Defense in Depth

All links and images for this episode can be found on CISO Series

Cybersecurity boils down to securing your data or data protection. But that simple concept has turned into a monumental task that is only exacerbated every time we move our data to a new platform. How do we secure data today, to be ready for whatever comes next in computing?

Check out this post and this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and guest co-host Gary Hayslip (@ghayslip), global CISO, SoftBank Investment Advisers. Our sponsored guest is Elliot Lewis (@ElliotDLewis), CEO, Keyavi.

Thanks to our podcast sponsor, Keyavi

Myth: Data can't protect itself. Fact: Now it does! You control where your data goes in the world, who can access it and when. On any device. Anytime. Anywhere. FOREVER. Learn more at Keyavi.com.

In this episode:

• How do we secure data today, to be ready for whatever comes next in computing?
• How do we go about building a data transformation program that's platform agnostic?
• Why has this simple concept turned into a monumental task?

All links and images for this episode can be found on CISO Series

Is attack surface profiling the same as a pen test? If it isn't what unique insight can attack surface profiling deliver?

Check out this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Nick Shevelyov, former CSO, Silicon Valley Bank.

Thanks to our podcast sponsor, Keyavi

Myth: Data can't protect itself. Fact: Now it does! You control where your data goes in the world, who can access it and when. On any device. Anytime. Anywhere. FOREVER. Learn more at Keyavi.com.

In this episode:

• Is attack surface profiling the same as a pen test?
• What unique insight can attack surface profiling deliver?
• Is "Attack Surface Profiling" more like a natural evolution from traditional vulnerability management?

All links and images for this episode can be found on CISO Series

What's your best indicator that your security program is actually improving? And besides you and your team, is anyone impressed?

Check out this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Simon Goldsmith (@cybergoldsmith), director of information security, OVO Energy.

Thanks to our podcast sponsor, Votiro

Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything – including Microsoft 365. Learn more at Votiro.com.

In this episode:

• What's the best indicator that your security program is actually improving?
• Does anyone care that you're actually improving your security posture?
• What should we be measuring to prove a security program is working and getting better?

All links and images for this episode can be found on CISO Series

Interviewing for leadership positions in cybersecurity is difficult for everyone involved. There are far too many egos and many gatekeepers. What can be done to improve recruiting of CISOs?

Check out this post and this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn with our guest Ty Sbano (@tysbano), CISO, Vercel.

Thanks to our podcast sponsor, Thinkst

Most Companies find out way too late that they've been breached. Thinkst Canary changes this. Deploy Canaries in minutes and then forget about them. Attackers tip their hand by touching 'em giving you the one alert, when it matters. With 0 admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.

In this episode:

• What can be done to improve CISO recruiting?
• Is there a disconnect between HR and what the company actually needs regarding a position?
• How long should the interview process take?

All links and images for this episode can be found on CISO Series

How are nefarious actors using our own data (and metadata) against us? And given that, in what way have we lost our way protecting data that needs to be course corrected?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our sponsored guest is John Ayers (@cyberjohn1747), vp of advanced detection and response office of the CTO, Optiv.

Thanks to our podcast sponsor, Optiv

The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters.

In this episode:

• How are nefarious actors using our own data (and metadata) against us?
• In what way have we lost our way protecting data that needs to be corrected?
• We examine how our interconnectedness is both a blessing and a curse.
• Is there already far too much sensitive data in essentially open source intelligence?

All links and images for this episode can be found on CISO Series

Is it possible to position your security team as a profit center instead of the traditional cost center reporting to the CIO?

Check out this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our guest is Michael Weiss, CISO, Human Interest.

Thanks to our podcast sponsor, Optiv

The modern enterprise needs a solution as unique as its business. Optiv's Advanced Detection and Response (ADR) works with your organization to comb through the D&R clutter and find the ideal security solutions for your business. ADR delivers tailored detection and response backed by technology, real-time intel and deep expertise applied at touch. Bottom line: ADR finds and neutralizes threats fast, so you can focus on what matters.

In this episode:

• Is it possible to position your security team as a profit center instead of the traditional cost center reporting to the CIO?
• Is security still primarily an efficiency conversation or has effectiveness now changed the dialogue on how success is measured?
• How to go about measuring the value cybersecurity provides the enterprise.
• We examine the problems that can arise when security is treated as a profit center.

All links and images for this episode can be found on CISO Series

For years we've been referring to malware protection as a cat and mouse game. The crooks come up with a new malware attack, and then the good guys figure out a way to stop it. And that keeps cycling over and over again. So where are we today with malware protection and is there any way to get ahead of the cycle?

Check out this post and this post for the discussion that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Our sponsored guest is Aviv Grafi (@avivgrafi), CTO and founder, Votiro.

Thanks to our podcast sponsor, Votiro

Can you trust that your content and data is free of malware and ransomware? With Votiro you can. Votiro removes evasive and unknown malware from content in milliseconds, without impacting file fidelity or usability. It even works on password-protected and zipped files. Plus, it's an API, so it integrates with everything – including Microsoft 365. Learn more at Votiro.com.

In this episode:

• How can we take proactive approaches that are capable of stopping attacks, not just detecting them?
• What do you think we're doing really well in terms of malware, and where could we do a lot better?
• We examine the need for organizations to upgrade their defenses.
• Has ransomware made a massive target out of every organization?

All links and images for this episode can be found on CISO Series

We all know and have experienced bad security awareness training. People can learn, and should learn about being cyber aware. How do you build a security awareness training program that sticks?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn with our guest Lisa Kubicki (@lmk2), trust and security, training and awareness director, DocuSign.

Thanks to our podcast sponsor, Drata

Save 200+ hours with Drata's automated continuous compliance solution for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, & CCPA. Drata connects to your techstack with 75+ integrations, including AWS, GitHub, GCP, & more to automate the compliance process. Kickstart your compliance journey by requesting a demo and get 10% off

In this episode:

• We ask, "How do you build a security awareness training program that sticks?"
• How do you develop a program that resonates with staff and actually improves security outcomes?
• We get tips from the community on how they built a security awareness training program.
• We examine what a successful engagement would look like.

All links and images for this episode can be found on CISO Series

You want to bring on entry level personal, But green employees, who are not well versed in security, IT, or your data introduce risk once they have access to it. What are ways to bring these people on while also managing risk?

Check out this post for the discussions that are the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Rich Lindberg, CISO, JAMS.

Thanks to our podcast sponsor, SolCyber

At SolCyber we're hell-bent on delivering Fortune 500 level cyber security for small and medium-sized enterprises. When you're being targeted by the same bad guys, nothing else will do. We bring to the table a curated stack of leading technologies and around-the-clock SOC support, all simply priced per user. Let us do the heavy lifting.

In this episode:

• We ask, "What are ways to bring entry-level people onboard the company while also managing risk?"
• How does education stack up against on-the-job experience?
• Are there advantages to hiring an inexperienced greenthumb versus experienced only new hires?

Zero trust is a hollow buzzword. In any form of security, there exist critical points where we have to trust. What we need is a move away from implicit trust to explicit trust, or identity that can be verified.

Check out this post for the discussion that is the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Geoff Belknap (@geoffbelknap), CISO, LinkedIn. Our guest is Yaron Levi (@0xL3v1), CISO, Dolby.

Thanks to our podcast sponsor, Optiv

Need a guide on your Zero Trust journey? Jerry Chapman, Engineering Fellow at Optiv and author of "Zero Trust Security: An Enterprise Guide" shares the following takeaways: - The key elements of Zero Trust - How to visualize your Zero Trust journey and place it in the proper context - Integrated technologies to drive adaptive processes and a mature security model Learn more at www.optiv.com/zerotrust.

In this episode:

• We ask cyber professionals, where is the 'trust' in zero-trust?
• What and who should we be trusting?
• How should we refer to zero trust since you can't run any kind of operation where you trust no one and nothing?