In episode 111 of Cybersecurity Where You Are, Tony Sager is joined by Rick Howard, N2K Chief Security Officer and the Chief Analyst and Senior Fellow at The Cyberwire. Together, they discuss a first principle of cybersecurity proposed by Rick in his book, Cybersecurity First Principles: A Reboot of Strategy and Tactics.

Here are some highlights from our episode:

• 04:30. What drove the need to formulate a foundational cybersecurity assumption
• 07:44. How other "first" principles of cybersecurity have failed
• 14:13. The three elements of Rick's first principle of cybersecurity
• 25:55. How to derive action and improvements from Rick's first principle
• 40:34. Tips on getting started with a risk forecasting strategy

Resources

• Episode 105: Context in Cyber Risk Quantification
• FAIR: A Framework for Revolutionizing Your Risk Analysis
• Election Security Spotlight – CIA Triad
• Episode 44: A Zero Trust Framework Knows No End
• Executive Order on Improving the Nation’s Cybersecurity
• Cybersecurity Canon
• Superforecasting: The Art and Science of Prediction
• How to Measure Anything in Cybersecurity Risk

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 110 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Lee Noriega, Executive Director of the Cybersecurity Services Organization and Acting General Manager of Sales and Business Services at the Center for Internet Security® (CIS®); and Jerry Gitchel, founder of Leverage Unlimited and listener to Cybersecurity Where You Are. Together, they examine a question sent in by Jerry: if a corporate culture is lacking, can a security culture exist?

Here are some highlights from our episode:

• 01:33. What security culture is and how it differs from corporate culture
• 05:30. What elements factor into a strategy to drive corporate culture
• 09:30. The importance of a feedback loop for culture
• 15:43. How to cultivate "institutional ownership" in an organization's workforce
• 19:03. What goes into fostering security consciousness in support of security champions
• 25:14. The challenges of engaging corporate culture to think about security culture
• 29:13. Examples and takeaways for listeners

Resources

• Why Employee Cybersecurity Awareness Training Is Important
• Episode 107: Continuous Improvement via Secure by Design
• Seth Godin | Why People Like Us Do This
• The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 109 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Randy Rose, VP of Security Operations & Intelligence at the Center for Internet Security® (CIS®); and Theodore "TJ" Sayers, Director of Intelligence & Incident Response at CIS. Together, they examine the scariest malware of 2024 and share some recommendations for how organizations can keep up with the changing cyber threat landscape.

Here are some highlights from our episode:

• 01:32. What makes certain malware strains "scarier" than others
• 05:37. What trends shaped the cyber threat landscape in 2024
• 14:25. The most terrifying cyber threat actor sphere in 2024
• 19:41. How malware tactics and techniques from 2024 will continue to evolve
• 25:04. How individuals and organizations can proactively defend themselves
• 29:52. National strategies that are shaping malware defense and incident response

Resources

• Top 10 Malware Q3 2024
• Election Security Spotlight – What Is Misinformation?
• Salt Typhoon Hacks of Telecommunications Companies and Federal Response Implications
• Episode 107: Continuous Improvement via Secure by Design

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 108 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Ed Skoudis, CEO of Counter Hack Challenges and President of SANS Technology Institute. Together, they discuss the evolution of gaming and competition in cybersecurity and how these activities help to make the industry stronger.

Here are some highlights from our episode:

• 02:04. What goes into creating a game environment that attracts all kinds of skill levels
• 04:43. A multi-disciplinary approach to creating a game environment
• 16:14. How gaming and competition help to spot people with talent and potential
• 23:32. The challenges of keeping pace with new technology
• 32:03. The biggest challenges of putting a game environment together
• 36:47. How to keep track of characters, situations, and story elements of a game

Resources

• SANS Cyber Ranges
• SANS Holiday Hack Challenge
• Episode 59: Probing the Modern Role of the Pentest
• Episode 95: AI Augmentation and Its Impact on Cyber Defense
• LockBit 3.0 RaaS Gang Incorporates BlackMatter Capabilities

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 107 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Steve Lipner, Executive Director of SAFECode. Together, they discuss how software development organizations can use principles of "secure by design" to get on a track of continuous improvement.

Here are some highlights from our episode:

• 01:38. Steve's background and thoughts on the emergence of secure by design
• 14:04. Three guiding principles of secure software development
• 16:13. The impact of security awareness from a developer's perspective
• 22:22. How threat modeling helps to address security as a system problem
• 25:37. The effect of modern software development methodologies like Agile and DevSecOps
• 30:29. What CISA's activity around secure by design means for the industry

Resources

• SAFECode
• Secure Software Development Framework (SSDF)
• Embedded IoT Security: Helping Vendors in the Design Process
• Episode 95: AI Augmentation and Its Impact on Cyber Defense

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 106 of Cybersecurity Where You Are, Sean Atkinson is joined by Chris Smith, Social Media Specialist at the Center for Internet Security® (CIS®).

Together, they use a donation scam about a natural disaster to advise how you can stay safe against this type of cyber threat.

Here are some highlights from our episode:

• 00:49. Why it's important to talk about donation scams and why they're so prevalent
• 05:13. Recounting a real-world example of a donation scam
• 10:43. Common tactics leveraged by online scammers
• 13:27. Guidance for defending against a donation scam
• 16:48. The rise of checks and balances to defend against crowdfunding scams
• 20:59. How research can help you to verify before you donate
• 29:11. What to do if you have fallen for a scam

Resources

• Episode 27: Cyber Scams
• October: Cybersecurity Awareness Month

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 105 of Cybersecurity Where You Are, Sean Atkinson discusses the importance of context in maturing how you use cyber risk quantification to build cases for risk treatment strategies.

Here are some highlights from our episode:

• 01:56. The inspiration for an episode on cyber risk quantification
• 02:38. How to situate risk quantification in your business processes
• 08:56. Traps to avoid when quantifying cyber risks
• 12:12. How the quantification process relates to controls implementation
• 16:50. Why the right people and data can help you build something sustainable
• 23:19. Three lenses for examining cyber risk
• 26:50. Different means for communicating risk to stakeholders

Resources

• Quantitative Risk Analysis: Its Importance and Implications
• FAIR: A Framework for Revolutionizing Your Risk Analysis
• CIS Critical Security Controls®
• CIS Risk Assessment Method
• 6 Truths of Cyber Risk Quantification
• Society of Information Risk Analysts

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 104 of Cybersecurity Where You Are, Sean Atkinson is joined by Kennidi Ortega, Information Security Analyst at the Center for Internet Security® (CIS®).

Together, they explore the experience of a first-year analyst and how they might make the most of getting started in a cybersecurity career.

Here are some highlights from our episode:

• 01:07. How Kennidi got started in cybersecurity and what led her to the field
• 03:44. What the beginning of Sean's cybersecurity career looked like
• 04:23. The biggest challenges a first-year analyst may face
• 07:56. Helpful resources for getting started in the cybersecurity industry
• 11:58. Which technical skills Kennidi sharpened the quickest in her role
• 16:05. The most important business skills for planning a future in cybersecurity
• 20:13. How an agile mindset in cybersecurity supports career growth
• 23:00. Recommendations on career mapping for first-year analysts
• 28:13. The value of mentorships in cybersecurity

Resources

• Episode 103: Education vs. Experience in Cybersecurity
• Episode 54: How to Get Started in Cybersecurity
• Episode 15: Cybersecurity Success Takes Soft Skills
• Episode 45: The Importance of Mentorship
• TryHackMe
• SANS Cyber Security Summits
• PancakesCon
• Trace Labs
• Backdoors & Breaches
• Raices Cyber
• CyberWarrior
• Cyber.org
• Women in CyberSecurity

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 103 of Cybersecurity Where You Are, Sean Atkinson examines education and experience as pathways for new professionals to enter the cybersecurity industry.

Here are some highlights from our episode:

• 01:42. What's motivating Sean to talk about this topic
• 03:32. The value of cybersecurity degrees
• 05:17. The pros and cons of degree programs in cybersecurity
• 07:47. How a cybersecurity certification compares to a degree
• 10:57. Considerations for pursuing a certification in cybersecurity
• 14:00. Using certifications to learn new technology paradigms
• 16:54. Why a breadth of practical experience is important
• 22:49. Pathways for gaining experience in cybersecurity

Resources

• Episode 75: How GenAI Continues to Reshape Cybersecurity
• Episode 59: Probing the Modern Role of the Pentest
• Outliers: The Story of Success
• Hack The Box
• TryHackMe
• David Bombal
• IppSec
• PortSwigger
• John Hammond

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].

In episode 102 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by the following guests:

• Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®)
• Lawrence Cruciana, President of Corporate Information Technologies (CorpInfoTech)

Together, they discuss the "sporty" rigor underlying the process and value of achieving CIS Controls Accreditation.

Here are some highlights from our episode:

• 01:36. What is meant by CIS Controls Accreditation, as certified by CREST
• 03:32. What motivated CorpInfoTech to pursue accreditation
• 07:47. The importance of CIS Controls Accreditation to the cybersecurity ecosystem
• 20:07. The business value of accreditation for recipients

Resources

• CIS Controls Accreditation
• CorpInfoTech Receives First CIS Controls Accreditation
• CorpInfoTech
• Top Hurdles for MSSPs and One Shining Solution
• CIS Community Defense Model 2.0
• Episode 44: A Zero Trust Framework Knows No End

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].