Plan-B Security

Continued from last week's Security Leadership Strategy and Tactics conversation where we learn how to take the strategy and add it up to the sum of the bigger picture. We learn how Key Results are the journey to your goal, and how commanders intent keeps the organization focused, with or without you. This is one of my favorite yet!

Leading a team is hard, and it's even harder in the face of changing economical conditions, where money may not be flowing to where a business needs to stay secure, but instead where they can use it to make more money. Learn a few ways using the CITER risk-scenario model to justify investment and cost, and how to turn it into Objectives and Key Results.

Dig in to the details around Device Trust, where it's good and where it's bad. We walk through the fundamentals a program needs to have in place to start building on the device authorization and device attestation stories, which combined provide the device trust principles. There's a few ways to thwart device trust, and a few attack vectors it's not able to solve either. So join us as we talk about the good the bad, and ways to use device trust for incremental improvements while growing and building on other security skills!

Multi-factor Authentication is the the best way to protect your online life, keeping your data safe, secure and private. However, not all MFA is created equal. Let's listen to a few ways of thinking about the MFA problem and what the future of account security looks like. I'll also touch on the MGM, Caesars and Retool announcements as they relate to MFA and what we can learn and do differently! Be sure to share your learnings with your family, friends and loved ones so they know how to keep their data safe too - let's keep the digital world private!

The principle of most private is something I have been noodling on for a long time. It's not perfect, and will definitely see changes in the future, but it was a great way again to change the mindset. Least privilege is often a blocker to productivity, and a huge friction point for companies. Most private supports least privilege by adding intent and context into the conversation, allowing security and IT professionals to better understand what it is that needs to be solved. Most Private and also be broken down into Purpose, Risk, Impact, Validate, Audit, Transparency and Education when you need a framework for understanding if something is Most Private or not.

The 4 C's of cyber security are more of a philosophical pillar around building a security culture. Learn how Consistency, Clarity, Collaboration and Creativity play into sharing the security vision, working with others to make security a priority, and solving road blocks in a positive and effective manner.

Risk and Threat modeling (yes, they are different) are two effective ways to start building out the requirements for your security program. Solutioning through scenarios is like that, with a little more table top exercise sprinkled in. Also, learn how an old model from my Telecom days, the FCAPS model, plays a vital role in how I approach problems and come up with solutions.

Companies go through different rates of growth and have different information security needs as a result. Learn about a few common stages of growth, signs that your company might be in it, and what you might be able to accomplish. When the business doesn't want security to get in the way of getting a product launched, focus on the corporate side. Once you've made impact, start building components the company can consume to start doing things right in a standardized way. Ultimately, you'll find yourself writing policies and engineering technical solutions to enforce them. It's a never ending challenge, but it's so rewarding!

Right off the heels of BlackHat, DEFCON31 and BSidesLV, also known as Hacker Summercamp, hear about an impromptu conversation at dinner with a stranger around how to become more "Security" minded using the FTC's Start with Security guidance, making the jump from IT to Security a real possibility!