponsor, Compyl
GRC solutions often cause process roadblocks within organizations. They are either antiquated and lack the functionality needed or so stripped down they can’t fix the problems you set to solve. That's why the team over at Compyl created the all-in-one security and compliance automation platform. Compyl quickly integrates with the tools you use, and automates 85% of th…
playlist_add
Feb 16, 2023
What Leads a Security Program: Risk or Maturity?
All links and images for this episode can be found on CISO Series.
When you think about building a plan (and budget!) for your security program, do you lead with risk, maturity, or something else?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Ngozi Eze, CISO, Levi Strauss.
Thanks to our podcast sponsor, runZero
runZero is the cyber asset management solution that helps you find and identify every managed and unmanaged asset connected to your network and in the cloud. Get the data and context needed to effectively manage and secure your environment. Try runZero for free at runzero.com.
In this episode:
* When you think about building a plan (and budget!) for your security program, do you lead with risk, maturity, or something else?
* What's the overall theme you lead with when you're building a security program?
* Why…
playlist_add
Feb 9, 2023
Limitations of Security Frameworks
All links and images for this episode can be found on CISO Series
Why do strongly supported security frameworks have such severe limitations when building a security program?
Check out this post for the discussions that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Stas Bojoukha, CEO, Compyl.
Thanks to our podcast sponsor, Compyl
GRC solutions often cause process roadblocks within organizations. They are either antiquated and lack the functionality needed or so stripped down they can’t fix the problems you set to solve. That's why the team over at Compyl created the all-in-one security and compliance automation platform. Compyl quickly integrates with the tools you use, and automates 85% of the day-to-day tasks, all while providing complete transparency and comprehensive reporting along the way. Start your free trial wi…
playlist_add
Feb 2, 2023
Why Is There a Cybersecurity Skills Gap?
All links and images for this episode can be found on CISO Series.
Why is there a cybersecurity skills gap? Practically everyone is looking to hire, and there are ton of people getting training and trying to get into the industry, but we still have this problem. Why?
Check out this post for the discussions that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome Edwin Covert (@ebcovert3), head of cyber risk engineering, Bowhead Specialty.
Thanks to our podcast sponsor, Orca Security
In this episode:
* Why is there a cybersecurity skills gap?
* Practically everyone is looking to hire, and there are tons of people getting training and trying to get into the industry, but we still have this problem. Why?
* Is there a problem with the system of hiring junior people, training, and preventing burnout?
* Is the problem gatekeepers who don't do a…
playlist_add
Jan 26, 2023
What Can the Cyber Haves Do for the Cyber Have Nots?
All links and images for this episode can be found on CISO Series.
Given that your company's security is dependent on the security of your partners and others, what can we do to get more organizations above the security poverty line?
Check out this post for the discussions that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest, Jason Kikta (@kikta), CISO, Automox.
Thanks to our podcast sponsor, Automox
Are you ready to ditch manual patching? With Automox, you can automatically patch your third-party applications, Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Try for yourself with our free 15-day trial and have all your endpoints safe and secure in just 15 minutes.
In this episode:
* Given that your company's security is dependent on the security of your partners and others, what can we do…
playlist_add
Jan 19, 2023
Securing Unmanaged Assets
All links and images for this episode can be found on CISO Series.
"When the asset discovery market launched, every single company that offered a solution used the line, “You can’t protect what you don’t know.” Everyone agreed with that.
Problem is, “what you don’t know” has grown… a lot."
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Huxley Barbee (@huxley_barbee), security evangelist, runZero.
Thanks to our podcast sponsor, runZero
runZero is the cyber asset management solution that helps you find and identify every managed and unmanaged asset connected to your network and in the cloud. Get the data and context needed to effectively manage and secure your environment. Try runZero for free at runzero.com.
In this episode:
* Everyone agrees that, “You can’t protect what you don’t know”,…
playlist_add
Jan 12, 2023
Ambulance Chasing Security Vendors
All links and images for this episode can be found on CISO Series
A good high profile security threat seems like a good time to alert potential customers about how your product could help or even prevent a breach. Seems like a solid sales tactic for any industry that is not cybersecurity.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Angela Williams, CISO, UL.
Thanks to our podcast sponsor, Automox
Are you ready to ditch manual patching? With Automox, you can automatically patch your third-party applications, Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Try for yourself with our free 15-day trial and have all your endpoints safe and secure in just 15 minutes.
In this episode:
* Is tying your product to a high profile event a good sales tactic for ve…
playlist_add
Jan 5, 2023
Do CISOs Have More Stress than Other C-Suite Jobs
All links and images for this episode can be found on CISO Series
Why do CISOs seem more stressed out than other C-level executives?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Jared Mendenhall, Head of information security, Impossible Foods.
Thanks to our podcast sponsor, Compyl
GRC solutions often cause process roadblocks within organizations. They are either antiquated and lack the functionality needed or so stripped down they can’t fix the problems you set to solve. That's why the team over at Compyl created the all-in-one security and compliance automation platform. Compyl quickly integrates with the tools you use, and automates 85% of the day-to-day tasks, all while providing complete transparency and comprehensive reporting along the way. Start your free trial with Compyl to…
playlist_add
Dec 15, 2022
How Should We Discuss Cyber With the C-Suite?
All links and images for this episode can be found on CISO Series
How detailed do we get in our conversation with business leaders? Do we dumb it down? Or is that a recipe for trouble?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Lee Parrish (@leeparrish), CISO, Newell Brands.
Thanks to our podcast sponsor, Qualys
Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.
In this episode:
* How detailed do we get in our conversation with business leaders?
* Do we dumb it down? Or is that a recipe for trouble?
* To what level does the C-Suite need to be cyber savvy?
* How essential is it for senior leaders to know more?
playlist_add
Dec 8, 2022
Can You Be a vCISO If You’ve Never Been a CISO?
All links and images for this episode can be found on CISO Series
Why are there so many vCISOs who have never been a CISO? Isn't it difficult to advise on a role you've never done? Do organizations feel comfortable hiring an inexperienced vCISO as their CISO?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Steve Tran, CSO, DNC.
Thanks to our podcast sponsor, runZero
runZero is the cyber asset management solution that helps you find and identify every managed and unmanaged asset connected to your network and in the cloud. Get the data and context needed to effectively manage and secure your environment. Try runZero for free at runzero.com.
In this episode:
* Why are there so many vCISOs who have never been a CISO?
* Isn't it difficult to advise on a role you've never done?
* Do o…
playlist_add
Dec 1, 2022
How Should We Gauge a Company's Cyber Health?
All links and images for this episode can be found on CISO Series
As an outside observer, how can you tell if a company is staying cyber healthy? While there is no financial statement equivalency to let you know the strength of a company's security profile, there are signals that'll give you a pretty good idea.
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Matt Honea, CISO, SmartNews.
Thanks to our podcast sponsor, Automox
Are you ready to ditch manual patching? With Automox, you can automatically patch your third-party applications, Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Try for yourself with our free 15-day trial and have all your endpoints safe and secure in just 15 minutes.
In this episode:
* As an outside observer, how can you tell if a…
playlist_add
Nov 17, 2022
Reducing the Attack Surface
All links and images for this episode can be found on CISO Series
The cyber attack surface just keeps growing to the point that it seems endless. Protecting it all is impossible. Is there anything that can be done to reduce that attack surface and limit your exposure?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Jonathan Trull (@jonathantrull), CISO, Qualys.
Thanks to our podcast sponsor, Qualys
Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.
In this episode:
* Is there anything that can be done to reduce that attack surface and limit your exposure?
* Is attack surface reduction a new security development philosophy or is it just a rebranding of vulnerability management?
* And what value does it have in comparison to other popular theories such as zero trust and d…
playlist_add
Nov 10, 2022
Do We Need a Marketing Manager for the Security Team?
All links and images for this episode can be found on CISO Series
Those reports on security procedures for the business are falling short. No one is reading them. What good are security controls if your staff doesn't know about them or adhere to them? Is it time to hire a marketing manager for the security team?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Laura Deaner (@b3dwin), CISO, Northwestern Mutual.
Thanks to our podcast sponsor, IANS Research
CISOs, how does your compensation compare with your peers? Download IANS + Artico Search's 2022 CISO Compensation Benchmark Report. Find objective insights and comprehensive compensation data from over 500 CISOs across the U.S. and Canada.
In this episode:
* What good are security controls if your staff doesn't know about them or adhere to them?
* Is it time to hire a…
playlist_add
Nov 3, 2022
Cybersecurity Budgets
All links and images for this episode can be found on CISO Series
Cybersecurity budgets are increasing, by a lot. What's fueling the increase and where are those budgets being spent?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest sponsored guest Nick Kakolowski, senior director of research at IANS Research.
Thanks to our podcast sponsor, IANS Research
CISOs, how does your compensation compare with your peers? Download IANS + Artico Search's 2022 CISO Compensation Benchmark Report. Find objective insights and comprehensive compensation data from over 500 CISOs across the U.S. and Canada.
In this episode:
* What's fueling the increase in cybersecurity budgets and where are those budgets being spent?
* Do we understand where the money is being spent? Is it on new hires? Mo…
playlist_add
Oct 27, 2022
How Can We Make Sense of Cybersecurity Titles?
All links and images for this episode can be found on CISO Series
What's the difference between a head of security, a vp of security, and a CISO? Do job responsibilities change whether you're a security analyst or a threat engineer? Roles are confusing and so is the pay and responsibilities attached to them.
Check out this post and this post for the basis of today's discussion. this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Hadas Cassorla, CISO, M1. Our guest is Renee Guttman, former CISO of Coca-Cola, Time Warner, Campbells.
Thanks to our podcast sponsor, IANS Research
CISOs, how does your compensation compare with your peers? Download IANS + Artico Search's 2022 CISO Compensation Benchmark Report. Find objective insights and comprehensive compensation data from over 500 CISOs across the U.S. and Canada.
In this episode:
* What's the difference between a head of security, a vp of security, and a CISO?
* Do job responsibili…
playlist_add
Oct 20, 2022
Walk a Mile in a Security Recruiter's Shoes
All links and images for this episode can be found on CISO Series
Instead of complaining about the security hiring process, walk a mile in a recruiter's shoes and have a little compassion to what they're going through, and how you might be able to help, at any level.
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap) with our guest Caleb Sima (@csima), CSO, Robinhood.
Thanks to our podcast sponsor, Safe Security
If your CFO or Board was to ask: ‘How much could we lose to a cyber attack?’ Would you know?
Introducing SAFE - the industry’s most complete Cyber Risk Quantification solution to help you answer those crucial questions in real-time:
* Visualize and measure cyber risk across your entire estate
* Discover your $ risk exposure per attack vector
* Gain personalized, actionable insights to tackle your most cri…
playlist_add
Oct 13, 2022
Moving Security from a Prevention to a Resilience Strategy
All links and images for this episode can be found on CISO Series
Are security programs drifting from a prevention to a resilience strategy? If so, are you truly operating in a resilient environment? Or are you still acting in a prevention stance but you know you should be resilient?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest David Ratner (@davidhratner), CEO, HYAS.
Thanks to our podcast sponsor, HYAS
"Better production environment security starts with visibility. After all, how can you protect your most valuable asset if you don’t know A: what’s expected and B: when something’s happening that isn’t expected?
This is why HYAS Confront monitors traffic to alert you to anomalies, letting you address risks, threats, and changes, while blocking infiltrations before…
playlist_add
Oct 6, 2022
How to Engage with Non-Technical Business Leaders
All links and images for this episode can be found on CISO Series
How do you talk to non-technical business leaders about cybersecurity? It's a concern, it's a risk, they want to know so they can make logical business decisions. How do you help?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap). Our guest is Sara Hall, deputy CISO, MassMutual.
Thanks to our podcast sponsor, HYAS
"Better production environment security starts with visibility. After all, how can you protect your most valuable asset if you don’t know A: what’s expected and B: when something’s happening that isn’t expected?
This is why HYAS Confront monitors traffic to alert you to anomalies, letting you address risks, threats, and changes, while blocking infiltrations before they become successful attacks.
Don’t just react, take your security back…
playlist_add
Sep 29, 2022
Cybersecurity Burnout
All links and images for this episode can be found on CISO Series
Why are cybersecurity professionals burning out? What's the dynamic of the job, the pressures being put on them, that causes the best to leave? And this industry can't afford to lose its best talent.
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and special guest co-host Shawn Bowen (@SMbowen), CISO, World Fuel Services. Our guest is Bozidar Spirovski (@spirovskib), CISO, Blue dot.
Thanks to our podcast sponsor, HYAS
Better production environment security starts with visibility. After all, how can you protect your most valuable asset if you don’t know A: what’s expected and B: when something’s happening that isn’t expected?
This is why HYAS Confront monitors traffic to alert you to anomalies, letting you address risks, threats, and changes, while blocking infiltrations before they…
playlist_add
Sep 22, 2022
How to Build a Greenfield Security Program
All links and images for this episode can be found on CISO Series
You're starting a security program from scratch and you're trying to figure out where to start, what to prioritize, and how to architect it so it grows naturally and not a series of random patches over time.
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO. Our guest is Mark Bruns, CISO, First Bank.
Thanks to our podcast sponsor, Keyavi
Myth: Data can’t protect itself. Fact: Now it does! You control where your data goes in the world, who can access it and when. On any device. Anytime. Anywhere. FOREVER. Learn more at Keyavi.com.
In this episode:
* Have you ever had a purely greenfield situation?
* When starting a security program from scratch, how do you figure out where to start and what to prioritize?
* What are the top five actions if you w…
playlist_add
Sep 15, 2022
Managing the Onslaught of Files
All links and images for this episode can be found on CISO Series
Files are still the core of how people do business. How are you dealing with the onslaught of files coming into your network? People are sharing files across a multitude of platforms, and many for which you may not even know about. What checks and balances do you put in place to make sure you've got file integrity no matter the source?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Aviv Grafi, founder and CTO, Votiro.
Thanks to our podcast sponsor, Votiro
Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it’s an API, so it int…
playlist_add
Sep 8, 2022
Can You Have Culture Fit and Diversity, or Are They Mutually Exclusive?
All links and images for this episode can be found on CISO Series
Hiring managers speak about looking for culture fit and diversity, but never at the same time. Can they coexist? Are they mutually exclusive?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Sherron Burgess, CISO, BCD Travel.
Thanks to our podcast sponsor, Votiro
Can you trust that the files entering your organization are free of hidden threats like malware & ransomware? With Votiro you can. Votiro removes evasive and unknown malware from files in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it’s an API, so it integrates with email, cloud apps & storage, and content collaboration platforms like Microsoft 365 - wherever files need to flow. Learn more at Votiro.com.
In this episode:
*…
playlist_add
Sep 1, 2022
How to Follow Up With a CISO
All links and images for this episode can be found on CISO Series
Cyber sales is hard. But don't let the difficulty of doing it get in way of your good judgement. So what is the right way to follow up with a CISO?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Jack Kufahl, CISO, Michigan Medicine.
Thanks to our podcast sponsor, SolCyber
At SolCyber we're hell-bent on delivering Fortune 500 level cyber security for small and medium-sized enterprises. When you're being targeted by the same bad guys, nothing else will do. We bring to the table a curated stack of leading technologies and around-the-clock SOC support, all simply priced per user. Let us do the heavy lifting.
In this episode:
* What is the right way to follow up with a CISO?
* How to prevent the difficulty of sales from cloudin…
playlist_add
Aug 25, 2022
Roles to Prepare You to Be a CISO
All links and images for this episode can be found on CISO Series
One day you want to be a CISO. What area of security you begin your studies? Or maybe you shouldn't be studying security.
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Evelin Biro (@wolfsgame), CISO, Alliant Credit Union.
Thanks to our podcast sponsor, Qualys
Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.
In this episode:
* What path should I take if I want to be a CISO?
* What security jobs/roles best prepare you to become a CISO?
* In what ways does the CISO role require totally different skills than the technical roles?
playlist_add
Aug 18, 2022
Minimizing Damage from a Breach
All links and images for this episode can be found on CISO Series
What can we do to reduce the damage of a breach and the duration of detection and remediation?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is Dave Klein (@cybercaffeinate), director, cyber evangelist, Cymulate.
Thanks to our podcast sponsor, Cymulate
The Ultimate Guide to Security Posture Validation: Learn how to effectively measure and reduce risk through continuous validation of your enterprise’s security posture. Download the playbook here.
In this episode:
* What can we do to reduce the damage of a breach and the duration of detection and remediation?
* How do we determine what’s most important and how to best reduce risk?
* How can teams best reduce the impact of the "boom" you feel during a breach?
playlist_add
Aug 11, 2022
We're All Still Learning Cyber
All links and images for this episode can be found on CISO Series
Learning cyber is not a question for those who are just starting out. It's for everybody. Where and how do we learn at every stage of our professional careers?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Jerich Beason, CISO, Commercial, Capital One.
Thanks to our podcast sponsor, SlashNext
SlashNext protects the modern workforce from phishing and human hacking across all digital channels. SlashNext Complete™ utilizes our patented AI SEER™ technology to detect zero-hour phishing threats by performing dynamic run-time analysis on billions of URLs a day through virtual browsers and machine learning. Take advantage of SlashNext's phishing defense services for email, browser, mobile, and API.
In this episode:
* Where do we…
playlist_add
Aug 4, 2022
Practical Cybersecurity for IT Professionals
All links and images for this episode can be found on CISO Series
You’re a CISO, vCISO, or MSSP rolling into a company that has yet to launch a cybersecurity department. How do you communicate about cyber with the IT department? They’re not completely new to cyber. What’s the approach to engagement that helps, but doesn’t insult? How do you offer practical cybersecurity advice?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is sponsored guest Scott McCrady (@scottsman3), CEO, SolCyber.
Thanks to our podcast sponsor, SolCyber
At SolCyber we're hell-bent on delivering Fortune 500 level cyber security for small and medium-sized enterprises. When you're being targeted by the same bad guys, nothing else will do. We bring to the table a curated stack of leading technologies and aroun…
playlist_add
Jul 28, 2022
Data Protection for Whatever Comes Next
All links and images for this episode can be found on CISO Series
Cybersecurity boils down to securing your data or data protection. But that simple concept has turned into a monumental task that is only exacerbated every time we move our data to a new platform. How do we secure data today, to be ready for whatever comes next in computing?
Check out this post and this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and guest co-host Gary Hayslip (@ghayslip), global CISO, SoftBank Investment Advisers. Our sponsored guest is Elliot Lewis (@ElliotDLewis), CEO, Keyavi.
Thanks to our podcast sponsor, Keyavi
Myth: Data can’t protect itself. Fact: Now it does! You control where your data goes in the world, who can access it and when. On any device. Anytime. Anywhere. FOREVER. Learn more at Keyavi.com.
In this episode:
* How do we secure data today, to be ready for whatever c…
playlist_add
Jul 21, 2022
What Is Attack Surface Profiling?
All links and images for this episode can be found on CISO Series
Is attack surface profiling the same as a pen test? If it isn't what unique insight can attack surface profiling deliver?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Nick Shevelyov, former CSO, Silicon Valley Bank.
Thanks to our podcast sponsor, Keyavi
Myth: Data can’t protect itself. Fact: Now it does! You control where your data goes in the world, who can access it and when. On any device. Anytime. Anywhere. FOREVER. Learn more at Keyavi.com.
In this episode:
* Is attack surface profiling the same as a pen test?
* What unique insight can attack surface profiling deliver?
* Is “Attack Surface Profiling” more like a natural evolution from traditional vulnerability management?
playlist_add
Jul 14, 2022
How Can You Tell If Your Security Program Is Improving?
All links and images for this episode can be found on CISO Series
What’s your best indicator that your security program is actually improving? And besides you and your team, is anyone impressed?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Simon Goldsmith (@cybergoldsmith), director of information security, OVO Energy.
Thanks to our podcast sponsor, Votiro
Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it’s an API, so it integrates with everything – including Microsoft 365. Learn more at Votiro.com.
In this episode:
* What's the best indicator that your security program is actually improvi…
playlist_add
Jul 7, 2022
How Can We Improve Recruiting of CISOs and Security Leaders?
All links and images for this episode can be found on CISO Series
Interviewing for leadership positions in cybersecurity is difficult for everyone involved. There are far too many egos and many gatekeepers. What can be done to improve recruiting of CISOs?
Check out this post and this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn with our guest Ty Sbano (@tysbano), CISO, Vercel.
Thanks to our podcast sponsor, Thinkst
Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this.
Deploy Canaries in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With 0 admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.
In this episode:
* What can be done to improve CISO recruiting…
playlist_add
Jun 30, 2022
How Is Our Data Being Weaponized Against Us?
All links and images for this episode can be found on CISO Series
How are nefarious actors using our own data (and metadata) against us? And given that, in what way have we lost our way protecting data that needs to be course corrected?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is John Ayers (@cyberjohn1747), vp of advanced detection and response office of the CTO, Optiv.
Thanks to our podcast sponsor, Optiv
The modern enterprise needs a solution as unique as its business.
Optiv’s Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and…
playlist_add
Jun 23, 2022
Can Security Be a Profit Center?
All links and images for this episode can be found on CISO Series
Is it possible to position your security team as a profit center instead of the traditional cost center reporting to the CIO?
Check out this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Michael Weiss, CISO, Human Interest.
Thanks to our podcast sponsor, Optiv
The modern enterprise needs a solution as unique as its business.
Optiv’s Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters.
In this episode:
* Is it possible to position your security team as a profit c…
playlist_add
Jun 16, 2022
Getting Ahead of the Ongoing Malware Fight
All links and images for this episode can be found on CISO Series
For years we've been referring to malware protection as a cat and mouse game. The crooks come up with a new malware attack, and then the good guys figure out a way to stop it. And that keeps cycling over and over again. So where are we today with malware protection and is there any way to get ahead of the cycle?
Check out this post and this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Aviv Grafi (@avivgrafi), CTO and founder, Votiro.
Thanks to our podcast sponsor, Votiro
Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it’s an API, so it…
playlist_add
Jun 9, 2022
Building a Security Awareness Training Program
All links and images for this episode can be found on CISO Series
We all know and have experienced bad security awareness training. People can learn, and should learn about being cyber aware. How do you build a security awareness training program that sticks?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn with our guest Lisa Kubicki (@lmk2), trust and security, training and awareness director, DocuSign.
Thanks to our podcast sponsor, Drata
Save 200+ hours with Drata's automated continuous compliance solution for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, & CCPA. Drata connects to your techstack with 75+ integrations, including AWS, GitHub, GCP, & more to automate the compliance process. Kickstart your compliance journey by requesting a demo and get 10% off
In this episode:
* We ask, “How do you build a s…
playlist_add
Jun 2, 2022
Onboarding Cyber Professionals with No Experience
All links and images for this episode can be found on CISO Series
You want to bring on entry level personal, But green employees, who are not well versed in security, IT, or your data introduce risk once they have access to it. What are ways to bring these people on while also managing risk?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Rich Lindberg, CISO, JAMS.
Thanks to our podcast sponsor, SolCyber
At SolCyber we're hell-bent on delivering Fortune 500 level cyber security for small and medium-sized enterprises. When you're being targeted by the same bad guys, nothing else will do. We bring to the table a curated stack of leading technologies and around-the-clock SOC support, all simply priced per user. Let us do the heavy lifting.
In this episode:
* We ask, “What are ways to bring e…
playlist_add
May 26, 2022
Where's the Trust in Zero Trust?
All links and images for this episode can be found on CISO Series
Zero trust is a hollow buzzword. In any form of security, there exist critical points where we have to trust. What we need is a move away from implicit trust to explicit trust, or identity that can be verified.
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Yaron Levi (@0xL3v1), CISO, Dolby.
Thanks to our podcast sponsor, Optiv
Need a guide on your Zero Trust journey? Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide" shares the following takeaways:
- The key elements of Zero Trust
- How to visualize your Zero Trust journey and place it in the proper context
- Integrated technologies to drive adaptive processes and a mature security model
Learn more at www.optiv.com/zerotrust.
I…
playlist_add
May 19, 2022
Who Investigates Cyber Solutions?
All links and images for this episode can be found on CISO Series
Cyber professionals, who is responsible on your team for investigating new solutions?
Check out this post and this post for the discussion that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Nick Ryan, director of enterprise technology security and risk, Baker Tilly.
Thanks to our podcast sponsor, Votiro
Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it’s an API, so it integrates with everything – including Microsoft 365. Learn more at Votiro.com.
In this episode:
* We ask cyber professionals, who is responsible on their team for investigating new solutions? If it's a co…
playlist_add
May 12, 2022
Does the Cybersecurity Industry Suck?
All links and images for this episode can be found on CISO Series
In the cyber industry we pat each other on the back and give each other awards, all while the statistics for breaches appear to be worsening, Are we celebrating growing failure? Does the cyber industry suck?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Fredrick Lee (AKA "Flee") (@fredrickl), Flee, CSO, Gusto.
Thanks to our podcast sponsor, Cymulate
The Ultimate Guide to Security Posture Validation: Learn how to effectively measure and reduce risk through continuous validation of your enterprise’s security posture. Download the playbook here.
In this episode:
* We ask if our very own industry, ourselves, are the ones to blame for our constant woes?
* Where do we stand in accepting fault and responsibility for the indust…
playlist_add
May 5, 2022
Are We Taking Zero Trust Too Far?
All links and images for this episode can be found on CISO Series
For some, the definition of zero trust has expanded from how we grant access to networks, applications, and data to how we trust individuals in the real world. Are we taking zero trust too far?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Thomas Doughty, CISO, Prudential Financial.
Thanks to our podcast sponsor, Netfoundry
NetFoundry, built on OpenZiti, is the only solution purpose-built to connect massively distributed apps, edges, clouds and devices in minutes, ensuring zero trust of the internet, local and OS host network and delivered as SaaS. Isolating the app to make network security irrelevant and remove the pain of public DNS, VPNs, bastions, as well as complex firewall rules.
In this episode:
* We ask if we’re ta…
playlist_add
Apr 28, 2022
Is Shift Left Working?
All links and images for this episode can be found on CISO Series
Developers and security professionals have been heavily sold on the concept of "shift left" or deal with security issues early in development rather bolting it on at the end. It all made logical sense, but now we've been doing it for a few years and has shift-left actually reduced application security concerns?
Check out this post, this post, and this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Mike Gorman (@gormamic), head of security and compliance, NetFoundry.
Thanks to our podcast sponsor, Netfoundry
NetFoundry, built on OpenZiti, is the only solution purpose-built to connect massively distributed apps, edges, clouds and devices in minutes, ensuring zero trust of the internet, local and OS host network and delivered as SaaS. Isolating the app to make networ…
playlist_add
Apr 21, 2022
Technical vs. Compliance Professionals
All links and images for this episode can be found on CISO Series
Do we have a Monitgue/Capulet rivalry between technical and compliance professionals? Why is this happening, and what can be done to improve it? Does it need to be improved?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Linda White, director of InfoSec, Axiom Medical.
Thanks to our podcast sponsor, Netfoundry
NetFoundry, built on OpenZiti, is the only solution purpose-built to connect massively distributed apps, edges, clouds and devices in minutes, ensuring zero trust of the internet, local and OS host network and delivered as SaaS. Isolating the app to make network security irrelevant and remove the pain of public DNS, VPNs, bastions, as well as complex firewall rules.
In this episode:
* We look at the Monitgue/Capulet rivalry between technical and compli…
playlist_add
Apr 14, 2022
Why Do So Many Cybersecurity Products Suck?
All links and images for this episode can be found on CISO Series
Why do we end up with so many bad security products? Who is to blame and how can we fight back an ecosystem that may be fostering subpar products?
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is Haroon Meer (@HaroonMeer), founder and researcher, Thinkst Canary.
Thanks to our podcast sponsor, Thinkst Canary
Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this.
Deploy Canaries in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With 0 admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.
In this episode:
* Is the cybersecurity ecosystem giving a rise to subpa…
playlist_add
Apr 7, 2022
Training for a Cyber Disaster
All links and images for this episode can be found on CISO Series
What are you doing to prepare for the next cyber disaster? You must train for it, because when it happens, and it will happen, everyone should know what they need to do.
Check out this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Roland Cloutier (@CSORoland), CISO, TikTok.
Thanks to our podcast sponsor, Keyavi
Data that protects itself? Now it does! We made data so smart it can think for itself. Secure itself. Stay continually aware of its surroundings. Control where, when and who is allowed access. And automatically report back to its owner. This changes the entire cybersecurity paradigm. Learn how.
In this episode:
* What is the importance of cyber crisis management and training?
* What are the best ways to prepare for a cyber disaste…
playlist_add
Mar 31, 2022
Virtual Patching
All links and images for this episode can be found on CISO Series
What if you didn't spend all your time patching vulnerabilities but instead created a security policy that prevented known vulnerabilities from being exploited. How doable is this solution of virtual patching?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Ody Lupescu, CISO, Ethos Life.
Thanks to our podcast sponsor, Araali Networks
Managing vulnerabilities at the speed and scale of the cloud is challenging, especially when the implications of a single mistake gives attackers an asymmetric advantage over defenders. Araali allows your security teams to resilient patch and monitor the most valuable apps and services so they cannot be exploited even if they are vulnerable. To learn more, visit araali.
In this episode:
* What is virtual patching really? Is it a…
playlist_add
Mar 24, 2022
Start a Cybersecurity Department from Scratch
All links and images for this episode can be found on CISO Series
A 500+ person company doesn't have a security department. They need one and they need to convince the CEO they need one. How do you build a cybersecurity team and program from scratch?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Rishi Tripathi (@ris12hi), CISO, Mount Sinai Health System.
Thanks to our podcast sponsor, Tines
Tines was founded by experienced security practitioners who cared about their teams. When they couldn’t find an automation platform that delivered, they founded a company and built their own. A few years later, customers like Coinbase, McKesson, and GitLab run their most important security workflows on Tines – everything from phishing response to employee onboarding. To learn more, visit tines.com.
In…
playlist_add
Mar 17, 2022
How to Think Like a Cybercrook
All links and images for this episode can be found on CISO Series
"If you want to catch a cybercrook, you need to think like one." But how do you actually go about thinking like a cybercriminal? What's the actual process?
Check out this post and this post for the discussions that are the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn.
Our guest is Brian Brushwood (@shwood), creator of Scam School and World's Greatest Con. Plus he's launched multiple channels with millions of subscribers and multiple number one comedy albums. Plus, he's a touring magician. He's our first non-cyber professional guest, but he is so perfect for this episode.
Thanks to our sponsor, Varonis
On average, an employee can access 17 million files on day one. Varonis will show you where critical data is vulnerable, detect anomalies, and automatically right-size privileges to get you to…
playlist_add
Mar 10, 2022
Building a Data-First Security Program
All links and images for this episode can be found on CISO Series
Could you build a data-first security program? What would you do if you focused your security program on just the asset?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Brian Vecci (@brianthevecci), field CTO, Varonis.
Thanks to our sponsor, Varonis
On average, an employee can access 17 million files on day one. Varonis will show you where critical data is vulnerable, detect anomalies, and automatically right-size privileges to get you to “Zero Trust.” Their data security platform can test your ransomware readiness and show you where you stack up. Learn more at www.varonis.com/cisoseries.
In this episode:
* Do I know where my sensitive data lives? How can I tell?
* Why do all the tools that try to classify data fail miserably?
* How much sho…
playlist_add
Mar 3, 2022
Offensive Security
All links and images for this episode can be found on CISO Series
Offensive security or "hacking back" has always been seen as either unethical or illegal. But now, we're seeing a resurgence in offensive security solutions. Are we redefining the term, or are companies now "hacking back?"
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Eric Hussey, CISO, Aptiv.
Thanks to our podcast sponsor, Varonis
On average, an employee can access 17 million files on day one. Varonis will show you where critical data is vulnerable, detect anomalies, and automatically right-size privileges to get you to “Zero Trust.” Their data security platform can test your ransomware readiness and show you where you stack up. Learn more at www.varonis.com/cisoseries.
In this episode:
* Has the definition of offensive security changed?
* Can we trul…
playlist_add
Feb 24, 2022
When Vendors Pounce on New CISOs
All links and images for this episode can be found on CISO Series
A security professional announces a new position as CISO. As a vendor you see this as good timing to try a cold outreach to sell your product. Why do so many vendors think this is a good tactic, when in reality it’s exactly what you should not do?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Yaron Levi (@0xL3v1), CISO, Dolby.
In this episode:
* Is the pouncing on new CISOs actually a successful sales technique?
* Should vendors refine their relationship, and focus on "pull" rather than "push"?
* What about focusing on content marketing and thought leadership?
* Should vendors shift from "marketplace" to "metricplace?"
playlist_add
Feb 17, 2022
Building a Cybersecurity Culture
All links and images for this episode can be found on CISO Series
How do you begin building a cyber security culture for the whole company? And more importantly, how do you maintain that?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Mike Hanley (@_mph4), CSO, GitHub.
Thanks to our podcast sponsor, Anjuna
Anjuna Confidential Cloud software effortlessly enables enterprises to safely run even their most sensitive workloads in the public cloud. Unlike complex perimeter security solutions easily breached by insiders and malicious code, Anjuna leverages the strongest secure computing technologies available to make the public cloud the most secure computing resource anywhere.
In this episode:
* When building a cybersecurity culture, where is the most important place to start?
* How can we avoid…
playlist_add
Feb 10, 2022
How to Pitch to a Security Analyst
All links and images for this episode can be found on CISO Series
You're a security vendor and you've got a short briefing with a security analyst from a research firm. What do you want to get across to them, and what do you want to hear back from them?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Ed Amoroso (@hashtag_cyber), founder and CEO, Tag Cyber.
Huge thanks to our sponsor, Cymulate
The Ultimate Guide to Security Posture Validation: Learn how to effectively measure and reduce risk through continuous validation of your enterprise’s security posture. Download the playbook here.
In this episode:
* What are the right questions to ask?
* How can we better understand each other?
* What to NOT do in an analyst conversation
playlist_add
Feb 3, 2022
Is Your Data Safer in the Cloud?
All links and images for this episode can be found on CISO Series
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is Michael Johnson, CISO, Novi (the financial arm of Meta, formerly Facebook)
Thanks to our podcast sponsor, Anjuna
Anjuna Confidential Cloud software effortlessly enables enterprises to safely run even their most sensitive workloads in the public cloud. Unlike complex perimeter security solutions easily breached by insiders and malicious code, Anjuna leverages the strongest secure computing technologies available to make the public cloud the most secure computing resource anywhere.
In this episode:
* Which is safer for sensitive data: public cloud or on-prem?
* Is it the technology, the people or the process that makes the difference?
* Who is most affected by the public…
playlist_add
Jan 27, 2022
What Should We Stop Doing in Cybersecurity?
All links and images for this episode can be found on CISO Series
Security professionals are drowning in activities. Not all of them can be valuable. What should security professionals stop doing be to get back some time?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Jim Rutt, CISO, Dana Foundation.
Thanks to our podcast sponsor, Thinkst
Most companies discover they’ve been breached way too late. Thinkst Canary fixes this: just 3 minutes of setup; no ongoing overhead; nearly 0 false positives, and you can detect attackers long before they dig in. Check out why our Hardware, VM and Cloud-based Canaries are deployed and loved on all 7 continents.
In this episode:
* What tool or process should we stop doing to stop wasting time?
* Are "third-party risk reviews" useful at all?
* Can we smooth out the sales cycle?
* Ar…
playlist_add
Jan 20, 2022
DDoS Solutions
How seamless are Distributed Denial of Service or DDoS solutions today? If you get a denial of service attack, how quickly can these solutions snap into action with no manual response by the user?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Alastair Cooke (@demitasenz), analyst, GigaOm.
Huge thanks to our podcast sponsor, MazeBolt
In this episode:
* Where should a DDoS solution reside?
* What vital elements should go into a DDoS solution?
* Do we need more automation and intelligence in these solutions?
* How involved should the customer be with their DDoS solution?
playlist_add
Jan 13, 2022
Making Cybersecurity Faster and More Responsive
All links and images for this episode can be found on CISO Series
Knowing is only one-third the battle. Another third is responding. And the last third is responding quickly. It’s not enough to just have the first two thirds. We need to be faster, but how?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Jason Elrod (@jasonelrod), CISO, MultiCare Health System.
Thanks to our podcast sponsor, Eclypsium
Eclypsium is the enterprise firmware security company. Our comprehensive, cloud-based platform identifies, verifies, and fortifies firmware and hardware in laptops, servers, network gear and devices. The Eclypsium platform secures against persistent and stealthy firmware attacks, provides continuous device integrity, delivers firmware patching at scale, and prevents ransomware and malicious implants.
In this episode:
* What c…
playlist_add
Jan 6, 2022
Promises of Automation
All links and images for this episode can be found on CISO Series
Automation was supposed to make cybersecurity professionals’ lives simpler. And it was supposed to solve the talent shortage. Has any of that actually happened?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Brian Lozada (@brianl1775), CISO, HBOMax.
Thanks to our podcast sponsor, deepwatch
Increasing ransomware attacks and their evolving sophistication have been putting more pressure on security teams than ever before. Luckily, managed detection and response (or MDR) has emerged as a critical component for improving security operations, reducing ransomware risk, and minimizing the overall impact an attack can have. Visit deepwatch.com to see how we help to prevent breaches for our customers, by working together.
In this episode:…
playlist_add
Dec 16, 2021
When Social Engineering Bypasses Our Cyber Tools
All links and images for this episode can be found on CISO Series
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is Josh Yavor (@schwascore), CISO, Tessian.
Thanks to our podcast sponsor, Tessian
95% of breaches are caused by human error.
But you can prevent them. Learn how Tessian can stop “OH SH*T!” moments before they happen, why Tessian has been recognized by analysts like Gartner and Forrester, and which world-renowned companies trust the platform to protect their data.
In this episode:
* What do you do for the attacks your rule sets can't catch?
* Would it help if we eliminated email systems as the standard b2b toolset for communications?
* Are there any better ways to handle spearphishing?
* Are you ready to add BCC - Business communications compromise to your threat l…
playlist_add
Dec 9, 2021
How Can We Simplify Security?
All links and images for this episode can be found on CISO Series
Why is cybersecurity becoming so complex? What is one thing we can do, even if it's small, to head us off in the right direction of simplicity?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Leda Muller, CISO at Stanford, Residential and Dining Enterprises.
Thanks to our podcast sponsor, Eclypsium
Eclypsium is the enterprise firmware security company. Our comprehensive, cloud-based platform identifies, verifies, and fortifies firmware and hardware in laptops, servers, network gear and devices. The Eclypsium platform secures against persistent and stealthy firmware attacks, provides continuous device integrity, delivers firmware patching at scale, and prevents ransomware and malicious implants.
In this episode:
* Is cybersecurity becoming too complex?
* Sh…
playlist_add
Dec 2, 2021
Convergence of Physical and Digital Security
All links and images for this episode can be found on CISO Series
Security convergence is the melding of all security functions from physical to digital and personal to business. The concept has been around for 17 years yet organizations are still very slow to adopt. A company's overall digital convergence appears to be happening at a faster rate than security convergence.
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest is Anne Marie Zettlemoyer (@solvingcyber), business security officer, vp, security engineering, MasterCard.
Thanks to our podcast sponsor, Tessian
95% of breaches are caused by human error.
But you can prevent them. Learn how Tessian can stop “OH SH*T!” moments before they happen, why Tessian has been recognized by analysts like Gartner and Forrester, and which world-renowned companies trust th…
playlist_add
Nov 18, 2021
How Do You Measure Cybersecurity Success?
All links and images for this episode can be found on CISO Series
In most jobs there’s often a clear indicator if you’re doing a good job. In security, specifically security leadership, it’s not so easy to tell. “Nothing happening” is not an effective measurement. So how should security performance be graded?
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest is Deneen DeFiore (@deneendefiore), CISO, United Airlines.
Thanks to our podcast sponsor, Tessian
In this episode:
* How should security performance be graded?
* Is "keeping it simple" the best option?
* What's the best measurement option?
playlist_add
Nov 11, 2021
How Do We Turn Tables Against Adversaries?
All links and images for this episode can be found on CISO Series
If we’re going to turn the tables against our adversaries, everything from our attitude to our action needs to change to a format where attacks and breaches are not normalized, and we know the what and how to respond to it quickly.
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our sponsored guest Scott Scheferman (@transhackerism), principal strategist, Eclypsium.
Thanks to our podcast sponsor, Eclypsium
Eclypsium is the enterprise firmware security company. Our comprehensive, cloud-based platform identifies, verifies, and fortifies firmware and hardware in laptops, servers, network gear and devices. The Eclypsium platform secures against persistent and stealthy firmware attacks, provides continuous device integrity, delivers firmware patching at scale, and…
playlist_add
Nov 4, 2021
Ageism in Cybersecurity
All links and images for this episode can be found on CISO Series
Is it too much experience? Is it that they're difficult to work with? Do they want too much money? Will they not be motivated? Are cyber professionals over the age of 40 being discriminated in hiring practices?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Ben Sapiro, head of technology risk and CISO at Canada Life.
Thanks to our podcast sponsor, Qualys
Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.
In this episode:
* Are cyber professionals over the age of 40 being discriminated in hiring practices?
* Is "older experience" a threat to younger managers?
* Do older professionals have too much attitude?
* What other work options exist for the 40+ expert?
playlist_add
Oct 28, 2021
Proactive Vulnerability Management
All links and images for this episode can be found on CISO Series
How do we turn the tide from reactive to proactive patch management? Does anyone feel good about where they are with their own patch management program? What would it take to get there?
Check out this post and this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Sumedh Thakar (@sumedhthakar), CEO, Qualys.
Thanks to our podcast sponsor, Qualys
Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.
In this episode:
* How do we turn the tide from reactive to proactive patch management?
* Do cultural differences make a difference?
* Do we need a new framework or template?
playlist_add
Oct 21, 2021
Why Is Security Recruiting So Broken?
All links and images for this episode can be found on CISO Series
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest Tony Sager (@sagercyber), svp, and chief evangelist, Center for Internet Security.
Thanks to our podcast sponsor, Qualys
In this episode:
* What role should HR play in the hiring process of cybersecurity candidates?
* What happens when HR's algorithms don't see the right keywords?
* What are some better ways to get noticed by a human decision maker?
playlist_add
Oct 14, 2021
How to Be a Vendor that CISOs Love
All links and images for this episode can be found on CISO Series
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest Andy Ellis (@csoandy), operating partner, YL Ventures.
Thanks to our podcast sponsor, Varonis
What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn’t stand a chance. Get a free risk assessment.
In this episode:
* What are some "positive vendor engagement" characteristics?
* What tips can we share with vendors who want to build a lasting good impression?
* How can a vendor go about building trust?
playlist_add
Oct 7, 2021
The "Are We Secure?" Question
All links and images for this episode can be found on CISO Series
When a senior person at your company asks you, "Are we secure?" how should you respond?
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Steve Zalewski, and our guest Paul Truitt, principal US cyber practice leader, Mazars.
Thanks to our podcast sponsor, Varonis
Still in the news is REvil’s ransomware attack on Kaseya VSA servers. Varonis is here to help mitigate the blast radius of such attacks. Want a step-by-step guide on what you should be looking for? Learn more about how to prevent ransomware.
In this episode:
* When a senior, non-technical person asks, "Are we secure?" how do you respond?"
* What does this question say about an executive's engagement level?
* Why are they asking this now?
* How relevant/accurate is this question anyway?
playlist_add
Sep 30, 2021
Ransomware Kill Chain
What are the tell tale signs you've got ransomware before you receive the actual ransomware threat?
Check out this post and this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our sponsored guest Brian Vecci (@BrianTheVecci), field CTO, Varonis.
Thanks to our podcast sponsor, Varonis
What is your ransomware blast radius? The average user can access 17 million files. Varonis reduces your blast radius in days, not years. Combined with advanced detection that monitors every file touch, ransomware doesn’t stand a chance. Get a free risk assessment.
In this episode:
* How to catch the ransomware threat earlier
* The individual capabilities needed in a full anti-ransomware stack
* Honeypots and anomalous behavior
* Back to basics: look at how ransomware works
playlist_add
Sep 23, 2021
Can Technology Solve Phishing?
All links and images for this episode can be found on CISO Series
Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest Robert Wood (@holycyberbatman), CISO at Centers for Medicare & Medicaid Services.
Thanks to our podcast sponsor, Living Security
Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change. This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers.
In this episode:
* Will there be a day that phishing can be solve…
playlist_add