Defense in Depth

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-how-much-do-you-know-about-your-data/

Do cybersecurity professionals even know what they're protecting? How aware are they of the data, its content and its sensitivity? What happens to your security posture when you do understand the data you're protecting? What can you do that you weren't able to do before?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, and Steve Zalewski, CISO, Levi Strauss, with our sponsored guest, Aidan Simister (@aidansimister), CEO, Lepide.

Thanks to our podcast sponsor, Lepide

Ninety eight percent of all threats start with Active Directory and nearly always involve the compromise of data stored on enterprise data stores. Lepide's unique combination of detailed auditing, anomaly detection, real time alerting, and real time data discovery and classification allows you to identify, prioritize and investigate threats – fast.

In this episode:

• How much do you know about the data you are being asked to protect?
• Equating the value of the data to be protected with the cost of protection
• How to find out how data is being used
• Moving beyond the bare minimum of protection

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-do-startups-need-a-ciso/

Startups are all about proving the value of their product and growth. At the beginning, all of their money is funneled into product and market development. When do they need a CISO, if at all?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, and guest co-host Jimmy Sanders (@jfireluv), head of cybersecurity for Netflix DVD and our guest is Bryan Zimmer (@bryanzimmer), head of security for Humu.

Thanks to our podcast sponsor, Lepide

Ninety eight percent of all threats start with Active Directory and nearly always involve the compromise of data stored on enterprise data stores. Lepide's unique combination of detailed auditing, anomaly detection, real time alerting, and real time data discovery and classification allows you to identify, prioritize and investigate threats – fast.

In this episode:

• Should a company get a CISO right away, or wait until the security program matures?
• If they get a CISO should they go for "on-prem" or on-demand?
• Or.... should they just go and seek CISO-level advice from the security community?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-insider-risk/

By just doing their jobs, your employees are introducing risk to the business. They don't mean to be causing issues, but their simple actions and sometimes mistakes can cause great harm. Is it their fault, or is it security's fault for not creating the right systems?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host, Steve Zalewski, CISO, Levis, and our sponsored guest Mark Wojtasiak (@markwojtasiak), vp, portfolio strategy & product marketing, Code42 and author of Inside Jobs: Why Insider Risk is the Biggest Cyber Threat You Can't Ignore.

Thanks to our podcast sponsor, Code42

Redefine data security standards for the hybrid workforce. Check out Code42.

In this episode:

• Distractions and fatigue causing split-second mistakes
• The need for tailored education and training
• Making it easier for people to make the right choice
• Identify ways damage could happen, in order to mitigate

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-whats-the-obsession-with-zero-trust/

Why is everyone obsessed with Zero Trust? Is it just a marketing ploy that vendors are using to sell their products? Or, is it truly a methodology that provides better security, especially in today's environment.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, co-host, Geoff Belknap (@geoffbelknap), CISO LinkedIn, Melody Hildebrandt (@mhil1), evp, product & engineering and CISO, Fox.

Thanks to our podcast sponsor, Code42

Redefine data security standards for the hybrid workforce. Check out Code42.

In this episode

Does Zero Trust obscure the core principles it's supposed to serve?

How does Zero Trust affect the assumptions around cybersecurity's control and ownership of a network

What are the real Zero Trust best practices?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-mentoring/

Companies want security people with experience and they want to grow cybersecurity leaders. It's often hard to find that experience, and while there are certification courses aplenty, courses in cybersecurity leadership are hard to find. One possible solution is mentoring, but that has its own hurdles.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host, Geoff Belknap (@geoffbelknap), CISO LinkedIn, and our guest Sean Catlett, CSO, Slack.

In this episode

• The mutual value of being a mentor
• What obligations does a mentee have?
• Mentorship: large-scale concepts or day-to-day or both?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-securing-the-super-bowl-and-other-huge-events/

How do cybersecurity professionals secure a huge event like the Olympics, the Superbowl, or a city's New Year's Eve party? What are the unique considerations that come into play?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our guest Tomás Maldonado (@tomas_mald), CISO, NFL

Thanks to our podcast sponsor, Lepide

Ninety eight percent of all threats start with Active Directory and nearly always involve the compromise of data stored on enterprise data stores. Lepide's unique combination of detailed auditing, anomaly detection, real time alerting, and real time data discovery and classification allows you to identify, prioritize and investigate threats - fast.

In this episode

• Protecting large events starts long before, like years before
• How threat actors targeting events differ from than those targeting companies
• It's not just the target - there's also public safety
• When it goes live, it GOES LIVE

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-cybersecurity-isnt-that-difficult/

What are you security people complaining about? As compared to 10, 15, 20 years ago, the technical aspects of cybersecurity are not that difficult. We've got the control frameworks, tools, and training that are predecessors didn't have.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Naomi Buckwalter (@ineedmorecyber), director of information security and IT at Beam Technologies, and our guest, John Overbaugh (@johnoverbaugh), vp, security, CareCentrix

Thanks to our podcast sponsor, Trend Micro as bold

Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud.

In this episode

• What infosec was like "back in the day"
• What's out of alignment: the technology or the culture?
• Can we really stand on the shoulders of giants amid so much change?
• Where is individual cyberhygiene in all of this?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-cloud-security-myths/

The cloud is inherently insecure! The cloud will handle all your security needs. More data breaches happen in the cloud. These are just some of the many many myths of cloud security. Listen as we debunk as many as we possibly can.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Steve Zalewski, CISO, Levis, and our sponsored guest Mark Nunnikhoven (@markna), vp, cloud research, Trend Micro.

Thanks to our podcast sponsor, Trend Micro

Threat actors want what you're storing in the cloud. Trend Micro's Cloud One platform provides cloud security from a single console, keeping you at your most resilient. Let what happens in the cloud, stay in the cloud.

In this episode

• How many cloud myths from years back still endure?
• Is cloud less secure or more secure now?
• Who has the responsibility for security?
• Just because you're in the cloud, does that mean you're protected?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-what-is-securitys-mission/

What's the mission of your security program? Is it to proactively SECURE THE COMPANY against a compromise of the CONFIDENTIALITY, INTEGRITY, and AVAILABILITY, OR, is it to PROTECT THE COMPANY BRAND by effectively PREVENTing, DETECTING and RESPONDING to cyber-threats? These are the two options for security's mission that we discuss on this week's show.

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Steve Zalewski, Deputy CISO, Levis, and our guest, Johna Till Johnson (@JohnaTillJohnso), CEO, Nemertes Research.

Thanks to our podcast sponsor, Trend Micro

The conversation between you and your board of directors is not always a walk in the park. With more cloud projects coming your way, it's time to change the conversation to speak their language and start paving the way for a secure future. For more, go to http://trendmicro.com/CISO

In this episode

• Security mission option 1: protecting the company
• Security mission option 2: protecting the brand & revenue stream
• Does one lead to/support the other?
• Does the degree of cloud presence make a difference?
• How much of this is technical vs philosophical?

All links and images for this episode can be found on CISO Series

https://cisoseries.com/defense-in-depth-vendor-cisos/

It's hard to be a CISO. But, what's it like to be a CISO at a security vendor, doing the hard work while carrying the stigma of being a "vendor"?

Check out this post for the basis for our conversation on this week's episode which features me, David Spark (@dspark), producer of CISO Series, guest co-host Geoff Belknap (@geoffbelknap), CISO, LinkedIn, and our sponsored guest Allan Alford (@AllanAlfordinTX), CTO/CISO, TrustMAPP, and host of The Cyber Ranch Podcast.

Thanks to our podcast sponsor, TrustMAPP

Does your board want to see yet more heat maps? No, they do not. They want to see that security investments align with business goals, and that their costs are objectively justified. TrustMAPP's data visualization helps you communicate with your board in a way they can understand – and approve.

In this episode

• How to balance being an advocate, an evangelist and an operator
• Are there really "stigmas" to being a security vendor?
• What's unique to practicing security while being a security vendor?