Defense in Depth

All links and images for this episode can be found on CISO Series.

What are we doing to improve access management? Make it too loose and it's the number one way organizations get breached. Put on too many controls and now you've got irritated users just trying to do their job. How does each organization find their sweet spot?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Paul Guthrie (@pguthrie), information security officer, Blend.

Thanks to our podcast sponsor, Opal

Opal is building the next generation of intelligent identity. Identity is one of the last great enterprise frontiers. It's fragmented with legacy architecture. Opal's mission is to empower teams to understand and calibrate access end to end, and to build identity security for scale. Learn more by at www.opal.dev

In this episode:

• What is the one most significant action you've taken to improve access management?
• What are we doing to improve access management?
• What is the correct balance between too many controls and not enough?
• How does each organization find their sweet spot?

All links and images for this episode can be found on CISO Series.

With the growth of business-led IT, does SaaS security need to be a specific focus in a CISO's architectural strategy?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Steve Zalewski who also hosts Defense in Depth.

Thanks to our podcast sponsor, AppOmni

Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.

In this episode:

• With the growth of business-led IT, does SaaS security need to be a specific focus in a CISO's architectural strategy?
• Is the problem the architecture of the applications themselves or the fact that a non-security group is bringing these applications online? Is it both?
• Is this problem solvable?
• What technical controls can you put in place to mitigate risk from apps you deem risky?

All links and images for this episode can be found on CISO Series.

When it comes to data, compliance, and reducing risk, where are we gaining control? Where are we losing control? And what are we doing about that?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. We welcome our sponsored guest Amer Deeba, CEO and Co-founder, Normalyze.

Thanks to our podcast sponsor, Normalyze

Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches. Discover, visualize, and secure your cloud data in minutes with Normalyze Freemium.

In this episode:

• When it comes to data, compliance, and reducing risk, where are we gaining control?
• Where are we losing control? And what are we doing about that?
• Is "losing control" inevitable?
• Is SaaS really extremely difficult to work with at scale?

All links and images for this episode can be found on CISO Series.

If you're struggling to get your first job in security or you're trying to get back into the industry after being laid off, you need to lean on your security community. But like networking, you should find it before you need it.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski.

Thanks to our podcast sponsor, Egress

Egress helps organization stop email security risks is by addressing both inbound and outbound threats together,. We recognize that people get hacked, make mistakes, and break the rules. Egress's Intelligent Cloud Email Security suite uses patented self-learning technology to detect sophisticated inbound and outbound threats, and protect against data loss. Learn more at egress.com.

In this episode:

• Are you struggling to get your first job in security or trying to get back into the industry after being laid off?
• What is the importance of building your security community network ?
• What should you look for in a community?
• What should you expect to put into it, and what should you expect to get back?

All links and images for this episode can be found on CISO Series.

What should a cyber job description require, and what shouldn't it? What's reasonable and not reasonable?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Rob Duhart (@robduhart), deputy CISO, Walmart.

Thanks to our podcast sponsor, Normalyze

Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches. Discover, visualize, and secure your cloud data in minutes with Normalyze Freemium.

In this episode:

• What should a cyber job description require, and what shouldn't it? What's reasonable and not reasonable?
• Do these completely unrealistic job descriptions hurt the entire industry?
• What is it we need to put in a cyber job description, and what do we need to leave out?
• Who's losing out here?

All links and images for this episode can be found on CISO Series.

Since so much technology today is not launched by the IT department, but by business units themselves. How do security professionals engage with business and application owners and have a conversation about security policy and procedures?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Harold Byun (@haroldnhoward), chief product officer, AppOmni.

Thanks to our podcast sponsor, AppOmni

Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.

In this episode:

• What's your experience talking about security policy and procedures with business and application owners?
• How do security professionals engage with business and application owners?
• How do they have a conversation about security policy and procedures?
• Is there anything you learned that you didn't realize before?

All links and images for this episode can be found on CISO Series.

There are millions of cybersecurity jobs open. Over time, that number has just been growing. What we're doing now does not seem to be working. So what's it going to take to fill all these jobs quickly?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Rich Gautier, former CISO for the U.S. Department of Justice, Criminal Division.

Thanks to our podcast sponsor, Brinqa

Understand your cyber assets, prioritize vulnerabilities, automate remediation, and continuously monitor cyber hygiene across the entire attack surface — infrastructure, applications and cloud — with Brinqa. See how at brinqa.com.

In this episode:

• There are millions of cybersecurity jobs open. What's it going to take to fill all these jobs quickly?
• Are job description requirements partially to blame for holding back the industry from tapping into greater diversity of expertise?
• Is it better off if you hire, train, culturally integrate, and reward that person?
• Does burn out and a steep learning curve keep adding to the problem?

All links and images for this episode can be found on CISO Series.

How do you create a positive security culture? It's rarely the first concept anyone wants to embrace, yet it's important everyone understands their responsibility. So what do you do, and how do you overcome inevitable roadblocks?

Check out this post and this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest, Jadee Hanson, CISO/CIO for Code42.

Thanks to our podcast sponsor, Code42

Code42 is focused on delivering solutions built with the modern-day collaborative culture in mind. Code42 Incydr tracks activity across computers, USB, email, file link sharing, Airdrop, the cloud and more, our SaaS-based solution surfaces and prioritizes file exposure and data exfiltration events. Learn more at Code42.com.

In this episode:

• How do you create a positive security culture?
• Where do we run into struggles when trying to create a positive security culture?
• Given its importance, why is it rarely the first concept anyone wants to embrace?
• What do you do, and how do you overcome inevitable roadblocks?

All links and images for this episode can be found on CISO Series.

All experienced security professionals were at one time very green. Entry level status means risk to your organization. That's if you give them too much access. What can you trust an entry level security professional to do that won't impose unnecessary risk? And how can those green professionals build trust to allow them to do more?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Kemas Ohale, vp, global information security, Lippert.

Thanks to our podcast sponsor, Normalyze

Normalyze is a cloud data security platform that continuously discovers sensitive data and their access paths across your cloud environments. Normalyze provides the ability to analyze, prioritize and respond to data threats to prevent damaging data breaches. Discover, visualize, and secure your cloud data in minutes with Normalyze Freemium.

In this episode:

• What can you trust an entry level security professional to do that won't impose unnecessary risk?
• How can those green professionals build trust to allow them to do more?
• What can they do with zero experience?
• How can they graduate upwards?

All links and images for this episode can be found on CISO Series.

What do we need to do to fix our processes to truly reduce risk and vulnerabilities?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Amad Fida (@brinqa), CEO, Brinqa.

Thanks to our podcast sponsor, Brinqa

Understand your cyber assets, prioritize vulnerabilities, automate remediation, and continuously monitor cyber hygiene across the entire attack surface — infrastructure, applications and cloud — with Brinqa. See how at brinqa.com.

In this episode:

• What do we need to do to fix our processes to truly reduce risk and vulnerabilities?
• How to work with all departments to improve process, communication, and motivation?
• Why does security need to be treated as a function of the enterprise risk program?
• What are the elements that make a great solution?