Zero trust is a cybersecurity first principle strategy. Key to deploying a robust program is the Identity and Access Management tactic (IAM). The old perimeter defense model, designed in the 1990s, where network architects allowed good guys (and bad guys) through the perimeter to validate IAM policy seems ridiculous in hindsight. The new model, Software Defined Perimeter (SDP), is not as well known but is probably a better design. In this episode, Rick Howard discusses the history and current state.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In 1995, AT&T patented the idea of two-factor authentication (2FA). They said that to identify an authorized user, a system needed to check at least two of three factors: something they have, something they are, or something they know. But the early systems were clunky, hard to manage, and only used in environments that needed the most security. Today, the industry has come a long way and there are several different choices for 2FA with some more secure than others: SMS, Email, Authenticator Soft Tokens, Push, and Universal 2nd Factor (U2F). In this show, we talk about how each works and the relative security merits of each.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Single Sign-On (SSO) in the real world is complicated and messy and how we got there is a byzantine maze of innovation and standards that has taken years. But, if zero trust is the first principle strategy we are all trying to pursue, getting Identity and Access Management (IAM) right is the most important tactic. And, SSO is a piece of the entire Identity and Access Management puzzle. Rick summarizes the history and current state of Single Sign-On with some Rick the Toolman thrown in.

Learn more about your ad choices. Visit megaphone.fm/adchoices

One way to reduce the risk of software supply chains is with a concept called a Software Bill of Materials (SBOMs). Standards bodies have been slowly working in the background for the past decade to move this concept into reality. On this episode Rick Howard discusses the current state of SBOMs, and throws some Rick the Toolman in as well.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rick Howard, N2K’s CSO and the CyberWire’s Chief Analyst, and Senior Fellow, interviews Andy Greenberg, Senior Writer at WIRED, regarding his new book, “Tracers in the Dark.”

Learn more about your ad choices. Visit megaphone.fm/adchoices

In order to understand the current state of the cybersecurity landscape, you must understand the history of how we got here. Rick summarizes the history along several threads: Firsts, adversary playbook names, government-commercial-academic entities, important papers and books, people, law, technologies, tools, and strategy-tactics.

Learn more about your ad choices. Visit megaphone.fm/adchoices

We’ve been wrestling with the idea of software development methodologies (Waterfall, Agile), infrastructure-as-code (cloud deployments, DevOps, DevSecOps) and coding best practices (OWASP, BSIMMS, SAMM) going on for two decades now. These are not independent systems. They overlap and interact. Up to this point, at least for the security side, they have been manual tasks, toil, that are prone to mistakes. We all know that automation can reduce the impact, at least be consistent with mistakes we make, and can offer a uniform fix across the enterprise once we have decided what to do. Automation is the key first principle strategy to get this done and DevOps/DevSecOps is the tactic we will all use to get there.Rick Howard takes us through the topic.

For a complete reading list and even more information, check out Rick’s more detailed essay on the topic.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Big thinkers from Lockheed Martin (kill chain), the Department of Defense (Diamond Model), and Mitre (ATT&CK Framework) gave us the blueprints of how to do intrusion kill chain prevention over a decade ago. It’s taken us that long for the rest of us mere cybersecurity mortals to get our heads around the key concepts. Rick Howard takes us through the models.

For a complete reading list and even more information, check out Rick’s more detailed essay on the topic.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this “Rick the Toolman” episode, Rick rethinks vulnerability management as a first principle zero trust tactic.

For a complete reading list and even more information, check out Rick’s more detailed essay on the topic.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The 2014 OPM hack: We can use cyber sand tables to enhance our cybersecurity first principle defenses since the concept, in various forms, have been used by military commanders, coaches, and athletes since the world was young. The show puts the OPM hack on the cyber sand table to see what might have been done differently.

For a complete reading list and even more information, check out Rick’s more detailed essay on the topic.

To access CyberWIre Pro only bonus material for CSO Perspectives, listen here.

Learn more about your ad choices. Visit megaphone.fm/adchoices