Defense in Depth

All links and images for this episode can be found on CISO Series.

Security professionals talk a lot about the reputational damage from breaches. And it seems logical, but major companies still do get breached and their reputation seems spared. What's the reality of what breaches can do to a company's reputation?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Cecil Pineda, CISO, R1.

Thanks to our podcast sponsor, Brinqa

Understand your cyber assets, prioritize vulnerabilities, automate remediation, and continuously monitor cyber hygiene across the entire attack surface — infrastructure, applications and cloud — with Brinqa. See how at brinqa.com.

In this episode:

• Security professionals talk a lot about the reputational damage from breaches, so why do companies still get breached?
• What's the reality of what breaches can do to a company's reputation?
• Does a breach really result in lasting reputation damage?
• Are we more accepting of breaches now?

All links and images for this episode can be found on CISO Series.

Do RFPs or request for proposals work as intended? It seems they're loaded with flaws yet for some organizations who must follow processes, they become necessary evils for both buyers and sellers. What can we do to improve the process?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Keith McCartney (@kmflgator), vp, security and IT, DNAnexus.

Thanks to our podcast sponsor, TrustCloud

TrustCloud is the all-in-one platform to accelerate sales and security reviews, automate compliance efforts, and map contractual liability across your business. Connect with us to learn how you can transform security from a cost center into a profit driver with TrustCloud's programmatic risk and compliance verification tools.

In this episode:

• Do RFPs or request for proposals work as intended?
• Does it seem they're loaded with flaws?
• Have they become necessary evils for both buyers and sellers?
• What can we do to improve the process?

All links and images for this episode can be found on CISO Series.

What are the moves we should be making in cloud to improve our security? What constitutes a good cloud security posture?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Andy Ellis, operating partner, YL Ventures. We welcome our sponsored guest Yoav Alon, CTO, Orca Security.

Thanks to our podcast sponsor, Orca Security

Orca Security is the pioneer of agentless cloud security that is trusted by hundreds of enterprises globally. With continuous first-to-market innovations and expertise, the Orca Platform ensures security teams quickly identify and remediate risks to keep their businesses secure. Connect your first account in minutes by visiting www.orca.security.

In this episode:

• What does successful cloud security look like?
• What are the moves we should be making in the cloud to improve our security?
• What constitutes a good cloud security posture?
• What should we be measuring when it comes to cloud security?

All links and images for this episode can be found on CISO Series.

One CISO has had enough of the security vendor marketing emails and cold sales calls. He's blocking them all. But it's not a call to avoid all salespeople. He just doesn't have the time to be a target anymore. So how should vendors engage with such a CISO? And does CISO represent most CISOs today?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Joy Forsythe, VP, Security, Thrive Global.

Thanks to our podcast sponsor, Code42

Code42 is focused on delivering solutions built with the modern-day collaborative culture in mind. Code42 Incydr tracks activity across computers, USB, email, file link sharing, Airdrop, the cloud and more, our SaaS-based solution surfaces and prioritizes file exposure and data exfiltration events. Learn more at Code42.com.

In this episode:

• How should vendors engage with CISOs who are tired of being targeted?
• How can vendors reach CISOs who have had enough of the security vendor marketing emails and cold sales calls?
• Does CISO represent most CISOs today?
• Is the sales "system" essentially broken?

All links and images for this episode can be found on CISO Series.

Do we really need more categories of security products? Every new Gartner magic quadrant complicates the marketplace but at the same time helps us understand the other vectors we need to protect. Do new categories of security products help or hurt the industry?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Corey Elinburg (@celinburg), CISO, CommonSpirit Health.

Thanks to our podcast sponsor, Egress

In this episode:

• Do we really need more categories of security products?
• Does it seem like every new Gartner magic quadrant complicates the marketplace but at the same time helps us understand the other vectors we need to protect?
• Do new categories of security products help or hurt the industry?
• Does this make it hard to keep up to date on all new products?

All links and images for this episode can be found on CISO Series.

How can security leaders and how do they go about matching business case to every security action you want to take? Is this the right way to sell security to the board?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Sravish Sridhar (@sravish), founder and CEO, TrustCloud.

Thanks to our podcast sponsor, TrustCloud

TrustCloud is the all-in-one platform to accelerate sales and security reviews, automate compliance efforts, and map contractual liability across your business. Connect with us to learn how you can transform security from a cost center into a profit driver with TrustCloud's programmatic risk and compliance verification tools.

In this episode:

• How can security leaders best make a case for security?
• How do you go about matching business cases to every security action you want to take?
• Is this the right way to sell security to the board?
• How do you show that security can be aligned to business objectives?

All links and images for this episode can be found on CISO Series.

Security tools are supposed to do a job. Either they need to alert you, protect you, or remediate an issue. But they don't always work and that's why we have breaches. Who's at fault, the tool or the administrators who configured the tool?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Kenneth Foster (@Kennethrfoster1), vp of IT governance, risk and compliance at FLEETCOR.

Thanks to our podcast sponsor, AppOmni

Do you know which 3rd party apps are connected to your SaaS platforms? After all, one compromised 3rd party app could put your entire SaaS ecosystem at risk. Get visibility to all 3rd party apps — and their level of data access — with AppOmni. Visit AppOmni.com to request a free risk assessment.

In this episode:

• Why do security tools fail?
• Who's at fault, the tool or the administrators who configured the tool?
• Is it usually because the control is ineffective or was the control misconfigured / ignored?
• Do InfoSec produts have an efficacy issue or an implementation issue?

All links and images for this episode can be found on CISO Series.

We talk a lot on this show about what makes cybersecurity such a hard job, yet there are so many people who are in it and love it. What draws people to this profession and why do they love it so much?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest David Cross (@MrDBCross), CISO, Oracle SaaS Cloud.

Thanks to our podcast sponsor, Orca Security

Orca Security is the pioneer of agentless cloud security that is trusted by hundreds of enterprises globally. With continuous first-to-market innovations and expertise, the Orca Platform ensures security teams quickly identify and remediate risks to keep their businesses secure. Connect your first account in minutes by visiting www.orca.security.

In this episode:

• We talk a lot on this show about what makes cybersecurity such a hard job, yet there are so many people who are in it and love it.
• What draws people to this profession and why do they love it so much?
• Do you love the ability to influence the organization and leadership?
• Do you love making an impact by helping people and businesses with safer behaviors and activities?

All links and images for this episode can be found on CISO Series.

We expect our users to be perfect security responders even when the adversaries are doing everything in their power to trick them. These scams are designed to make humans respond to them. Why aren't we building our security programs to account for this exact behavior that is simply not going to go away?

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Ken Athanasiou, CISO, VF Corporation.

Thanks to our podcast sponsor, Code42

In this episode:

• Why do we expect our users to be perfect security responders even when the adversaries are doing everything in their power to trick them?
• Aren't these scams designed to make humans respond to them?
• Why aren't we building our security programs to account for this exact behavior that is simply not going to go away?
• Why do so many security practitioners treat our users as children to be managed instead of adults to be educated and assigned a level of accountability?

All links and images for this episode can be found on CISO Series.

How do you make the argument that your company needs a CISO, and that YOU should be that leader? What do you need to demonstrate to prove you can be that person?

Check out this post and this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest Radley Meyers (@radleymeyers), Partner, SPMB Executive Search.

Thanks to our podcast sponsor, SPMB

SPMB connects top executive talent to the world's best and fastest growing innovators across the country. A key area we bring extensive knowledge and expertise to is our dedicated Security Practice, leading both functional searches (CISO and VP's defining security strategy) and building out executive teams at top security software companies.

In this episode:

• How do you make the argument that your company needs a CISO, and that YOU should be that leader?
• What do you need to demonstrate to prove you can be that person?
• Do you have a sound understanding of the WHY behind the organization's existence and how value is added or taken away?
• How do you lay out a plan to win in whatever industry you are in because of security NOT despite it?