Defense in Depth

All links and images for this episode can be found on CISO Series

Why do CISOs seem more stressed out than other C-level executives?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Jared Mendenhall, Head of information security, Impossible Foods.

Thanks to our podcast sponsor, Compyl

GRC solutions often cause process roadblocks within organizations. They are either antiquated and lack the functionality needed or so stripped down they can't fix the problems you set to solve. That's why the team over at Compyl created the all-in-one security and compliance automation platform. Compyl quickly integrates with the tools you use, and automates 85% of the day-to-day tasks, all while providing complete transparency and comprehensive reporting along the way. Start your free trial with Compyl today and see all the efficiency gains you can expect from a leading solution. Learn about Compyl today at www.compyl.com/getstarted.

In this episode:

• Do CISOs undergo more stress than other C-Suite jobs?
• Why do CISOs seem more stressed out than other C-level executives?
• Is it because the role is not fully formed and that CISOs don't get enough resources?
• Do the blurred lines of the CISO job increase the stress? Even more so that the CEO?

All links and images for this episode can be found on CISO Series

How detailed do we get in our conversation with business leaders? Do we dumb it down? Or is that a recipe for trouble?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Lee Parrish (@leeparrish), CISO, Newell Brands.

Thanks to our podcast sponsor, Qualys

Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.

In this episode:

• How detailed do we get in our conversation with business leaders?
• Do we dumb it down? Or is that a recipe for trouble?
• To what level does the C-Suite need to be cyber savvy?
• How essential is it for senior leaders to know more?

All links and images for this episode can be found on CISO Series

Why are there so many vCISOs who have never been a CISO? Isn't it difficult to advise on a role you've never done? Do organizations feel comfortable hiring an inexperienced vCISO as their CISO?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Steve Tran, CSO, DNC.

Thanks to our podcast sponsor, runZero

runZero is the cyber asset management solution that helps you find and identify every managed and unmanaged asset connected to your network and in the cloud. Get the data and context needed to effectively manage and secure your environment. Try runZero for free at runzero.com.

In this episode:

• Why are there so many vCISOs who have never been a CISO?
• Isn't it difficult to advise on a role you've never done?
• Do organizations feel comfortable hiring an inexperienced vCISO as their CISO?
• If the person has the requisite background, why does it matter what the title they had before is?

All links and images for this episode can be found on CISO Series

As an outside observer, how can you tell if a company is staying cyber healthy? While there is no financial statement equivalency to let you know the strength of a company's security profile, there are signals that'll give you a pretty good idea.

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our guest Matt Honea, CISO, SmartNews.

Thanks to our podcast sponsor, Automox

Are you ready to ditch manual patching? With Automox, you can automatically patch your third-party applications, Windows, macOs, and Linux devices with one easy-to-use, cloud-native platform. Try for yourself with our free 15-day trial and have all your endpoints safe and secure in just 15 minutes.

In this episode:

• As an outside observer, how can you tell if a company is staying cyber healthy?
• What are the signals to let you know the strength of a company's security profile?
• How do we go about trying to determine a company's cyber health?
• Why is it important to know about another company's cyber health?

All links and images for this episode can be found on CISO Series

The cyber attack surface just keeps growing to the point that it seems endless. Protecting it all is impossible. Is there anything that can be done to reduce that attack surface and limit your exposure?

Check out this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Jonathan Trull (@jonathantrull), CISO, Qualys.

Thanks to our podcast sponsor, Qualys

Qualys is a pioneer and leading provider of cloud-based security and compliance solutions.

In this episode:

• Is there anything that can be done to reduce that attack surface and limit your exposure?
• Is attack surface reduction a new security development philosophy or is it just a rebranding of vulnerability management?
• And what value does it have in comparison to other popular theories such as zero trust and defense in depth?
• Is everything just another form of exposure management?

All links and images for this episode can be found on CISO Series

Those reports on security procedures for the business are falling short. No one is reading them. What good are security controls if your staff doesn't know about them or adhere to them? Is it time to hire a marketing manager for the security team?

Check out this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Laura Deaner (@b3dwin), CISO, Northwestern Mutual.

Thanks to our podcast sponsor, IANS Research

CISOs, how does your compensation compare with your peers? Download IANS + Artico Search's 2022 CISO Compensation Benchmark Report. Find objective insights and comprehensive compensation data from over 500 CISOs across the U.S. and Canada.

In this episode:

• What good are security controls if your staff doesn't know about them or adhere to them?
• Is it time to hire a marketing manager for the security team?
• Why does it make sense to think of who the stakeholder is and what's happening in their world?
• How to best build policies that don't get ignored?

All links and images for this episode can be found on CISO Series

Cybersecurity budgets are increasing, by a lot. What's fueling the increase and where are those budgets being spent?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest sponsored guest Nick Kakolowski, senior director of research at IANS Research.

Thanks to our podcast sponsor, IANS Research

CISOs, how does your compensation compare with your peers? Download IANS + Artico Search's 2022 CISO Compensation Benchmark Report. Find objective insights and comprehensive compensation data from over 500 CISOs across the U.S. and Canada.

In this episode:

• What's fueling the increase in cybersecurity budgets and where are those budgets being spent?
• Do we understand where the money is being spent? Is it on new hires? More tooling?
• Does training new hires provide a good ROI for an increased budget?
• Should we equate the success of a security program with the size of the budget? Or not?

All links and images for this episode can be found on CISO Series

What's the difference between a head of security, a vp of security, and a CISO? Do job responsibilities change whether you're a security analyst or a threat engineer? Roles are confusing and so is the pay and responsibilities attached to them.

Check out this post and this post for the basis of today's discussion. this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Hadas Cassorla, CISO, M1. Our guest is Renee Guttman, former CISO of Coca-Cola, Time Warner, Campbells.

Thanks to our podcast sponsor, IANS Research

CISOs, how does your compensation compare with your peers? Download IANS + Artico Search's 2022 CISO Compensation Benchmark Report. Find objective insights and comprehensive compensation data from over 500 CISOs across the U.S. and Canada.

In this episode:

• What's the difference between a head of security, a vp of security, and a CISO?
• Do job responsibilities change whether you're a security analyst or a threat engineer?
• Why are cyber security roles so confusing?
• And why is there such a variance of pay and responsibilities attached to them?

All links and images for this episode can be found on CISO Series

Instead of complaining about the security hiring process, walk a mile in a recruiter's shoes and have a little compassion to what they're going through, and how you might be able to help, at any level.

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap) with our guest Caleb Sima (@csima), CSO, Robinhood.

Thanks to our podcast sponsor, Safe Security

If your CFO or Board was to ask: 'How much could we lose to a cyber attack?' Would you know?

Introducing SAFE - the industry's most complete Cyber Risk Quantification solution to help you answer those crucial questions in real-time:

• Visualize and measure cyber risk across your entire estate
• Discover your $ risk exposure per attack vector
• Gain personalized, actionable insights to tackle your most critical risks
• Communicate your real-time cyber risk posture to your Board

Learn more at www.safe.security

In this episode:

• Instead of complaining about the security hiring process, CISOs should walk a mile in a recruiter's shoes and have a little compassion to what they're going through.
• Have we thought about the process we're creating for candidates?
• Are we being responsible and thinking about the candidate's journey vs. being opportunistic?

All links and images for this episode can be found on CISO Series

Are security programs drifting from a prevention to a resilience strategy? If so, are you truly operating in a resilient environment? Or are you still acting in a prevention stance but you know you should be resilient?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. We welcome our sponsored guest David Ratner (@davidhratner), CEO, HYAS.

Thanks to our podcast sponsor, HYAS

"Better production environment security starts with visibility. After all, how can you protect your most valuable asset if you don't know A: what's expected and B: when something's happening that isn't expected? This is why HYAS Confront monitors traffic to alert you to anomalies, letting you address risks, threats, and changes, while blocking infiltrations before they become successful attacks. Don't just react, take your security back with HYAS. Visit HYAS.com"

In this episode:

• Are security programs drifting from a prevention to a resilience strategy?
• If so, are you truly operating in a resilient environment? Or are you still acting in a prevention stance but you know you should be resilient?
• What does a resilience strategy look like?
• How does your security stack change when you choose resilience?