The Cyber Ranch Podcast
Allan Alford
Subscribe
Ride the cyber trails with one CISO (Allan Alford) and a diverse group of friends and experts who bring a human perspective to cybersecurity.
Available episodes
Newest first
Oldest first
6 days ago
Permissions Management w/ Ron Nissim
Howdy, y’all, and welcome to The Cyber Ranch Podcast! Joining Allan this week is Ron Nissim, CEO @ Entitle. Yes, this is one of our rare shows with a vendor as a guest. Why? Because in this case, the vendor was more highly informed than any of Allan’s practitioner friends he was able to query about the subject. And what is that subject? Permissions Management. One that we’ve never done a deep dive into on this show, and one that’s overdue. So without further ado, enjoy hearing Ron chat with Allan.
* What are the fundamental tenants of proper permissions management?
* What are the goals?
* What does the tech stack look like? different categories you're going to pursue?
* What are the differences between mid-market and enterprise when it comes to permissions management?
* What is missing still in permissions management?
* What does next 3-5 years look like?
* How does permissions lifecycle tie into identity lifecycle?
* What is broken with RBAC?
playlist_add
20 Sept 2023
The Cybersecurity Efficacy Gap w/ AJ Grotto
Allan is joined by AJ Grotto: William J. Perry International Security Fellow and Founding Director of the Program on Geopolitics, Technology and Governance at Stanford University. He also serves as the faculty lead for the cyber policy specialization that the university offers through its master's in international policy program . He’s also a visiting fellow at the Hoover Institution. He’s talking with me today about Cybersecurity spend vs. cybersecurity efficacy. AJ, thanks so much for coming on down to ‘The Ranch!
The below points are mostly followed, but the pair also get into CISOs embracing risk, CISOs owning risk, and buying 'lemons' in the cybersecurity market:
* So Cybersecurity Ventures says 2023 spending is growing 15% year over year. Between awareness training and tech stack, they are estimating $198+ billion in spend this year on cybersecurity. Techcrunch analyzed the estimated shrinkage of budgets this year based on economic conditions: 45% of budgets remain unchanged or even increased. 3% of budgets were cut by an average of 21.2%. So these figures hold close to steady despite the economic downturn. We spend more and more on cybersecurity every year. When does this end?
* Conversely, InfoSecurity Magazine says ransomware attacks surged by 74% in 2023. Wired reports an increase for 2023 as well. We can dig into Verizon and IBM annual reports to see generally trends of year-over-year increases as well. Verizon shows 13% increase with a curve that’s trending upward more quickly each year. What gives?
* How do we solve this? How do we bridge this gap?
* Tactically, we have tech stacks and awareness training and GRC. What is our spend story there vs. this looming threat landscape?
* Is the solution to spend less, but more intelligently? In other words, crafty rationalization where we still get full coverage, but spend less?
* If we can never close the gap between spend and threat, what are we to do?
Sponsored by our good friends at Seraphic Security.
Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.
playlist_add
13 Sept 2023
Cybersecurity Awareness Month CALL TO ACTION - The Podcast Trifecta!
Warning: Some naughty language in this show, but well placed naughty language!
Challenge issued!!!! Allan has teamed up with TWO other podcasts to take on the insufferable marketing that floods the cybersecurity industry in the month of October! Who among you will win???
Win?
That's right! Allan, along with George K and George A from Bare Knuckles & Brass Tacks joins forces with Aaron Pritz and Cody Rivers of Simply Solving Cyber! Together, this trifecta weighs in on the October bonanza that is Cybersecurity Awareness Month. While the month started to raise awareness for the general public, it’s now become an excuse for vendors to inundate infosec professionals' inboxes with inane messaging. Introducing: The Cyber Community Month challenge! Vendors: we’re challenging you to come up with campaigns that give back to the customer community rather than sending awareness spam. Client-side practitioners: Show us how you engage local communities, volunteer at schools, help nonprofits, etc. to spread cyber knowledge! We’re awarding prizes in November. Share your efforts on social media with the hashtag #CyberCommunityChallenge
Sponsored by our good friends at Entitle.
Entitle is how cloud-forward companies provide employees with granular and just-in-time access within their cloud infrastructure and SaaS applications. Whether it's providing access to production for on-cal engineers or granting access to customer data when a support ticket is opened, Entitle easily integrates with your stack, offering self-serve access requests, instant visibility into your cloud entitlements and making user access reviews a breeze. Learn more at entitle.io
playlist_add
7 Sept 2023
Protecting Small Organizations w/ Georges Merchak
* Nearly 43% of cyber-attacks are on small businesses.
* 82% of ransomware attacks were targeted at companies with less than 1000 employees.
* 61% of SMBs were the target of a Cyberattack in 2021.
* 37% of companies hit by ransomware had fewer than 100 employees.
And yet...
*
36% of small businesses have no concern whatsoever about cyberattacks. Another 59% of small business owners who have no cybersecurity believe that their company is too minuscule to be targeted.
*
47% of businesses that have less than 50 employees don’t allocate any funds towards cybersecurity. While 51% of small businesses don’t utilize any IT security measures.
The threat is real, but preparedness is not. Join Allan and Georges Merchak as they tackle the nuances of protecting small organizations. Georges is an industry veteran who has held many full-time practitioner roles, but also consulting roles. Georges has served small business.
Together they address:
* Vs. bigger businesses, what are the challenges and benefits for the small guys? Are there any benefits?
* Is there value for a CISO to consult with these guys?
* What is different about their attack surface?
* So security is their least concern, and yet it sure seems like it should be a big concern. How do we educate them?
* What’s the maturity rollout? There is no way you can tackle a small business’ entire cyber problem in one go…
* What are the low-hanging fruit? Some very practical steps?
Y'all enjoy!
Sponsored by our good friends at Seraphic Security.
Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.
playlist_add
30 Aug 2023
Nowhere to Hide w/ Chris Roberts
You know you're being watched, right?
Imagine for some reason you needed to bury a treasure where nobody would ever find it. In today's society, how could you even do that? How can you get from Point A to Point B without being observed or tracked in some way?
Did you know that you can be listened to through smart lightbulbs?
This episode features the infamous and always gracious Chris Roberts, back again on the 'Ranch during this LIVE! recording from the HIP Global 2023 conference in NYC.
Chris and Allan talk about these subjects and more in an eye-opening show about just how much folks can see you and hear you.
Join in and become just a little more paranoid...
Sponsored by our good friends at Seraphic Security.
Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.
playlist_add
23 Aug 2023
Cybersecurity in Popular Culture w/ George Finney LIVE!
In this LIVE! show at Black Hat, Allan and his friend George Finney (recurring guest, CISO @ SMU, multi-times author and CEO of Well Aware Security) discuss cybersecurity in popular culture. They talk about the impact on real-world cybersecurity practices of such non-fiction gems as Clifford Stoll's book The Cuckoo's Egg and such cheesy fictional accounts as the movie Swordfish.
It might have made you grown, but it might have inspired you and others.
It might have represented what we do well enough that you can refer people to it who ask after our craft. Or maybe the portrayal was so bad it was laughable.
Join Allan and George LIVE! at Black Hat as they pick apart their favorites and take suggestions from the audience as well... Hack the Planet!
Sponsored by our good friends at Seraphic Security.
Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.
playlist_add
16 Aug 2023
Allan Interviews EVERYONE at Black Hat
Did you miss Black Hat this year? Well you won't miss the great conversations that were had, as Allan captured so many good ones for this special Black Hat retrospective episode.
Did you get to attend Black Hat this year? See if your experience was as amazing as Allan's! This show is LIVE and untarnished. It's the real Black Hat experience!
In this episode, Allan talks to (in alphabetical order, with timestamps):
1:02 - Dani Woolf, Founder & CEO at Audience 1st
3:06 - Daniel Blackford, Manager of Threat Research @ Proofpoint
6:48 - Dean Sysman, CEO @ Axonius
8:19 - Deepen Desai, Global CISO & Head of Security Research @ ZScaler
15:39 - G. Mark Hardy, host of the CISO Tradecraft Podcast
18:42 - Glen Pendley, CTO @ Tenable
23:54 - Kayne McGladrey, Field CISO @ Hyperproof
24:52 - Leigh Honeywell, CEO @ Tall Poppy
25:52 - Masha Sedova, CEO @ Elevate Security
28:47 - Nate Warfield, Director of Research @ Eclypsium
31:43 - Rich Berthao, Cybersecurity Leader, Planner, and Innovator
32:41 - Rob Labbé, CEO and CISO in Residence for the Mining and Metals ISAC
This show captures an amazing week!
Sponsored by our good friends at Seraphic Security.
Seraphic helps you defend your digital workplace with security and DLP for every browser and essential desktop apps like Microsoft Teams, Slack, Asana, and Notion. Protect against compromise and prevent data loss via the web with Seraphic.
playlist_add
9 Aug 2023
Allan is at Black Hat
A brief thank you to our listeners and a request for feedback on the show.
We'll catch y'all next week!
playlist_add
2 Aug 2023
The Open Source Security Foundation with Omkhar Arasaratnam
The OpenSSF is doing invaulable work for the cybersecurity community. And their new managing director happens to be Omkhar Arasaratnam, whose appearance on the show a while back created one of our most popular episodes ever! Omkhar is back to talk about the OpenSSF:
* What is the OpenSSF and how does it relate to the Linux Foundation?
* What is the organization's mission?
* What is the organization's vision?
* What exciting projects are taking place (and a sneak peek about some upcoming announcements at Black Hat!)
* What mark do you want to leave on the OpenSSF as Managing Director?
Omkhar is an expert in DevOps and CI/CD. He is an expert in security. His passion is supply chain security. You can see where all of this can come together in his new role and make amazing things happen for your industry. Y'all enjoy, and y'all be good now!
playlist_add
26 Jul 2023
Cloud Security Remediation w/ Tunde Oni-Daniel
Cloud security remediation can be a daunting task that impacts Dev, Sec and Ops teams all. And it can be a huge, manual, pain in the... You get the idea. But there are techniques to navigate it and to overcome many of the common traps and hurdles.
Tunde Oni-Daniel is a grizzled veteran in our industry who has managed to maintain his enthusiasm, passion and energy for the job. Tunde is an expert on cloud remediation and together he and Allan discuss:
* Cloud lifecycle
* Challenges when findings happen
* Drift management
* Bugs vs vulnerabilities
* Sec/Dev/Ops relationships with regards to remediation
* What works, what's fast?
* The next 3-5 years of cloud remediation
This one is a phenomenal show packed full of practical tips and high energy.
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
19 Jul 2023
Things We Believe But Cannot Prove w/ Drew Simonis
In this episode, Allan and Drew tackle and interesting subject that was suggested by Drew and that Allan posted for the LinkedIn community to gather around: things we believe in cybersecurity that we cannot prove.
The LinkedIn conversation was phenomenal, and Drew and Allan do a great job of summarizing it and calling out the underpinnings behind much of what we believe in this industry.
Questions Allan asks Drew:
* What inspired this topic?
* What were some of your favorites from the LinkedIn thread?
* What are the underlying themes here?
* Is BYOD security really a thing?
* Are third-party risk assessments useful?
Special thanks to LinkedIn posters:
* Peter Schawacker
* John Prokap
* Duane Gran
* Brian Campbell
* Matthew Dimmick
* Graham Lewendon
* Marcus W.
* Dmitriy Sokolovskiy
* And everyone who participated in a very lively thread...
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
12 Jul 2023
Board Reporting with Kate Kuehn
Kate is a legend in our industry, is a multiple times board member herself as well as having reported to boards in a wide variety of roles. She is currently Chief Trust Officer at Aon. Allan and Kate have intended to get her down to The Cyber Ranch for some time, but the stars finally aligned in this fantastic episode jam-packed with great advice.
Do please forgive the sound quality on this one. It was recorded on the road, and the conversation was too amazing to re-record despite the quality issues.
Kate and Allan cover:
* Best human approaches in board communicating – everything but the presentation itself
* How to get to know your board both individually and collectively
* What to present
* What not to present
* Best tips and tricks overall
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yours…
playlist_add
6 Jul 2023
Allan Answers LinkedIn Questions
This week Allan flies solo and tackles a variety of questions that came in from LinkedIn - including his origin story.
Allan tackles the following questions:
* How does a CISO protect themselves from prosecution?
* How does one get value from a cybersecurity assessment?
* How should one pick a cybersecurity solution or company?
* How do you "disconnect" from cybersecurity?
* How to start and sustain a cybersecurity podcast - why and why not?
* Allan's orgin story
* Allan argues with himself over two issues
NOTE: Allan states: "I have no idea why anyone would want to hear my origin story, but here it is. You can skip it if you like. It runs from roughly 19 minutes to 24 minutes."
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
28 Jun 2023
The Real Implications of Contemporary Exploits with Anne Marie Zettlemoyer
The MOVEit breach has been top of mind, especially with Solar Winds and Colonial Pipeline and log4j and all the others having been so recent. It is easy to blame the victims. It is easy to make excuses that nobody can defend against a Zero Day. There are a lot of easy responses to these kinds of affairs.
But what Allan and Anne Marie Zettlemoyer get into in this episode is a variety of questions around the assumptions:
* Start with a quick summary of the MOVEit exploit and Clop.
* How does this attack compare to SolarWinds?
* What can we do to prepare for zero-day exploits?
* Is society (and the business world) getting jaded to ransomware attacks and breaches? Is this affecting their investments in cyber?
* Is a post-breach CISO really rolling in the assets and resources the way so many assume?
* What are the long-term implications for a business, its stock prices, and its CISO investment?
This is another episode that strives to get deeper than the surface. We hope you…
playlist_add
22 Jun 2023
Zero Trust & DSPM with Claude Mandy - SPECIAL LIVE EDITION
This episode was recorded LIVE at the 2023 Symmetry Systems Unconference on Zero Trust, adjunct to RSAC 2023.
Allan is joined by his friend Claude Mandy, former CISO, former analyst, and now Chief Evangelist at Symmetry Systems. Like Allan, Claude is a Zero Trust enthusiast. The podcast was the capstone to a long day of Zero Trust presentations, panels, book reviews and other great topics and conversations.
Join Allan and Claude at this live recording that covers:
- How does DSPM fit into Zero Trust?
- Allan's victory at a recent Digital Fight Club event where he championed Zero Trust
- Overcoming Zero Trust marketing hype
- Is Zero Trust a framework, an architecture, or something else? Hint: Claude says it's something else.
- What are the biggest challenges in implementing Zero Trust?
- What are the benefits to the business of Zero Trust?
- Security is about the intersection of Data & Entities - not about Assets
- What are the most exciting aspects of RSAC 2023 for Claude an…
playlist_add
21 Jun 2023
Money with Nick Vigier
Money is the hardest thing for a CISO to acquire. As with last week's show on Time, Money has to be spent wisely as well. Perhaps the tricks to spend it wisely directly relate to how we can acquire more the next cycle to achieve the mission we know we need to achieve. In this episode we cover:
- What are the best methods for securing a budget?
- How do you structure your budget to align with business costs (COGS, R&D, CAC...)?
- What are some good ways to save money as a CISO?
- How do you best lower vendor costs for the long term?
- How can a CISO help make money for the business?
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
14 Jun 2023
Time w/ Paul Robinson
Time is one of our most precious commodities as security practitioners. And yet we have traditional time sinkholes where we waste time, lose time, and spend time. Join Allan and Paul Robinson, Founder and Managing Director at Tempus Network, as they explore several of these areas and give concrete tips on how to save time as security practitioners:
- Keeping up with industry trends
- Managing cyber incidents
- Third-party questionnaires (both directions!)
- Vendor onboarding
- Work from home vs. going into the office
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
7 Jun 2023
FedRAMP, StateRAMP, TX-RAMP with Jay Adams
Join Allan and his guest Jay Adams, CISO @ Enchoice and former security architect for several large private and public sector efforts - from M&A activities to massive public portals.
Jay is going through TX-RAMP right now, and both he and Allan have done research on FedRAMP and StateRAMP as well.
What are the differences? Why might you choose one over the other? What are the gotchas?
This is a great show and you'll get to learn a bit about Allan's brief foray into state government as well...
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
5 Jun 2023
RSAC 2023 Special Edition Campfire Chats - Part 2
This is Part 1 of an incredible series of interviews Allan conducted live at RSA 2023. Guests include:
* Gary Hayslip, CISO @ Softbank Investment Advisers
* Michael Calderin, CISO @ YAGEO Group
* David Cross, CISO @ Oracle SaaS Cloud
* Audra Streetman, Security Strategist @ Splunk
* Adrian Peters, CISO @ Vista Equity Partners
* Robin Sundaram, CISO @ RELX
* Merritt Baer, Office of the CISO @ AWS
* Rob Wood, CISO @ Centers for Medicare & Medicaid Services
* Bryan Green, CISO Americas @ ZScaler
* Stephanie Derdouri, Sr. Manager, Information Security and Technology Risk Management @ Capital Group
* Andres Andreu, CISO @ 2U
* Paul Love, CISO & Chief Privacy Officer @ Co-op Solutions
* Royce Markose, former CISO
* Bob Schuetter, CISO @ Ashland
* Susan Thomas, CEO @ 10Fold
* Brian Markham, CISO @ EAB
* Ken Foster, VP of IT GRC @ FLEETCOR
* Elizabeth Martinez, Account Exec @ ThreatLocker
* Josiah Dykstra, Senior Fellow, Office of Innovation @ The NSA
*…
playlist_add
31 May 2023
1% Leadership with Andy Ellis
This week's show is exciting because Allan has been waiting for Andy's book on leadership to come out for quite some time. The book is called “1% Leadership – Master The Small, Daily Improvements That Set Great Leaders Apart”, and it consists of 54 chapters - each of which presents a specific facet of good leadership in a nearly "buffet style" manner. You can pick and choose topics that resonate with you and dive right in.
Allan picked 6 chapters that resonated with him in particular and got Andy to elaborate:
* Chapter 1 - “Personal improvement is a prerequisite to leading professionally”
* Chapter 6 - “Gift kindness where it isn’t expected”
* Chapter 8 – “An uncompelled apology unburdens everyone”
* Chapter 13 - "Your wellness is one of the greatest assets you control" (Listen as Andy hits Allan straight in the feels on this topic)
* Chapter 24 – "People need to see versions of themselves to feel welcome"
* Chapter 35 - "In general, be vague"
Th…
playlist_add
24 May 2023
Will LLM AI Close The Bad Guys’ Skills Gap? with Adrian Sanabria
This episode is a bit scary. Adrian Sanabria, who on an earlier show busted many cybersecurity myths, is back again, this time analyzing the impact of Large Language Model Artificial Intelligence on a hypothesized skills gap on the bad guy side.
Premise One: Given how many organizations that are vulnerable and that have NOT been breached, the bad guys are suffering the same skills gap we are.
Premise Two: Exploit attacks (think of exploits as ransomware, data hostage situations, threats to publish breached data, etc.) can benefit from LLM AI.
It's really that simple a connecting of the dots. Adrian and Allan deconstruct the steps of an exploit attack, analyze the capabilities of LLM AI and cross-reference the two.
If they are right, then we have a burden of leveraging and learning LLM AI ourselves, as quickly as possible...
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix…
playlist_add
22 May 2023
RSAC 2023 SPECIAL EDITION Campfire Chats - Part 1
This is Part 1 of an incredible series of interviews Allan conducted live at RSA 2023. Guests include:
* Chris Kennedy, CISO @ Citadel
* Gary Hayslip, CISO @ Softbank Investment Advisers
* Michael Calderin, CISO @ YAGEO Group
* Reet Kaur, CISO @ Portland Community College
* Rob LaMagna-Reiter, CISO @ Hudl
* Matthew Lang, vCISO
* David Cross, CISO @ Oracle SaaS Cloud
* Audra Streetman, Security Strategist @ Splunk
* Vishal Amin, General Manager of Security Solutions (Federal) @ Microsoft
* Adrian Peters, CISO @ Vista Equity Partners
* Kelly Shortridge, Author of “Security Chaos Engineering: Sustaining Resilience in Software and Systems”
* Robin Sundaram, CISO @ RELX
* Merritt Baer, Office of the CISO @ AWS
* Tim Rohrbaugh, former CISO & Industry Leader
* Rob Wood, CISO @ Centers for Medicare & Medicaid Services
* Bryan Green, CISO Americas @ ZScaler
* Stephanie Derdouri, Sr. Manager, Information Security and Technology Risk Management @ Capital Gro…
playlist_add
17 May 2023
Two Founder CEOs with Merav Bahat and Mickey Bresman
Leadership skills, technical skills, cybersecurity skills, pluck, drive and determination are all on display as Allan interviews Merav Bahat, CEO @ Dazz and Mickey Bresman, CEO @ Semperis.
Dazz has completed a Series A investment round. Semperis a Series C. It turns out that the skills each CEO needs are still remarkably the same.
Saddle up for another episode, where Allan asks his guests:
* What’s the coolest thing that has happened for you or to you as a startup CEO?
* What has been the biggest single challenge?
* What are your top 3 tenets of leadership?
* What is the purpose of vision and how clear must it be?
* What is the purpose of mission and how clear must it be?
* What is your advice to those who would want to become a startup CEO?
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yours…
playlist_add
10 May 2023
Security Chaos Engineering with Kelly Shortridge
What is security chaos engineering? You may remember Kelly Shortridge, our very first guest, who came on the show to talk about behavioral economics and cybersecurity. Well Kelly is back to talk about her new book, "Security Chaos Engineering: Sustaining Resilience in Software and Systems".
Security chaos engineering is derived from chaos engineering, a relatively new discipline in software development that seeks to test distributed computing systems to ensure that they withstand unexpected disruptions. It's all about resilience, in other words. Security chaos engineering seeks to do the same for the security of such software systems.
Kelly breaks down her book during a lively conversation featuring an opinion or two her cat, Link (yes, a Zelda reference!):
* Who should read this book?
* Resilience in software and systems
* Systems-oriented security
* Architecting and designing
* Building and delivering
* Operating and observing (Allan's favorite chapter as it intersects…
playlist_add
3 May 2023
The 9-Layer Cybersecurity Program Cake with Bryan Liebert
Bryan Liebert is one smart cookie. Who bakes cybersecurity cakes. But seriously, Bryan has been a CISO, consultant, architect, and has served many other roles in cybersecurity. His specialty is creating simple to digest (we could not help it, sorry!) models for managing and reporting on cybersecurity programs and practices.
Join Bryan and Allan as they serve up (we're still doing it!) a lively and informative episode!
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
26 Apr 2023
Four Problems with Cybersecurity with Adrian Wright
Adrian Wright, "The Cynical CISO" of LinkedIn fame, joins Allan to discuss four areas where cybersecurity is perhaps getting it wrong:
* Cybersecurity viewed as a necessary evil, related to The Twilight Zone
* Ownership, Authority, Accountability: Inventory and Means of Control
* Are WE the baddies?
* (Largely) Forgotten Security Principles
Allan and Adrian dissect cybersecurity practice in this great episode!
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
24 Apr 2023
The Cloud and the Big Bang of Data with Cecil Pineda and Gene Moore
Join us for a SPECIAL EDITON! episode of The Cyber Ranch Podcast LIVE! from CISO XC in Dallas-Fort Worth, Texas!
The topic is data security: its challenges and how to overcome them.
Joining Allan are Cecil Pineda of R1 ("Cecil the CISO") and Gene Moore of Securiti.
The conversation is live and lively, recorded as-is and delivered to you.
Enjoy!
Sponsored by Securiti - https://securiti.ai/
playlist_add
19 Apr 2023
The Blurring of Personal & Corporate Security with Leigh Honeywell
We always think of cybersecurity startups as companies who contribute to the tech stack in an organizational environment - usually the enterprise. We also think of personal cybersecurity in terms of protecting Grandma or our kids from the bad guys. But these two worlds intersect far more than you would think, and the techniques for addressing these problems intersect as well.
This week Allan is joined by Leigh Honeywell, CEO at Tall Poppy, to discuss these intersections. Leigh is uniquely qualified, as her non-traditional startup addresses "personal security outside the firewall", which includes executive protection...
Sponsored by our good friends at Dazz:
Dazz takes the pain out of the cloud remediation process using automation and intelligence to discover, reduce, and fix security issues—lightning fast. Visit Dazz.io/demo and see for yourself.
playlist_add
12 Apr 2023
Design Partnerships with Emily Heath
Emily Heath is a well-known and well-respected figure in cybersecurity. She has been a CISO three times in a variety of industries, including software and a major airline. She has been in law enforcement, is a partner at a VC firm, and serves on boards of directors as well.
With this wealth of experience she has come to value design partnerships - working with small startups to help craft their solutions to meet hers and their needs.
But what are some of the challenges in design partnerships? Allan and Emily tackle the following questions:
* What inspires one towards design partnerships?
* How can a practitioner design partner help a first-time founder?
* Where does the innovation come from in this model?
* Does the vast amount of cyber vendors help or hinder the design partnership model?
* What are the pros and cons of alternatives to design partnership?
* How does a practitioner get started with design partnership?
Sponsored by our good friends at Dazz:
Dazz takes th…
playlist_add
5 Apr 2023
All About Advisory Boards with Karla Reffold
This week Allan is joined by Karla Reffold, COO at Orpheus Cyber. Yes, that makes her a vendor, but, yes, she follow's the show's rules: She is a friend, not a sponsor; she is not all vendory; and most importantly she is a subject matter expert on this week's topic: advisory boards!
In fact, Karla has written an ebook on the subject which is available here:
https://karlareffold.co.uk/advisory-boards-guide-book
Topics covered in the show:
- The ethical entanglements of being on an advisory board
- Paid vs. unpaid advisory board roles (and cash vs. equity)
- Advisory board roles as kickbacks (yes, it happens)
- Advisors who are customers vs. advisors who are not
- Do advisory board roles help or hurt a CISO's career?
Enjoy! Y'all be good!
playlist_add
29 Mar 2023
CISO vs. Individual Contributor Perspectives w/ William Klusovsky
Becoming a CISO means changing a lot of perspectives. Individual contributors need to learn this, and the CISO is the best one to teach them. "They're never going to get it!" is a mantra used by both sides of that dialogue, and that is not a solution. Will and Allan discuss:
- What precepts really are "obvious"
- How does one onboard leadership and business perspectives?
- What should CISOs do to ensure their teams gain those perspectives?
- What can individual contributors do to ensure that they gain those perspectives?
- The value of self-teaching and mentorship
- Beliefs we should get rid of
It's a great conversation! Ya'll enjoy it!
playlist_add
22 Mar 2023
How to Trust Your Vendors - A Scary Case Study with Paul Moreno
This episode is a story about an entire vendor encounter gone horribly wrong. Allan is joined by Paul Moreno, VP of InfoSec at Catawii, formerly SVP of Cybersecurity at Adyen, investor and advisor. Paul found a cybersecurity vendor. Paul found good references. Paul got referrals from peers. Paul did a PoC. And after that, it all went downhill. Paul was kind enough to share his story as he and Allan pick apart the failings and deliberate on ways we can all avoid such encounters.
Topics covered are:
- How to spot lies
- Vetting the vendor's internal security landscape
- ISO 27001 Statement of Applicability
- Breaches and whistleblowing
- GDPR violations in charging to delete data
It is a story you will want to hear, and the analysis just might save you some pain down the road...
Sponsored by Allan Alford Consulting https://allanalford.com/about
playlist_add
15 Mar 2023
Tech Teams, GRC Teams, and the CISO with Dr. Mike Brass
Join Allan and Dr. Mike Brass (whose degree is in archaeology!) as they jointly explore the technical side of the house vs. the GRC side of the house, noting that GRC can be a great path to CISO.
Hear Mike's journey from IT technician to GRC to CISO.
Topics Allan and Mike cover:
* The tension between tech teams and GRC teams, and how a CISO can bridge the two teams
* Reasons why GRC makes such a great background for the CISO role (and how to get there)
* What engineering/architecture folks should know about GRC
* What GRC folks should know about the tech side of the house
* What the rest of the business should know about GRC
You also get to hear Mike's journey, which has spanned small and large companies, government think tanks and more!
Sponsored by Allan Alford Consulting https://allanalford.com
playlist_add
8 Mar 2023
How Do We Embrace Imperfection with Robin Sundaram
We have this idea that we can be perfect. And we know that idea is unsound. So we settle for imperfection. But are we doing that purposefully? Do we have a conscious plan for embracing imperfection? How can we, as cyber professionals, embrace our imperfection meaningfully and with intent?
Join Allan and Robin Sundaram as they explore this topic, covering areas such as:
* NIST CSF is all about imperfection
* Embracing CMDB imperfection
* Vulnerability Management and Patch Management
* Product/Project Rollouts
* Dev teams and the pipeline
* Imperfection and GRC
It's a great conversation and you are sure to learn a thing or two!
Sponsored by Allan Alford Consulting: https://allanalford.com
playlist_add
1 Mar 2023
Technical Case vs. Business Case with Omkhar Arasaratnam
In this episode, Allan is joined by Omkhar Arasaratnam, a force in the industry and an expert in the intersection of software and security (you may remember Omkhar from an earlier show about supply chain security).
They challenge each other to a game, "Technical Case vs. Business Case", where they must provide both arguments for a given technology deployment. The real subtext here is that whenever these two get together, they always lean towards a technical conversation, so they are challenging themselves.
Topics Covered:
* MFA
* Service Accounts
* Refresh Cycles
* Token Expiration
* Recovery Emails
* Regulatory Mandates
* Biometrics
* SBOM
It's a lively conversation and we hope you will find value in it!
Sponsor Links:
Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cyb…
playlist_add
22 Feb 2023
The Implications of ChatGPT and AI with Shaun Marion and ChatGPT
Join Allan, Shaun Marion (CISO of McDonald's) and ChatGPT itself for a lively conversation about the implications of this new tool, AI in general, and nuances about ChatGPT's usage.
Even after controls were put into place to prevent ChatGPT from helping the bad guys, Allan and Shaun were able to trick it into giving up details on hacking, authoring phishing emails and more.
Shaun and Allan explore the potential for abuse and the positive promise and excitement that this new era of AI is ushering in.
What are the societal implications of ChatGPT?
What are the positive advances of AI?
Should we be cautious with what we feed ChatGPT?
Hear answers to these questions and more on this week's lively episode.
Sponsor Links:
Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity framew…
playlist_add
15 Feb 2023
Breach Communications with Heather Noggle
How important are communications after your company has been breached? They can make or break customer perception, and the perception of the world. Bad communications are perceived as bad intent.
Joining Allan this week is Heather Noggle, owner of Codistac - a company that specializes in cyber communications, advocacy and awareness. She studied communications in college, and takes this stuff very seriously.
The pair cover LastPasss, Okta and Reddit breaches, comparing the bad to the good.
Topics covered:
* Poor editing of communications
* Willful non-communication
* Obfuscation
* Apologies
* Letting the lawyers have their say - but not the last say
* The balance between speed and accuracy
It's a great conversation and a great show.
Sponsor Links:
Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one so…
playlist_add
8 Feb 2023
BISO Bonanza with Ann Hines, James Binford and Matt Winkeler
Do you want to be a CISO one day? Are you a CISO today who wants to strengthen your ties into the rest of the business? The Business Information Security Officer (BISO) role is one you should explore.
The role can vary quite a bit, as you will hear on this episode with not one, not two, but three BISOs joining Allan Alford to discuss the role and its nuances: where it fits, what is required, how it is best positioned and managed.
Allan has been a BISO himself and has managed BISOs as well, so the conversation is rapid and productive.
Join Allan along with Ann Hines (BISO @ USAA), James Binford (BISO @ Humana) and Matt Winkeler (BISO @ Equifax) as the explore the BISO role.
Sponsor Links:
Thank you to our sponsor TrustMAPP for bringing this episode to life! The TrustMAPP solution gets you out of spreadsheets and slide decks and into managing, measuring and reporting on your cybersecurity with an all-in-one solution that combines cybersecurity frameworks, maturity, risk and business…
playlist_add
1 Feb 2023
Developing and Fostering Good Leadership with Joey Rachid and Scott Moser
Joining Allan today are two folks who are passionate about leadership – not just practicing good leadership, but instilling good leadership in future generations. Joey Rachid is CISO in the ecommerce and financial services industry, is on advisory boards, has worked for the Big Four, and more importantly is a former US Marine (although all the Marines will tell you there is no such thing as a former Marine!)
Scott Moser is SVP and CISO at Sabre Corporation, has also been a CISO for Caesar’s (the gaming and hospitality company), and has held some very interesting military roles of his own. In a joint branches capacity, Scott has been a CIO in Alaska. For the US Air Force, Scott has been a Commander and an IT Director, all over the world. He has also worked for the Joint Staff in Washington, DC as a branch chief.
These two gentlemen speak about leadership holistically - how to exhibit excellent leadership yourself, how to train for good leaderships, and how to foster it in others.…
playlist_add
25 Jan 2023
Are We Protecting People, Data, or Business? with Nipun Gupta
This week Allan is joined by Nipun Gupta, and industry veteran who has been a consultant, practitioner, vendor, advisor and investor.
The topic is "What are we really protecting in cyber?" and the nuances of that question are explored in depth - as well as the interrelationships.
Is "protect the business" a guardrail statement while "protect data and people" is the mission?
How do we tie protecting people to protecting the business? For the people? For the business?
How do we map data to the business mission?
How far do we go to protect data?
What about this new DevOps, application-centric world?
Enjoy this conversation! It's a lively one.
playlist_add
18 Jan 2023
Influences from Outside of Cybersecurity with Peter Schawacker
This week, Allan is joined by Peter Schawacker, CEO @ Nearshore Cyber, former CISO, advisor to MSPs, etc. Another one of Allan's illustrious guests with 25 years in cyber. (https://www.linkedin.com/in/schawacker/). The topic started as all that the two have learned outside of cybersecurity that has helped them in cyber. But it gets way more esoteric than that, and quickly. Detailed show notes and links are provided below because this show is all over the place!
02:11 Point MOOt, Texas: MOO-based virtual city with virtual economy, virtual stock market, various political models of governance and high preponderance of highly interactive bots used for practical and administrative purposes. http://linguafranca.mirror.theinfo.org/9405/moo.html https://archive.nytimes.com/www.nytimes.com/books/first/l/leonard-bots.html
04:49 A fast tour of the the age of the universe, Planet Earth, and humans' presence on the planet, industrial revolution and the Internet
05:45 The Annex BBS in LA https://…
playlist_add
11 Jan 2023
Managing Careers with Luis Valenzuela
This episode is jam-packed with wisdom that is delivered at a rapid pace. Some folks will find themselves rewinding and taking notes. Luis Valenzuela, Director of Data Loss Prevention and Data Governance at InComm Payments, joins Allan Alford to talk about managing careers - how to manage your own, and, for leaders, how to help your team manage theirs. Topics include:
- Pivotal career transitions
- Is a plan _really_ required?
- Principles, foundations, and successful behaviors
- Practical steps and resources
- Is the power of envisioning enough?
- Tactical and other tips
Y'all enjoy this one, now!
playlist_add
4 Jan 2023
100th Episode Call-In Special with 21 Guests!
To celebrate the 100th episode, Allan decided to let the audience participate in the show. 21 people called in and answered a wide variety of questions about cybersecurity. It is a fantastic show and it is very fun to hear all the different perspectives from folks who have just about every role in cybersecurity you can imagine:
00:00:58 - Brent Deterding - What can practioners do to show more love to vendors? 00:03:07 - Evgeniy Kharam - How important are soft skills in cybersecurity? 00:03:54 - Evgeniy Kharam - What are we doing wrong in cybersecurity? 00:05:17 - Andy Ellis - what are we doing right and what are we doing wrong? 00:07:15 - Nipun Gupta - What needs to happen to get cybersecurity practitioners to trust cybersecurity vendors? 00:10:29 - Brent Forest - What is the value of mentorship in cybersecurity? 00:13:48 - Heather Noggle - How do you get small organizations to take cybersecurity more seriously? 00:17:34 - Karla Reffold - What piece of advice would you give somone try…
playlist_add
14 Dec 2022
Can We Even Measure Risk? with Andy Ellis and Chris Roberts - EXPLICIT
This is another "'E' for explicit" show as this one is another LIVE! show from the CISO XC conference in Dallas-Fort Worth. Why the 'E'? Because halfway through Allan Alford's conversation with Andy Ellis (CISO at Orca, Operating Partner at YL Ventures, former CISO at Akamai), Chris Roberts (CISO at Boom Supersonic) joins the stage with some fine whisky and his own clever takes on measuring risk.
Join Allan, Andy, and Chris as they deconstruct risk, extolling its virtues, and hopefully change the way you think about risk altogether. Is likelihood times impact valid? Is the 5x5 grid valid? What is plausibility vs. probability? Find out on this great LIVE! episode!
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/…
playlist_add
7 Dec 2022
Is It Even Our Job to Make Them Care About Cybersecurity? with Yaron Levi
In this episode, Allan Alford plays Devil's advocate - challenging the practitioner community to refute the idea that we should quit trying to make the organization care and simply make suggestions and accept the organization's level of risk tolerance.
Allan posted this topic on LinkedIn and it created quite a buzz. The show features quotes from Simon Goldsmith, Kevin Pope, Malcolm Harkins, and others.
Listen to hear a deconstruction of this position, and hear some great arguments both for and against it. We'll give away the ending - the argument is ultimately refuted - but it is a great thought exercise and a wonderful journey getting to that conclusion. Hint: The show's ending is more apt than ever: "Ya'll be good now!"
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the…
playlist_add
30 Nov 2022
Building Cybersecurity Community with Scott Schindler
Scott Schindler, veteran CISO, vCISO, and adjunct professor joins Allan at the ranch to talk about how to build, strengthen, participate in, contribute to and benefit from a cybersecurity community. Allan chose Scott for this show because of his incredible community focus and the high level of participation and engagement he demonstrates in his own career.
How can we, as privacy and security professionals, overcome our paranoia in order to build community?
How do we, as new members of cybersecurity, break into the community?
How do I start a local community?
How do we welcome others?
What is wrong with the cybersecurity community today that we need to fix?
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hac…
playlist_add
16 Nov 2022
Geopolitics, APTs and Cybersecurity with Dan Holden
Dan Holden, a 20+ year industry veteran, former vendor, and current CISO at Big Commerce joins Allan Alford at the ranch to talk about the BIG picture. Join them on this wild trail ride that goes as far back as the Monroe Doctrine of 1823, the pre-cursors to WWI, Regan-era cyber doctrine, cyber and modern warfare, lessons learned from the COVID economy (hint: GDP is now part of critical infrastructure), famous APT heists, modern global imperialism... This show ties these threads together into a forward-looking vision for cybersecurity that includes shifts in global prioritization of cybersecurity, federal regulations, and changes to the VC investment landscape. Saddle up and get ready for a wild ride!
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control c…
playlist_add
9 Nov 2022
3 Very Practical Tips with Duane Gran
This week Allan Alford is joined by Duane Gran, Director of Information Security at Converge Technology Solutions to discuss three different aspects of the CISO craft -- and to offer practical, concrete guidance on how to achieve the right outcomes:
* Eliminating the culture of "No!"
* Managing Third-Party Risk
* Building a "No Blame" Culture
The common thread behind all of these themes is relationship building and goodwill - but the details are well worth the listen!
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
playlist_add
2 Nov 2022
Should the CISO...? with Andy Bennett
In this week's show, Allan and his guest Andy Bennett (a very clever CISO with a heck of a pedigree) decide to tackle some thought exercises with a series of questions that all start with "Should the CISO...?"
* Should the CISO be the one to decide whether to report breaches?
* Should the CISO own the SOC?
* Should the CISO report to the CIO?
* Should the CISO have an MBA?
* Should the CISO be mentoring individual contributors in their team?
* Should the CISO be sharing the political realities of “upstairs”?
* Should the CISO own Identity?
Enjoy this fantastic conversation that goes to a lot of surprising places!
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
playlist_add
26 Oct 2022
Tired Topics in Cybersecurity - Part Two with Michael Santarcangelo and Rich Mason
Once again, Allan, Rich, and Michael dissect topics in our community that are, well, tired. Topics are brought up to spur online debate, but for which a conclusion is never reached. Topics that bifurcate our community without moving our industry forward. Topics that cause us to overly rotate on the wrong areas.
In this show we address:
Defining terms: zero trust, ML, AI, hacker vs. cracker, cybersecurity vs information security
How to pronounce "CISO"
Work from home vs coming to the office
Do we deserve a seat at the table or is it earned?
Hopefully, these three are stepping beyond the tired answers to these topics and are raising the bar on how we should approach the information security profession. You be the judge...
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams th…
playlist_add
19 Oct 2022
Tired Topics in Cybersecurity - Part One with Rich Mason and Michael Santarcangelo
We have all seen the conversations on LinkedIn where someone starts with a hotly debated topic, and the debate goes on and on, nothing is concluded, and then the next week, someone else posts the same topic and starts the gerbil wheel spinning again. We have seen this phenomenon with common complaints too. These are, in short, tired conversations.
Join Allan Alford, Rich Mason, and Michael Santarcangelo as they rope in some of these tired topics and propose alternative ways of looking at them.
This one runs a bit longer than usual because the conversation is that good. Also, there are a few naughty words...
In this Part One episode they offer some alternative takes on the following tired topics:
* Who should the CISO report to?
* Users as the weakest link
* Talent Shortage
* CISO Burnout
* Imposter Syndrome
* Awards Marketing
* Bad Vendor Behavior
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset…
playlist_add
12 Oct 2022
One Tool to Rule Them All with Derly Gutierrez
CISOs and other security executives have relied on spreadsheets to perform a great deal of the management functions of their programs. What if there was a better way? Derly Gutierrez is back on the ranch for a third time now to discuss his alternative - the humble ticketing system. It might seem obvious in some cases, but Derly has pushed the use cases far beyond what you might imagine. Topics Derly and Allan cover include:
* Risk Management Lifecycle
* Vendor Management Lifecycle
* Personnel Onboarding/Offboarding (Joiners, Movers, Leavers)
* Data Governance Lifecycle
* SOC2 Audits
* Internal Audits
* UI Considerations
* Organizational Familiarity with the Tool
* Automation & Integration
In this short but sweet episode, a lot of very practical tips are addressed. Y'all be good now!
Links:
Thank you to our sponsor Axonius for bringing this episode to life! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory…
playlist_add
5 Oct 2022
Cybersecurity Myths & Misconceptions with Josiah Dykstra
Josiah Dykstra, Cybersecurity Technical Fellow at the NSA and Author, kicks up the dust off some previous topics discussed on the Ranch and deepens the conversation on cybersecurity myths and behavioral economics. Prior to the release of his latest book, Cybersecurity Myths and Misconceptions, Josiah breaks down some biases, fallacies, myths, and magical thinking that cybersecurity practitioners fall victim to. Josiah taps into cyber’s psyche and exposes the errors behind practitioners playing make-believe.
Timecoded Guide:
[00:00] Researching cybersecurity psychology & other exciting industry mashups
[09:22] Security logical fallacies: straw man, gambler’s, & ad hominem
[15:19] Cyber cognitive biases: confirmation, omission, and zero risk bias
[19:24] Perverse incentives & cobra effect: security vendors, bug bounties, & cyber insurance
[25:55] Creating an accurate measure of how secure we really are
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode…
playlist_add
28 Sept 2022
Entrepreneurship After the Golden Handcuffs with Christian Espinosa
Christian Espinosa, Author, Speaker, and CEO, comes down to the Ranch to talk about the journey of starting, growing, selling, and moving on from the business he created, Alpine Security. From correcting the problems with his high IQ staff to unshackling himself from the golden handcuffs of a business sale, Christian breaks down the specific conflicts he faced on his entrepreneurial journey— and reveals how these experiences have inspired two books about cybersecurity, business ownership, and life itself.
Timecoded Guide:
[00:00] Finding business coherency in the one-page strategic plan
[08:39] Selling Alpine security & transitioning from leader to participant
[13:46] Escaping the golden handcuffs & embarking on a new career journey
[17:35] Outlining seven steps to emotional intelligence in cyber with his first book
[20:34] Embarking on appreciation of life’s little moments with book number two
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to lif…
playlist_add
21 Sept 2022
How APIs Expose Business Logic Flaws with Chuck Herrin
Chuck Herrin, CTO at Wib, came down to the Ranch to explain the risks and threats currently facing APIs, or application programming interfaces. Simply put, APIs facilitate people and applications in communicating with other applications, but Chuck sees the lack of protocols, regulations, and security plans laid out for these APIs as a massive security threat. Breaking down the process using an API hack he performed as an example, Chuck talks about what the state of API security is and where it needs to be headed.
Timecoded Guide:
[00:00] Bringing a background in finance into the cybersecurity API world
[05:25] "Hacking" a bank’s API using business logic instead of hacking
[12:17] Implementing standard API protocols and processes
[14:27] Flipping the API language and preparing injection threats
[19:03] Evolving defenses overtime to meet both new needs and new risks
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just d…
playlist_add
14 Sept 2022
What Is (And Isn’t) a CISO with Matthew Lang
Matthew Lang, former CISO at SECU, former CISO of 3D Systems, and former Chief Petty Officer in the US Navy, comes on down to the Ranch to talk about what it really means to be a CISO. Many folks wear the title of CISO, but the role itself is still often considered a confusing mixed bag when talking about what it entails and who should have this role. Matthew walks through what a CISO is, what a CISO isn’t, and where the bridges between the CISO role and other roles in the company should be.
Timecoded Guide:
[00:00] Defining what a CISO isn’t in order to discover what a CISO is
[06:45] Finding the bridges between CISO & other company roles
[12:12] Getting things clear between CISO, COO, CIO, and CEO
[16:20] Understanding a CISO’s peers & meeting with security points of contact
[24:49] What the CISO role should be & solidifying the CISO definition
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it…
playlist_add
7 Sept 2022
Fighting the Increase in Cyber Attacks with Leon Ravenna
Leon Ravenna, CISO & CIO at KAR Global, former VP of Security & Compliance at Interactive Intelligence joins Allan this week to talk about the increases in cybersecurity threats and risks - increases in breadth and depth of various attacks and increases in our own problems in dealing with those attacks. It has implications for all of us, as we have not necessarily seen an increase in the right defensive capabilities to maintain parity. COVID and work-from-home have not helped either...
Questions covered this show:
1. You mentioned firewall attacks, social engineering, HR/interview/job fraud. Of course there is ransomware. What else is on the rise?
2. How much has COVID and work-from-home impacted the landscape?
3. What are the vendors doing wrong about this landscape?
4. What are they doing right?
5. So what are the real solutions to these problems? Let’s break it down, starting with ransomware, my personal favorite.
-Firewall attacks
-HR/Interview/Job Fraud
-Phishing
-…
playlist_add
31 Aug 2022
Understanding SEC’s Proposal for Cyber Risk Management with Yaron Levi
Yaron Levi, current CISO at Dolby and former CISO at Blue Cross Blue Shield in Kansas City, comes down to the Ranch to talk about the March 2022 proposal from Securities and Exchange Commission (SEC). Titled the Cybersecurity Risk Management Strategy: Governance and Incident Disclosure, this report has huge implications for cybersecurity in any publicly-traded company. Yaron walks through his research into this report and explains what this means in the future for real-world cyber practitioners.
Timecoded Guide:
[00:00] Introducing the Cybersecurity Risk Management Strategy: Governance and Incident Disclosure
[08:45] Explaining filing 8-Ks and 4-day turnaround disclosures
[14:03] Debating the obligations of a third party in an incident (i.e. supply chain)
[16:04] Comparing SEC’s cyber proposal to accounting’s GAAPs
[25:33] Involving the Board of Directors in cyber risk management
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asse…
playlist_add
24 Aug 2022
Ask CISO Allan Alford Anything pt. 2
Allan Alford, CISO/CTO and host of the Cyber Ranch podcast, resumes his session of AMA, or “ask me anything,” to cover the remaining questions left by curious cybersecurity practitioners on his LinkedIn. Previously, Allan posed two questions: If you could ask a 5-time CISO any question, what would it be? How about a cybersecurity startup CTO? Using the responses he received, Allan continues to walk through every topic under the cybersecurity umbrella and give further insight into what it means to be a CISO.
Timecoded Guide:
[00:00] Avoiding FUD (fear, uncertainty, and doubt) in your next cyber risk discussion
[06:10] Facing stressful ransomware situations without proper preparation
[12:11] Hiring hackers as team members & debating the ethics of black hat hackers
[21:20] Addressing cyber risk in an accessible way for your organization's board
[26:41] Understanding the past, present, & future of cybersecurity insurance
Sponsor Links:
Thank you to our sponsor Axonius for bring…
playlist_add
17 Aug 2022
Ask CISO Allan Alford Anything
Allan Alford, CISO/CTO and host of the Cyber Ranch podcast, changes things up this week with a session of AMA, or “ask me anything”. Instead of hosting a guest, Allan takes center stage. On LinkedIn, Allan posed two questions: If you could ask a 5-time CISO any question, what would it be? How about a cybersecurity startup CTO? Using the responses he received, he walks through every topic under the cybersecurity umbrella and gives further insight into what it means to be a CISO.
Timecoded Guide:
[00:00] Seeing the best of the job in the often thankless role of CISO
[06:04] Building teams through learning strengths vs the negative perception of employee poaching
[09:50] Starting out in IT & transitioning to CISO through consistent skill-building
[15:18] Learning from past CISO mistakes & embracing business first, risk second, cyber third
[27:23] Understanding the industry with a technical CISO point of view & a hacker’s mindset
[38:06] Managing the many highs and lows of bec…
playlist_add
10 Aug 2022
When a CISO Writes a Book with George Finney & Robert Pace
Cybersecurity practitioners give back to the community by recording Youtube videos, interviewing in magazines, or creating podcasts— just like this one. However, books remain a fantastic method of delivering info and impacting lives that shouldn’t be forgotten with the rise of social media. Allan tallied it up and thus far, nine of his friends have written books. He has been approached about writing one himself, and he wanted to get the inside track on the process. George Finney, CISO at SMU, and Robert Pace, CISO at Invitation Homes, explain the ups and downs of writing books from a cyber perspective. This interview with George and Robert was recorded LIVE! at the CISO XC 2022 conference.
Timecoded Guide:
[00:00] Introducing the cybersecurity and the personal books George and Robert write
[08:28] Overcoming writing challenges in order to help others with your book
[15:16] Understanding the monetary gains and losses of book writing
[23:59] Being purposeful, intentional, and us…
playlist_add
3 Aug 2022
Doing More by Doing Less with Drew Simonis
Drew Simonis, CISO at Juniper Networks, discusses the debate of doing more by doing less. So often in cybersecurity, practitioners think they have to do it all and view themselves as the smartest people in the room. The fact of the matter is that none of us are the smartest in the room and we have to learn to trust each other. Drew believes a collaborative, trusting environment will bring us to a place of doing less and seeing better results because of it.
Timecoded Guide:
[00:00] Introducing the foundations of Drew’s “do more by doing less” mindset
[07:03] Doing more by doing less, specifically in tech stack and GRC teams
[15:00] Revamping the cybersecurity and IT vendor ecosystem
[20:43] Understanding consumer and CISO impact on the cyber vendor market
[32:34] Reshaping the command and control security mindset
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! Manual asset inventory just doesn't cut it anymore. That's where Axonious comes…
playlist_add
27 Jul 2022
Getting Back to the Basics with Sonja Hammond
Sonja Hammond, Vice President & CISO at National Veterinary Associates, brings her love of animals and more importantly her love for security basics down to the Ranch this week. The buzz around new cyber technology and security protocols can easily warp our perspective on what’s most important for CISOs. Sonja spends some time in this episode explaining why cybersecurity organizations instead need to focus on simple tech and strong security processes and training protocols.
Timecoded Guide:
[00:00] Breaking down basics of people, process, and technology
[06:59] Where tech stack is failing us and how to keep the vendor community on hold
[10:31] Building a good GRC team with a focus on NIST CSF
[14:13] Training the right way for GRC and cyber professionals
[19:30] Understanding the end user and setting your cyber team up for success
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life! Manual asset inventory just doesn't cut it anymore. That's where…
playlist_add
20 Jul 2022
Debunking Cyber Myths with Adrian Sanabria
Adrian Sanabria, Director of Product Management at Tenchi Security, arrives at the Ranch this week to debunk cyber myths and expose industry lies. Using his background running Security Weekly Labs at Cyber Risk Alliance, Adrian explains the lack of cohesive product testing happening in the cyber world, and delves into the research he’s done to get to the bottom of cyber’s most elusive statistics. Do 60% of small businesses go out of business after a breach? Adrian has an answer that just might surprise you.
Timecoded Guide:
[00:00] Introducing Adrian and his journey with Cyber Risk Alliance
[06:47] Buying awards and lying about customers
[13:24] Finding the source of fake cyber statistics
[24:28] The lies of vulnerability management and security awareness training
[30:58] Explaining Adrian’s It’s Time to Kill the Pen Test talk
[40:41] Creating a money-making concept for debunking cyber myths
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to l…
playlist_add
13 Jul 2022
Privacy Professionals & Regulatory Headaches with Adam Stone
Adam Stone, Chief Privacy Officer at TrustMAPP, brings his decades of security and privacy knowledge to the Ranch this week to talk about the disciplines of security and privacy. Where do they intersect? What makes security professionals and privacy professionals different? And, maybe most important of all: How can these two disciplines work together within an organization without being perceived as useless regulatory headaches?
Timecoded Guide:
[00:00] Comparing and contrasting security and privacy responsibilities
[08:30] Privacy, GRC, and building trust with stakeholders
[15:28] Coordinated and cooperative efforts of security and privacy teams
[20:57] Security awareness training vs the lack of awareness of privacy
[27:26] Drawing the line with privacy laws for security professionals
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security co…
playlist_add
6 Jul 2022
The Overrated in Cybersecurity with Jerry Perullo
Jerry Perullo, former CISO of the NYSE, former chairman of the board off the FS-ISAC, founder, professor, and host of the Life After CISO podcast, comes down to the Cyber Ranch to discuss the many roles he’s had throughout his career and the many highly unique opinions he has on the cyber industry. Together, Jerry and Allan break down what’s overrated in cybersecurity, from patching to dark web to vulnerability departments, and every detail and concept in between.
Timecoded Guide:
[01:53] Taking on a variety of roles in the cyber industry and breaking down which elements of cybersecurity are overrated
[08:48] Recognizing when encryption is needed and when it is overrated or overemphasized as something you need in cybersecurity
[15:43] Service-level agreement timelines, addressing critical risks, and engaging with the 80/20 rule
[24:17] Understanding when to separate data about different vulnerabilities and attacks, and when to report on them in the same conversation (i.e. boar…
playlist_add
29 Jun 2022
Better User Awareness Training with Tim Silverline
Tim Silverline, VP of Security at Gluware, joins host Allan Alford on the Ranch this week for a discussion about user awareness training and the latest and greatest (as well as not the greatest) methods around phishing simulations. Tim and Allan get into the nitty gritty of how your company can improve user awareness results through avoiding basic click-through models, considering advanced warning for certain training exercises, and understanding risk quantification when evaluating employee metrics.
Timecoded Guide:
[04:30] Running the right phishing simulation for your user base and gauging your results appropriately
[10:08] Pushing boundaries in the tactics used in phishing exercises and making employees pay attention more closely to their everyday emails
[15:10] Calling out unlikely and unhelpful phishing strategies and simulations, including the harm of impersonating employees without any warning
[21:04] Realizing which methods of user awareness are no longer effective and shi…
playlist_add
22 Jun 2022
The Founder-Angel Investor Connection with Sameer Sait & John Stewart
Allan invites a founder and an angel investor to the ranch this week to talk about how founders and angel investors really connect. Meet Sameer Sait, former CISO at Amazon Whole Foods and now founder of BalkanID, and John Stewart, former CISO at Cisco and investor at Talons Ventures. Together, these gentlemen offer a lot about both sides of the investment story, from evaluation to the decision to work together, and what a mutually beneficial founder and angel investor relationship looks like.
Timecoded Guide:
[01:23] Exploring John and Sameer’s backgrounds in cyber and how they developed their own unique founder-angel investor connection
[04:53] Understanding the triggering aspects that caused someone like John to become an angel investor in BalkanID and how BalkanID selected their investors
[08:20] Delving into the uniqueness of different founder-investor relationships and how John (vs other BalkanID investors) makes his impact on Sameer’s work as a founder
[13:30] Giving exp…
playlist_add
15 Jun 2022
Open Door Security w/ James Allan-McLean
“When people come to Security and tell you everything they are doing, that’s a real win.” - James Allan-McLean
Allan is joined by James Allan-McLean, Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military, to talk about his ‘Open Door Security’ method and the benefits of transparent, no-strings-attached approach to security. In this episode, Allan and James take a deep dive into this methodology and address questions such as:
-What is Open Door Security?
-What does a successful Open Door Security program look like?
-How to go about tackling security implications within your org
-The philosophy behind James’ ‘handrail’ metaphor
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her…
playlist_add
8 Jun 2022
DevSecOps w/ Chris Hughes
Allan is joined by Chris Hughes, CISO & Co-founder at Aquia and adjunct professor at UMGC, to talk about all things DevSecOps (Development, Security and Operations). They explore the DevSecOps phrase itself, as well as why security should be treated as an integral component and not a separate entity. In this episode, Allan and Chris take a deep dive into the subject and bring clarity to questions, such as:
-What roles help achieve security in DevOps?
-What are the cultural barriers to implementing secure DevOps?
-What are some common mistakes as well as best tips?
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone
Guest Bio:
Chris Hughes is a proven Cloud/Cybersecurity leader with nearly 20 years of experience in b…
playlist_add
1 Jun 2022
Board Reporting Metrics Pt. 2 w/ Andy Ellis
Andy Ellis, CISO at Orca Security, is back for part 2 of this series on Board Reporting Metrics. In Episode 1, Andy and host Allan Alford addressed some of the most common questions posed by the board and shared their perspective on what the board needs to know from a cybersecurity standpoint. In this episode, they continue the conversation by fielding questions from LinkedIn on topics such as:
-Vulnerability and threat hunting metrics
-Top 3 metrics to report to the board and why
-Breach reporting implications and much more!
Check out part 1 of Board Reporting Metrics here
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone
Guest Bio:
Andy Ellis is a visionary technology and business executive with deep expertis…
playlist_add
25 May 2022
Board Reporting Metrics Pt. 1 w/ Andy Ellis
In this episode, Allan is joined by the CISO at Orca Security, Andy Ellis, to share his thoughts on board reporting metrics. What does the board need to know from a cybersecurity perspective? One of the questions is often: “Are we secure?” Is that even the right question? How much should you talk about compliance? Do you speak of IT assets? What about speaking to specific controls? Listen to this episode to hear the common questions posed by the board and how to answer them with metrics. In some cases, it is teaching them to ask different questions. This episode is a master class in board communication in cybersecurity, and the conversation went into such depth that a Part 2 is already being planned.
Check out Andy’s previous episode here
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more a…
playlist_add
18 May 2022
Getting a Seat at “The Table” w/ Brent Deterding
“Having a seat at the table doesn’t mean getting your way all the time. It means having a seat and I think that is very important to understand.” - Brent Deterding
In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CISOs can earn and keep their seat at the executive table. Brent was a fan of the Learned Helplessness episode of The Cyber Ranch Podcast with Steve Mancini, and furthered the conversation as it relates to the often espoused topic of CISOs needing a seat at “the table.” Brent discusses the power of shifting your mindset, how lack of confidence has created a cycle of self sabotaging, and ways we can collectively improve our current standing.
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her vid…
playlist_add
11 May 2022
All About SBOMs w/ Chris Castaldo
“Knowing what’s in your software, in your organization, can help you quickly determine if you are impacted by a new vulnerability.” - Chris Castaldo
In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software Bills of Materials (SBOMs) and their potential implications and use. Chris explains the concept and purpose of SBOMs, his tips for signing and securing SBOMs in terms of the CI/CD pipeline, and his thoughts on SBOMs being a roadmap for “bad guys.” Lastly, he shares advice on managing and understanding contracts.
Listen to Chris Castado’s previous Cyber Ranch episode here and be sure to grab a copy of his book!
Guest Bio:
Chris Castaldo is the author of “Start-up Secure: Baking Cybersecurity into your Company from Founding to Exit”. He is an experienced and industry recognized CISO with over 20 years of experience in cybersecurity. Chris is an expert in building cybersecurity programs from the ground up and specializes…
playlist_add
4 May 2022
Total Greenfield Innovation w/ Guillaume Ross
What would you do if you could build your security program from scratch?
In this episode, Allan is joined by the Head of Security at Fleet, Guillaume Ross, to talk about his time building out an innovative and out-of-the-box security program and the steps he took to make it all happen. Guillaume walks us through how he developed and maintained a serverless, container based environment, his tips for securing PCs and Macs within a serverless environment, and how to establish department and business buy-in and overall cooperation. Lastly, he details steps to ensure resilience in an ‘everything as code’ security model.
Some of what he builds might seem obvious – other parts will genuinely surprise you!
Guest Bio:
Guillaume Ross is the Head of Security at Fleet Device Management. He likes securing organizations, clouds, products and more, by refusing to implement the same things that have been tried and failed thousands of times already.
Links:
Sponsored by our good friends at…
playlist_add
27 Apr 2022
Securing Cryptocurrency and NFTs w/ Nick Percoco
What are the security implications of cryptocurrency and NFTs and what do we need to know in order to transact safely? In this episode, Allan is joined by the Chief Security Officer at Kraken, Nick Percoco, to talk about securing the cryptocurrency and NFT spaces. Allan and Nick reflect on the events of the Mt. Gox bitcoin breach of 2013, address some of the most common misconceptions about crypto assets, and explore the biggest security challenges users and retail investors face when navigating the space. Lastly, Nick considers what cybersecurity lessons can be drawn from the security practices within the cryptocurrency ecosystem.
Guest Bio:
Nicholas Percoco has more than 25 years of security & technology experience, and is the Chief Security Officer at Kraken - a global digital asset exchange - where he is responsible for Security, IT, Technical Project Management, Operational Resiliency and Engineering.
Links:
Stay in touch with Nick Percoco on LinkedIn
Follow Allan Alford on L…
playlist_add
20 Apr 2022
”Playing Well With Others” - The Tech Stack w/ Tommy Todd
Allan is joined by the Vice President of Security at Code42, Tommy Todd, to talk about how the tech stack can “play well with others”. In this episode, Tommy takes a deep dive into exploring how APIs and automation can help solve our needs in cybersecurity – from incident response to the tech stack. The two discuss how to evaluate security products during a Proof Of Concept (POC) for integration capabilities and tips on addressing ROI concerns.
Guest Bio:
Tommy Todd has over 20 years of cybersecurity experience, primarily focused on data privacy and data protection strategies. Prior to Code42, he served in security roles at Symantec, Ionic Security, and Optiv as well as many other firms. Throughout his career, he has acted as a leader, mentor, engineer, architect, and consultant to solve difficult data protection challenges.
Links:
Stay in touch with Tommy Todd on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valle…
playlist_add
13 Apr 2022
Thriving In A Male Dominated Industry w/ Ashley Rose
Allan is joined by the founder and CEO of Living Security, Ashley Rose, to speak about her experiences as a female entrepreneur and leader in a male dominated industry. She details the story behind her non-traditional route into cybersecurity and how she leverages her unique skills and vision to disrupt and transform the community. Ashley shares how she overcomes bias and business challenges in the field as well as the inspiration behind her creative marketing strategies. Lastly, the two highlight the lack of diversity and representation in the space and give advice to young entrepreneurs and females in, and breaking into, cybersecurity.
Guest Bio:
As the CEO of Living Security, Ashley has been the driving force behind the company’s rapid growth. Since its founding in 2017, Living Security has raised more than $20 million for growth and product development and accelerated revenue growth for three consecutive years. Ashley is also continually working to build a diverse and inclusive…
playlist_add
6 Apr 2022
Why CISOs and CIOs Don’t Get Along w/ Nick Vigier
This episode of the Cyber Ranch Podcast was recorded LIVE on stage at the CISO 360 Conference in New York City, hosted by Pulse Conferences. Nick Vigier, a seasoned CISO and former CIO, joins Allan in addressing the elephant in the room: Why don’t CISOs and CIOs don’t get along?
Nick draws on his experience in both positions to share his unique perspective on the CISO and CIO relationship. In this episode, Allan and Nick highlight the operating differences between the two positions and explore the opposing interests that exist around topics such as budgets and reporting structure. Lastly, Nick shares why engaging in empathetic conversations around metrics, business impact, and risk management is the ultimate key to a more harmonious relationship.
Guest Bio:
Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rathe…
playlist_add
30 Mar 2022
Learned Helplessness in Cybersecurity w/ Steve Mancini
This topic couldn’t be more relevant given recent events in the security community. Allan Alford is joined by Steve Mancini, CISO at Eclypsium, to have a refreshing conversation about the negative messaging, thinking, and tropes in cybersecurity - not just the stuff that the press says about us, or even the stuff we say about each other - but the self-defeating stuff we think and say to ourselves.
Steve addresses the reinforcement of negative catchphrases and how it affects the psyche of the community and explores how burnout is creating a culture of sleepless nights and masochistic badges of honor. Lastly, they emphasize the importance of empathy and support within the community and remind us that humans are our greatest asset, not our weakest links.
Guest Bio:
Steve Mancini is the CISO at Eclypsium, former Deputy CISO at Cylance, and an advisory board member for several cyber companies.
Links:
Stay in touch with Steve Mancini on LinkedIn
Follow Allan Alford on LinkedIn and Tw…
playlist_add
23 Mar 2022
Leveraging Employee Strengths for Cyber Roles w/ Nick Vigier
There are numerous personality tests available to help identify personality traits, but many of them have very little scientific validity or reliability. Such tests often aspire to explain what you are good at and what you are bad at, and miss the mark. In this episode, Allan is joined by his friend and owner of Rising Tide Security, Nick Vigier, to explore CliftonStrengths – a personality measurement that focuses less on ability, and more upon your predilections - what energizes you, and what and drains you - and with a pretty good degree of scientific validity and reliability. Nick and Allan explore what makes CliftonStrengths different from the other personality assessments and how Nick leverages that information to better understand his team and colleagues, and to help folks find the right role in cybersecurity. The two sit down to dissect Allan’s own assessment results to identify his top 5 energizers, as well as his top energy drainers. And lastly, Nick shares why he favors t…
playlist_add
16 Mar 2022
A Full Data Approach w/ Paola Saibene
In the episode, Allan is joined by the Principal at Teknion Data Solutions, Paola Saibene, to bring clarity to an often misunderstood topic: data governance. Paola helps to distinguish the difference between data governance and data management, examines the intersection between data ethics and cybersecurity, and explores the best methodology for applying risk frameworks. Lastly, she takes time to express the importance of being people focused and “humanizing” cybersecurity.
Guest Bio:
Paola Saibene is the Principal at Teknion Data Solutions, Former CISO, CEO, VP of Enterprise Risk Management, Data Privacy Officer, Strategy Officer, CTO, and CIO.
Links:
Stay in touch with Paola Saibene on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
9 Mar 2022
The Great Resignation & Cybersecurity w/ Jessie Bolton
With a looming skills/people gap in cybersecurity and retention at an all time low, it begs the question: Where is everyone? In this episode, Allan Alford and guest Jessie Bolton sit down to discuss the elusive “Great Resignation” and how it is affecting the cybersecurity community. Tune in to get the answers to the questions we are all asking ourselves, like: why are people resigning, how has the pandemic shifted our perspectives on work and boundary setting, how is the “great resignation” impacting security organizations, and how can we attempt to solve this issue?
Links:
Follow Jessie Bolton on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
2 Mar 2022
How Old is Data Risk Management? w/ G. Mark Hardy
In this episode, Allan is joined by the President at National Security Corporation, Navy veteran, and host of the CISO Tradecraft podcast, G. Mark Hardy. This show takes a fascinating dive into the origins of data risk management, measurement, and quantification. G Mark explores the stories and advice given from some of the greatest leaders in this space – whose advice still rings true today.
Key Takeaways:
01:52 G Mark’s bio
06:43 FIPS-65 - the “grandaddy” of risk management
11:34 The ALE method, explained!
14:35 Oldies, but STILL goodies
18:12 A stroll down risk management memory lane
28:56 Revering “the greats”
37:22 What do you value and what’s your currency?
Links:
Stay in touch with G. Mark Hardy on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
23 Feb 2022
CISOs as Caretakers w/ Randy Potts
In this episode of The Cyber Ranch Podcast, Allan is joined by the CISO at Real Time Resolutions, Randy Potts. The two sit down to have a refreshing and raw conversation about the caretaking, responsibility, and code of ethics for CISOs - or lack thereof, and how to get back in touch with our “why” and mission.
Disclaimer: This episode briefly mentions pornography and gambling within an important and relevant context, and has therefore been categorized as explicit.
Key Takeaways:
01:43 Randy’s bio
03:08 Caring for “the people”
09:08 Stewards and custodians of data
14:10 Servant leadership
16:57 CISOs as caretakers
18:53 Doing the right thing
21:18 CISO code of conduct - or lack thereof
24:55 How do we fix this?
29:06 It’s nice to be nice
Links:
Stay in touch with Randy Potts on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcas…
playlist_add
16 Feb 2022
Cyber Mentoring w/ David Belanger
In this episode, Allan is joined by David Belanger, CISO at Maxor National Pharmacy, to talk about the challenges of breaking into cybersecurity. David discusses the importance of establishing mentor/mentee relationships in the community, why building a personal brand and expanding your network is a must when finding work, and tips for newcomers looking to break into the field. Lastly, the two touch on the power of visualization and staying humble throughout your career journey.
Key Takeaways:
01:27 Bio & CISO life
02:57 Let’s define Mentor/Mentee
04:21 What makes cybersecurity mentorship unique?
07:10 Developing a long & short-term strategy
13:16 Mentors are essential
18:05 Formal vs. organic mentorships
22:10 Get out of your comfort zone
25:55 Advice for newcomers
30:15 Visualizing your success
32:00 Staying humble
Links:
Stay in touch with David Belanger on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Vall…
playlist_add
9 Feb 2022
Rationalizing the Tech Stack w/ Mark Butler
In this episode, Allan invites Mark Butler, an Advisory CISO at TRACE3, to talk about tech stack rationalization and how to get the most out of your technology investment. Mark shares advice on everything from how to properly analyze, identify, and consolidate your tools, both in the stack and cloud environment, to coaching your application specialists on embracing change.
Key Takeaways
01:10 Bio
02:36 What is tech stack rationalization?
03:46 Where to get started
06:20 Evaluation - a 3 prong approach
08:08 The security architecture alignment
10:51 What about contractual obligations?
13:18 The “best of breed” strategy
17:37 Rationalizing the cloud
21:00 Data analysis - tooling, extraction, metrics
25:24 The 3rd party tool conundrum
27:50 The future of cloud rationalization
29:40 How to resolve tech overlap?
32:19 Embracing change
34:37 Mark’s advice on emotional intelligence
Stay in touch with Mark Butler on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
P…
playlist_add
2 Feb 2022
Penetration Testing Programs LIVE w/ Phillip Wylie
In this episode, Allan is joined LIVE on stage at FutureCon Dallas 2022 by U.S Bank Senior Cloud Penetration Tester, co-author of The Pen Tester Blueprint, podcast host, and college instructor, Phillip Wylie. Phillip journeys into his past to share how he went from pro wrestler to pentester, gives writing advice to future authors in the field, explores the art of pentesting, and the best starter certifications for pentesters. Lastly, Phillip explores the best advice he’s ever received and the dangers of burnout.
Key takeaways:
01:27 Phillip's origin story - wrestling men and bears
03:04 The Pwn School Project
04:47 The Hacker Factory Podcast
06:55 Always a way to cyber
10:18 An opportunity to write
14:08 The Art of Pentesting
17:19 Getting square on terminology
24:42 The limitless child
27:25 The skinny on certs
30:23 Mentors
35:06 Back in the pentesting lab
37:14 When does threat modeling factor?
43:50 Coloring in purple
Follow Phillip Wylie on LinkedIn and Twitter
F…
playlist_add
25 Jan 2022
What We’re Doing Wrong in the SOC w/ Yaron Levi
Allan is joined by Yaron Levi, CISO at Dolby, to talk about the SOC and why we are going about it all wrong. Allan and Yaron identify and examine the three main areas of concern: the data, the analyst, the analysis – and how to improve upon them. Lastly, Yaron shares his thoughts on what steps and approaches need to be taken in order to successfully accomplish the SOC’s goal.
Key Takeaways:
01:35 Bio
02:36 What are we doing wrong in the SOC?
06:54 Hypothesizing
11:22 How much gets left out when we make a hypothesis?
13:42 Anti-fragility & business outcomes
16:30 Business objective + threat model example
21:09 Lead with the why/ downstream applications
27:06 What outside influence has helped you inside cyber?
Learn more about Yaron on Twitter and LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
19 Jan 2022
Cybersecurity Centers of Excellence w/ Rafal Los
Allan is joined by Rafal Los, industry innovator, strategist, and personality. His career spans 20+ years while working inside companies from the Fortune 10 to a firm of less than 10. Additionally, Rafal is a founder and host of the Down the Security Rabbithole Podcast - an industry podcast delivering a weekly take on cybersecurity since 2011. Join Allan and Rafal as they discuss cyber security centers of excellence, metrics, marketing and acceptance in this conversation between two friends.
Key Takeaways:
01:56 Bio
04:27 Goals for Cybersecurity Center of Excellence (CoE)
06:44 How do you birth a Cybersecurity CoE?
09:45 Selling your service
15:18 Cost - who pays in the end and how?
17:10 Getting management on board
24:22 It’s not all about cost – but it is.
26:37 Metrics
31:05 Quality metrics
34:33 Your mess for less
38:02 What is something outside cyber that helps on the inside?
Links:
Follow Allan on LinkedIn and Twitter
Follow Rafal Los on LinkedIn and Twitter
C…
playlist_add
12 Jan 2022
Investing in Cybersecurity Startups w/ Kathy Wang
Join Allan as he discusses investing in cybersecurity startups with the perfect guest for the subject: Kathy Wang, CISO at Very Good Security, investor at Silicon Valley CISO Investments, investor at Firebolt Ventures, and former founder as well!
Allan and Kathy talk about investment goals, the process from start to finish, how to get started, the buy-in costs, returns, what to expect, partnering, etc.
Join them as they dive into this fascinating topic:
DISCLAIMER: NOBODY ON THIS SHOW IS A FINANCIAL ADVISOR OR PLANNER, AND NOTHING SAID ON THIS SHOW CONSTITUTES FINANCIAL ADVICE. OPINIONS EXPRESSED ON THIS SHOW ARE JUST THAT – OPINIONS – AND YOU SHOULD NOT USE THEM TO CONDUCT YOUR FINANCIAL AFFAIRS. CONSULT A LICENSED EXPERT INSTEAD OF US!
Key Takeaways:
02:14 Bio
02:54 Getting into cyber security investing
05:28 Spotting good investments
09:13 What’s the process?
15:15 Ranging investments | partnerships
22:35 29 no's and 1 yes – is that reality?
26:20 Seeking investme…
playlist_add
5 Jan 2022
50th Episode Special w/ Many Guests
In this special episode, Allan invites a few familiar voices back to the show, conducts a countdown of his Top 5 most popular shows, and reviews some of the most common guest responses. Lastly, Allan issues some important thank you's and shares a few comments and feedback from the listeners.
Highlights:
Top 3 guest answers to "What keeps you going in cybersecurity?"
Top 3 guest answers to "What surprises you the most in cybersecurity?"
Top 5 shows by download
Visits from:
Tim Rohrbaugh, CISO - Jet Blue
Chris Cochran & Ron Eddings - Hacker Valley Media
Drew Brown, who has held many security leadership roles and who is an avid user of the FAIR methodology of risk measurement
Richard Seiersen, former CISO, famed champion of measuring risk, and author of "The Metrics Manifesto: Confronting Security with Data"
Accidental CISO of Twitter fame
THANK YOU to all of our listeners, Hacker Valley Media, our fantastic guests, and to everyone who helped get us to 50 shows!!!
Links:
Foll…
playlist_add
22 Dec 2021
Minimum Viable Security w/ Chris Roberts & Cecil Pineda: EXPLICIT CONTENT
Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minimum Viable security, tactical frameworks, the challenges with large frameworks, and the challenges of competing frameworks.
This show was recorded after happy hour and the audience and participants both imbibed. It's a rowdy show and features some explicit content.
Key Takeaways:
0:00 Allan’s holiday greeting
0:39 Allan introduces the live show, guests and issues a disclaimer about naughty language
2:02 Chris Roberts on Minimum Viable Security
2:42 Cecil on his love/hate relationship with compliance and the need for weighting controls
4:25 Allan proposes “tactical frameworks”
5:38 Chris challenges the crowd on their asset management successes
7:43 Allan introduces “See it, manage it, secure it.” (Which he flagrantly st…
playlist_add
15 Dec 2021
Organizational Resilience w/ Marnie Wilking
In this episode, Allan is joined by Marnie Wilking, CISO at Wayfair. Marnie has directed Information Security and multi-discipline Risk Management Programs for more than 15 years -- providing a unique set of skills and experience to manage operational risks and improve risk management among diverse businesses. Join Allan and Marnie as they define organizational resilience, discuss its goals and enablers, and analyze the COVID pandemic through its lens.
Key Takeaways:
01:26 Bio
03:42 Organizational resilience
06:40 COVID benefits; business enabling?
09:47 Building hybrid work environments
11:11 Virtual offices and home fatigue
17:14 Bullets dodged in organizational resilience
20:51 Tabletop exercises
27:16 Office conflicts and mailing troubles
30:38 Communication in resilience
32:29 What surprises Marnie in cyber security?
Links:
Learn more about Marnie on LinkedIn and Crunchbase
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hac…
playlist_add
8 Dec 2021
The vCISO Life w/ Dan Doggendorf
Welcome to another live show of the Cyber Ranch! Allan is joined by Dan Doggendorf, a creative cybersecurity leader with a passion for simplicity, efficiency, accountability, common sense, and honesty. The duo discusses the ins and outs of being a VCISO, how one walks the path and what the industry can do to make this role better. This show was conducted at the Cybersecurity Conference 9 (CSC 9) conducted by the North Texas Chapter of ISSA. All proceeds from the event went directly to scholarships for the Collin College cybersecurity program.
Key Takeaways:
01:47 - Bio
02:33 - vCISO life
04:18 - The path to an independent contractor
07:46 - Should you specialize?
10:46 - Strategizing experience in cyber security
14:26 - Challenges of being a CISO & vCISO
19:04 - Staying connected as a vCISO
23:17 - Victories as a vCISO
27:06 - The bad times and mistakes made as a vCISO
29:52 - What should change for vCISOs?
30:51 - Advice for future vCISOs
34:09 - What surprises Dan in cyb…
playlist_add
1 Dec 2021
GRC: ”Now What?” w/ Security & Compliance Weekly
This week, Allan is joined by Frederick Lee aka “Flee”, Chief Security Officer and Head of IT at Gusto, Jeff Man, host of Security & Compliance Weekly, and notorious infosec curmudgeon, and by Kat Valentine, Security and Compliance Weekly co-host. A few weeks ago Allan appeared on their show to discuss “GRC: ‘What?’ and ‘So What?’. In that episode, found here, they take a deep dive into GRC in terms of understanding is purpose and value.
In this crossover episode, the group continues the conversation to talk about “GRC: ‘Now what?’ (The cultural impact and implementation, risk register, achieving actionable results and much more).
Join Allan and the Security & Compliance Weekly team as they dive into overcoming cultural barriers, a continued conversation on the order of priority (“RGC” vs. “GRC”, for example), and enlisting allies in the business.
Key Takeaways:
2:20 Implementing GRC culturally – Flee's take
4:13 Jeff’s take
6:16 Kat’s take
10:4…
playlist_add
24 Nov 2021
The CMO‘s Perspective w/ Nathan Burke and Julie O‘Brien
CISOs complain on social media about bad marketing – when they are targeted inappropriately, or with messages that don’t resonate, or with messages that outright lie. This week Allan Alford decides to hear from the other side, and invites his two favorite CMOs to the show. Julie O’Brien, CMO at AttackIQ, and Nathan Burke, CMO at Axonious, sit down with Allan to send a message to cyber security professionals about the vital role marketing plays in the industry, what is good marketing and bad marking, and how marketing affects all of our careers more than we know. Hear different perspective on topics like buzzwords, cold calls, and the difference between good and bad marketing practices. Backed up with proven experience, this episode is packed with useful info for all cyber practitioners and aspiring practitioners.
Key Takeaways:
02:00 Julie Bio
03:13 Nathan Bio
04:00 Standing out as a marketer
10:15 Emphasizing what you don’t do as a company, rather than what you do
15:56…
playlist_add
17 Nov 2021
Practical Working (And Hiring!) from Home w/ Brian Castagna
Brian Castagna (CISO at Seven Bridges - a genomics company) is a CISO with a proven track record of successfully building information security programs at cloud technology companies. He is on a mission to humanize the new work environment - our own home. Join Allan and Brian as they touch on transitioning from an office environment, both mentally and physically, hiring remotely, work/life balance and much more.
Key Takeaways:
01:33 Bio
02:22 Remote work
03:00 Hiring a remote workforce
10:50 What’s the human side of working from home?
17:38 Transitioning from work to home
19:54 Mental transitioning
21:00 Collaboration & strategy
24:30 Layering the human back in
27:19 What surprises you in cyber?
Learn more about Brian on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ
playlist_add
10 Nov 2021
Threat-Informed Defense, CISA, CVEs and ATT&CK w/ MITRE Engenuity
This week, Allan is joined by some serious heavy hitters in cyber. Richard Struse (Director for the Center for Threat-Informed Defense at MITRE Engenuity), Jonathan Baker (Director of Research & Development, Center for Threat-Informed Defense at MITRE Enginuity), and Jonathan Reiber (Sr. Director for Cybersecurity Strategy and Policy @ AttackIQ). The four are here to have a conversation about CISA's new BOD that outlines 290 key vulnerabilities that require focus, the coincidental mapping of the CVE database to MITRE ATT&ACK, and the implications for all of us. Of special note is the fact that ATT&CK is already mapped to NIST SP 800-53, meaning that we now have an opportunity to move bi-directionally from a threat-informed defense or to start with a framework and back into vulnerabilities. The implications for our industry are huge.
They also discuss briefly an overview of the bi-partisan work in both the Executive and Legislative branches to further cybersecurity interests and the re…
playlist_add
3 Nov 2021
A Day in the Life of Two CISOs w/ Mustapha Kebbeh
Mustapha Kebbeh, CISO at Brinks and heavy-hitter in the Dallas/Fort Worth Cyber community, joins Allan again this week as they cover a topic Mustapha noted was absent so far in the series… Namely, “What is a day in the life of a CISO?” Mustapha and Allan get into details of what they do and don’t do, what their teams do and don’t do, what bits are boring, what bits are surprising, and what bits are the most fun. Join them as they talk about real situations and practical solutions while describing the very best and worst parts of the job.
Key Takeaways:
01:41 Bio
03:00 A day in the life of a CISO - examples from the last 3 weeks
07:30 Being a CISO in a company that knows its risk appetite
11:49 Product Security
13:53 The most surprising part about being a CISO
15:33 The most boring part
22:30 The most fun part
26:08 What do you wish you could do as a CISO?
29:42 Mustapha shares what surprises him the most in cyber security
Links:
Learn more about Mustapha on Linked…
playlist_add
27 Oct 2021
Practical Trust-Centric Security w/ Omar Khawaja
Omar Khawaja is an experienced CISO with a strong technical background, who managed to find some very creative ways to manage his security program that go against his engineering instincts. Join Allan and Omar as they discuss why trust-based security is the more suitable option to have a fundamentally better security program and team. Hear why Omar and Allan believe that investing in people will pay far more dividends than the latest tech tool. And more importantly, gain some very practical and concrete tips for managing and measuring your security program.
Key Takeaways:
01:19 Bio
03:26 What is wrong with tech-centric security?
06:00 Using tech tools as nothing more, and using them appropriately
12:22 Trust, then risk, then control
14:30 Customer first, always
19:02 Helping foster a trust-centric culture
28:40 Culture = mindset = best measurable quality
29:33 What surprises Omar in cyber security?
32:50 The “change agent network”
Links:
Learn more about Omar on Twitter…
playlist_add
20 Oct 2021
CISO in the Supply Chain w/ Emilio Escobar
Allan is joined this week by Emilio Escobar, CISO at Data Dog and former VP of Information Security at Hulu. He is also a long-term developer of Ettercap, a comprehensive suite for man-in-the-middle attacks.
Like many of us, Emilio started his journey in infosec as a hacker kid, exploring the world through modems and BBSs. Emilio is not a security vendor CISO, but is a CISO for a company that is in the supply chain for many other companies. He has to balance internal and external duties as a result.
Come listen as Allan and Emilio discuss the B2B CISO life, the skills required, business alignment, facing customers, and how all of these skills just might define "the modern CISO".
And, yes, they even tackle the age-old question, "How technical should a CISO be?"
Key Takeaways:
01:27 Bio
03:10 Security questionnaires and interactions
05:49 Is there a fix to solving vendor risk?
07:17 Utilizing machines for questionnaires
09:33 Leveraging skills
12:50 How technical should a CISO…
playlist_add
14 Oct 2021
Is Resilience Even the Goal? Antifragility w/ Sounil Yu
Allan is joined by Sounil Yu, one of cybersecurity's most well-known contributors. Sounil has a long history in cybersecurity, and is also the inventor of The Cyber Defense Matrix and the DIE Triad.
Sounil and Allan discuss cyber resilience and contrast it with "antifragility", a notion introduced by Nassim Nicholas Taleb. Sounil argues that in cybersecurity, antifragility should be the goal, and not resilience.
Antifragility allows for stronger data protection, as it does not just survive stresses and attacks, but actually encourages them. Sounil explains how antifragility also neatly dovetails with his DIE (Distributed, Immutable, Ephermeral) Triad of data protection, which he contrasts with the CIA (Confidentiality, Intregrity, Avaiability) Triad in the context of the "pets vs. cattle" model.
Join Allan as he learns a great deal in a short amount of time from Sounil...
Key Takeaways:
01:23 Bio
02:20 Cyber Defense Matrix
03:10 Is cyber resilience the wrong idea?
04:17 Backups…
playlist_add
7 Oct 2021
Is the SOC Dead? w/ Erik Bloch
Allan's guest this week is Erik Bloch. Erik Bloch is a cyber security leader, influencer, and pioneer. He currently sits as Senior Director of Detection and Response at Sprinklr, but has held many rolls in cybersecurity, including being a product manager for SIEM products more than once. This last point is relevant, because it makes it even more surprising that Erik is convinced that the SOC's utility has passed... Join Allan and Erik as they dive deep into why he thinks SOC is failing, the alternatives, what it takes to make an impactful change in incident response, and who to aim it towards. This conversation began when Allan read Erik's article on LinkedIn, “RIP SOC. Hello D-IR". Key Takeaways: 01:16 Bio 02:18 Erik’s article: why is SOC failing? 05:01 What is the alternative? 07:29 Implementing fundamentals where it counts 10:15 Cloud Integration 17:45 Cloud agnostic tooling solution 23:27 The inevitability of a one-stop solution 27:20 Targeting the right audience 28:17 What sur…
playlist_add
29 Sept 2021
The Value of Threat Intelligence w/ Samara Williams
Allan's guest is Samara Williams, Manager of Threat Operations at Cardinal Health, speaker, advocate and passionate member of the threat intelligence community.
Samara broke into cyber via a rotational program, sampling many cyber jobs at many cyber companies in a short order - a fantastic start in cyber that turbocharged her maturity and experience. She quickly developed a passion for threat intelligence, and has worked in that space ever since.
Join Samara and Allan for a deep dive into threat intel, its pros and cons, its value, and its potential...
Key Takeaways:
01:28 Bio
02:56 The love/hate relationship with threat intel: yay or nay?
06:07 The steps to threat intel – breaking it dow
15:14 How threat intel can help bridge tactical & operational Practices
19:57 Having a successful SOC program
22:18 Managing the unknown and practicing the fundamentals
26:17 Making a case for prioritizing threat intel
27:55 What surprises Samara in cyber security?
Links:
Learn more ab…
playlist_add
22 Sept 2021
Practical Realities of Ransomware Management w/ Bryan Hurd
This week, Allan is joined by Bryan Hurd. Bryan is a multi-talented cyber security professional who has founded and operated programs dating back to the early nineties. Currently Chief of Office for Stroz Friedberg (AON Cyber), he started his career in NCIS, founding the Navy’s first ever cyber counterintelligence program in 1993.
Join Bryan and Allan for a masterclass on ransomware, incident response, and preparedness. Having both consulted on ransomware situations many times, they offer a wealth of practical tips, do’s, don’ts, and gotchas. You can also hear their perspectives on the roles and processes in taking appropriate action when crisis hits.
This is a longer than usual episode, but that is because it is filled with practical advice based on a great deal of experience.
Key Takeaways:
01:20Bio
02:58Is ransomware still the #1 threat to an organization?
07:30Having your incident response team ready and prepared
12:16The roles, processes, and fundamentals of inciden…
playlist_add
15 Sept 2021
WHY We Measure Risk w/ Sameer Sait
In this episode Allan interviews his friend Sameer Sait, former CISO at Amazon, Forcepoint and Arrow Electronics, who joins Allan for a discussion about WHY we measure risk.
It is about more than just asking for money. (And who are you actually asking money from? Hint: It is not the Board).
How does risk measurement change in the beginning of the CISO’s journey vs. later when the program is more mature?
What is the goal of good risk metrics? What is the role of cyber insurance in all this? What about business traction and cooperation with other department’s goals and objectives?
And finally, how does measuring risk affect disposition or risk?
Key Takeaways:
01:20 Sammer's bio
02:30 Asking for money - it's not from the Board
05:58 Measuring risk: inside-out vs. outside-in
11:20 Approaching management with an objective, not a story
12:38 Working with your team, as a team
14:12 The effects of measuring risk
18:36Analyzing the priorities and their consequences
24:36 Good…
playlist_add
8 Sept 2021
What Comes After the CISO Role? w/ Helen Patton
Host Allan Alford interviews his friend Helen Patton, advisory CISO at Cisco, and former CISO at Ohio State University. Helen and Allan discuss the career path of the CISO – specifically what comes after the CISO role has been fulfilled - and how there is not a clear path defined for the post-CISO career.
Allan and Helen discuss several models for post-CISO life that they themselves have explored, and that other CISO friends have as well, such as: shifting back and forth from CISO to vendor, shifting back and forth between CISO and advisory CISO roles at VC’s and other entities, becoming CIOs or CTOs, etc.
Helen explains how there is no clearly defined path for a post-CISO life, how no mentors are available to aid with that transition, but also how CISOs can decide to simply change their roles as a CISO. She explains a little bit more about her advisory CISO life and the internal and emotional differences between it and a conventional practitioner CISO role.
Key Takeaways:
0:26…
playlist_add
1 Sept 2021
Humans Are Not the Weakest Link in Cybersecurity w/ George Finney
Allan is joined by George Finney, CSO at Southern Methodist University and author of the book Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future.
George’s mission is clear: unite the cybersecurity community through proven strategy, and help preserve and leverage the humanity within cybersecurity.
He believes that the community as a whole under-plays the human role, and he and Allan discuss potential changes to the way we view security awareness training and the role of users in general.
Key Takeaways:
00:18 Intro/Bio
01:25 George’s story
04:27 Humans are not the weakest link in cybersecurity
07:17 How habits affect security awareness
08:30 The 9 habits and forming your cybersecurity personality
14:05 How secret keepers build a community
17:30 Potential improvements to security awareness training
22:22 The origin of the nine habits
26:50 What surprises George about cybersecurity still?
Links:
Learn more about George on LinkedIn and on Twitter…
playlist_add
25 Aug 2021
Does SOAR Meet Its Promises? w/ Benjamin Corll
Host Allan Alford interviews Benjamin Corll, VP of Cybersecurity and Privacy at Coats, about security orchestration, automation, and response (SOAR).
Bejamin and Allan critique SOAR's promises and premises, what else it could be doing, its pricing and overhead, and lack of standards as well.
But it is not all negative - Benjamin does share stories as well of SOAR's successes in his shop, and of the things it does do well...
Come on down the ranch and give this show a listen!
Key Takeaways:
0:09 – Intro
0:55 – Benjamin's background and day job
3:46 – The premise and the promises of SOAR
6:32 – What else could be automated?
9:25 – Benjamin explains about the trouble ticket system and the change management system
11:57 – The standards for SOAR today
17:19 – How do we improve the cyber posture of all our organizations, making them more secure?
19:34 – Has SOAR managed to stay affordable for those who need it?
22:54 – What SOAR does well, the benefits and the…
playlist_add
18 Aug 2021
The Modern CISO w/ James Azar
Host Allan Alford interviews guest James Azar, host of the CyberHub CISO Talk Podcast, and CISO in the financial services space. James and Allan discuss the techniques and approaches of the modern CISO, and contrast this with some of the older approaches of the job. James defines the cultural shift between the old and new as having taken place since September, 2017 (the Equifax breach).
James and Allan discuss the impact on the team, business, clients, customers, and shares their thoughts and experience on how to stay modern. “What keeps you going in cybersecurity?” as the signature final question for each guest has been replaced with “What surprises you the most in cybersecurity?” James is the first guest to answer that question, and his answer is a bit of surprise itself…
Key Takeaways:
0:16 – Intro
1:04 – Bio
2:00 – The modern CISO contrasted with the older CISO
4:46 – What does the modern CISO mean to the team, business, clients and customers?
7:10 – H…
playlist_add
11 Aug 2021
Frameworks Over Time w/ Derly Gutierrez, Mustapha Kebbeh and Patrick Benoit
In this, the very first LIVE episode, Allan Alford interviews guests Derly Gutierrez, Head of Information Security at 1010Data, Patrick Benoit, BISO at CBRE, and Mustapha Kebbeh, CISO at Brinks, as they discuss the use of security frameworks in general and over time.
Regarding framework compliance, do we choose one or do we choose many? Do we embrace them fully or partially? What changes our approach to frameworks over time?
Security strategies are explained throughout the episode, along with the notions of business adaptation and adoption, regulation and other requirements, and "minimum viable security" approaches that don't require frameworks at all.
Key Takeaways:
0:43 – Intro
1:53 – Question to Mustapha: pick and choose from a framework or embrace a framework all in one go?
2:47 – Patrick discusses his own approach to Mustapha’s statement
3:26 – The evolution of CFS adoption briefly discussed and the importance of protection
6:59 – Discussion of a possible "leas…
playlist_add
4 Aug 2021
Burnout, Toxicity, and Overcoming Obstacles w/ Marilise de Villiers
On this episode, Allan invites Marilise de Villiers, Founder and CEO at ROAR! Coaching & Consulting, to come on down to the ranch and discuss how to deal with toxic situations, how to overcome obstacles in the workplace, how to avoid burnout, and how to spot our own negative behaviors that interfere with our success.
Marilise and Allan cover toxic workplaces and bosses, share personal stories, and discuss the internal mechanisms which allow external toxicity to harm us, as well as the internal behaviors to prevent that.
They discuss obstacles, and how big obstacles should be embraced. They also talk about "exercising the resilience muscle".
This is a fantastic show with some open and vulnerable moments, as well as with some very practical advice for avoiding burnout and dealing with problems most of us have faced or will face in our information security careers.
Key Takeaways:
1:11 How Marilise got into information security
2:29 About her coaching and consulting practice for inf…
playlist_add
28 Jul 2021
Migrating from Monolithic to Cloud w/ Greg Rogers
In this episode, Allan interviews Greg Rogers, CISO at Legal & General America, about migrating legacy, monolithic, internally facing, manually tested, waterfall applications to Cloud, CI/CD with automation, customer-facing applications, all with modern development languages and environments.
Greg migrated just about everything legacy to just about everything modern across a series of monolithic applications. In this episode he gives tips on the technical aspects of his journey, tools and techniqes for overcoming cultural barriers as well.
Greg outlines what he did in-house, and what he leveraged from out-of-house - from code to services.
Ultimately, Greg was able to pull of this transition piece by piece, and he shares how he was able to do it.
Lastly, Greg closes with what keeps him going in cybersecurity...
Key Takeaways:
1:19 How Greg got into cyber
4:12 An overview of the challenge
6:39 Greg's biggest security challenges with the project, both cultural and techincal
8:06…
playlist_add
21 Jul 2021
Credential Stuffing w/ Dr. Sam Small
In this episode, Allan's friend Dr. Sam Small, CISO of Zero Fox, joins us to chat about credential stuffing, its implications and the defenses against it.
Several statistics are given from a few industry reports on credential stuffing, including the Verizon DBIR and F5's report.
Several techniques to foil credential stuffing are explored, as well as common traps when combatting credential stuffing. OWASP provides some guidance in this area.
The criminal's abilities vis a vis breach sharing and botnet as a service are discussed as well.
Finally, Sam explains what keeps him going in cybersecurity...
Key Takeaways:
1:08 Sam's background and education in cyber
2:41 Sam defines credential stuffing and explains why we should care about it
4:17 The origins of the term 'credential stuffing' vs. its history
4:39 Is ransomware the end goal of every single kind of cyber attack?
5:22 Botnets as a service to drive credential stuffing attacks
6:33 Allan cites statistics from the Verizon…
playlist_add
14 Jul 2021
”Ugly Exits” w/ Naomi Buckwalter
On today’s episode with Allan, we talk “Ugly Exits” with Naomi Buckwalter, Director of Information Security. Of course, to start the episode, Naomi answers Allan’s question of how she got started in cyber.
They circle back to the topic at hand, “Ugly Exits”. Under this umbrella are: being fired, laid off, "burning bridges", or being encouraged to leave in a "voluntary" manner. Allan shares statistics for some of these categories, including a substantial statistic on those who have been outright fired.
When it comes to burning bridges, so many people walk away from a company that is behaving in an unethical manner and putting their employees in unethical situations. To Naomi, this is a frightening common thread. It’s scary how many unethical employers are out there.
Naomi shared a personal story of her ugly exit, and the fact that it was deserved to some extent. She has owned that experience, has learned from it, and has grown as a result.
Allan shares his persona…
playlist_add
7 Jul 2021
Agile for Security Programs w/ Tim Rohrbaugh
On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.
Tim got into cyber through the military. From the military he went into consulting and ended up at JetBlue. At JetBlue that he is always trying to find ways to invest dollars in security programs to balance what is going on. Along with that, he strives to keep his team motivated and moving forward.
Agile is a software programming methodology, and it replaced Waterfall. Waterfall was the traditional model of development, where large chunks of code had to flow from developers to QA, back to developers several times, and finally to release.
Agile, on the other hand, works off user-centric stories, which roll up to bigger stories called epics. Stories are small, discrete goals, met with smaller, discrete chunks of code released in what are called 'sprints'. QA is very rapid as well, leading to rapid release. Agile i…
playlist_add
30 Jun 2021
All About Analysts w/ Christina Richmond
With us today is Christina Richmond program Vice President at IDC. She's an industry analyst, and she's here to talk to us all about the analyst lifestyle.
Allan starts the episode asking Christina to share all about how she got into cyber and what her day job is like. Christina actually began by working in the storage space, and discovered security. To her it was like a drug. What does she do throughout her days? Partakes in hundreds and hundreds of calls with companies who need help with launches and marketing, specifically in growing areas of cybersecurity. In essence, there is a lot to being an analyst. But to be successful, you have to be curious!
The best way to put Christina’s job in words, is “learning the whole from the parts.” She talks with individual players, studies market trends, and then circles around again to piece it together. One big feedback loop.
On a side note, Christina would like everyone to know she is looking to hire at the director level! If you know…
playlist_add
23 Jun 2021
The Journey to Passwordless Authentication w/ Derly Gutierrez
With us today is Derly Gutierrez, Head of Security at 1010 Data, and veteran. Derly is here with us today to talk about the journey to passwordless authentication and the flaws and strenghts of today's authentication methoods.
Allan and Derly refer to studies and surveys about the problems with passwords and the challenges of implementing passwordless approaches.
Derly emphasizes the need for other complementary technologies such as Role-Based Access Control (RBAC), Privileged Access Management (PAM), and system-to-system communications.
The two discuss corporate and personal use of passwordless solutions, talk about legal precedence and the future of passwordless approaches.
Key Takeaways
1:14 How Derly got into cyber
1:58 About Derly's day job as Head of Security
2:34 Allan quotes the 2017 Verizon DBIR on how many breaches involve weak or stolen passwords
3:35 Allan cites NIST 800-63b
4:15 Derly talks about CAC cards in the US DoD
4:50 Derly sides with vendor innovations o…
playlist_add
16 Jun 2021
Application Security w/ Taylor Lehmann
With us today is Taylor Lehmann, former ciso several times over in the healthcare sector, and currently Americas leader for security, networking, identity, and compliance solution architecture at AWS.
Taylor and Allan talk about application security: why it's important, who are the personas, the value of threat modeling, infrastructure as code, how to get started, and relationships with developers.
Taylor, a Boston boy, starts the show trying to say, "Howdy!" correctly. Taylor started at PWC and grew into a healthcare CISO. He has now transitioned to AWS.
Key Takeaways
1:40 How Taylor got into Cyber
2:58 Taylor’s day job
4:30 Appsec Defined
5:49 Taylor's favorite appsec frameworks
7:48 Why appsec is important
8:55 The personas and roles
11:22 Security training in appsec
12:27 Threat modeling
15:11 Infrastructure as code
20:46 How to get started in appsec
24:12 Devs already know and care about security
25:38 Where does the trope come from that devs don't care?
26:52…
playlist_add
9 Jun 2021
Solving The Global Cyber Problem w/ Ian Thorton-Trump
With us today is Ian Thornton-Trump, Chief Information Security Officer at Cyjax and an ITIL-certified IT professional with 25 years of experience in IT security and information technology.
Ian shares his background which started back in the Canadian military. During those times, "IT" was called "automated data processing", and it is quite clear how far this has advanced. He joined the Royal Canadian Mounted Police and spent a year working on criminal intelligence. Soon after he became a consultant and made his way to the UK in 2015.
Oftentimes organizations have not planned or prepared for risk, and that includes cyber. In that sense, cyber can be compared to the environmental landscapes and infrastructure, which Ian finds eerily similar. A lot of problems created in cyber mimic a lot of the environment problems we face in today’s world. One example is the recent failure of the Texas power grid during a very harsh winter. Investment in cybersecurity is critical.
Allan feel…
playlist_add
2 Jun 2021
FAIR from the Trenches w/ Drew Brown
With us today is Drew Brown, IT Security Manager at the Commonwealth of Pennsylvania. Drew is here to talk about FAIR and his real-world usage of it and testing it in the trenches.
Drew shares a little bit about his background in cyber, and a little bit about his day job. He spent 15 years in IT. That opened the door then for him to be the CISO for one of the state agencies. Now his title is IT Security Manager but essentially he is responsible for communicating security and risks and working within a law enforcment agency to make sure that what is implemented is secure, it's compliant, and it meets all of the agency objectives.
With FAIR, you start by asking some very basic questions: What is the asset? What is the thing of value that you're trying to protect? Once you understand what that is, you then ask who is going to come after that asset: cyber criminals, nation state, some kind of industrial espionage, hacktivist, or whatever. Or maybe it's Doris in accounting. Either way, yo…
playlist_add
26 May 2021
Clever Hiring Practices w/ Andy Ellis
With us today is Andy Ellis, operating partner at YL Ventures, former Akamai CSO and newly inducted member of the CSO Hall of Fame. We're here to talk about nonstandard hiring practices and how Andy has built an amazing team using nonstandard approaches.
Andy began his career in cyber ("I remember back then, you know, we didn't call it cyber, but I think we've all given up and, and that's now the name for our career field.") as an Air Force ROTC cadet, spent 20 years at Akamai, and joined an advisor program at YL Ventures.
Andy found a solution that addresses hiring needs and the talent shortage, while also building a very clever and very innovative team.
For new roles, look and see if you have somebody who's almost senior that you can promote to do that job. And backfill the almost senior person instead. Try not to hire senior people, try to hire the most junior person you can get away with and promote everybody up the chain. The real trick is to figure out how your HR and finance…
playlist_add
19 May 2021
Measuring Risk w/ Richard Seiersen
Today we talk with Richard Seiersen, co-author of “How to Measure Anything in Cybersecurity Risk”.
Richard shared that at his first CISO position, he was challenged with addressing prioritization of risk, which led to his authoring a book with Doug Hubbard.
What can cyber learn from older risk disciplines? The life table used broadly to measure time-to-event data goes back 500 years.
Businesses keep falling back to the classic 5x5 "likelihood and impact" matrix which is an inconsistent, non-math-based method.
Without math it is really just casting spells in the board room. There are no ratios or explanation of differences, for example.
CISOs are called upon to make a bet about something. We will use subject matter expert opinions, and can make them measurably better. Consistency is key.
Wild guesses can still help constrain the forecast. There are existing models in cyber such as FAIR that provide a more mathematically applied approach.
Statistics came about because people n…
playlist_add
12 May 2021
Becoming a CISO w/ Accidental CISO
With us today, is a very special guest, Accidental CISO, of Twitter fame. His anonymity on Twitter, allows him to be a little more “truthy” about the CISO game than a lot of us can afford to be on social media. We have distorted his voice a bit to protect that anonymity.
“Accidental” shares how he got into cyber, and that is a culmination of being in a career where he had to fill “all” the hats. He stepped away from his CISO role a few years ago and is now in consulting where he has the opportunity to help other people realize they need to build security programs when they have never done it or know how.
How did he become the “Accidental CISO”? Simply by trying to help during the course of going through an audit. They had to identify who was the CISO, and he made the mistake of asking who the security officer was for the company. The answer was, “That’s you.”
Accidental CISO doesn’t think becoming a CISO accidentally is all that uncommon. When going thr…
playlist_add
5 May 2021
Breach & Attack Simulation w/ Marlys Rodgers
Today we talk with Marlys Rodgers, who has been in cyber for over 20 years. She currently is CISO for CSAA Insurance Group and is running security for the company as well as running governance risk and compliance for technology. She shares that it feels like she is constantly balancing assessing with preventing.
Allan brings up breach and attack simulation (BAS), and when it is most appropriate to implement in the context of the maturity of a security program. Marlys feels BAS is most effective when some, or most, of the intended controls are in place so you can focus on areas you need to strengthen. For her company, she was glad they did it earlier rather than later. They had a pretty good lead time to get systems to integrate.
The way you use BAS, especially along with threat intelligence, is really important. If you don’t have a purple team, or a red and blue team how does one start or how do you reorganize? Hear how Marlys did just that. Tag-teaming works best!
How has…
playlist_add
28 Apr 2021
Enterprise Security Architecture: A $110b Case Study w/ John Petrie
With us today is John Petrie, Counselor to the NTT Global CISO. He is responsible for managing the growing internal security challenges for the NTT operating companies across the globe.
Retired in 1996 from the Marines John began his career in multiple security positions. He shares that his major responsibility of today is creating the enterprise security architecture (“ESA”) for NTT.
Allan used to work for NTT DATA Services, and shares that John is working for the ultimate parent company of the NTT global conglomerate – a full 3 companies of inheritance between John’s company and Allan’s former company. John shares just how big NTT really is throughout 180 countries. Altogether there are 986 companies worldwide, generating over $110 billion in revenue each year. NTT is #62 on the Global Fortune 500.
John shares the full gamut of what an enterprise security architecture really is, how important it is and what it does. There are nine principles to building his ESA, and…
playlist_add
26 Apr 2021
Programs for Women & Veterans in Cyber w/ WiCyS - SPECIAL EDITION
With us today are Lynn Dohm, Executive Director of Women in Cybersecurty (WiCyS) and Martha Laughman, Veterans Iniative Lead at WiCyS and Director of Workforce Development at Smoothstack. Lynn and Martha are here to talk about the amazing programs for women and women veterans at WiCyS.
WiCyS is so much more than a conference for women in cybersecurity. Its presence spans the globe and its programs are myriad. Mentorship, student scholarships, training, special interest groups, job boards, veterans' assistance, and apprenticeships are all available.
Smoothstack is a partner of WiCyS, and has created a program for women veteran apprenticeships designed to benefit all parties involved.
The program is based on attitude, aptitude and intitial assessments, but requires no cybersecurity knowledge at the start. Apprentices are paid, trained, and qualified when they come out, working for employers on a two-year contract at a minimum. The program addresses employers' fears over being the fi…
playlist_add
21 Apr 2021
Data Risk Governance w/ Patrick Benoit
Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas.
To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders.
Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging.
They discuss briefly various rules for dealing with older data and various me…
playlist_add
14 Apr 2021
Vishing, Smishing and STIR/SHAKEN w/ Mike Manrod
Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Mike Manrod, CISO at Grand Canyon Education. Mike has done quite a bit of research on vishing, smishing and the upcoming STIR/SHAKEN legislation meant to combat those two.
To start the conversation, Allan asks Mike to share a little about himself, his background in information security and what he does at his day job. Mike started as an IT technologist who orginally resented the security team for slowing down technology projects. Then a friend took him to a security conference, and the rest is history.
Mike explains what vishing and smishing are, contrasting them to traditional phishing. Mike and Allan discuss personally targeted vishing and smishing vs. attacks targeted at organizations.
Allan and Mike cover the new STIR/SHAKEN legislation and related RFCs, along with th…
playlist_add
7 Apr 2021
Maturing Purple Teaming w/ Gabe Lawrence
Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Gabe Lawerence, General Manager of Cyber Security Protection at Toyota Motor North America. Gabe has seen the good and bad of purple teaming, and we’re here today to discuss what a mature purple teaming organization looks like.
To start the conversation, Allan asks Gabe to share a little about himself, his background in information security and what he does at his day job. His path to security hasn’t been linear - he has been a developer, an entrepreneur and a startup owner, slowly making his way to different levels of management in the security space. Gabe runs Enterprise Security at Toyota North America and is responsible for the technical side of the business and manufacturing environment.
When discussing what successful purple teaming looks like, Gabe points to the…
playlist_add
31 Mar 2021
Interview with a Vendor w/ Dutch Schwartz
In this episode, host and CISO Allan Alford interviews his friend Dutch Schwartz, Principal Security Specialist at Amazon Web Services. Dutch is a vendor, but do not press 'stop' just yet! Dutch is an empathetic outsider, an observor, and a constant learner and researcher. He brings some unique insights to our practice.
Dutch talks about his encounters with CISOs and their direc staffs, and opines on the debate as to how technical a CISO should be (versus business-oriented).
Allan and Dutch discuss healthy vs. unhealthy (Dutch prefers the term 'challenging') security cultures.
Dutch talks about all security efforst aligning with business initiatives, and Allan espouses his theory that all CISO actions should ties to business initiatives, risk reduction, and maturity improvement.
Dutch remains enthused about cybersecurity because of conversations like this very interview.
Key Takeaways
1:32 - Dutch shares his cyber origin story - stumbling into cyber after a militiary career as an…
playlist_add
24 Mar 2021
Advancing Cybersecurity Careers w/ Christophe Foulon
In this episode, host and CISO Allan Alford interviews his friend Chris Foulon, Sr. Manager of Cybersecurity at a leading fintech compnay, and co-host of the "Breaking into Cybersecurity" podcast.
Chris has 15 years in information security, having started at the helpdesk years ago. His biggest desire in infosec is helping others. In his day job Chris gets to work with every part of the business.
On the subject of the personnel shortage in cybersecurity, Chris believes that there is no shortage. Rather, he suggests that hiring managers limit their choices by holding out for too high an experience level, and by neglecting diversity and inclusion.
His advice for those who are entering the profession is to combine experience, certifications and education as suited to themselves and the roles they are applying for. He suggests reserach and listening to podcasts like this one. Chris suggests finding a mentor has well.
Chris and Allan discuss diversity, inclusion and allyship at leng…
playlist_add
17 Mar 2021
Developing Leadership w/ Gary Hayslip
Today, host and CISO Allan Alford interviews friend and fellow CISO Gary Hayslip. Besides being a brilliant business leader, Gary is an author, mentor, and one of the best all-around humans Allan knows!
To start the conversation, Allan asks Gary to share about himself and his background in cybersecurity. While he had a natural interest in computers and technology more generally, Gary’s formal entrance to the cybersecurity field came during his time in the military. He developed a love for security, and as he’s climbed within the industry in the years after his military service, he’s also developed a strong network as a colleague and mentor. Allan tapped into this shared community through one of its most-used platforms, LinkedIn, to find out what others in the field would most like to learn from Gary.
The first questions deal with topics of leadership and training, and Gary explains his own practices of educating himself and his team. In his own life, he is committed to mai…
playlist_add
15 Mar 2021
The Post-COVID Reckoning w/ Dr. Rebecca Wynn - SPECIAL EDITION
In this show, host Allan Alford interviews Dr. Rebecca Wynn about information security decisions made during COVID and what the 2021 "reckoning" might look like. Dr. Wynn is a well-recognized CISO and Chief Privacy Officer, who faced some large-scale challenges during 2020. Allan welcomes Dr. Wynn to the cyber ranch!
The show starts with Allan asking Dr. Wynn to introduce herself and to tell the listeners a bit about her background. Dr. Wynn has received quite a lot of recognition in the field.
Allan and Rebecca Wynn share a wealth of connections in the CISO community, and both have consulted with numerous companies over 2020. This positions them to be able to talk to the broad spectrum of COVID-related actions and reactions taken during 2020.
Moving workers to home all over the world resulted in an increased attack surface and increased privacy concerns as well. Security quesionnaires were on the rise, as were deeper investigations into PCI, SOC2, etc. report. COVID, in other word…
playlist_add
10 Mar 2021
Business-Oriented Security w/ Chris Castaldo
In this show, host Allan Alford interviews his friend Chris Castaldo about how to align information security with the business. Chris is the CISO at Crossbeam, and is also the author of the book "Start-Up Secure: Baking Cybersecurity into Your Company from Founding to Exit", available for pre-order at Amazon. Chris, like Allan, views himself as a very business-oriented CISO. Allan welcomes Chris down to the ranch to discuss business orientation and alignment of information security in detail.
The show starts with Allan asking Chris to introduce himself and to tell the listeners a bit of his background. Chris's book fills the void in books for founders that seemed to utterly lack any reference to cybersecurity. Allan recommends the book, as he was one of the lucky few to review the book before its release.
But that is not what they are here to chat about today... Allan asks Chris what it means to be a business-oriented CISO - and what does it look like to NOT be a business-oriented CI…
playlist_add
3 Mar 2021
Supply Chain Security w/ Omkhar Arasaratnam
Today, host and CISO Allan Alford interviews Omkhar Arasaratnam, a veteran of the cybersecurity industry, on the topic of supply chain security. With a career in security going all the way back to 2004, and with experience working for IBM and several financial institutions before becoming an Engineering Director at Google, Omkhar brings much hard-earned insight to the table!
Looking to tap into that insight, Allan poses two questions for Omkhar. First, how would he characterize or define supply chain security and its implications? And second, how would he explain the SolarWinds breach and its fallout? Omkhar centers his thoughts on the SolarWinds situation, a costly breach in which hackers manipulated a code base and used it as a leverage point to gain access to high-worth targets. This attack required precision and focus, and is of the first public breaches; however, Allan and Omkhar imagine that there will be copycat attacks to come, and that the attack is a wake up call for al…
playlist_add
24 Feb 2021
Startups & VCs in InfoSec w/ Will Lin
In this show, host Allan Alford interviews his friend Will Lin about startups and venture capital. Will Lin is a venture capitalist with ForgePoint Capital, focusing exclusively on the information security space. First and foremost, Will views his current role as a way to help others. Allan welcomes Will on to the show to help his listeners learn more about the startup world, the venture capital world, and how those two intersect.
The show starts with Allan asking Will why he thinks startups are such a prevalent force in the cyber security world. Will is not sure, but his hypothesis is that this is in large part due to the ever-changing nature of cyber security. Since needs are constantly changing and each organization has unique needs, startups have popped up to address those specialties and change based on the different needs that arise. His second hypothesis is that there always need to be organizations prepared to address new and emerging threats to security.
For VCs, Will shares…
playlist_add
22 Feb 2021
Storytelling in InfoSec w/ Chris Cochran & Ron Eddings of Hacker Valley
On this episode of The Cyber Ranch Podcast, host Allan Alford is joined by Ron Eddings and Chris Cochran from Hacker Valley Studio. The episode begins with Ron and Chris sharing how they came to cyber security and the roles they’ve held in the space.
While they came up in the cyber security space through different channels, they now work together at Marqeta, Ron as a Security Architect Leader and Chris as the Director of Security Engineering. Additionally, together they host the Hacker Valley Podcast. Allan is curious how the podcast affects their day jobs and their day jobs influence the podcast. Ron and Chris explain that it has given them wider contacts with people in the security industry and the opportunity to speak with them about their interests and expertise.
Allan asks Ron and Chris how they stay passionate about their work. Chris says both he and Ron believe in getting better everyday, even if it’s in small increments. Reading books, taking classes, speaking to mentors…
playlist_add
10 Feb 2021
Vulnerability Management w/ Anne Marie Zettlemoyer
Allan Alford interviews Anne Marie Zettlemoyer about the topic of vulnerability management. Anne Marie is a visiting fellow with the National Security Institute at George Mason University, and one of the all-around sharpest minds Allan knows in information security!
Anne Marie is deeply entrenched in the world of information security, and she loves her work. She began her career in accounting and finance, but by serendipity was introduced to security through a position updating a company’s payment system. From there, she was recruited into the Secret Service, where she developed a passion for the information security field - a field she hasn’t left since! Anne Marie is driven by the energy and nobility of her profession, and she values work as a protector and defender. At the same time, she feels a high level of responsibility to her company and her customers to navigate information security well.
The baseline for security work, Anne Marie says, is the fundamentals. The fir…
playlist_add
3 Feb 2021
Behavioral Economics & InfoSec w/ Kelly Shortridge
Behavioral Economics has altered our perceptions of what actually motivates human beings. How do these theories about our more primitive behaviors as well as our intellectual biases apply to information security? Allan Alford & Kelly Shortridge discuss in the context of infosec programs and events in a whirlwind of conversation. Sponsored by our friends at AttackIQ
Podcast: The Cyber Ranch Podcast
Episode 2: Behavioral Economics and InfoSec with Kelly Shortridge
On this episode of The Cyber Ranch Podcast, host Allan Alford is joined by Kelly Shortridge, VP of Product Management at Capsule8. Their conversation begins with Kelly introducing herself and her work. She works in products for a security vendor, and she’s done research into applying behavioral economics to security. Kelly says she grew up with a love of computers, but was mostly about building gaming rigs side of things. Her career in information security began in the investment banking industry, which led her to fall in…
playlist_add
15 Jan 2021
1-Minute Introduction
A one minute introduction to the show and its format
playlist_add