Defense in Depth

All links and images for this episode can be found on CISO Series

What does a young person, eager to get into cybersecurity, have to show or prove to land their first help desk, tech support role?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn and our guest Bryan Zimmer (@bryanzimmer), head of security, Humu.

Thanks to our podcast sponsor, Palo Alto Networks

In 1666, Sir Isaac Newton famously used a prism to disperse white light into colors. Today, cloud security professionals use Prisma Cloud from Palo Alto Networks to disperse full lifecycle security and full stack protection across their multi- and hybrid-cloud environments. We think Sir Isaac would approve. Learn more about Prisma Cloud paloaltonetworks.com/Prisma/cloud.

In this episode

• Balancing out certifications and experience
• If we train you, will you stay, or will you leave?
• What's your compelling story that shows what you can do?
• Researching the competition: what are other candidates doing?

All links and images for this episode can be found on CISO Series

What do we want the Board and C-Suite to know about cybersecurity? If you could teach them one thing about cybersecurity that would stick, what would that be?

Check out this post and this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn and our guest Phil Huggins (@oracuk), CISO, NHS Test & Trace, Department of Health and Social Care.

Thanks to our podcast sponsor, Proofpoint

Sixty six percent of CISOs feel their organization is unprepared to handle a cyberattack and 58% consider human error to be their biggest cyber vulnerability. Proofpoint's 2021 Voice of the CISO report explores key challenges facing CISOs after an unprecedented twelve months. Get the report.

In this episode

• What the Board needs to know to make the CISO's job more effective
• It's not about the Board understanding cyber – but it is about mitigating risk
• Security is a shared responsibility: Board & CISOs
• Using other companies' breaches as Board learning opportunities

All links and images for this episode can be found on CISO Series

The demand for CISOs is growing due to increased regulations and cyber threats. Yet, while the demand is there, the supply keeps rotating. Companies think the next CISO is going to fix the problems of the last one. Why is a CISO's tenure so short and why is the hiring process for CISOs so disjointed?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, Steve Zalewski, and Gary Hayslip (@ghayslip), CISO, Softbank Investment Advisers

Thanks to our podcast sponsor, RevCult

On average, 18 percent of all your Salesforce data fields are highly sensitive and 89 percent of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get a free Salesforce Security Self-Assessment to understand your Salesforce security weaknesses.

In this episode:

• Why a CISO's tenure is so short and why they leave
• The value of keeping risk management in the CISO's sights
• The need to clarify the CISO role in the mind of the executive
• The need to clarify the CISO role in the mind of the CISO

All links and images for this episode can be found on CISO Series

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Liam Connolly, CISO, Seek. and our guest Ben Sapiro (@ironfog), head of technology risk and CISO, Canada Life.

Thanks to our podcast sponsor, RevCult

On average, 18 percent of all your Salesforce data fields are highly sensitive and 89 percent of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get a free Salesforce Security Self-Assessment to understand your Salesforce security weaknesses.

In this episode:

• What actions can a manager take to retain staff?
• What do team members/employees want?
• How important is team chemistry?
• Establishing a creative thinking culture

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-salesforce-security/

Thanks to our podcast sponsor, RevCult

On average, 18 percent of all your Salesforce data fields are highly sensitive and 89 percent of users have access to that data. RevCult is the only solution that helps you understand the data you have in Salesforce, and if you're protecting it. Get a free Salesforce Security Self-Assessment to understand your Salesforce security weaknesses.

In this episode:

• Where is Salesforce delivering in security controls and where is it falling short?
• Salesforce security is more than just a single topic
• Working with 3rd party SalesForce apps

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-cloud-configuration-fails/

Why do we hear so many stories about incidents related to poor or misconfigured cloud services?

Check out this post and this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn and our sponsored guest, Brendan O'Connor, CEO, AppOmni.

Thanks to our podcast sponsor, AppOmni

AppOmni is building the future of SaaS security. We empower our users to enforce security standards across their SaaS applications, and enable them to remediate in confidence knowing they're fixing the most important SaaS security issues first. Contact us at www.appomni.com to find out who - and what - has access to your SaaS data.

In this episode:

• Why configuration drift and 3rd party access are still significant issues
• Are cloud providers to blame?
• The dynamic nature of cloud over time – we can't keep up!
• Who is ultimately responsible?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/starting-pay-for-cyber-staff/

What should an entry level cybersecurity person be paid? And what level of education and training should be expected of them?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Naomi Buckwalter (@ineedmorecyber), director of information security and IT at Beam Technologies, and our guest Dan Walsh (@danwalshciso), CISO, VillageMD.

Thanks to our podcast sponsor, AppOmni

AppOmni is building the future of SaaS security. We empower our users to enforce security standards across their SaaS applications, and enable them to remediate in confidence knowing they're fixing the most important SaaS security issues first. Contact us at www.appomni.com to find out who - and what - has access to your SaaS data.

In this episode:

• Discussing the $15/hour entry level position
• Why are qualified people applying for low paying entry level jobs?
• The classic: This entry level position needs prior experience
• Assessing the value that interns can bring

All links and images for this episode can be found on CISO Series.

https://cisoseries.com/fear-of-automation/

Why are security professionals so darn afraid of automation? We continue to hold on to the idea that people have to be integral in the real-time decision process to protect ourselves from the technology we deploy to protect us.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, and Steve Zalewski, CISO, Levi Strauss, with our guest Edward Frye (@edwardfrye), CISO, Aryaka Networks and president of Silicon Valley chapter of ISSA.

AppOmni is building the future of SaaS security. We empower our users to enforce security standards across their SaaS applications, and enable them to remediate in confidence knowing they're fixing the most important SaaS security issues first. Contact us at www.appomni.com to find out who - and what - has access to your SaaS data.

In this episode:

• Is it a fear of heavy lifting or not knowing what to lift?
• Is it a fear of change or a fear of cost?
• Is it a fear of automating human judgment?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-hiring-talent-with-no-security-experience/

Should you look for the ideal candidate that has all the security talent you want, or should you find the right person and train them with the security talent you want. And if the latter, what is the right person to work in security who doesn't have security experience?

Check out this post and this Twitter discussion for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host, Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest Dev Akhawe (@frgx), CISO, Figma.

Thanks to our podcast sponsor, Sonatype

With security concerns around software supply chains ushered to center stage in recent months, organizations around the world are turning to Sonatype as trusted advisors. The company's Nexus platform offers the only full-spectrum control of the cloud-native software development lifecycle including third-party open source code, first-party source code, infrastructure as code, and containerized code.

• Is there a cyber talent shortage?
• If so, does the shortage come from the hiring side?
• The dangers of leaving positions open too long
• The dangers of focusing on checklists vs. candidate potential

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-security-hygiene-for-software-development/

How do we improve the quality of our software? In the rush to be competitive, security has often taken a back seat to be first to market. What's the formula for fast and secure applications?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host, Geoff Belknap (@geoffbelknap), CISO LinkedIn, and sponsored guest Wayne Jackson, CEO, Sonatype.

Thanks to our podcast sponsor, Sonatype

In this episode:

• Are we working too fast and under too much pressure to be secure?
• What types of scanning should we do, and how often?
• What about open source/third party software in the pipeline?
• What are the dangers inherent in purchasing "secure software"?