CyberOXtales

In this episode of CyberOXTales Podcast, host Neatsun Ziv, CEO of OX Security, welcomes Yabing Wang, VP, Information Security & CISO of Justworks. They explore how to effectively communicate cybersecurity risks to the board, avoid common pitfalls in board presentations, and align cybersecurity with business priorities. Yabing shares her unique experience bridging technical and business leadership roles, offering practical advice for security professionals at the executive level.

About Our Guest:

Yabing Wang is the VP, Information Security & CISO of Justworks, a New York-based company specializing in payroll, benefits, and insurance services. With over 20 years of experience in cybersecurity and former roles at Netscape and HEB, Yabing has a rich background in both technical and executive leadership.

Connect with Yabing: LinkedIn

Key Takeaways:

• Use plain language and relatable examples when communicating cybersecurity risks to non-technical board members.
• Avoid focusing solely on metrics. Frame the data within the broader security context to show progress and highlight key risks.
• While CISOs act as advisors on risk, business owners should ultimately own the risk decisions.
• Yabing discusses the benefits of reporting to general counsel versus traditional IT reporting lines, offering unique visibility to the board.
• Yabing shares details about his new book, 97 Things Every Application Security Professional Should Know, a comprehensive guide for security professionals.

In this episode of CyberOXTales Podcast, host Neatsun Ziv, CEO of Ox Security, welcomes Tyson Kopczynski, a former CISO with over 20 years of experience in healthcare and FinTech. They discuss the concept of 'near hit' incidents, communicating cybersecurity risks to management, and the importance of a structured incident response plan. Tyson shares practical advice on how to approach communication with different stakeholders during incidents and reflects on his new role as a virtual CISO, contrasting it with being a full-time CISO. The episode provides valuable insights into effective incident management and adaptive cybersecurity strategies.

About Our Guest:

Tyson Kopczynski is a seasoned cybersecurity professional with over 20 years of experience in the industry. He has served as the Chief Security Officer (CSO) at Aledade and Oportun, working extensively in the healthcare and FinTech sectors. Tyson is a respected industry expert, author, and speaker, collaborating with various venture capitalists and startups. Currently transitioning to a Virtual Chief Information Security Officer (vCISO) role, Tyson aims to leverage his expertise to help organizations enhance their security practices.

Connect with Tyson: LinkedIn

Key Takeaways:

• Effective communication with management during incidents involves presenting a structured plan and keeping stakeholders informed.
• Engaging with the board requires a more informative and high-level approach to provide confidence in the security response.
• Structured incident response plans help maintain control and mitigate risks during cybersecurity incidents.
• Transitioning to a vCISO role offers a fresh perspective and diverse experiences to assist organizations in bolstering their security postures.

Listen to the full episode here. Stay tuned for more insightful stories, scenarios, and cybersecurity playbooks on CyberOxTales!

In this episode of CyberOxTales Podcast, host Neatsun Ziv, CEO of Ox Security, interviews Eli Edelkind, Head of Cybersecurity at CAVA, shedding light on the pivotal role of visibility in cybersecurity practices. Eli emphasizes the evolution of cybersecurity towards prioritizing visibility to enhance risk management and control efficacy. Through insightful anecdotes and practical examples, Eli illustrates how a proactive approach to visibility enables organizations to fortify their cybersecurity posture and navigate evolving threats effectively.

About Our Guest:

Eli Edelkind is a seasoned cybersecurity professional currently serving as the head of cybersecurity at CAVA, a fast-casual Mediterranean restaurant chain expanding nationwide. With a wealth of experience in the cybersecurity domain, Eli excels in establishing visibility, risk prioritization, and effective communication strategies within his organization. His expertise lies in aligning cybersecurity initiatives with business objectives, providing a secure environment while enabling operational efficiency.

Connect with Eli: LinkedIn

Key Takeaways:

• Establishing visibility is paramount in cybersecurity to effectively understand risks and prioritize tasks.
• Prioritizing risks based on people, applications, and infrastructure allows for targeted security control implementation.
• Cybersecurity professionals should communicate potential risks transparently to stakeholders, aligning with business objectives.
• Keeping pace with state-specific privacy regulations is essential in industries like restaurants to ensure compliance.
• Collaborating with legal teams, industry networks, and internal stakeholders aids in adapting cybersecurity strategies to evolving regulatory landscapes.

Listen to the full episode here. Stay tuned for more insightful stories, scenarios, and cybersecurity playbooks on CyberOxTales!

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews Sam Curry, CISO of Zscaler. The focus of the conversation is on building relationships within and outside of the cybersecurity team. Sam shares his insights on the importance of alignment between cybersecurity and business counterparts, the challenges faced by CISOs, and the need for cybersecurity professionals to develop business skills. He emphasizes the four factors of trust and the role they play in building strong relationships. Sam also discusses the specific relationships that cybersecurity professionals need to cultivate, such as with the general counsel and finance teams. The episode concludes with practical advice on how to improve relationship-building skills and navigate the complexities of the cybersecurity field.

About Our Guest:

Sam Curry is a veteran in the field of cybersecurity, having witnessed its evolution from its nascent stages to its current complexities. Over the years, he has observed the field mature and transform significantly. Despite these advancements, Sam identifies a persistent challenge that hampers effective cybersecurity: the misalignment between information security and business operations. He emphasizes that while some professionals excel in bridging this gap, the tendency for cybersecurity to drift away from business priorities remains a recurring issue. Throughout his career, Sam has been dedicated to addressing this disconnect, striving for a more integrated approach to protect organizations better.

Key Takeaways:

• Building strong relationships between cybersecurity and business counterparts is crucial for the success of cybersecurity initiatives.
• The lack of alignment between cybersecurity and the business is a common problem in the industry, leading to burnout and short tenures for CISOs.
• Trust is a key factor in building relationships, and it is based on credibility, reliability, intimacy, and alignment.
• Cybersecurity professionals should develop business skills and be steeped in the core business of their organizations.
• It is important to establish relationships with key stakeholders such as the general counsel, finance teams, and customers to effectively address cybersecurity risks.
  
  

Listen to the full episode here. Stay tuned for more insightful stories, scenarios, and cybersecurity playbooks on CyberOXtales!

In this episode of CyberOXtales Podcast, host Neatsun Ziv, Co-Founder and CEO of OX Security, interviews Avishai Avivi, cybersecurity expert and CISO of SafeBreach. They discuss the intricacies of security frameworks versus actual security practices. Avishai shares his insights on the importance of focusing on security over compliance, highlighting the discrepancies between regulations and real security needs. The discussion emphasizes the need for a balanced approach involving people, processes, and tools in a security program. Avishai stresses the importance of understanding business risks and translating technical security concepts into language that resonates with executives. Through practical examples and a playbook approach, this episode underscores the necessity of aligning security measures with the organization's unique requirements for a robust and effective security program.

About Our Guest:
Avishai Avivi is a seasoned security expert and CISO with a rich history in managing the development of cutting-edge security products. His journey took off at Juniper, where he transitioned from working on security products to leading their development. It was during this period that Avishai first encountered various security frameworks such as NIST, ISO, and SOC. However, it wasn't until his tenure at Wells Fargo that he fully immersed himself in the world of frameworks, compliance, and regulations. This marked a significant shift from his previous role, underscoring his adaptability and deepening his expertise in the security domain.

Key Takeaways:

• Balance regulations and actual security measures for a robust cybersecurity program. Understand the law versus its intent.
• Help the company manage risks, not eliminate them. Translate technical risks to business terms for better understanding.
• Balance tools, people, and processes in your security program. Ensure all three pillars are well-developed and aligned.
• Use accessible language and mainstream examples to convey cybersecurity concepts to business leaders effectively.
• Regulations guide your security program, providing pointers for risk management. Translate them for practical implementation.
• Lack of a continuity plan can have severe consequences on business operations. Highlight the importance of business resilience.
• Use real-world examples from mainstream media to emphasize cybersecurity risks and the importance of effective security measures.
• Ensure a balanced approach across people, process, and tools in your security program for comprehensive protection and resilience.
  
  Listen to the full episode here. Stay tuned for more insightful stories, scenarios, and cybersecurity playbooks on CyberOXtales!

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews Ira Winkler, CISO and Vice President of CYE. They discuss the challenges faced by CISOs in obtaining the necessary budgets for their cybersecurity programs. Ira emphasizes the importance of CISOs understanding the business side of cybersecurity and being able to demonstrate the return on investment (ROI) of their efforts. He discusses the limitations of current risk quantification models, such as FAIR, and proposes a more advanced approach that combines machine learning and graph flow theory to calculate cyber risk and identify optimal countermeasures. Ira also highlights the need for CISOs to more effectively and efficiently communicate real threats and potential financial losses to the organization in order to justify their budget requests.

About Our Guest:

Ira Winkler is a renowned cybersecurity expert and award-winning CISO. He started his career as an intelligence analyst at the NSA before transitioning to become a computer systems analyst. Ira has worked for various government agencies and private companies, including HP and Walmart, where he held positions such as Chief Security Strategist and Chief Security Architect. He is currently the CISO at CYE Security, an Israeli company specializing in cyber risk optimization. Ira has authored seven books on cybersecurity and is recognized as a leading authority in the industry.

Key Takeaways:

• CISOs often struggle to obtain the budgets they need for their cybersecurity programs because they fail to demonstrate the ROI of their efforts.
• Understanding the business side of cybersecurity is crucial for CISOs to effectively communicate the value they bring to the organization.
• Risk quantification models like FAIR provide a high-level framework but lack the precision and actionable insights needed for budget justifications.
• Advanced approaches that combine machine learning, Monte Carlo algorithms, and graph flow theory can provide more accurate risk calculations and help identify the most effective countermeasures.
• CISOs should gather historical data, analyze industry trends, and highlight real-world examples of cyber threats to support their budget requests.

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews David B. Cross, CISO for the Oracle SaaS Cloud and Venture Partner with Rain Capital VC. They discuss the importance of having a playbook for handling data breaches and security incidents. David emphasizes the need for training and clear processes to ensure that everyone in an organization knows how to respond to potential security threats. He also highlights the importance of communication and collaboration between different teams and the need for a neutral facilitator during post-incident analysis.

About Our Guest:
David Cross is the CISO for the Oracle SaaS Cloud and a Venture Partner with Rain Capital VC. He has extensive experience in the cybersecurity space, with a background in the US Navy and over 17 years at Microsoft, where he worked on Windows security, Azure security, and cloud security. He also spent time leading the Google Cloud Security organization before joining Oracle. David is a respected expert in the field and is passionate about helping organizations improve their security practices.

Key Takeaways:

• All employees should receive training on how to identify and report potential security threats. Having a clear process in place ensures that everyone knows what to do in case of an incident.
• Organizations should establish a centralized contact point for reporting security incidents. This ensures that incidents are properly documented and assigned to the appropriate team for analysis and response.
• Having a playbook that outlines the steps to be taken during a security incident helps ensure a consistent and effective response. The playbook should include clear ownership and next steps for each stage of the incident response process.
• It's also important to have a process in place for double-checking and validating potential security threats. This helps prevent false positives and ensures that incidents are properly investigated and addressed.
• Conducting a thorough root cause analysis (RCA) and post-incident analysis is essential for learning from security incidents and improving future response efforts. This analysis should focus on identifying areas for improvement and implementing necessary changes.

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews Amy Chaney, a financial services senior risk executive, about her experience handling the Log4j vulnerability event while working at JPMorgan Chase and Company. Amy provides insights into the environment she worked in at the time and explains the severity and impact of Log4j. She discusses the steps taken to handle the event, including inventorying systems, creating a centralized war room, and disseminating information to various teams. Amy emphasizes the importance of modernization, automation, and agility in preparing for and responding to such events. She also highlights the need for a strong security posture and collaboration across teams to effectively manage and mitigate risks.

About Our Guest:

Amy Chaney is a financial services senior risk executive with over 25 years of experience in the industry. She has served in leadership roles across multiple domains and has worked at JPMorgan Chase and Company, a large and complex financial services firm. Amy has a strong background in risk management and has expertise in navigating complex environments and managing critical vulnerabilities.


Key Takeaways:

• The Log4j vulnerability, also known as Log4Shell, was a critical vulnerability discovered in the logging mechanism from Apache. It had widespread use and was easy to exploit, requiring no authentication. The severity of the vulnerability prompted immediate action from organizations globally.
• Building a centralized war room and establishing a drumbeat of communication and coordination is crucial in managing and responding to a large-scale event like the Log4j vulnerability. This ensures that the right information is disseminated, actions are prioritized, and progress is tracked.
• Having an accurate inventory of systems and applications is essential for understanding the scope of the vulnerability and prioritizing remediation efforts. This includes not only internal systems but also third-party and vendor networks.
• Modernization and automation play a significant role in effectively responding to vulnerabilities. By automating upgrades and patches, organizations can reduce the reliance on manual processes and minimize the risk of human error.
• Collaboration and teamwork are key in managing and mitigating risks. By bringing together different teams, including security, risk, legal, and business units, organizations can leverage diverse expertise and ensure a coordinated response.