Enterprise Security Weekly (Video)

CISOs struggle more with reactive budgets than CIOs or CTOs. It's not that part of the CISO's budget shouldn't be reactive, it's certainly necessary to an extent. The problem is when proactive measures suffer as a result. In this interview, we'll discuss some of the causes behind this and some strategies for breaking out of this loop.

This segment is sponsored by LevelBlue. Visit https://securityweekly.com/levelblue to learn more about them!

Show Notes: https://securityweekly.com/esw-383

Today's cyber threat actors are capitalizing on organizations' identity vulnerabilities, such as MFA. Nearly 75% of cloud security failures now result from mismanaged identities, access, and privileges, and the identity attack surface is becoming more challenging to protect as companies expand their cloud environments and supply chains to meet their IT needs.

Damon McDougald, Global Cyber Protection lead at Accenture, joins Security Weekly's Mandy Logan to share his perspective on why identity is so crucial in today's hybrid work environment, the innovations that are changing the game when it comes to cybersecurity, the top challenges companies face in implementing identity, and how identity can help keep threat actors at bay.

Segment Resources: https://www.accenture.com/us-en/services/security/digital-identity

Hybrid workforces are here to stay. This means protecting today's workforce requires securing access to applications from any device, anywhere, while maintaining a seamless user experience. Punit Minocha, the EVP of Business Development & Corporate Strategy at Zscaler, joins SC Media to discuss the challenges companies are facing with securing their hybrid workforces and how integrated, best-of-breed solutions from Zscaler and Okta deliver zero trust security that helps companies protect their data, infrastructure, and employees as they scale and innovate.

Segment Resources: https://www.okta.com/press-room/press-releases/zscaler-and-okta-enhance-enterprise-cybersecurity-with-new-zero-trust/

This segment is sponsored by Oktane, to view all of the CyberRisk TV coverage from Oktane visit https://securityweekly.com/oktane.

Show Notes: https://securityweekly.com/esw-382

This week, in the enterprise security news:

1. the latest cybersecurity fundings
2. Cyera acquires Trail Security
3. Sophos acquires Secureworks
4. new companies and products
5. more coverage on Cyberstarts' sunrise program
6. AI can control your PC
7. public cybersecurity companies are going private
8. Splunk and Palo Alto beef

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-382

The future is here! Imagine if you could get into the office, a datacenter, or even an apartment building as easily as you unlock your smartphone. Alcatraz AI is doing exactly that with technology that works similarly to how smartphones unlock using your face. It works in the dark, if you shave off your beard, and so quickly you don't even need to slow down for the scan - you can just keep on walking.

We don't often cover physical security, so this interview is going to be a treat for us. There are SO many questions to ask here, particularly for our hosts who have done physical penetration tests, social engineering, and tailgating in the past to get past physical security measures.

Show Notes: https://securityweekly.com/esw-382

Customer Identity is everywhere. It's powering secure experiences for billions - enabling people to check their luggage at the airport, watch their favorite Major League Soccer games, or take their favorite Peloton class. Because it's everywhere, threat actors now see customer identity as a path to financial gain. Bots now make up nearly 50% of all internet traffic and are being used to steal sign-up bonuses or breach accounts. And cybercriminals are bypassing the login box completely, stealing authenticated session cookies at record rates. Bhawna Singh. Chief Technology Officer of Customer Identity Cloud at Okta joins host Mandy Logan, from Security Weekly, to discuss the current state of customer identity, what developers need to know about securing their applications and what Okta is doing to help developers build applications that decipher a human from a bot.

Segment Resources: https://www.okta.com/oktane/ https://www.okta.com/press-room/press-releases/okta-helps-builders-easily-implement-auth-for-genai-apps-secure-how/

Whether it's phishing techniques, password spraying, or social engineering, security leaders today are constantly needing to see past blindspots, educate their workforces, and rethink the enterprise security checklist. Many companies, like Okta, are finding ways to incorporate security within their company culture, as every employee has a role to play in keeping a company secure. Charlotte Wylie, Deputy CSO at Okta, joins Security Weekly's Mandy Logan to discuss what security leaders are being challenged with today when it comes to securing their workforce and from experience with implementing Okta's Secure Identity Commitment how companies can be prioritizing security within their culture to help prevent threat actors from taking advantage of the weakest link.

Segment Resources: https://www.okta.com/blog/2024/08/how-okta-fosters-a-security-culture/ https://www.okta.com/press-room/press-releases/okta-openid-foundation-tech-firms-tackle-todays-biggest-cybersecurity/

This segment is sponsored by Oktane. Visit https://securityweekly.com/oktane2024 and use discount code OKTNSC24 to pay only $100 for your full conference pass!

Show Notes: https://securityweekly.com/esw-381

The vast majority of the folks working polls and elections are volunteers. This creates a significant training challenge. Not only do they have to learn how to perform a complex and potentially stressful job in a short amount of time (most training is one day or less), cybersecurity-related concerns are usually not included for individual poll location and election workers.

Kirsten Davies has a passion project that attempts to solve this, with some concise, accessible, and straightforward training material. It is made available through two PDFs on her new organization's website, instituteforcybercivics.org.

Show Notes: https://securityweekly.com/esw-381

Ever heard someone say, "the attacker only has to be right once, but the defender has to get it right every time"? On this episode, we'll dispel that myth. There is some truth to the saying, but only with regards to initial access to the target's environment. Once on the inside, the attacker's advantage flips to the defender. Call it the 'Home Alone' effect. Or the Goonies effect? Die Hard? So many movie metaphors work here!

The conversation isn't just about setting traps for attackers, however, there's also a conversation to have about fundamentals and ensuring practitioners are prepared for whatever attackers might throw at them. This segment is inspired by the essay from Lenny by the same name: Transform the Defender's Dilemma into the Defender's Advantage

Show Notes: https://securityweekly.com/esw-381

Finally, in the enterprise security news,

1. HUMAN, Relyance AI, and watchTowr raise funding this week
2. Alternative paths to becoming a CISO
3. Vendor booths don't have to suck (for vendors or conference attendees!)
4. Budget planning guidance for 2025
5. CISOs might not be that great at predicting their own future needs
6. Use this one easy trick to bypass EDR!
7. Analyzing the latest breaches and malware
8. You probably shouldn't buy a Fisker Ocean, no matter how cheap they get

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-380

Implementing SASE can be tricky and onerous, but it doesn't have to be. Today, we discuss Unified SASE as a Service with Renuka Nadkarni, Chief Product Officer at Aryaka. Particularly, how can Unified SASE make both networking and security more flexible and agile?

IT and security professionals need to ensure secure and performant applications and data access to all users across their distributed global network without escalating cost, risk or complexity, or sacrificing user experience.

This segment is sponsored by Aryaka. Visit https://securityweekly.com/aryaka to learn more about them!

Show Notes: https://securityweekly.com/esw-380

Secure by design is more than just AppSec - it addresses how the whole business designs systems and processes to be effective and resilient. The latest report from LevelBlue on Cyber Resilience reveals security programs that are reactive, ill-equipped, and disconnected from IT and business leaders.

Most security problems are out of security teams' hands. Addressing them requires input, buy-in, and action from business leaders and IT. Security cannot afford to be separate from the rest of the organization.

In this interview, we'll discuss how we could potentially solve some of these issues with Theresa Lanowitz from LevelBlue.

Segment Resources:

• Grab your copy of the LevelBlue Futures Report on Cyber Resilience

This segment is sponsored by LevelBlue. Visit https://securityweekly.com/levelblue to learn more about them!

Show Notes: https://securityweekly.com/esw-380