Albert E. Whale is a serial entrepreneur with over 30 years of experience in cybersecurity and risk management. He is the Founder and CEO of IT Security Solutions, which helps businesses secure their environments using ITS Safe™, an appliance that delivers real-time continuous protection of networks, printers, servers, clouds, modems and routers, and other equipment. Albert is a Global Ambassador at the Napoleon Hill Institute where he supports other professionals in their personal development. He also is a Startup Mentor at the Founder Institute, guiding entrepreneurs as they build their businesses. He is the author and coauthor of two award-winning books: #HACKED and #HACKED2.

In this Kitecast episode, Albert asserts that organizations must be more vigilant about third-party risk. He also argues that compliance regulations aren’t the panacea many believe them to be when it comes to thwarting cyber threats and minimizing cyber risk. Going against the grain, he argues that overemphasis on compliance regulations may leave organizations more vulnerable to cyber threats. Point-in-time security measures, which are reflective of compliance regulations, need to be replaced with continuous monitoring and scanning. Finally, Albert recommends that CISOs and CSOs abandon their efforts to adopt business speak when articulating cyber risk to executives and boards of directors. Instead, Albert contends they need to retain their specialist language to ensure conveyance of cyber risk. 

LinkedIn Profile: www.linkedin.com/in/albertwhale 

IT Security Solutions: http://www.it-security-solutions.com/ 

Published Books: 

#HACKED: 10 Practice Cybersecurity Tips to Help Protect Personal or Business Information

#HACKED2: Practice Guidance for Dealing with Threats to Your Business and Privacy

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Mark Lynd is a former CEO, CIO, CTO, and CISO and currently serves as the Head of Digital Business at Netsync that employs a consultative and collaborative approach to help organizations architect innovative technology solutions that meet business needs. He is an author, frequent speaker on topics related to AI, IoT, and cybersecurity, is ranked in the Top 1 Globally for Security by Thinkers360, was named an Ernst & Young Entrepreneur of the Year for the Southwest Region, and is frequently interviewed by and quoted in publications such as The Wall Street Journal, InformationWeek, and others. Before his time in the private sector, Mark served in the U.S. Army’s 3rd Ranger Battalion and 82nd Airborne Division.

In this Kitecast episode, Mark discusses the significance of GRC (Governance, Risk Management, and Compliance) in today’s technology landscape, which is being propelled by accelerated evolution in cyber threats, third-party risks, and data security issues in the cloud. One outcome is that organizations must prioritize GRC strategies rather than making them an afterthought. In addition, Mark argues that Digital Rights Management (DRM) is critical when implementing a GRC strategy that addresses a zero-trust model focused on protecting sensitive content. 

Beyond connecting GRC with DRM, Mark also speaks about artificial intelligence (AI), why it is important to teach cybersecurity life skills to teenagers, what he will be covering in his next book, how lack of DRM governance in the higher education sector is exposing national secrets, and more. This is an insightful discussion for anyone interested in learning from a proven leader who is dedicated to digital transformation and cybersecurity.

LinkedIn Profile: www.linkedin.com/in/marklynd 

Netsync: www.netsync.com 

Published Book: Cyber Security Life Skills for Teens: Life Skills for the Digital Age 

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Richard Stiennon, a cybersecurity pioneer, author, and industry executive, spoke about the hottest trending topic of our day in this Kitecast episode: artificial intelligence (AI). He currently serves as the Chief Research Analyst at IT-Harvest, a research organization he founded in 2017, which provides access to data on more than 3,318 cybersecurity vendors. To streamline and automate the compilation of data, Stiennon explains how IT-Harvest is using ChatGPT 4.0. On that note, Stiennon discusses how AI is transforming cybersecurity—both for the good and the bad. 

Cybercriminals are finding ways around guardrails instituted in commercially available AI solutions like ChatGPT and Bard or simply developing their own to accelerate the development of malware, automate advanced persistent threats, and generate human-like phishing and spear-phishing attacks. At the same time, cybersecurity vendors are rapidly adding new AI capabilities to their product portfolios that improve the efficacy and efficiency of threat prevention, incident response, threat correlation and analysis, and more. Beyond the topic of AI, Stiennon addressed his thoughts on the role of cybersecurity leaders and subject-matter experts when it comes to serving as a board member or advisor. As a board member and advisor for a number of cybersecurity and compliance companies, he argues that organizations need to rethink how cybersecurity is discussed at the business level. Rather than teaching CISOs to speak the language of the business, they need to speak the language of cybersecurity and teach boards to understand cybersecurity risk through the lens of cybersecurity. 

LinkedIn Profile: www.linkedin.com/in/stiennon/ 

IT-Harvest: www.it-harvest.com 

Published Books:

Net Zeros and Ones: How Data Erasure Promotes Sustainability, Privacy, and Security

https://www.amazon.com/Net-Zeros-Ones-Promotes-Sustainability-ebook/dp/B0BN72M57X/ref=sr_1_3

Secure Cloud Transformation: The CIO's Journey

https://www.amazon.com/Secure-Cloud-Transformation-CIOS-Journey/dp/1945254203

UP and to the RIGHT: Strategy and Tactics of Analyst Influence

https://www.amazon.com/UP-RIGHT-Strategy-Influence-influence/dp/0985460709

There Will Be Cyberware: How the Move to Network-centric War Fighting Has Set the Stage for Cyberwar

https://www.amazon.com/There-Will-Be-Cyberwar-Network-Centric/dp/0985460784/

Surviving Cyber War

https://www.amazon.com/Surviving-Cyberwar-Richard-Stiennon/dp/1605906883/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

In this Kitecast episode, Michael Redman, who is a Knowledge & Learning Management Instructor at Schellman and is a subject-matter expert in various cybersecurity and compliance standards, spoke at length about Cybersecurity Maturity Model Certification (CMMC), the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and other topics that are pressing concerns for the Defense Industrial base (DIB). Redman asserts that businesses must approach cybersecurity as a risk management issue, just like any other business risk. Organizations must take proactive measures to mitigate cybersecurity risks and ensure they have a robust cybersecurity program in place.

Part of the podcast discussion with Redman involved the role of Certified Third Party Assessor Organizations (C3PAOs) and CMMC compliance. He explains that C3PAOs are an interesting entity and are being asked to shoulder a whole lot of responsibility with not a lot of reward. C3PAOs are swimming in murky water and need to be patient. As we proceed closer to CMMC implementation, the good, better, and best 3CPAOs will rise to the top, and the ones that aren’t fully invested will focus their energies elsewhere.

Midway through the podcast, Redman spoke about the CMMC Standards Council, of which he is a part. He explains that the Standards Council is working to create an objective matrix that can be used to rate C3PAOs objectively. He believes this will help organizations choose the right C3PAO based on their needs and budget. The alpha version of the objective matrix was just completed and is circulating among subject-matter experts for feedback.

Redman also talks about the importance of having a risk-based approach to cybersecurity. He suggests that organizations need to identify their high-value assets and focus on protecting them. He believes a risk-based approach is more effective than a compliance-based approach, as it helps organizations focus on what really matters. He emphasizes the importance of having a cybersecurity program aligned with the business objectives of the organization and one that accounts for third-party risk management (TPRM).\

Digital transformation is driving dramatic changes in cybersecurity. The confluence of cybersecurity and compliance demands a risk management model, and one focused on keeping private data private. Organizations can no longer view cybersecurity and compliance in separate silos but rather as intertwined and predictors of risk. Kiteworks’ content-defined zero-trust approach, which relies on the Kiteworks Private Content Network, is used by thousands of organizations around the world to unify security and compliance approaches to sensitive content communications while wrapping them in a hardened virtual appliance.

For more on Schellman, visit www.schellman.com/.

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Vertosoft's CTO Chet Hayes is a technologist at heart and has kept his finger on the pulse of the public sector for much of his career. Early on in his career, he cut his teeth in technical software architecture roles in organizations such as Sun Microsystems, Hughes Information Technology, and BEA Systems. Based in Virginia, much of his customer-facing work was with the federal government. For the past 15 years, Hayes has worked in various senior leadership positions serving the public sector.

While government organizations face many of the same technology challenges as private sector organizations, they also have unique requirements. Federal government agencies and their supply chains, in particular, tend to be ahead of the private sector when it comes to the use of cybersecurity frameworks. In this Kitecast episode, Hayes discusses how the NIST CSF, CMMC 2.0, FedRAMP Authorization, and other federal cybersecurity standards are driving the adoption of zero trust and other security best practices. Discover what he thinks are some of the biggest security opportunities and challenges facing the government sector today and how data privacy exposure risks play into both components by listening to this podcast.

For more on Vertosoft, visit www.vertosoft.com.

For more on Chet Hayes, visit www.linkedin.com/in/chetdhayes.

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Serial Entrepreneur and Cybersecurity and Risk Management Pioneer Taiye Lambo has worn a lot of different hats over the course of his career. He has led cybersecurity at the Federal Reserve Bank of Atlanta, the City of Atlanta, and Harland Clarke, among others. He founded or co-founded organizations such as eFortresses (a Gartner Cool Vendor), CloudeAssurance, and the Holistic Information Security Practitioner Institute (HISPI).

In this Kitecast episode, Lambo discusses a range of topics related to cybersecurity and risk management. He argues that cybersecurity frameworks like NIST CSF, ISO 27001, and SOC 2 empower organizations to measure their risk and institute technologies and processes to manage that risk. He also overviews the HISPI Certification Program and how cybersecurity and risk management professionals can get certified. 

https://www.hispi.org 

https://www.cloudeassurance.com 

https://efortresses.com  

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Over 20 years ago, Evgeniy Kharam launched his career on the “high seas” as a cybersecurity engineer for the Israeli Navy and in his subsequent professional career spent over 40,000 hours in pre- and post-sales support as a cybersecurity architect and consultant working with private and public sector organizations across the spectrum—from those with 500 employees to those with more than 100,000 employees.

Kharam sees Zero Trust as a critical ingredient for any cybersecurity approach and argues in this podcast interview that protecting sensitive content requires appropriate governance tracking and controls. As part of this process, least-privilege access and employing zero trust when it comes to governance policies are crucial in managing security and compliance risks. 

Check out Evgeniy's podcasts at https://linktr.ee/ekcyber. 

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

NCSi CTO Bryan Hadzik has spent over two decades with the Utah-based security and operations service provider. As cybercriminals and rogue nation-states focus their attention on hacking critical information, government and industry groups have responded by passing different compliance regulations, such as GDPR, FERPA, GBLA, PIPEDA, and others, and cybersecurity frameworks that include NIST CSF, ISO 27001, and SOC 2. Hadzik discusses how this has led to an intertwining of cybersecurity and compliance that organizations must address in order to manage private content and compliance risks effectively. He points out that insurance companies rate insurance policies based on an organization's adherence to these cybersecurity frameworks and ability to ensure compliance with data privacy regulations. 

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

While Sylvain Hirsch played on the Swiss National Rugby Team over a period of eight years, he learned much about the importance of collective collaboration and response. This prepared him for a career in cyber forensics and incident response that has taken him on an interesting journey from Europe to the Asia-Pacific region. He's worked for international organizations such as Credit Suisse in threat detection and response and has spent the past two years as an incident responder at Mandiant. His academic endeavors include serving as a guest speaker at different conferences and guest lecturer and researcher at Interpol, University College Dublin, University of Lausanne, and Berner Fachhochschule. This Kitecast episode explores various aspects of cyber forensics and incident response and what Sylvain sees as best practices and anticipates will be key advances in the field.

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Software Entrepreneur and Executive Josh Horwitz built a highly successful customer engagement software company and sold it. What was his next move? He dived into the Dark Web and—working with a couple other entrepreneurs—launched a fast-growth cybersecurity startup called Enzoic. Their focus is on stopping bad actors from exploiting compromised passwords. This frequently is a point of entry when cybercriminals and rogue nation-states gain access to networks, applications, and sensitive content. Watch or listen to this Kitecast episode to learn how Josh and the team at Enzoic are transforming password security by mining the Dark Web, empowering organizations and users to use passwords that have not been compromised and, when they are compromised, letting them know they have been. 

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.