The Cyber Ranch Podcast
Allan Alford
Subscribe
Ride the cyber trails with one CISO (Allan Alford) and a diverse group of friends and experts who bring a human perspective to cybersecurity.
Available episodes
Newest first
Oldest first
2 days ago
Getting a Seat at “The Table” w/ Brent Deterding
“Having a seat at the table doesn’t mean getting your way all the time. It means having a seat and I think that is very important to understand.” - Brent Deterding
In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CISOs can earn and keep their seat at the executive table. Brent was a fan of the Learned Helplessness episode of The Cyber Ranch Podcast with Steve Mancini, and furthered the conversation as it relates to the often espoused topic of CISOs needing a seat at “the table.” Brent discusses the power of shifting your mindset, how lack of confidence has created a cycle of self sabotaging, and ways we can collectively improve our current standing.
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone
Guest Bio:
Brent is an Executive CISO whose mission is to enable Afni and its global workforce to support their customers securely and confidently. Prior to being a CISO, for over 20 years, he was a security practitioner with a security vendor specializing in threat detection, incident response, and security strategy. His efforts helped hundreds of organizations detect, respond to, and mitigate attacks.
Additional Links:
Stay in touch with Brent Deterding on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Continue this conversation on our Discord
Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast
playlist_add
May 11, 2022
All About SBOMs w/ Chris Castaldo
“Knowing what’s in your software, in your organization, can help you quickly determine if you are impacted by a new vulnerability.” - Chris Castaldo
In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software Bills of Materials (SBOMs) and their potential implications and use. Chris explains the concept and purpose of SBOMs, his tips for signing and securing SBOMs in terms of the CI/CD pipeline, and his thoughts on SBOMs being a roadmap for “bad guys.” Lastly, he shares advice on managing and understanding contracts.
Listen to Chris Castado’s previous Cyber Ranch episode here and be sure to grab a copy of his book!
Guest Bio:
Chris Castaldo is the author of “Start-up Secure: Baking Cybersecurity into your Company from Founding to Exit”. He is an experienced and industry recognized CISO with over 20 years of experience in cybersecurity. Chris is an expert in building cybersecurity programs from the ground up and specializes in applying cybersecurity in start-ups from seed to exit. He is also a Visiting Fellow at the National Security Institute (NSI) at George Mason University's Antonin Scalia Law School.
Links:
Sponsored by our good friends at Axonius
Stay in touch with Chris Castaldo on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Continue this conversation on our Discord
Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast
playlist_add
May 4, 2022
Total Greenfield Innovation w/ Guillaume Ross
What would you do if you could build your security program from scratch?
In this episode, Allan is joined by the Head of Security at Fleet, Guillaume Ross, to talk about his time building out an innovative and out-of-the-box security program and the steps he took to make it all happen. Guillaume walks us through how he developed and maintained a serverless, container based environment, his tips for securing PCs and Macs within a serverless environment, and how to establish department and business buy-in and overall cooperation. Lastly, he details steps to ensure resilience in an ‘everything as code’ security model.
Some of what he builds might seem obvious – other parts will genuinely surprise you!
Guest Bio:
Guillaume Ross is the Head of Security at Fleet Device Management. He likes securing organizations, clouds, products and more, by refusing to implement the same things that have been tried and failed thousands of times already.
Links:
Sponsored by our good friends at Axonius
Stay in touch with Guillaume Ross on LinkedIn and Twitter
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Continue this conversation on our Discord
Listen to more from the Hacker Valley Studio and The Cyber Ranch Podcast
playlist_add
Apr 27, 2022
Securing Cryptocurrency and NFTs w/ Nick Percoco
What are the security implications of cryptocurrency and NFTs and what do we need to know in order to transact safely? In this episode, Allan is joined by the Chief Security Officer at Kraken, Nick Percoco, to talk about securing the cryptocurrency and NFT spaces. Allan and Nick reflect on the events of the Mt. Gox bitcoin breach of 2013, address some of the most common misconceptions about crypto assets, and explore the biggest security challenges users and retail investors face when navigating the space. Lastly, Nick considers what cybersecurity lessons can be drawn from the security practices within the cryptocurrency ecosystem.
Guest Bio:
Nicholas Percoco has more than 25 years of security & technology experience, and is the Chief Security Officer at Kraken - a global digital asset exchange - where he is responsible for Security, IT, Technical Project Management, Operational Resiliency and Engineering.
Links:
Stay in touch with Nick Percoco on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Apr 20, 2022
”Playing Well With Others” - The Tech Stack w/ Tommy Todd
Allan is joined by the Vice President of Security at Code42, Tommy Todd, to talk about how the tech stack can “play well with others”. In this episode, Tommy takes a deep dive into exploring how APIs and automation can help solve our needs in cybersecurity – from incident response to the tech stack. The two discuss how to evaluate security products during a Proof Of Concept (POC) for integration capabilities and tips on addressing ROI concerns.
Guest Bio:
Tommy Todd has over 20 years of cybersecurity experience, primarily focused on data privacy and data protection strategies. Prior to Code42, he served in security roles at Symantec, Ionic Security, and Optiv as well as many other firms. Throughout his career, he has acted as a leader, mentor, engineer, architect, and consultant to solve difficult data protection challenges.
Links:
Stay in touch with Tommy Todd on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Apr 13, 2022
Thriving In A Male Dominated Industry w/ Ashley Rose
Allan is joined by the founder and CEO of Living Security, Ashley Rose, to speak about her experiences as a female entrepreneur and leader in a male dominated industry. She details the story behind her non-traditional route into cybersecurity and how she leverages her unique skills and vision to disrupt and transform the community. Ashley shares how she overcomes bias and business challenges in the field as well as the inspiration behind her creative marketing strategies. Lastly, the two highlight the lack of diversity and representation in the space and give advice to young entrepreneurs and females in, and breaking into, cybersecurity.
Guest Bio:
As the CEO of Living Security, Ashley has been the driving force behind the company’s rapid growth. Since its founding in 2017, Living Security has raised more than $20 million for growth and product development and accelerated revenue growth for three consecutive years. Ashley is also continually working to build a diverse and inclusive organization around the belief that the team should reflect the community at large.
Links:
Stay in touch with Ashley Rose on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Apr 6, 2022
Why CISOs and CIOs Don’t Get Along w/ Nick Vigier
This episode of the Cyber Ranch Podcast was recorded LIVE on stage at the CISO 360 Conference in New York City, hosted by Pulse Conferences. Nick Vigier, a seasoned CISO and former CIO, joins Allan in addressing the elephant in the room: Why don’t CISOs and CIOs don’t get along?
Nick draws on his experience in both positions to share his unique perspective on the CISO and CIO relationship. In this episode, Allan and Nick highlight the operating differences between the two positions and explore the opposing interests that exist around topics such as budgets and reporting structure. Lastly, Nick shares why engaging in empathetic conversations around metrics, business impact, and risk management is the ultimate key to a more harmonious relationship.
Guest Bio:
Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization.
Links
Stay in touch with Nick Vigier on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Mar 30, 2022
Learned Helplessness in Cybersecurity w/ Steve Mancini
This topic couldn’t be more relevant given recent events in the security community. Allan Alford is joined by Steve Mancini, CISO at Eclypsium, to have a refreshing conversation about the negative messaging, thinking, and tropes in cybersecurity - not just the stuff that the press says about us, or even the stuff we say about each other - but the self-defeating stuff we think and say to ourselves.
Steve addresses the reinforcement of negative catchphrases and how it affects the psyche of the community and explores how burnout is creating a culture of sleepless nights and masochistic badges of honor. Lastly, they emphasize the importance of empathy and support within the community and remind us that humans are our greatest asset, not our weakest links.
Guest Bio:
Steve Mancini is the CISO at Eclypsium, former Deputy CISO at Cylance, and an advisory board member for several cyber companies.
Links:
Stay in touch with Steve Mancini on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Mar 23, 2022
Leveraging Employee Strengths for Cyber Roles w/ Nick Vigier
There are numerous personality tests available to help identify personality traits, but many of them have very little scientific validity or reliability. Such tests often aspire to explain what you are good at and what you are bad at, and miss the mark. In this episode, Allan is joined by his friend and owner of Rising Tide Security, Nick Vigier, to explore CliftonStrengths – a personality measurement that focuses less on ability, and more upon your predilections - what energizes you, and what and drains you - and with a pretty good degree of scientific validity and reliability. Nick and Allan explore what makes CliftonStrengths different from the other personality assessments and how Nick leverages that information to better understand his team and colleagues, and to help folks find the right role in cybersecurity. The two sit down to dissect Allan’s own assessment results to identify his top 5 energizers, as well as his top energy drainers. And lastly, Nick shares why he favors the idea of personality development plans vs professional development plans in the workplace.
Guest Bio:
Nick Vigier is the Owner of Rising Tide Security and former CISO at ID.me, DigitalOcean, and former CIO at Gemini. Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization.
Links:
Stay in touch with Nick Vigier on LinkedIn and Twitter. Take the CliftonStrengths assessment here
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Mar 16, 2022
A Full Data Approach w/ Paola Saibene
In the episode, Allan is joined by the Principal at Teknion Data Solutions, Paola Saibene, to bring clarity to an often misunderstood topic: data governance. Paola helps to distinguish the difference between data governance and data management, examines the intersection between data ethics and cybersecurity, and explores the best methodology for applying risk frameworks. Lastly, she takes time to express the importance of being people focused and “humanizing” cybersecurity.
Guest Bio:
Paola Saibene is the Principal at Teknion Data Solutions, Former CISO, CEO, VP of Enterprise Risk Management, Data Privacy Officer, Strategy Officer, CTO, and CIO.
Links:
Stay in touch with Paola Saibene on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Mar 9, 2022
The Great Resignation & Cybersecurity w/ Jessie Bolton
With a looming skills/people gap in cybersecurity and retention at an all time low, it begs the question: Where is everyone? In this episode, Allan Alford and guest Jessie Bolton sit down to discuss the elusive “Great Resignation” and how it is affecting the cybersecurity community. Tune in to get the answers to the questions we are all asking ourselves, like: why are people resigning, how has the pandemic shifted our perspectives on work and boundary setting, how is the “great resignation” impacting security organizations, and how can we attempt to solve this issue?
Links:
Follow Jessie Bolton on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Mar 2, 2022
How Old is Data Risk Management? w/ G. Mark Hardy
In this episode, Allan is joined by the President at National Security Corporation, Navy veteran, and host of the CISO Tradecraft podcast, G. Mark Hardy. This show takes a fascinating dive into the origins of data risk management, measurement, and quantification. G Mark explores the stories and advice given from some of the greatest leaders in this space – whose advice still rings true today.
Key Takeaways:
01:52 G Mark’s bio
06:43 FIPS-65 - the “grandaddy” of risk management
11:34 The ALE method, explained!
14:35 Oldies, but STILL goodies
18:12 A stroll down risk management memory lane
28:56 Revering “the greats”
37:22 What do you value and what’s your currency?
Links:
Stay in touch with G. Mark Hardy on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Feb 23, 2022
CISOs as Caretakers w/ Randy Potts
In this episode of The Cyber Ranch Podcast, Allan is joined by the CISO at Real Time Resolutions, Randy Potts. The two sit down to have a refreshing and raw conversation about the caretaking, responsibility, and code of ethics for CISOs - or lack thereof, and how to get back in touch with our “why” and mission.
Disclaimer: This episode briefly mentions pornography and gambling within an important and relevant context, and has therefore been categorized as explicit.
Key Takeaways:
01:43 Randy’s bio
03:08 Caring for “the people”
09:08 Stewards and custodians of data
14:10 Servant leadership
16:57 CISOs as caretakers
18:53 Doing the right thing
21:18 CISO code of conduct - or lack thereof
24:55 How do we fix this?
29:06 It’s nice to be nice
Links:
Stay in touch with Randy Potts on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcas…
playlist_add
Feb 16, 2022
Cyber Mentoring w/ David Belanger
In this episode, Allan is joined by David Belanger, CISO at Maxor National Pharmacy, to talk about the challenges of breaking into cybersecurity. David discusses the importance of establishing mentor/mentee relationships in the community, why building a personal brand and expanding your network is a must when finding work, and tips for newcomers looking to break into the field. Lastly, the two touch on the power of visualization and staying humble throughout your career journey.
Key Takeaways:
01:27 Bio & CISO life
02:57 Let’s define Mentor/Mentee
04:21 What makes cybersecurity mentorship unique?
07:10 Developing a long & short-term strategy
13:16 Mentors are essential
18:05 Formal vs. organic mentorships
22:10 Get out of your comfort zone
25:55 Advice for newcomers
30:15 Visualizing your success
32:00 Staying humble
Links:
Stay in touch with David Belanger on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Vall…
playlist_add
Feb 9, 2022
Rationalizing the Tech Stack w/ Mark Butler
In this episode, Allan invites Mark Butler, an Advisory CISO at TRACE3, to talk about tech stack rationalization and how to get the most out of your technology investment. Mark shares advice on everything from how to properly analyze, identify, and consolidate your tools, both in the stack and cloud environment, to coaching your application specialists on embracing change.
Key Takeaways
01:10 Bio
02:36 What is tech stack rationalization?
03:46 Where to get started
06:20 Evaluation - a 3 prong approach
08:08 The security architecture alignment
10:51 What about contractual obligations?
13:18 The “best of breed” strategy
17:37 Rationalizing the cloud
21:00 Data analysis - tooling, extraction, metrics
25:24 The 3rd party tool conundrum
27:50 The future of cloud rationalization
29:40 How to resolve tech overlap?
32:19 Embracing change
34:37 Mark’s advice on emotional intelligence
Stay in touch with Mark Butler on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
P…
playlist_add
Feb 2, 2022
Penetration Testing Programs LIVE w/ Phillip Wiley
In this episode, Allan is joined LIVE on stage at FutureCon Dallas 2022 by U.S Bank Senior Cloud Penetration Tester, co-author of The Pen Tester Blueprint, podcast host, and college instructor, Phillip Wiley. Phillip journeys into his past to share how he went from pro wrestler to pentester, gives writing advice to future authors in the field, explores the art of pentesting, and the best starter certifications for pentesters. Lastly, Phillip explores the best advice he’s ever received and the dangers of burnout.
Key takeaways:
01:27 Phillip's origin story - wrestling men and bears
03:04 The Pwn School Project
04:47 The Hacker Factory Podcast
06:55 Always a way to cyber
10:18 An opportunity to write
14:08 The Art of Pentesting
17:19 Getting square on terminology
24:42 The limitless child
27:25 The skinny on certs
30:23 Mentors
35:06 Back in the pentesting lab
37:14 When does threat modeling factor?
43:50 Coloring in purple
Follow Phillip Wiley on LinkedIn and Twitter
F…
playlist_add
Jan 25, 2022
What We’re Doing Wrong in the SOC w/ Yaron Levi
Allan is joined by Yaron Levi, CISO at Dolby, to talk about the SOC and why we are going about it all wrong. Allan and Yaron identify and examine the three main areas of concern: the data, the analyst, the analysis – and how to improve upon them. Lastly, Yaron shares his thoughts on what steps and approaches need to be taken in order to successfully accomplish the SOC’s goal.
Key Takeaways:
01:35 Bio
02:36 What are we doing wrong in the SOC?
06:54 Hypothesizing
11:22 How much gets left out when we make a hypothesis?
13:42 Anti-fragility & business outcomes
16:30 Business objective + threat model example
21:09 Lead with the why/ downstream applications
27:06 What outside influence has helped you inside cyber?
Learn more about Yaron on Twitter and LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at Axonius
playlist_add
Jan 19, 2022
Cybersecurity Centers of Excellence w/ Rafal Los
Allan is joined by Rafal Los, industry innovator, strategist, and personality. His career spans 20+ years while working inside companies from the Fortune 10 to a firm of less than 10. Additionally, Rafal is a founder and host of the Down the Security Rabbithole Podcast - an industry podcast delivering a weekly take on cybersecurity since 2011. Join Allan and Rafal as they discuss cyber security centers of excellence, metrics, marketing and acceptance in this conversation between two friends.
Key Takeaways:
01:56 Bio
04:27 Goals for Cybersecurity Center of Excellence (CoE)
06:44 How do you birth a Cybersecurity CoE?
09:45 Selling your service
15:18 Cost - who pays in the end and how?
17:10 Getting management on board
24:22 It’s not all about cost – but it is.
26:37 Metrics
31:05 Quality metrics
34:33 Your mess for less
38:02 What is something outside cyber that helps on the inside?
Links:
Follow Allan on LinkedIn and Twitter
Follow Rafal Los on LinkedIn and Twitter
C…
playlist_add
Jan 12, 2022
Investing in Cybersecurity Startups w/ Kathy Wang
Join Allan as he discusses investing in cybersecurity startups with the perfect guest for the subject: Kathy Wang, CISO at Very Good Security, investor at Silicon Valley CISO Investments, investor at Firebolt Ventures, and former founder as well!
Allan and Kathy talk about investment goals, the process from start to finish, how to get started, the buy-in costs, returns, what to expect, partnering, etc.
Join them as they dive into this fascinating topic:
DISCLAIMER: NOBODY ON THIS SHOW IS A FINANCIAL ADVISOR OR PLANNER, AND NOTHING SAID ON THIS SHOW CONSTITUTES FINANCIAL ADVICE. OPINIONS EXPRESSED ON THIS SHOW ARE JUST THAT – OPINIONS – AND YOU SHOULD NOT USE THEM TO CONDUCT YOUR FINANCIAL AFFAIRS. CONSULT A LICENSED EXPERT INSTEAD OF US!
Key Takeaways:
02:14 Bio
02:54 Getting into cyber security investing
05:28 Spotting good investments
09:13 What’s the process?
15:15 Ranging investments | partnerships
22:35 29 no's and 1 yes – is that reality?
26:20 Seeking investme…
playlist_add
Jan 5, 2022
50th Episode Special w/ Many Guests
In this special episode, Allan invites a few familiar voices back to the show, conducts a countdown of his Top 5 most popular shows, and reviews some of the most common guest responses. Lastly, Allan issues some important thank you's and shares a few comments and feedback from the listeners.
Highlights:
Top 3 guest answers to "What keeps you going in cybersecurity?"
Top 3 guest answers to "What surprises you the most in cybersecurity?"
Top 5 shows by download
Visits from:
Tim Rohrbaugh, CISO - Jet Blue
Chris Cochran & Ron Eddings - Hacker Valley Media
Drew Brown, who has held many security leadership roles and who is an avid user of the FAIR methodology of risk measurement
Richard Seiersen, former CISO, famed champion of measuring risk, and author of "The Metrics Manifesto: Confronting Security with Data"
Accidental CISO of Twitter fame
THANK YOU to all of our listeners, Hacker Valley Media, our fantastic guests, and to everyone who helped get us to 50 shows!!!
Links:
Foll…
playlist_add
Dec 22, 2021
Minimum Viable Security w/ Chris Roberts & Cecil Pineda: EXPLICIT CONTENT
Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minimum Viable security, tactical frameworks, the challenges with large frameworks, and the challenges of competing frameworks.
This show was recorded after happy hour and the audience and participants both imbibed. It's a rowdy show and features some explicit content.
Key Takeaways:
0:00 Allan’s holiday greeting
0:39 Allan introduces the live show, guests and issues a disclaimer about naughty language
2:02 Chris Roberts on Minimum Viable Security
2:42 Cecil on his love/hate relationship with compliance and the need for weighting controls
4:25 Allan proposes “tactical frameworks”
5:38 Chris challenges the crowd on their asset management successes
7:43 Allan introduces “See it, manage it, secure it.” (Which he flagrantly st…
playlist_add
Dec 15, 2021
Organizational Resilience w/ Marnie Wilking
In this episode, Allan is joined by Marnie Wilking, CISO at Wayfair. Marnie has directed Information Security and multi-discipline Risk Management Programs for more than 15 years -- providing a unique set of skills and experience to manage operational risks and improve risk management among diverse businesses. Join Allan and Marnie as they define organizational resilience, discuss its goals and enablers, and analyze the COVID pandemic through its lens.
Key Takeaways:
01:26 Bio
03:42 Organizational resilience
06:40 COVID benefits; business enabling?
09:47 Building hybrid work environments
11:11 Virtual offices and home fatigue
17:14 Bullets dodged in organizational resilience
20:51 Tabletop exercises
27:16 Office conflicts and mailing troubles
30:38 Communication in resilience
32:29 What surprises Marnie in cyber security?
Links:
Learn more about Marnie on LinkedIn and Crunchbase
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hac…
playlist_add
Dec 8, 2021
The vCISO Life w/ Dan Doggendorf
Welcome to another live show of the Cyber Ranch! Allan is joined by Dan Doggendorf, a creative cybersecurity leader with a passion for simplicity, efficiency, accountability, common sense, and honesty. The duo discusses the ins and outs of being a VCISO, how one walks the path and what the industry can do to make this role better. This show was conducted at the Cybersecurity Conference 9 (CSC 9) conducted by the North Texas Chapter of ISSA. All proceeds from the event went directly to scholarships for the Collin College cybersecurity program.
Key Takeaways:
01:47 - Bio
02:33 - vCISO life
04:18 - The path to an independent contractor
07:46 - Should you specialize?
10:46 - Strategizing experience in cyber security
14:26 - Challenges of being a CISO & vCISO
19:04 - Staying connected as a vCISO
23:17 - Victories as a vCISO
27:06 - The bad times and mistakes made as a vCISO
29:52 - What should change for vCISOs?
30:51 - Advice for future vCISOs
34:09 - What surprises Dan in cyb…
playlist_add
Dec 1, 2021
GRC: ”Now What?” w/ Security & Compliance Weekly
This week, Allan is joined by Frederick Lee aka “Flee”, Chief Security Officer and Head of IT at Gusto, Jeff Man, host of Security & Compliance Weekly, and notorious infosec curmudgeon, and by Kat Valentine, Security and Compliance Weekly co-host. A few weeks ago Allan appeared on their show to discuss “GRC: ‘What?’ and ‘So What?’. In that episode, found here, they take a deep dive into GRC in terms of understanding is purpose and value.
In this crossover episode, the group continues the conversation to talk about “GRC: ‘Now what?’ (The cultural impact and implementation, risk register, achieving actionable results and much more).
Join Allan and the Security & Compliance Weekly team as they dive into overcoming cultural barriers, a continued conversation on the order of priority (“RGC” vs. “GRC”, for example), and enlisting allies in the business.
Key Takeaways:
2:20 Implementing GRC culturally – Flee's take
4:13 Jeff’s take
6:16 Kat’s take
10:4…
playlist_add
Nov 24, 2021
The CMO‘s Perspective w/ Nathan Burke and Julie O‘Brien
CISOs complain on social media about bad marketing – when they are targeted inappropriately, or with messages that don’t resonate, or with messages that outright lie. This week Allan Alford decides to hear from the other side, and invites his two favorite CMOs to the show. Julie O’Brien, CMO at AttackIQ, and Nathan Burke, CMO at Axonious, sit down with Allan to send a message to cyber security professionals about the vital role marketing plays in the industry, what is good marketing and bad marking, and how marketing affects all of our careers more than we know. Hear different perspective on topics like buzzwords, cold calls, and the difference between good and bad marketing practices. Backed up with proven experience, this episode is packed with useful info for all cyber practitioners and aspiring practitioners.
Key Takeaways:
02:00 Julie Bio
03:13 Nathan Bio
04:00 Standing out as a marketer
10:15 Emphasizing what you don’t do as a company, rather than what you do
15:56…
playlist_add
Nov 17, 2021
Practical Working (And Hiring!) from Home w/ Brian Castagna
Brian Castagna (CISO at Seven Bridges - a genomics company) is a CISO with a proven track record of successfully building information security programs at cloud technology companies. He is on a mission to humanize the new work environment - our own home. Join Allan and Brian as they touch on transitioning from an office environment, both mentally and physically, hiring remotely, work/life balance and much more.
Key Takeaways:
01:33 Bio
02:22 Remote work
03:00 Hiring a remote workforce
10:50 What’s the human side of working from home?
17:38 Transitioning from work to home
19:54 Mental transitioning
21:00 Collaboration & strategy
24:30 Layering the human back in
27:19 What surprises you in cyber?
Learn more about Brian on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ
playlist_add
Nov 10, 2021
Threat-Informed Defense, CISA, CVEs and ATT&CK w/ MITRE Engenuity
This week, Allan is joined by some serious heavy hitters in cyber. Richard Struse (Director for the Center for Threat-Informed Defense at MITRE Engenuity), Jonathan Baker (Director of Research & Development, Center for Threat-Informed Defense at MITRE Enginuity), and Jonathan Reiber (Sr. Director for Cybersecurity Strategy and Policy @ AttackIQ). The four are here to have a conversation about CISA's new BOD that outlines 290 key vulnerabilities that require focus, the coincidental mapping of the CVE database to MITRE ATT&ACK, and the implications for all of us. Of special note is the fact that ATT&CK is already mapped to NIST SP 800-53, meaning that we now have an opportunity to move bi-directionally from a threat-informed defense or to start with a framework and back into vulnerabilities. The implications for our industry are huge.
They also discuss briefly an overview of the bi-partisan work in both the Executive and Legislative branches to further cybersecurity interests and the re…
playlist_add
Nov 3, 2021
A Day in the Life of Two CISOs w/ Mustapha Kebbeh
Mustapha Kebbeh, CISO at Brinks and heavy-hitter in the Dallas/Fort Worth Cyber community, joins Allan again this week as they cover a topic Mustapha noted was absent so far in the series… Namely, “What is a day in the life of a CISO?” Mustapha and Allan get into details of what they do and don’t do, what their teams do and don’t do, what bits are boring, what bits are surprising, and what bits are the most fun. Join them as they talk about real situations and practical solutions while describing the very best and worst parts of the job.
Key Takeaways:
01:41 Bio
03:00 A day in the life of a CISO - examples from the last 3 weeks
07:30 Being a CISO in a company that knows its risk appetite
11:49 Product Security
13:53 The most surprising part about being a CISO
15:33 The most boring part
22:30 The most fun part
26:08 What do you wish you could do as a CISO?
29:42 Mustapha shares what surprises him the most in cyber security
Links:
Learn more about Mustapha on Linked…
playlist_add
Oct 27, 2021
Practical Trust-Centric Security w/ Omar Khawaja
Omar Khawaja is an experienced CISO with a strong technical background, who managed to find some very creative ways to manage his security program that go against his engineering instincts. Join Allan and Omar as they discuss why trust-based security is the more suitable option to have a fundamentally better security program and team. Hear why Omar and Allan believe that investing in people will pay far more dividends than the latest tech tool. And more importantly, gain some very practical and concrete tips for managing and measuring your security program.
Key Takeaways:
01:19 Bio
03:26 What is wrong with tech-centric security?
06:00 Using tech tools as nothing more, and using them appropriately
12:22 Trust, then risk, then control
14:30 Customer first, always
19:02 Helping foster a trust-centric culture
28:40 Culture = mindset = best measurable quality
29:33 What surprises Omar in cyber security?
32:50 The “change agent network”
Links:
Learn more about Omar on Twitter…
playlist_add
Oct 20, 2021
CISO in the Supply Chain w/ Emilio Escobar
Allan is joined this week by Emilio Escobar, CISO at Data Dog and former VP of Information Security at Hulu. He is also a long-term developer of Ettercap, a comprehensive suite for man-in-the-middle attacks.
Like many of us, Emilio started his journey in infosec as a hacker kid, exploring the world through modems and BBSs. Emilio is not a security vendor CISO, but is a CISO for a company that is in the supply chain for many other companies. He has to balance internal and external duties as a result.
Come listen as Allan and Emilio discuss the B2B CISO life, the skills required, business alignment, facing customers, and how all of these skills just might define "the modern CISO".
And, yes, they even tackle the age-old question, "How technical should a CISO be?"
Key Takeaways:
01:27 Bio
03:10 Security questionnaires and interactions
05:49 Is there a fix to solving vendor risk?
07:17 Utilizing machines for questionnaires
09:33 Leveraging skills
12:50 How technical should a CISO…
playlist_add
Oct 14, 2021
Is Resilience Even the Goal? Antifragility w/ Sounil Yu
Allan is joined by Sounil Yu, one of cybersecurity's most well-known contributors. Sounil has a long history in cybersecurity, and is also the inventor of The Cyber Defense Matrix and the DIE Triad.
Sounil and Allan discuss cyber resilience and contrast it with "antifragility", a notion introduced by Nassim Nicholas Taleb. Sounil argues that in cybersecurity, antifragility should be the goal, and not resilience.
Antifragility allows for stronger data protection, as it does not just survive stresses and attacks, but actually encourages them. Sounil explains how antifragility also neatly dovetails with his DIE (Distributed, Immutable, Ephermeral) Triad of data protection, which he contrasts with the CIA (Confidentiality, Intregrity, Avaiability) Triad in the context of the "pets vs. cattle" model.
Join Allan as he learns a great deal in a short amount of time from Sounil...
Key Takeaways:
01:23 Bio
02:20 Cyber Defense Matrix
03:10 Is cyber resilience the wrong idea?
04:17 Backups…
playlist_add
Oct 7, 2021
Is the SOC Dead? w/ Erik Bloch
Allan's guest this week is Erik Bloch. Erik Bloch is a cyber security leader, influencer, and pioneer. He currently sits as Senior Director of Detection and Response at Sprinklr, but has held many rolls in cybersecurity, including being a product manager for SIEM products more than once. This last point is relevant, because it makes it even more surprising that Erik is convinced that the SOC's utility has passed... Join Allan and Erik as they dive deep into why he thinks SOC is failing, the alternatives, what it takes to make an impactful change in incident response, and who to aim it towards. This conversation began when Allan read Erik's article on LinkedIn, “RIP SOC. Hello D-IR". Key Takeaways: 01:16 Bio 02:18 Erik’s article: why is SOC failing? 05:01 What is the alternative? 07:29 Implementing fundamentals where it counts 10:15 Cloud Integration 17:45 Cloud agnostic tooling solution 23:27 The inevitability of a one-stop solution 27:20 Targeting the right audience 28:17 What sur…
playlist_add
Sep 29, 2021
The Value of Threat Intelligence w/ Samara Williams
Allan's guest is Samara Williams, Manager of Threat Operations at Cardinal Health, speaker, advocate and passionate member of the threat intelligence community.
Samara broke into cyber via a rotational program, sampling many cyber jobs at many cyber companies in a short order - a fantastic start in cyber that turbocharged her maturity and experience. She quickly developed a passion for threat intelligence, and has worked in that space ever since.
Join Samara and Allan for a deep dive into threat intel, its pros and cons, its value, and its potential...
Key Takeaways:
01:28 Bio
02:56 The love/hate relationship with threat intel: yay or nay?
06:07 The steps to threat intel – breaking it dow
15:14 How threat intel can help bridge tactical & operational Practices
19:57 Having a successful SOC program
22:18 Managing the unknown and practicing the fundamentals
26:17 Making a case for prioritizing threat intel
27:55 What surprises Samara in cyber security?
Links:
Learn more ab…
playlist_add
Sep 22, 2021
Practical Realities of Ransomware Management w/ Bryan Hurd
This week, Allan is joined by Bryan Hurd. Bryan is a multi-talented cyber security professional who has founded and operated programs dating back to the early nineties. Currently Chief of Office for Stroz Friedberg (AON Cyber), he started his career in NCIS, founding the Navy’s first ever cyber counterintelligence program in 1993.
Join Bryan and Allan for a masterclass on ransomware, incident response, and preparedness. Having both consulted on ransomware situations many times, they offer a wealth of practical tips, do’s, don’ts, and gotchas. You can also hear their perspectives on the roles and processes in taking appropriate action when crisis hits.
This is a longer than usual episode, but that is because it is filled with practical advice based on a great deal of experience.
Key Takeaways:
01:20Bio
02:58Is ransomware still the #1 threat to an organization?
07:30Having your incident response team ready and prepared
12:16The roles, processes, and fundamentals of inciden…
playlist_add
Sep 15, 2021
WHY We Measure Risk w/ Sameer Sait
In this episode Allan interviews his friend Sameer Sait, former CISO at Amazon, Forcepoint and Arrow Electronics, who joins Allan for a discussion about WHY we measure risk.
It is about more than just asking for money. (And who are you actually asking money from? Hint: It is not the Board).
How does risk measurement change in the beginning of the CISO’s journey vs. later when the program is more mature?
What is the goal of good risk metrics? What is the role of cyber insurance in all this? What about business traction and cooperation with other department’s goals and objectives?
And finally, how does measuring risk affect disposition or risk?
Key Takeaways:
01:20 Sammer's bio
02:30 Asking for money - it's not from the Board
05:58 Measuring risk: inside-out vs. outside-in
11:20 Approaching management with an objective, not a story
12:38 Working with your team, as a team
14:12 The effects of measuring risk
18:36Analyzing the priorities and their consequences
24:36 Good…
playlist_add
Sep 8, 2021
What Comes After the CISO Role? w/ Helen Patton
Host Allan Alford interviews his friend Helen Patton, advisory CISO at Cisco, and former CISO at Ohio State University. Helen and Allan discuss the career path of the CISO – specifically what comes after the CISO role has been fulfilled - and how there is not a clear path defined for the post-CISO career.
Allan and Helen discuss several models for post-CISO life that they themselves have explored, and that other CISO friends have as well, such as: shifting back and forth from CISO to vendor, shifting back and forth between CISO and advisory CISO roles at VC’s and other entities, becoming CIOs or CTOs, etc.
Helen explains how there is no clearly defined path for a post-CISO life, how no mentors are available to aid with that transition, but also how CISOs can decide to simply change their roles as a CISO. She explains a little bit more about her advisory CISO life and the internal and emotional differences between it and a conventional practitioner CISO role.
Key Takeaways:
0:26…
playlist_add
Sep 1, 2021
Humans Are Not the Weakest Link in Cybersecurity w/ George Finney
Allan is joined by George Finney, CSO at Southern Methodist University and author of the book Well Aware: Master the Nine Cybersecurity Habits to Protect Your Future.
George’s mission is clear: unite the cybersecurity community through proven strategy, and help preserve and leverage the humanity within cybersecurity.
He believes that the community as a whole under-plays the human role, and he and Allan discuss potential changes to the way we view security awareness training and the role of users in general.
Key Takeaways:
00:18 Intro/Bio
01:25 George’s story
04:27 Humans are not the weakest link in cybersecurity
07:17 How habits affect security awareness
08:30 The 9 habits and forming your cybersecurity personality
14:05 How secret keepers build a community
17:30 Potential improvements to security awareness training
22:22 The origin of the nine habits
26:50 What surprises George about cybersecurity still?
Links:
Learn more about George on LinkedIn and on Twitter…
playlist_add
Aug 25, 2021
Does SOAR Meet Its Promises? w/ Benjamin Corll
Host Allan Alford interviews Benjamin Corll, VP of Cybersecurity and Privacy at Coats, about security orchestration, automation, and response (SOAR).
Bejamin and Allan critique SOAR's promises and premises, what else it could be doing, its pricing and overhead, and lack of standards as well.
But it is not all negative - Benjamin does share stories as well of SOAR's successes in his shop, and of the things it does do well...
Come on down the ranch and give this show a listen!
Key Takeaways:
0:09 – Intro
0:55 – Benjamin's background and day job
3:46 – The premise and the promises of SOAR
6:32 – What else could be automated?
9:25 – Benjamin explains about the trouble ticket system and the change management system
11:57 – The standards for SOAR today
17:19 – How do we improve the cyber posture of all our organizations, making them more secure?
19:34 – Has SOAR managed to stay affordable for those who need it?
22:54 – What SOAR does well, the benefits and the…
playlist_add
Aug 18, 2021
The Modern CISO w/ James Azar
Host Allan Alford interviews guest James Azar, host of the CyberHub CISO Talk Podcast, and CISO in the financial services space. James and Allan discuss the techniques and approaches of the modern CISO, and contrast this with some of the older approaches of the job. James defines the cultural shift between the old and new as having taken place since September, 2017 (the Equifax breach).
James and Allan discuss the impact on the team, business, clients, customers, and shares their thoughts and experience on how to stay modern. “What keeps you going in cybersecurity?” as the signature final question for each guest has been replaced with “What surprises you the most in cybersecurity?” James is the first guest to answer that question, and his answer is a bit of surprise itself…
Key Takeaways:
0:16 – Intro
1:04 – Bio
2:00 – The modern CISO contrasted with the older CISO
4:46 – What does the modern CISO mean to the team, business, clients and customers?
7:10 – H…
playlist_add
Aug 11, 2021
Frameworks Over Time w/ Derly Gutierrez, Mustapha Kebbeh and Patrick Benoit
In this, the very first LIVE episode, Allan Alford interviews guests Derly Gutierrez, Head of Information Security at 1010Data, Patrick Benoit, BISO at CBRE, and Mustapha Kebbeh, CISO at Brinks, as they discuss the use of security frameworks in general and over time.
Regarding framework compliance, do we choose one or do we choose many? Do we embrace them fully or partially? What changes our approach to frameworks over time?
Security strategies are explained throughout the episode, along with the notions of business adaptation and adoption, regulation and other requirements, and "minimum viable security" approaches that don't require frameworks at all.
Key Takeaways:
0:43 – Intro
1:53 – Question to Mustapha: pick and choose from a framework or embrace a framework all in one go?
2:47 – Patrick discusses his own approach to Mustapha’s statement
3:26 – The evolution of CFS adoption briefly discussed and the importance of protection
6:59 – Discussion of a possible "leas…
playlist_add
Aug 4, 2021
Burnout, Toxicity, and Overcoming Obstacles w/ Marilise de Villiers
On this episode, Allan invites Marilise de Villiers, Founder and CEO at ROAR! Coaching & Consulting, to come on down to the ranch and discuss how to deal with toxic situations, how to overcome obstacles in the workplace, how to avoid burnout, and how to spot our own negative behaviors that interfere with our success.
Marilise and Allan cover toxic workplaces and bosses, share personal stories, and discuss the internal mechanisms which allow external toxicity to harm us, as well as the internal behaviors to prevent that.
They discuss obstacles, and how big obstacles should be embraced. They also talk about "exercising the resilience muscle".
This is a fantastic show with some open and vulnerable moments, as well as with some very practical advice for avoiding burnout and dealing with problems most of us have faced or will face in our information security careers.
Key Takeaways:
1:11 How Marilise got into information security
2:29 About her coaching and consulting practice for inf…
playlist_add
Jul 28, 2021
Migrating from Monolithic to Cloud w/ Greg Rogers
In this episode, Allan interviews Greg Rogers, CISO at Legal & General America, about migrating legacy, monolithic, internally facing, manually tested, waterfall applications to Cloud, CI/CD with automation, customer-facing applications, all with modern development languages and environments.
Greg migrated just about everything legacy to just about everything modern across a series of monolithic applications. In this episode he gives tips on the technical aspects of his journey, tools and techniqes for overcoming cultural barriers as well.
Greg outlines what he did in-house, and what he leveraged from out-of-house - from code to services.
Ultimately, Greg was able to pull of this transition piece by piece, and he shares how he was able to do it.
Lastly, Greg closes with what keeps him going in cybersecurity...
Key Takeaways:
1:19 How Greg got into cyber
4:12 An overview of the challenge
6:39 Greg's biggest security challenges with the project, both cultural and techincal
8:06…
playlist_add
Jul 21, 2021
Credential Stuffing w/ Dr. Sam Small
In this episode, Allan's friend Dr. Sam Small, CISO of Zero Fox, joins us to chat about credential stuffing, its implications and the defenses against it.
Several statistics are given from a few industry reports on credential stuffing, including the Verizon DBIR and F5's report.
Several techniques to foil credential stuffing are explored, as well as common traps when combatting credential stuffing. OWASP provides some guidance in this area.
The criminal's abilities vis a vis breach sharing and botnet as a service are discussed as well.
Finally, Sam explains what keeps him going in cybersecurity...
Key Takeaways:
1:08 Sam's background and education in cyber
2:41 Sam defines credential stuffing and explains why we should care about it
4:17 The origins of the term 'credential stuffing' vs. its history
4:39 Is ransomware the end goal of every single kind of cyber attack?
5:22 Botnets as a service to drive credential stuffing attacks
6:33 Allan cites statistics from the Verizon…
playlist_add
Jul 14, 2021
”Ugly Exits” w/ Naomi Buckwalter
On today’s episode with Allan, we talk “Ugly Exits” with Naomi Buckwalter, Director of Information Security. Of course, to start the episode, Naomi answers Allan’s question of how she got started in cyber.
They circle back to the topic at hand, “Ugly Exits”. Under this umbrella are: being fired, laid off, "burning bridges", or being encouraged to leave in a "voluntary" manner. Allan shares statistics for some of these categories, including a substantial statistic on those who have been outright fired.
When it comes to burning bridges, so many people walk away from a company that is behaving in an unethical manner and putting their employees in unethical situations. To Naomi, this is a frightening common thread. It’s scary how many unethical employers are out there.
Naomi shared a personal story of her ugly exit, and the fact that it was deserved to some extent. She has owned that experience, has learned from it, and has grown as a result.
Allan shares his persona…
playlist_add
Jul 7, 2021
Agile for Security Programs w/ Tim Rohrbaugh
On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.
Tim got into cyber through the military. From the military he went into consulting and ended up at JetBlue. At JetBlue that he is always trying to find ways to invest dollars in security programs to balance what is going on. Along with that, he strives to keep his team motivated and moving forward.
Agile is a software programming methodology, and it replaced Waterfall. Waterfall was the traditional model of development, where large chunks of code had to flow from developers to QA, back to developers several times, and finally to release.
Agile, on the other hand, works off user-centric stories, which roll up to bigger stories called epics. Stories are small, discrete goals, met with smaller, discrete chunks of code released in what are called 'sprints'. QA is very rapid as well, leading to rapid release. Agile i…
playlist_add
Jun 30, 2021
All About Analysts w/ Christina Richmond
With us today is Christina Richmond program Vice President at IDC. She's an industry analyst, and she's here to talk to us all about the analyst lifestyle.
Allan starts the episode asking Christina to share all about how she got into cyber and what her day job is like. Christina actually began by working in the storage space, and discovered security. To her it was like a drug. What does she do throughout her days? Partakes in hundreds and hundreds of calls with companies who need help with launches and marketing, specifically in growing areas of cybersecurity. In essence, there is a lot to being an analyst. But to be successful, you have to be curious!
The best way to put Christina’s job in words, is “learning the whole from the parts.” She talks with individual players, studies market trends, and then circles around again to piece it together. One big feedback loop.
On a side note, Christina would like everyone to know she is looking to hire at the director level! If you know…
playlist_add
Jun 23, 2021
The Journey to Passwordless Authentication w/ Derly Gutierrez
With us today is Derly Gutierrez, Head of Security at 1010 Data, and veteran. Derly is here with us today to talk about the journey to passwordless authentication and the flaws and strenghts of today's authentication methoods.
Allan and Derly refer to studies and surveys about the problems with passwords and the challenges of implementing passwordless approaches.
Derly emphasizes the need for other complementary technologies such as Role-Based Access Control (RBAC), Privileged Access Management (PAM), and system-to-system communications.
The two discuss corporate and personal use of passwordless solutions, talk about legal precedence and the future of passwordless approaches.
Key Takeaways
1:14 How Derly got into cyber
1:58 About Derly's day job as Head of Security
2:34 Allan quotes the 2017 Verizon DBIR on how many breaches involve weak or stolen passwords
3:35 Allan cites NIST 800-63b
4:15 Derly talks about CAC cards in the US DoD
4:50 Derly sides with vendor innovations o…
playlist_add
Jun 16, 2021
Application Security w/ Taylor Lehmann
With us today is Taylor Lehmann, former ciso several times over in the healthcare sector, and currently Americas leader for security, networking, identity, and compliance solution architecture at AWS.
Taylor and Allan talk about application security: why it's important, who are the personas, the value of threat modeling, infrastructure as code, how to get started, and relationships with developers.
Taylor, a Boston boy, starts the show trying to say, "Howdy!" correctly. Taylor started at PWC and grew into a healthcare CISO. He has now transitioned to AWS.
Key Takeaways
1:40 How Taylor got into Cyber
2:58 Taylor’s day job
4:30 Appsec Defined
5:49 Taylor's favorite appsec frameworks
7:48 Why appsec is important
8:55 The personas and roles
11:22 Security training in appsec
12:27 Threat modeling
15:11 Infrastructure as code
20:46 How to get started in appsec
24:12 Devs already know and care about security
25:38 Where does the trope come from that devs don't care?
26:52…
playlist_add
Jun 9, 2021
Solving The Global Cyber Problem w/ Ian Thorton-Trump
With us today is Ian Thornton-Trump, Chief Information Security Officer at Cyjax and an ITIL-certified IT professional with 25 years of experience in IT security and information technology.
Ian shares his background which started back in the Canadian military. During those times, "IT" was called "automated data processing", and it is quite clear how far this has advanced. He joined the Royal Canadian Mounted Police and spent a year working on criminal intelligence. Soon after he became a consultant and made his way to the UK in 2015.
Oftentimes organizations have not planned or prepared for risk, and that includes cyber. In that sense, cyber can be compared to the environmental landscapes and infrastructure, which Ian finds eerily similar. A lot of problems created in cyber mimic a lot of the environment problems we face in today’s world. One example is the recent failure of the Texas power grid during a very harsh winter. Investment in cybersecurity is critical.
Allan feel…
playlist_add
Jun 2, 2021
FAIR from the Trenches w/ Drew Brown
With us today is Drew Brown, IT Security Manager at the Commonwealth of Pennsylvania. Drew is here to talk about FAIR and his real-world usage of it and testing it in the trenches.
Drew shares a little bit about his background in cyber, and a little bit about his day job. He spent 15 years in IT. That opened the door then for him to be the CISO for one of the state agencies. Now his title is IT Security Manager but essentially he is responsible for communicating security and risks and working within a law enforcment agency to make sure that what is implemented is secure, it's compliant, and it meets all of the agency objectives.
With FAIR, you start by asking some very basic questions: What is the asset? What is the thing of value that you're trying to protect? Once you understand what that is, you then ask who is going to come after that asset: cyber criminals, nation state, some kind of industrial espionage, hacktivist, or whatever. Or maybe it's Doris in accounting. Either way, yo…
playlist_add
May 26, 2021
Clever Hiring Practices w/ Andy Ellis
With us today is Andy Ellis, operating partner at YL Ventures, former Akamai CSO and newly inducted member of the CSO Hall of Fame. We're here to talk about nonstandard hiring practices and how Andy has built an amazing team using nonstandard approaches.
Andy began his career in cyber ("I remember back then, you know, we didn't call it cyber, but I think we've all given up and, and that's now the name for our career field.") as an Air Force ROTC cadet, spent 20 years at Akamai, and joined an advisor program at YL Ventures.
Andy found a solution that addresses hiring needs and the talent shortage, while also building a very clever and very innovative team.
For new roles, look and see if you have somebody who's almost senior that you can promote to do that job. And backfill the almost senior person instead. Try not to hire senior people, try to hire the most junior person you can get away with and promote everybody up the chain. The real trick is to figure out how your HR and finance…
playlist_add
May 19, 2021
Measuring Risk w/ Richard Seiersen
Today we talk with Richard Seiersen, co-author of “How to Measure Anything in Cybersecurity Risk”.
Richard shared that at his first CISO position, he was challenged with addressing prioritization of risk, which led to his authoring a book with Doug Hubbard.
What can cyber learn from older risk disciplines? The life table used broadly to measure time-to-event data goes back 500 years.
Businesses keep falling back to the classic 5x5 "likelihood and impact" matrix which is an inconsistent, non-math-based method.
Without math it is really just casting spells in the board room. There are no ratios or explanation of differences, for example.
CISOs are called upon to make a bet about something. We will use subject matter expert opinions, and can make them measurably better. Consistency is key.
Wild guesses can still help constrain the forecast. There are existing models in cyber such as FAIR that provide a more mathematically applied approach.
Statistics came about because people n…
playlist_add
May 12, 2021
Becoming a CISO w/ Accidental CISO
With us today, is a very special guest, Accidental CISO, of Twitter fame. His anonymity on Twitter, allows him to be a little more “truthy” about the CISO game than a lot of us can afford to be on social media. We have distorted his voice a bit to protect that anonymity.
“Accidental” shares how he got into cyber, and that is a culmination of being in a career where he had to fill “all” the hats. He stepped away from his CISO role a few years ago and is now in consulting where he has the opportunity to help other people realize they need to build security programs when they have never done it or know how.
How did he become the “Accidental CISO”? Simply by trying to help during the course of going through an audit. They had to identify who was the CISO, and he made the mistake of asking who the security officer was for the company. The answer was, “That’s you.”
Accidental CISO doesn’t think becoming a CISO accidentally is all that uncommon. When going thr…
playlist_add
May 5, 2021
Breach & Attack Simulation w/ Marlys Rodgers
Today we talk with Marlys Rodgers, who has been in cyber for over 20 years. She currently is CISO for CSAA Insurance Group and is running security for the company as well as running governance risk and compliance for technology. She shares that it feels like she is constantly balancing assessing with preventing.
Allan brings up breach and attack simulation (BAS), and when it is most appropriate to implement in the context of the maturity of a security program. Marlys feels BAS is most effective when some, or most, of the intended controls are in place so you can focus on areas you need to strengthen. For her company, she was glad they did it earlier rather than later. They had a pretty good lead time to get systems to integrate.
The way you use BAS, especially along with threat intelligence, is really important. If you don’t have a purple team, or a red and blue team how does one start or how do you reorganize? Hear how Marlys did just that. Tag-teaming works best!
How has…
playlist_add
Apr 28, 2021
Enterprise Security Architecture: A $110b Case Study w/ John Petrie
With us today is John Petrie, Counselor to the NTT Global CISO. He is responsible for managing the growing internal security challenges for the NTT operating companies across the globe.
Retired in 1996 from the Marines John began his career in multiple security positions. He shares that his major responsibility of today is creating the enterprise security architecture (“ESA”) for NTT.
Allan used to work for NTT DATA Services, and shares that John is working for the ultimate parent company of the NTT global conglomerate – a full 3 companies of inheritance between John’s company and Allan’s former company. John shares just how big NTT really is throughout 180 countries. Altogether there are 986 companies worldwide, generating over $110 billion in revenue each year. NTT is #62 on the Global Fortune 500.
John shares the full gamut of what an enterprise security architecture really is, how important it is and what it does. There are nine principles to building his ESA, and…
playlist_add
Apr 26, 2021
Programs for Women & Veterans in Cyber w/ WiCyS - SPECIAL EDITION
With us today are Lynn Dohm, Executive Director of Women in Cybersecurty (WiCyS) and Martha Laughman, Veterans Iniative Lead at WiCyS and Director of Workforce Development at Smoothstack. Lynn and Martha are here to talk about the amazing programs for women and women veterans at WiCyS.
WiCyS is so much more than a conference for women in cybersecurity. Its presence spans the globe and its programs are myriad. Mentorship, student scholarships, training, special interest groups, job boards, veterans' assistance, and apprenticeships are all available.
Smoothstack is a partner of WiCyS, and has created a program for women veteran apprenticeships designed to benefit all parties involved.
The program is based on attitude, aptitude and intitial assessments, but requires no cybersecurity knowledge at the start. Apprentices are paid, trained, and qualified when they come out, working for employers on a two-year contract at a minimum. The program addresses employers' fears over being the fi…
playlist_add
Apr 21, 2021
Data Risk Governance w/ Patrick Benoit
Howdy, y’all, and welcome to The Cyber Ranch Podcast! With us today is Patrick Benoit, Global Head of Cyber GRC, and BISO at CBRE. Patrick is here to talk about Data Risk Governance, a slightly new twist on an old problem. Like our host, Patrick is also from the Dallas-Fort Worth area of Texas.
To start the conversation, Allan asks Patrick to share a little about himself, his background in information security and what he does at his day job. Patrick began his career in the military, eventually coming over to consulting and enterprise. He has built out more than one BISO program, and has run multiple GRC programs as well. Patrick has a customer-facing security role and believes that all security leaders are also, to some degree, sales leaders.
Allan and Patrick walk through a very practical approach to Data Risk Governance, starting with 'big chunks' and working towards the future with data tagging.
They discuss briefly various rules for dealing with older data and various me…
playlist_add
Apr 14, 2021
Vishing, Smishing and STIR/SHAKEN w/ Mike Manrod
Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Mike Manrod, CISO at Grand Canyon Education. Mike has done quite a bit of research on vishing, smishing and the upcoming STIR/SHAKEN legislation meant to combat those two.
To start the conversation, Allan asks Mike to share a little about himself, his background in information security and what he does at his day job. Mike started as an IT technologist who orginally resented the security team for slowing down technology projects. Then a friend took him to a security conference, and the rest is history.
Mike explains what vishing and smishing are, contrasting them to traditional phishing. Mike and Allan discuss personally targeted vishing and smishing vs. attacks targeted at organizations.
Allan and Mike cover the new STIR/SHAKEN legislation and related RFCs, along with th…
playlist_add
Apr 7, 2021
Maturing Purple Teaming w/ Gabe Lawrence
Welcome to The Cyber Ranch Podcast, recorded under the big blue skies of Texas, where one CISO explores the cybersecurity landscape with the help of friends and experts! Today, host and CISO Allan Alford interviews Gabe Lawerence, General Manager of Cyber Security Protection at Toyota Motor North America. Gabe has seen the good and bad of purple teaming, and we’re here today to discuss what a mature purple teaming organization looks like.
To start the conversation, Allan asks Gabe to share a little about himself, his background in information security and what he does at his day job. His path to security hasn’t been linear - he has been a developer, an entrepreneur and a startup owner, slowly making his way to different levels of management in the security space. Gabe runs Enterprise Security at Toyota North America and is responsible for the technical side of the business and manufacturing environment.
When discussing what successful purple teaming looks like, Gabe points to the…
playlist_add
Mar 31, 2021
Interview with a Vendor w/ Dutch Schwartz
In this episode, host and CISO Allan Alford interviews his friend Dutch Schwartz, Principal Security Specialist at Amazon Web Services. Dutch is a vendor, but do not press 'stop' just yet! Dutch is an empathetic outsider, an observor, and a constant learner and researcher. He brings some unique insights to our practice.
Dutch talks about his encounters with CISOs and their direc staffs, and opines on the debate as to how technical a CISO should be (versus business-oriented).
Allan and Dutch discuss healthy vs. unhealthy (Dutch prefers the term 'challenging') security cultures.
Dutch talks about all security efforst aligning with business initiatives, and Allan espouses his theory that all CISO actions should ties to business initiatives, risk reduction, and maturity improvement.
Dutch remains enthused about cybersecurity because of conversations like this very interview.
Key Takeaways
1:32 - Dutch shares his cyber origin story - stumbling into cyber after a militiary career as an…
playlist_add
Mar 24, 2021
Advancing Cybersecurity Careers w/ Christophe Foulon
In this episode, host and CISO Allan Alford interviews his friend Chris Foulon, Sr. Manager of Cybersecurity at a leading fintech compnay, and co-host of the "Breaking into Cybersecurity" podcast.
Chris has 15 years in information security, having started at the helpdesk years ago. His biggest desire in infosec is helping others. In his day job Chris gets to work with every part of the business.
On the subject of the personnel shortage in cybersecurity, Chris believes that there is no shortage. Rather, he suggests that hiring managers limit their choices by holding out for too high an experience level, and by neglecting diversity and inclusion.
His advice for those who are entering the profession is to combine experience, certifications and education as suited to themselves and the roles they are applying for. He suggests reserach and listening to podcasts like this one. Chris suggests finding a mentor has well.
Chris and Allan discuss diversity, inclusion and allyship at leng…
playlist_add
Mar 17, 2021
Developing Leadership w/ Gary Hayslip
Today, host and CISO Allan Alford interviews friend and fellow CISO Gary Hayslip. Besides being a brilliant business leader, Gary is an author, mentor, and one of the best all-around humans Allan knows!
To start the conversation, Allan asks Gary to share about himself and his background in cybersecurity. While he had a natural interest in computers and technology more generally, Gary’s formal entrance to the cybersecurity field came during his time in the military. He developed a love for security, and as he’s climbed within the industry in the years after his military service, he’s also developed a strong network as a colleague and mentor. Allan tapped into this shared community through one of its most-used platforms, LinkedIn, to find out what others in the field would most like to learn from Gary.
The first questions deal with topics of leadership and training, and Gary explains his own practices of educating himself and his team. In his own life, he is committed to mai…
playlist_add
Mar 15, 2021
The Post-COVID Reckoning w/ Dr. Rebecca Wynn - SPECIAL EDITION
In this show, host Allan Alford interviews Dr. Rebecca Wynn about information security decisions made during COVID and what the 2021 "reckoning" might look like. Dr. Wynn is a well-recognized CISO and Chief Privacy Officer, who faced some large-scale challenges during 2020. Allan welcomes Dr. Wynn to the cyber ranch!
The show starts with Allan asking Dr. Wynn to introduce herself and to tell the listeners a bit about her background. Dr. Wynn has received quite a lot of recognition in the field.
Allan and Rebecca Wynn share a wealth of connections in the CISO community, and both have consulted with numerous companies over 2020. This positions them to be able to talk to the broad spectrum of COVID-related actions and reactions taken during 2020.
Moving workers to home all over the world resulted in an increased attack surface and increased privacy concerns as well. Security quesionnaires were on the rise, as were deeper investigations into PCI, SOC2, etc. report. COVID, in other word…
playlist_add
Mar 10, 2021
Business-Oriented Security w/ Chris Castaldo
In this show, host Allan Alford interviews his friend Chris Castaldo about how to align information security with the business. Chris is the CISO at Crossbeam, and is also the author of the book "Start-Up Secure: Baking Cybersecurity into Your Company from Founding to Exit", available for pre-order at Amazon. Chris, like Allan, views himself as a very business-oriented CISO. Allan welcomes Chris down to the ranch to discuss business orientation and alignment of information security in detail.
The show starts with Allan asking Chris to introduce himself and to tell the listeners a bit of his background. Chris's book fills the void in books for founders that seemed to utterly lack any reference to cybersecurity. Allan recommends the book, as he was one of the lucky few to review the book before its release.
But that is not what they are here to chat about today... Allan asks Chris what it means to be a business-oriented CISO - and what does it look like to NOT be a business-oriented CI…
playlist_add
Mar 3, 2021
Supply Chain Security w/ Omkhar Arasaratnam
Today, host and CISO Allan Alford interviews Omkhar Arasaratnam, a veteran of the cybersecurity industry, on the topic of supply chain security. With a career in security going all the way back to 2004, and with experience working for IBM and several financial institutions before becoming an Engineering Director at Google, Omkhar brings much hard-earned insight to the table!
Looking to tap into that insight, Allan poses two questions for Omkhar. First, how would he characterize or define supply chain security and its implications? And second, how would he explain the SolarWinds breach and its fallout? Omkhar centers his thoughts on the SolarWinds situation, a costly breach in which hackers manipulated a code base and used it as a leverage point to gain access to high-worth targets. This attack required precision and focus, and is of the first public breaches; however, Allan and Omkhar imagine that there will be copycat attacks to come, and that the attack is a wake up call for al…
playlist_add
Feb 24, 2021
Startups & VCs in InfoSec w/ Will Lin
In this show, host Allan Alford interviews his friend Will Lin about startups and venture capital. Will Lin is a venture capitalist with ForgePoint Capital, focusing exclusively on the information security space. First and foremost, Will views his current role as a way to help others. Allan welcomes Will on to the show to help his listeners learn more about the startup world, the venture capital world, and how those two intersect.
The show starts with Allan asking Will why he thinks startups are such a prevalent force in the cyber security world. Will is not sure, but his hypothesis is that this is in large part due to the ever-changing nature of cyber security. Since needs are constantly changing and each organization has unique needs, startups have popped up to address those specialties and change based on the different needs that arise. His second hypothesis is that there always need to be organizations prepared to address new and emerging threats to security.
For VCs, Will shares…
playlist_add
Feb 22, 2021
Storytelling in InfoSec w/ Chris Cochran & Ron Eddings of Hacker Valley
On this episode of The Cyber Ranch Podcast, host Allan Alford is joined by Ron Eddings and Chris Cochran from Hacker Valley Studio. The episode begins with Ron and Chris sharing how they came to cyber security and the roles they’ve held in the space.
While they came up in the cyber security space through different channels, they now work together at Marqeta, Ron as a Security Architect Leader and Chris as the Director of Security Engineering. Additionally, together they host the Hacker Valley Podcast. Allan is curious how the podcast affects their day jobs and their day jobs influence the podcast. Ron and Chris explain that it has given them wider contacts with people in the security industry and the opportunity to speak with them about their interests and expertise.
Allan asks Ron and Chris how they stay passionate about their work. Chris says both he and Ron believe in getting better everyday, even if it’s in small increments. Reading books, taking classes, speaking to mentors…
playlist_add
Feb 10, 2021
Vulnerability Management w/ Anne Marie Zettlemoyer
Allan Alford interviews Anne Marie Zettlemoyer about the topic of vulnerability management. Anne Marie is a visiting fellow with the National Security Institute at George Mason University, and one of the all-around sharpest minds Allan knows in information security!
Anne Marie is deeply entrenched in the world of information security, and she loves her work. She began her career in accounting and finance, but by serendipity was introduced to security through a position updating a company’s payment system. From there, she was recruited into the Secret Service, where she developed a passion for the information security field - a field she hasn’t left since! Anne Marie is driven by the energy and nobility of her profession, and she values work as a protector and defender. At the same time, she feels a high level of responsibility to her company and her customers to navigate information security well.
The baseline for security work, Anne Marie says, is the fundamentals. The fir…
playlist_add
Feb 3, 2021
Behavioral Economics & InfoSec w/ Kelly Shortridge
Behavioral Economics has altered our perceptions of what actually motivates human beings. How do these theories about our more primitive behaviors as well as our intellectual biases apply to information security? Allan Alford & Kelly Shortridge discuss in the context of infosec programs and events in a whirlwind of conversation. Sponsored by our friends at AttackIQ
Podcast: The Cyber Ranch Podcast
Episode 2: Behavioral Economics and InfoSec with Kelly Shortridge
On this episode of The Cyber Ranch Podcast, host Allan Alford is joined by Kelly Shortridge, VP of Product Management at Capsule8. Their conversation begins with Kelly introducing herself and her work. She works in products for a security vendor, and she’s done research into applying behavioral economics to security. Kelly says she grew up with a love of computers, but was mostly about building gaming rigs side of things. Her career in information security began in the investment banking industry, which led her to fall in…
playlist_add
Jan 15, 2021
1-Minute Introduction
A one minute introduction to the show and its format
playlist_add