Defense in Depth

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our guest, Adam Glick, CISO, PSG.

In this episode:

• Vendors need to reach out to CISOs, but what does a successful approach look like?

• Do vendors often spray and pray with outreach, rather than doing a bare minimum of research?

• What else can vendors do to try to create meaningful outreach to CISOs?

• How do you like security sales professionals to build a relationship with you?

Thanks to our podcast sponsor, Praetorian

Praetorian helps companies adopt a prevention-first cybersecurity strategy by actively uncovering vulnerabilities and minimizing potential weaknesses before attackers can exploit them.

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining me is our guest, Erik Decker, CISO, Intermountain Health.

In this episode:

• Why are we all struggling trying to manage third-party risk?
• Why do the hated questionnaires seem like compliance checkbox efforts?
• Does anyone believe it reduces risk?
• What's the right approach and how do you strike the right balance?

Thanks to our podcast sponsor, Praetorian

Praetorian helps companies adopt a prevention-first cybersecurity strategy by actively uncovering vulnerabilities and minimizing potential weaknesses before attackers can exploit them.

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining me is our sponsored guest, Trevor Hilligoss, senior director of security research, SpyCloud.

In this episode:

• What are the things that raise red flags that you're about to experience an attack?
• What signals set off your Spidey sense that things could go sideways?
• What are the early warning signs an attack is underway?
• Did you learn anything new?

Thanks to our podcast sponsor, SpyCloud

Get ahead of ransomware attacks by acting on a common precursor: infostealer malware. SpyCloud recaptures what's stolen from infostealer-infected systems, and alerts your team to take action before compromised authentication data can be used by criminals to target your business. Get our latest research and check your malware exposure at spycloud.com/ciso.

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining me is our guest, David Christensen, VP, CISO, PlanSource.

In this episode:

• How do you actually focus your patching efforts on the vulnerabilities that are seen as universally holding the most risk?
• With limited resources, is it possible to "patch all the things"?
• How do we focus patching efforts to fix the most vital issues quickly?
• What are the risks we're dealing with?

Thanks to our podcast sponsor, SpyCloud

Get ahead of ransomware attacks by acting on a common precursor: infostealer malware. SpyCloud recaptures what's stolen from infostealer-infected systems, and alerts your team to take action before compromised authentication data can be used by criminals to target your business. Get our latest research and check your malware exposure at spycloud.com/ciso.

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our guest, Jerich Beason, CISO, WM.

In this episode:

• Does generative AI come with a new set of risks?
• How can we address these risks to take advantage of its benefits?
• How do we approach a much desired technology we're not so sure how we should secure?
• How can we take what we've learned from past technological advances and apply it to mitigate risks with generative AI?

Thanks to our podcast sponsor, SpyCloud

Get ahead of ransomware attacks by acting on a common precursor: infostealer malware. SpyCloud recaptures what's stolen from infostealer-infected systems, and alerts your team to take action before compromised authentication data can be used by criminals to target your business. Get our latest research and check your malware exposure at spycloud.com/ciso.

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our sponsored guest, Himaja Motheram, Censys.

In this episode:

• How can one create a security program around unknown problems?
• Don't we know a lot of the things we lack visibility into that can cause security issues?
• But what about the things you don't even know about in the first place?
• Will that thing we don't even know to look at, ever cause a security issue?

Thanks to our podcast sponsor, Censys

Censys is the leading Internet Intelligence Platform for Threat Hunting and Exposure Management. We provide the most comprehensive, accurate, and up-to-date map of the internet, which scans 45x more services than the nearest competitor across the world's largest certificate database (>10B). Learn more at www.censys.com.

All links and images for this episode can be found on CISO Series.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Russell Spitler, CEO and co-founder, Nudge Security.

In this episode:

• Are businesses walking a tightrope with generative AI?
• How can organizations implement generative AI responsibly?
• What can we learn from previous transitions that can help us responsibly bring generative AI into the workplace milieu?
• What else are we missing?

Thanks to our podcast sponsor, Nudge Security

Nudge Security provides complete visibility of every SaaS and cloud account ever created by anyone in your org, in minutes. No agents, browser plug-ins or network proxies required. With this visibility, you can discover shadow IT, manage your SaaS attack surface, secure SaaS access, and respond effectively to SaaS breaches.

All links and images for this episode can be found on CISO Series.

In increasingly complex technical defenses, threat actors frequently target the human element. This makes them a top attack vectors, but are they actually the weak leak in your defenses?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us is our guest, Christina Shannon, CIO, KIK Consumer Products.

Thanks to our podcast sponsor, SPHERE

SPHERE is the Identity Hygiene pioneer. It closes the loop on ownership, certification, and remediation challenges through an automated remediation process. By working with the IAM and PAM solutions organizations have in place, SPHEREboard automates discovery and remediation on an ongoing basis. Learn more at sphereco.com!

In this episode:

• Threat actors frequently target the human element, but are they actually the weak leak in your defenses?
• Have we been treating humans wrong in our environment?
• Is the blame on security professionals for failing to design security systems to set humans up for success?
• Is it disingenuous to presume that cybersecurity would be perfect if not for users?

All links and images for this episode can be found on CISO Series.

We often talk about the contradiction of seemingly entry-level security jobs requiring years of experience. But maybe that's because entry-level jobs don't actually exist.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Joining us this week is our guest Jay Wilson, CISO, Insurity.

Thanks to our podcast sponsor, SlashNext

SlashNext Complete delivers zero-hour protection for how people work today across email, mobile, and browser apps. With SlashNext's generative AI to defend against advanced business email compromise, smishing, spear phishing, executive impersonation, and financial fraud, your people are always protected anywhere they work. Request a demo today.

In this episode:

• What's "entry level" in cybersecurity and does it even exist?
• What causes the contradiction of seemingly entry-level security jobs requiring years of experience?
• Why does it seem like there are still no entry level jobs?
• How do job candidates get creative with their experience to get a foot in the door?

All links and images for this episode can be found on CISO Series.

The Securities and Exchange Commission issued new cyber rules. What do these new rules mean for CISOs and will they ultimately improve our cybersecurity posture?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our guest, Jamil Farshchi, CISO, Equifax.

Thanks to our podcast sponsor, Nudge Security

Nudge Security provides complete visibility of every SaaS and cloud account ever created by anyone in your org, in minutes. No agents, browser plug-ins or network proxies required. With this visibility, you can discover shadow IT, manage your SaaS attack surface, secure SaaS access, and respond effectively to SaaS breaches.

In this episode:

• The Securities and Exchange Commission issued new cyber rules.
• What do these new rules mean for CISOs and will they ultimately improve our cybersecurity posture?
• Are these rules something to celebrate, or are they just going to make a CISOs compliance efforts even more difficult?
• For those companies who actually follow the guidance, will this step up their cyber game considerably?