In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews Sam Curry, CISO of Zscaler. The focus of the conversation is on building relationships within and outside of the cybersecurity team. Sam shares his insights on the importance of alignment between cybersecurity and business counterparts, the challenges faced by CISOs, and the need for cybersecurity professionals to develop business skills. He emphasizes the four factors of trust and the role they play in building strong relationships. Sam also discusses the specific relationships that cybersecurity professionals need to cultivate, such as with the general counsel and finance teams. The episode concludes with practical advice on how to improve relationship-building skills and navigate the complexities of the cybersecurity field.

About Our Guest:

Sam Curry is a veteran in the field of cybersecurity, having witnessed its evolution from its nascent stages to its current complexities. Over the years, he has observed the field mature and transform significantly. Despite these advancements, Sam identifies a persistent challenge that hampers effective cybersecurity: the misalignment between information security and business operations. He emphasizes that while some professionals excel in bridging this gap, the tendency for cybersecurity to drift away from business priorities remains a recurring issue. Throughout his career, Sam has been dedicated to addressing this disconnect, striving for a more integrated approach to protect organizations better.

Key Takeaways:

• Building strong relationships between cybersecurity and business counterparts is crucial for the success of cybersecurity initiatives.
• The lack of alignment between cybersecurity and the business is a common problem in the industry, leading to burnout and short tenures for CISOs.
• Trust is a key factor in building relationships, and it is based on credibility, reliability, intimacy, and alignment.
• Cybersecurity professionals should develop business skills and be steeped in the core business of their organizations.
• It is important to establish relationships with key stakeholders such as the general counsel, finance teams, and customers to effectively address cybersecurity risks.
  
  

Listen to the full episode here. Stay tuned for more insightful stories, scenarios, and cybersecurity playbooks on CyberOXtales!

In this episode of CyberOXtales Podcast, host Neatsun Ziv, Co-Founder and CEO of OX Security, interviews Avishai Avivi, cybersecurity expert and CISO of SafeBreach. They discuss the intricacies of security frameworks versus actual security practices. Avishai shares his insights on the importance of focusing on security over compliance, highlighting the discrepancies between regulations and real security needs. The discussion emphasizes the need for a balanced approach involving people, processes, and tools in a security program. Avishai stresses the importance of understanding business risks and translating technical security concepts into language that resonates with executives. Through practical examples and a playbook approach, this episode underscores the necessity of aligning security measures with the organization's unique requirements for a robust and effective security program.

About Our Guest:
Avishai Avivi is a seasoned security expert and CISO with a rich history in managing the development of cutting-edge security products. His journey took off at Juniper, where he transitioned from working on security products to leading their development. It was during this period that Avishai first encountered various security frameworks such as NIST, ISO, and SOC. However, it wasn't until his tenure at Wells Fargo that he fully immersed himself in the world of frameworks, compliance, and regulations. This marked a significant shift from his previous role, underscoring his adaptability and deepening his expertise in the security domain.

Key Takeaways:

• Balance regulations and actual security measures for a robust cybersecurity program. Understand the law versus its intent.
• Help the company manage risks, not eliminate them. Translate technical risks to business terms for better understanding.
• Balance tools, people, and processes in your security program. Ensure all three pillars are well-developed and aligned.
• Use accessible language and mainstream examples to convey cybersecurity concepts to business leaders effectively.
• Regulations guide your security program, providing pointers for risk management. Translate them for practical implementation.
• Lack of a continuity plan can have severe consequences on business operations. Highlight the importance of business resilience.
• Use real-world examples from mainstream media to emphasize cybersecurity risks and the importance of effective security measures.
• Ensure a balanced approach across people, process, and tools in your security program for comprehensive protection and resilience.
  
  Listen to the full episode here. Stay tuned for more insightful stories, scenarios, and cybersecurity playbooks on CyberOXtales!

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews Ira Winkler, CISO and Vice President of CYE. They discuss the challenges faced by CISOs in obtaining the necessary budgets for their cybersecurity programs. Ira emphasizes the importance of CISOs understanding the business side of cybersecurity and being able to demonstrate the return on investment (ROI) of their efforts. He discusses the limitations of current risk quantification models, such as FAIR, and proposes a more advanced approach that combines machine learning and graph flow theory to calculate cyber risk and identify optimal countermeasures. Ira also highlights the need for CISOs to more effectively and efficiently communicate real threats and potential financial losses to the organization in order to justify their budget requests.

About Our Guest:

Ira Winkler is a renowned cybersecurity expert and award-winning CISO. He started his career as an intelligence analyst at the NSA before transitioning to become a computer systems analyst. Ira has worked for various government agencies and private companies, including HP and Walmart, where he held positions such as Chief Security Strategist and Chief Security Architect. He is currently the CISO at CYE Security, an Israeli company specializing in cyber risk optimization. Ira has authored seven books on cybersecurity and is recognized as a leading authority in the industry.

Key Takeaways:

• CISOs often struggle to obtain the budgets they need for their cybersecurity programs because they fail to demonstrate the ROI of their efforts.
• Understanding the business side of cybersecurity is crucial for CISOs to effectively communicate the value they bring to the organization.
• Risk quantification models like FAIR provide a high-level framework but lack the precision and actionable insights needed for budget justifications.
• Advanced approaches that combine machine learning, Monte Carlo algorithms, and graph flow theory can provide more accurate risk calculations and help identify the most effective countermeasures.
• CISOs should gather historical data, analyze industry trends, and highlight real-world examples of cyber threats to support their budget requests.

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews David B. Cross, CISO for the Oracle SaaS Cloud and Venture Partner with Rain Capital VC. They discuss the importance of having a playbook for handling data breaches and security incidents. David emphasizes the need for training and clear processes to ensure that everyone in an organization knows how to respond to potential security threats. He also highlights the importance of communication and collaboration between different teams and the need for a neutral facilitator during post-incident analysis.

About Our Guest:
David Cross is the CISO for the Oracle SaaS Cloud and a Venture Partner with Rain Capital VC. He has extensive experience in the cybersecurity space, with a background in the US Navy and over 17 years at Microsoft, where he worked on Windows security, Azure security, and cloud security. He also spent time leading the Google Cloud Security organization before joining Oracle. David is a respected expert in the field and is passionate about helping organizations improve their security practices.

Key Takeaways:

• All employees should receive training on how to identify and report potential security threats. Having a clear process in place ensures that everyone knows what to do in case of an incident.
• Organizations should establish a centralized contact point for reporting security incidents. This ensures that incidents are properly documented and assigned to the appropriate team for analysis and response.
• Having a playbook that outlines the steps to be taken during a security incident helps ensure a consistent and effective response. The playbook should include clear ownership and next steps for each stage of the incident response process.
• It's also important to have a process in place for double-checking and validating potential security threats. This helps prevent false positives and ensures that incidents are properly investigated and addressed.
• Conducting a thorough root cause analysis (RCA) and post-incident analysis is essential for learning from security incidents and improving future response efforts. This analysis should focus on identifying areas for improvement and implementing necessary changes.

In this episode of CyberOXtales Podcast, host Neatsun Ziv, CEO of OX Security, interviews Amy Chaney, a financial services senior risk executive, about her experience handling the Log4j vulnerability event while working at JPMorgan Chase and Company. Amy provides insights into the environment she worked in at the time and explains the severity and impact of Log4j. She discusses the steps taken to handle the event, including inventorying systems, creating a centralized war room, and disseminating information to various teams. Amy emphasizes the importance of modernization, automation, and agility in preparing for and responding to such events. She also highlights the need for a strong security posture and collaboration across teams to effectively manage and mitigate risks.

About Our Guest:

Amy Chaney is a financial services senior risk executive with over 25 years of experience in the industry. She has served in leadership roles across multiple domains and has worked at JPMorgan Chase and Company, a large and complex financial services firm. Amy has a strong background in risk management and has expertise in navigating complex environments and managing critical vulnerabilities.


Key Takeaways:

• The Log4j vulnerability, also known as Log4Shell, was a critical vulnerability discovered in the logging mechanism from Apache. It had widespread use and was easy to exploit, requiring no authentication. The severity of the vulnerability prompted immediate action from organizations globally.
• Building a centralized war room and establishing a drumbeat of communication and coordination is crucial in managing and responding to a large-scale event like the Log4j vulnerability. This ensures that the right information is disseminated, actions are prioritized, and progress is tracked.
• Having an accurate inventory of systems and applications is essential for understanding the scope of the vulnerability and prioritizing remediation efforts. This includes not only internal systems but also third-party and vendor networks.
• Modernization and automation play a significant role in effectively responding to vulnerabilities. By automating upgrades and patches, organizations can reduce the reliance on manual processes and minimize the risk of human error.
• Collaboration and teamwork are key in managing and mitigating risks. By bringing together different teams, including security, risk, legal, and business units, organizations can leverage diverse expertise and ensure a coordinated response.