Caffeinated Risk

The year end episode does some comparing and contrasting of risk management in different areas, including things outside of cyber. Ironically, recorded just a couple days before most of the world learned about a module design choice in Java that suddenly makes logging dangerous, it brings home the point that our cyber threat landscape is complex .

Complexity and uncertainty are nothing new for cyber security  and risk management  professionals. Navigating  through those waters despite the lack of authority often afforded those tasked with ensuring an organization's safety adds human behaviour to that complexity.  Tim offers a number of suggestions on influencing action despite competing agendas within the organization. 

While many in risk management or cyber security reference standards and leading practices, it can often be based on tacit acceptance, rather than deep research.  There is an argument that that research is too slow compared to commercial solutions, especially considering our current threat landscape and resource constraints. 

This episode explores the possibility of a middle ground and challenges a few assumptions along the way, it turns out things haven't chanced that much since the 1970's. An unplanned discussion with one of the co-hosts regarding the "science of cyber security" led to an interview with Doug Millward, a computer scientist who spend many years in SCADA engineering, programing and system architecture before completing post graduate studies in higher education.  

Combining real world computer science and security knowledge with academic skills led Mr. Millward to becoming a senior lecturer at Wolverhampton University, teaching at all levels from HND to Masters, designing a number of Security and Computer Science modules and also working as a lead researcher on the Biolive project - examining privacy issues for vulnerable adults. Doug Millward is now teaching at Kaplan/ the University of Essex Online where he has designed and taught a number of computer science modules at Masters level, specialising in Cyber Security.  

Doug is actively involved in research around cybersecurity, specialising in designing and modelling security in composable systems, the use of secure languages and data representations, and the application of risk frameworks and taxonomies at both the micro and macro levels. 

Skilled penetration testers are some of the more specialized people within the information security industry. When it comes to safely testing kinetic systems the pool of talented ethical hackers shrinks again but does include Paul Smith who has written a brand new book on the subject.

An ICS security specialist before it was a recognized specialty, Paul Smith has been a field operator, security tester, product manager, ICS vulnerability researcher and more. This episode explores risk consideration when impacts are measured in environmental damage and human life rather than records in a database. 

Mr. Smith's new book, "Pentesting Industrial Control Systems: An ethical hacker's guide to analyzing, compromising, mitigating and securing industrial processes" , will be released November 9th 2021.

Formerly vice president and chief privacy office at Cisco, CEO of Drumwave and a licensed attorney, Michelle Finneran Dennedy is recognized as a visionary leader in information systems privacy.  Currently the co-founder of Privatus Consulting supporting clients working through the wicked problem of privacy in this digital age.

Much to the benefit of Caffeinated Risk listeners she is also a friend of  co-host Tim McCreight and her wonderful sense of humor results in some very entertaining banter on a traditionally serious subject.  Ms. Dennedy is also the co-author of the Privacy Engineer's Manifesto, a must have reference for any privacy or security professional made freely available via Amazon digital download.

A business without cash flow isn't a business for long and security solutions are seldom free yet cyber security is a line item that business owners ignore at their peril.  Cost management and risk management come together in this lively podcast with special guest Larry Whiteside Jr. a former US Air Force division chief who has held a number of senior cyber security executive positions since returning to civilian life in 2002. 

Mr. Whiteside  is also the co-founder of the the International Consortium of Minority Cybersecurity Professionals (ICMCP),  a non-profit organization working to increase female and visible minority professionals in the industry.  He offers some sage advice to all those currently struggling to enter the industry and those searching for talent while still keeping an eye on the bottom line.

Cohosts Tim and Doug explore the security implications of workers returning to the corporate networks after over a year working remotely. 

Is there a new art of the possible to be considered based on the changes most organizations needed to make to networks and applications to get through the pandemic lockdown? Is this now more important than ever since the financial impacts of ransomware have reached new record levels and how might ESRM practices support resilience improvements.

Dave Tyson literally wrote the book on Managing Enterprise Security Risk through converged security  while serving as the CSO for the City of Vancouver during the winter Olympic games.  A practitioner rather than a theorist, Tyson has held senior security leadership positions at multiple major organizations including eBay, Pacific Gas and Electric and SC Johnson.

In this episode Dave Tyson discusses the origins of security convergence, why organizations need to explore this now more than ever and how to gain support with the executive suite by identifying and removing value chain friction created by security processes.

"We need more science in Cyber Security"  David Hechler, TAG Cyber Law Journal
 
Threat modeling should be step 0 of any security architecture but often goes completely unconsidered. This episode features Terry Ingoldsby, a veteran cyber risk professional, physicist, computer scientist and inventor of Securitree. Ingoldsby created the attack tree development platform because he felt cyber security assessments should be defendable rather than just the educated opinion of assessor.

Despite being the inventor, there is no sales pitch. Terry, Tim and Doug talk risk, engineering, business cases and why there is no AI magic when it comes to identifying events that could end your organization. 

Serial entrepreneur, author and futurist Scott Klososky  explores some new approaches to physical and cyber security that are innovative, potentially controversial and necessary as more and more of our daily way of life is affected by these security problems. 

Ten years before Youtube Mr. Klososky founded a startup that delivered webcasted media for commercial, government, sports and entertainment.  Scott has consistently demonstrated the ability to identify market opportunities and technology trends well in advance. Following the success of Webcasts.com with a second generation online banking platform that enabled smaller financial companies to compete head to head with the majors.

Today Scott Kolosky supports business leaders and boards by merging hard won success in technology with forward looking analysis to create concepts and models needed in today's hyper competitive markets. Whether those needs are the fusion of humans and technology within an organization,  data intelligence or risk management and the development of an integrated security model.

A security luminary before such a title was even coined, Winn Schwartau's predictions about the internet and global security problems have been scarily spot on for more than 30 years.  Named the “Civilian Architect of Information Warfare” by Admiral Patrick Tyrrell of the British Ministry of Defense, Schwartau also testified before Congress in 1991 and showed the world how and why massive identify theft, cyber-espionage, nation-state hacking and cyber-terrorism would be an integral part of our future.

His new book, "Analogue Network Security" is a mathematical, time-based and probabilistic approach to justifiable security. Winn and the Caffeinated Risk hosts explore how the the management of time and trust as an alternative approach to blind faith in the castle & moat model that continues to fail us.