Cybersecurity Refined and Feral

Is AI governance dead, or was it never actually alive? In this episode of Cybersecurity Refined and Feral, Candy and Cailin tackle the "elephant in the room"—Artificial Intelligence. While organizations are rushing to deploy AI at breakneck speed, the security guardrails are often left in the dust. To help us navigate this "Wild West," we are joined by two industry titans: Aruneesh Salhotra, a fractional CISO and global community builder, and Rock Lambros, CEO of RockCyber and author of The CISO Evolution.

Our guests pull back the curtain on the OWASP AI Exchange, a groundbreaking open-source project that serves as the "Rosetta Stone" for AI security. We move beyond the hype of GenAI to discuss how this framework provides over 300 pages of practical guidance for securing analytical, discriminative, and agentic AI systems.

In this episode, we discuss:

- The Evolution of OWASP: How a foundation built for web apps is adapting to the AI era.

- Beyond the Top 10: Why the AI Exchange is a comprehensive framework rather than just a list of vulnerabilities.

- The "Agentic" Threat: What happens to security when AI starts taking tangible actions instead of just answering questions.

- Data Security on Steroids: Why AI governance is fundamentally rooted in "bagging and tagging" your data.

- Global Impact: How the project is feeding directly into international standards like the EU AI Act.

Whether you are a CISO trying to explain AI risks to the board or a developer looking for actionable controls like the "Periodic Table of AI Security," this episode provides the map you need to move from "feral" chaos to "refined" resilience.

Resources Mentioned:

- OWASP AI Exchange: http://www.owaspai.org

- Connect with Aruneesh Salhotra: https://www.linkedin.com/in/aruneeshsalhotra/

- Connect with Rock Lambros: https://www.linkedin.com/in/rocklambros/

Is a SOC 2 attestation a vital proof of security or just a "rubber stamp" to keep procurement happy? In our latest episode of Cybersecurity Refined and Feral, Candy Alexander and Cailin join industry expert Rob to uncover the "Hard Truth" about the ROI of compliance.

We dig into the messy reality of audits, including:

- The Cost of Doing Business: Why SOC 2 is often the non-negotiable entry fee for selling to large enterprises.

- The "Magic Genie" Myth: Why GRC tools won't save you if you haven't made the philosophical shift to prioritize security every day.

- Operational Awareness: How the audit process actually teaches engineering and operations teams what they are supposed to be doing.

- The Power of Risk Assessments: How simply writing down your risks creates a "persuasion effect" that helps management prioritize security.

Whether you are a startup founder looking for a framework or a CISO navigating the "point-in-time" audit grind, this conversation is for you.

Cognitive Security in the Digital Age

Ever wonder how your thoughts, beliefs, and even decisions are being influenced by the digital world around you? In this groundbreaking episode of Cybersecurity Refined & Feral, Candy and Cailin sit down with Dr. Matthew Canham, founder of the Cognitive Security Institute, to explore the fascinating and often unsettling realm of cognitive security.

This isn't just about protecting data; it's about safeguarding the human mind in an increasingly connected and manipulated environment. Dr. Canham breaks down:

What is Cognitive Security? Understand this emerging field that focuses on protecting our perception, reasoning, and behavior from malicious influence.

Its Pervasive Impact: Discover how cognitive security threats are already affecting individuals, organizations, and society at large – often without us even realizing it.

The Alarming Role of Technology: We'll dive deep into the specific risks associated with various technologies, including the powerful capabilities of Artificial Intelligence (AI) and the vast availability of data, in shaping and manipulating human cognition.

Real-World Dangers: From disinformation campaigns and deepfakes to algorithmic biases and targeted persuasion, learn how these forces can be harnessed for both benign and malicious purposes.

This episode is a crucial listen for anyone navigating the modern information landscape. If you use technology, consume news, or simply exist in today's digital world, understanding cognitive security is no longer optional—it's essential for personal and organizational resilience. Tune in to arm yourself with knowledge and learn how to protect your most valuable asset: your mind.

Referenced Websites/links:

- https://www.cognitivesecurity.institute/

- https://darkbench.ai

- Cognitive Security Institute Youtube Channel: https://www.youtube.com/@cognitivesecurityinstitute

- Dr. Matthew Canham's LinkedIn Profile: https://www.linkedin.com/in/matthew-cognitivesecurity/

The cyber job market feels broken, doesn't it? Everyone says there's a talent shortage, but résumés are getting lost in a sea of applicants, and qualified pros can't seem to find a job. In this no-BS episode of Cybersecurity Refined & Feral, we cut through the noise and get to the truth behind the hiring crisis. We're joined by recruitment specialist Wayne Daley and ISSA New England Chapter VP Dan Bailey to give you the real story.

In this candid discussion, we tackle the paradox head-on:

- The AI/ML problem: How technology is both helping and hurting the job search, creating a "keyword challenge" for both applicants and recruiters.

- The rise of fractional C-suite roles: We discuss the pros and cons of this trend and why some organizations are turning to it.

- The overabundance of applicants: We explore why so many job postings are overwhelmed with unqualified respondents and how this impacts the hiring process.

- This episode isn't just about identifying the problems; it's about providing real solutions. We'll give you actionable advice on:

- Hacking the system: How to craft a resume that gets past the bots and lands on a human's desk.

- The power of networking: Why building a face-to-face network (even virtually) is more crucial than ever.

Whether you're an employer struggling to find the right talent or a professional looking to make your next career move, this episode is a must-listen. It's time to stop complaining about the problem and start implementing the solution.

Guest Information

- Wayne Daley is a veteran recruitment specialist with deep insights into the cybersecurity talent market.

- Dan Bailey is the Vice President of the ISSA New England Chapter and a seasoned professional with a strong understanding of industry trends and community building.

Are your Third-Party Risk Management (TPRM) efforts consuming valuable time and resources by answering Vendor Security Questionnaires without truly addressing risk? Join Candy and Cailin for a frank, no-holds-barred conversation with special guest Ross Young, the voice leading the charge to fix the fundamentally broken state of TPRM.

This episode dives into the painful realities of the "TPRM Time Sink":

- The Audit-Go-Round: We expose why the endless cycle of vendor questionnaires and compliance checklists has become a distraction, draining security teams while providing a false sense of security.

- Business Misalignment: We discuss how the TPRM process often fails to align with business objectives and executive priorities, leading to friction and ignored findings.

- Risk vs. Compliance: We challenge the notion that TPRM is rooted in auditing rather than continuous, actionable risk mitigation.

- Ross’s Simple Fix: Ross Young reveals his compelling vision for a simplified, modern TPRM framework that drastically reduces administrative burden and refocuses efforts on what truly matters to the business.

This is a critical listen for Business leaders, CISOs, and risk managers ready to move beyond the paperwork and implement an efficient, business-aligned TPRM program. Tune in to stop the treadmill and start mitigating genuine risk.

Join Candy and Cailin as they sit down with Ira for a chat that was not only incredibly insightful but also genuinely interesting, amusing, and entertaining! You know Ira for his sharp wit and candid perspectives, and this conversation is no exception.In this episode, we explore:The fascinating origins of Ira's trailblazing career in cybersecurity. The pivotal moments and accomplishments that defined his profound impact on the profession.His unique and often provocative insights into where the cybersecurity landscape is headed next.Practical advice for both seasoned professionals and those just beginning their cyber journey.If you appreciate deep wisdom delivered with a dose of humor and unvarnished truth, this is an episode you won't want to miss. Get ready to learn, laugh, and gain a fresh perspective from a true industry giant.

The Cloud Visionary: Jim Reavis on Cloud Security's Past, Present & Future

Join Candy and Cailin on "Cybersecurity Luminaries: History and Heroes" for an illuminating conversation with Jim Reavis, Co-founder and CEO of the Cloud Security Alliance (CSA)!

In this landmark episode, we sit down with the visionary who helped pave the way for secure cloud adoption globally. Jim takes us back to the dawn of cloud computing, revealing the critical insights that led him and his co-founders to establish the CSA over a decade ago.

Discover:

- The Early Cloud Frontier: What was cloud security like before it was a mainstream concept, and what challenges did pioneers face?

- The Birth of CSA: Hear the compelling story behind the founding of the Cloud Security Alliance and its initial mission to bring order and trust to the cloud.

- Defining Cloud Security: How frameworks like the CSA STAR and CCM became indispensable tools for organizations worldwide.

- Evolving Threats & Trends: Jim's unique perspective on the most pressing cloud security challenges today and what lies ahead, from AI to multi-cloud complexity.

- Building a Secure Future: Invaluable advice for cybersecurity professionals navigating the cloud landscape and how to stay ahead in this ever-changing domain.

Whether you're deeply immersed in cloud security, curious about its origins, or looking for insights from a true industry architect, this episode is a must-watch. Gain unparalleled perspective from a leader who has dedicated his career to making the cloud a safer place for everyone.

Don't miss this opportunity to learn from one of cybersecurity's most impactful figures!

#Cybersecurity #CloudSecurity #JimReavis #CloudSecurityAlliance #CSA #HistoryAndHeroes #Luminaries #CloudComputing #InformationSecurity #Podcast #Interview #CybersecurityHistory #CloudTrends #SecurityStandards

Feeling like a fraud in cybersecurity? You're not alone. Imposter syndrome – that persistent feeling of inadequacy despite evident success – is surprisingly common in our fast-paced and ever-evolving field. Join us on this episode as we shine a light on the shadowy corners of self-doubt that can plague even the most accomplished cybersecurity professionals.

We'll delve into:

- What exactly is imposter syndrome? Understanding its nuances and how it manifests in the cybersecurity context.

- Why cybersecurity professionals are particularly susceptible: Exploring the factors that contribute to these feelings in our industry, from the constant need to learn to the high-stakes nature of the work.

- The impact of imposter syndrome: How it can hinder career growth, impact mental well-being, and stifle innovation.

- Practical strategies to combat imposter syndrome: Actionable tips and techniques to recognize, challenge, and overcome these negative thought patterns.

- Building a supportive community: The importance of open conversations and shared experiences in normalizing and addressing imposter syndrome.

If you've ever felt like you're just "faking it 'til you make it," or that your achievements are down to luck rather than skill, this episode offers validation, understanding, and a roadmap to building genuine confidence in your cybersecurity journey. Tune in and know that you are not alone.

It's likely you're already doing it in some form, but do you know what it's truly called and how deep you really need to go? Join us as we break down the often-overlooked but crucial process of the BIA. We'll explore why not everyone, even at a basic system identification level, is formally conducting BIAs and what the potential risks are.

In this episode, we'll cut through the academic jargon and get practical. We'll define exactly what a BIA is, discuss the essential elements, and tackle the big question: How detailed does your BIA actually need to be to provide real value? Whether you're a seasoned risk management professional or just starting to grapple with business continuity, this episode will offer actionable insights on how to simplify and effectively implement BIAs within your organization. Tune in to make BIAs less daunting and more impactful!

Uncover the hidden dynamics between your cybersecurity team and the rest of the organization in "Perceptions of Cybersecurity." This insightful podcast delves into the common viewpoints held about the cybersecurity group – from being seen as the "department of no" to the misunderstood complexities of their daily battles.

Join us as we dissect why these perceptions arise, exploring factors like a lack of clear communication, the technical nature of the work, and the impact of security measures on day-to-day operations. More importantly, we'll equip you with actionable strategies to bridge the gap in understanding. Learn how cybersecurity professionals can better communicate their value, foster collaboration, and cultivate a culture of security awareness that resonates across all departments.

"Perceptions of Cybersecurity" is your guide to building stronger relationships, fostering trust, and ensuring that cybersecurity is seen not as an obstacle, but as a vital enabler of organizational success. Tune in to transform how your organization views – and works with – its cybersecurity team.