Redefining CyberSecurity

Guests:

Emily Coyle, President & Founding Partner, Cyber Governance Alliance

On LinkedIn | https://www.linkedin.com/in/emily-elaine-coyle-a8243328/

Dr. Amit Elazari, Co-Founder & CEO, OpenPolicy

On LinkedIn | https://www.linkedin.com/in/amit-elazari-bar-on/

On X | https://www.twitter.com/AmitElazari

Andrew Goldstein, Chair of Global White Collar Defense and Investigations Practice, Cooley LLP [@CooleyLLP]

On LinkedIn | https://www.linkedin.com/in/andrew-d-goldstein/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

View This Show's Sponsors

___________________________

Episode Notes

In the episode of Redefining CyberSecurity Podcast, host Sean Martin discusses the issues surrounding the SEC's precedent-setting decision to charge the CISO of SolarWinds, Tim Brown, in the aftermath of the Sunburst cyberattack. Joining Sean are Emily Coyle, the founder of Cyber Governance Alliance, Andrew Goldstein from law firm Cooley and Amit Elazari from OpenPolicy. 

Emily elucidates on the work of the Cyber Governance Alliance, aiming to lobby for methodology change by bringing the best practices of cybersecurity into the legal framework. The Alliance is seeking to provide cyber security professionals with the protections they need to carry out their role, including limitations on liability and protection against the chilling effect of litigation. 

Andrew speaks to the potential impacts their arguments could have on the wider cyber security field. A pressing concern he highlights is the effect of the SEC's decision on aspiring cyber security professionals and their willingness to engage in the field, potentially exacerbating an already vulnerable shortage of professionals.

Amit points out the contradictions between best practice standards for cybersecurity, enshrined in legislation, and the SEC’s decision. She puts a call to action to the cyber community to collectively support the renewal of the amicus, around furthering discussions with policy makers to create a balanced decision.

The group concludes that the lawsuit sets a challenging precedence for cybersecurity professionals. They argue that aligning legal and policy frameworks with cybersecurity practices should be a priority. They also encourage the community to engage the policymakers in discussion, starting with commenting on and signing the next amicus brief being drafted. Collectively they emphasize the urgency and importance of the cybersecurity community's involvement in shaping the future of cybersecurity policy and governance before it's set in stone.

Key Questions Addressed

• What has been the impact, thus far, of the SEC's decision to charge the CISO of SolarWinds, Tim Brown, after the Sunburst cyberattack?
• How can conflicting policies potentially impact the sustainability of effective cybersecurity practices and what is the call to action for the cybersecurity community?
• How is the Cyber Governance Alliance challenging the current cybersecurity legal framework and what protections are they seeking for cybersecurity professionals?

Top Insights from the Conversation

• The SEC's decision to charge the CISO of SolarWinds has far-reaching implications for the cybersecurity community and can deter aspiring professionals for a long time to come.
• Through the Cyber Governance Alliance, there's an ongoing effort to integrate the best practices of cybersecurity into the legal framework and provide basic liability protections for cybersecurity professionals.
• Despite the contradictions in cybersecurity policies, there's an urgent call for the cybersecurity community to unify and shape the future of cybersecurity policies and governance.

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

The amended amicus is due March 29th. Cooley will be hosting a webinar with Latham & Watkins (SolarWinds & Tim Brown outside counsel) to discuss:

        Date: Monday, March 11th
        Time: 4:00 - 4:30 EST
         Zoom Link: https://cooley.zoom.us/j/99323354217

To learn more about signing on to the updated amicus, contact Open Policy ( [email protected] ) or the team at Cooley via https://forms.office.com/Pages/ResponsePage.aspx?id=vqaHcH1e6Eme5Tx__T8eZbG7QNlB75pMoakNn09c-C5UMDBDNUVRVU8yUzFKV09HNjk5MTc0V0taSS4u.  

To learn more about Cyber Governance Alliance and their efforts to fight for cyber professionals in Washington, contact the team at ( [email protected]) or check out https://cybergovernancealliance.org/

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring this show with an ad placement in the podcast?

Learn More 👉 https://itspm.ag/podadplc

Guest: Keyaan Williams, Founder and Managing Director of CLASS-LLC [@_CLASSllc]

On LinkedIn | https://www.linkedin.com/in/keyaan/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Devo | https://itspm.ag/itspdvweb

___________________________

Episode Notes

In this episode of the Redefining CyberSecurity Podcast, hosted by Sean Martin, we are joined by guest Keyaan Williams to discuss the impact of the Securities and Exchange Commission (SEC) Incident Reporting Rule on organizations and its far-reaching implications. The wide-ranging discussion covers the shift in responsibility from a single Chief Information Security Officer (CISO) to the entire organization, the necessity for companies to have situational awareness to rapidly determine the materiality of cyber security incidents, and how these rules affect the company's enterprise risk management strategy.

Enterprise Risk Management (ERM) is integral to the way organizations protect themselves and manage risk. Contrary to focusing exclusively on cybersecurity and cyber-related risk, ERM takes an holistic approach and considers all risks across the company. This comprehensive approach ensures that companies make well-informed decisions about how they allocate resources, prioritize risks, and choose specific areas to mitigate. ERM also distributes the burden of risk oversight, reducing the intense pressure on CISOs or any single department and making risk management a collective responsibility. In an era of increasing regulatory oversight, such as the new rules from the SEC, ERM also aims to help companies demonstrate that they are taking all necessary precautions and addressing regulatory requirements effectively.

Williams also emphasizes the need for businesses to prepare for the increasing regulatory scrutiny by maintaining a robust governance structure and adopting a team-based approach for managing cyber security risks. They predict the possibility of additional rule-making concerning cybersecurity in the future, thus viewing the current phase as the calm before the storm.

Williams ends the conversation with an invitation for listeners to provide feedback, reinforcing the theme of the episode: collective engagement in cybersecurity management.

Key Questions Addressed:

• What is the impact of the new SEC reporting rule on CISOs and their teams?
• How can Enterprise Risk Management contribute to overcoming cybersecurity challenges?
• How does the SEC reporting rule change the role of a CISO within an organization?

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Digital twin technology, a remarkable innovation, is transforming how industries operate and manage cybersecurity. This edition of The Future of Cybersecurity Newsletter by Sean Martin explores the essence of digital twin technology, its market overview, applications across top industries, its role in cybersecurity, and key considerations for CISOs and the cybersecurity vendors building solutions with digital twin technologies in mind.

________

This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.

Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.

Sincerely, Sean Martin and TAPE3

________

Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.

TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.

Guest: Ari Schwartz, Managing Director of Cybersecurity Services and Policy at Venable LLP [@VenableLLP]

On Linkedin | https://www.linkedin.com/in/ari-schwartz-484a297a/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Devo | https://itspm.ag/itspdvweb

___________________________

Episode Notes

In this episode of Redefining CyberSecurity, host Sean Martin speaks with Ari Schwartz about the momentum to ban ransomware payments and the path to achieve it. Schwartz, a cybersecurity expert with three decades of experience, discusses his recently published blog post titled "The Path to Banning Ransomware Payments", and unpacks the ways not just businesses, but also governments can respond to this growing threat.

Martin and Schwartz delve into significant issues, including the moral, national security, and economic imperatives for banning these payments. The duo further discuss four potential strategies to make not paying ransoms the rational thing to do: requiring victims to report ransom payments, to submit to oversight by a government regulator, to pay fines or face potential criminal charges for refusing to comply.

Addressing the practicalities of such a ban, Schwartz believes it’s likely to happen within the next 3 to 5 years but notes the need for passing laws to successfully enforce it. He also examines the critical role of insurance in this scenario and emphasizes the importance of risk mitigation strategies and robust cybersecurity measures.

The episode also explores potential exceptions to the ban like potential life-or-death situations or major economic harm, and the need for government intervention during ransom situations. Lastly, they discuss how targeting ransomware can help internal corporate security teams highlight the threats to their leadership and drive investment in robust cybersecurity.

Top Questions Addressed:

• How can we effectively move towards the banning of ransomware payments?
• How does insurance play a role in this scenario and what should we prepare for in that regard?
• What are potential exceptions to the ban and how could a government intervene during ransomware situations?

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

The Path to Banning Ransomware Payments (LinkedIn post): https://www.linkedin.com/posts/ari-schwartz-484a297a_the-path-to-banning-ransomware-payments-activity-7142600762722848770-8_-J/

The Path to Banning Ransomware Payments: https://www.centerforcybersecuritypolicy.org/insights-and-research/the-path-to-banning-ransomware-payments

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Is the security platform dead? Did it ever live in the first place? Will it ever see the light of day? There are many thoughts on this topic, and Sean Martin wrote a new edition of The Future of Cybersecurity Newsletter to share his initial thoughts.

Read the article: https://www.linkedin.com/pulse/balancing-platforms-point-solutions-insights-from-product-sean-martin-f0lae/

________

This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.

Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.

Sincerely, Sean Martin and TAPE3

________

Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.

TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.

Guest: Shawn Tuma, Co-Chair, Data Privacy & Cybersecurity Practice at Spencer Fane, LLP [@SpencerFane]

On Linkedin | https://www.linkedin.com/in/shawnetuma/

On Twitter | https://twitter.com/shawnetuma

On Instagram | https://www.threads.net/@shawnetuma

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Devo | https://itspm.ag/itspdvweb

___________________________

Episode Notes

In this episode of the Redefining CyberSecurity Podcast, host Sean Martin sits down with cybersecurity data privacy attorney, Shawn Tuma. They delve into a comprehensive discussion on cyber risk, cybersecurity incident response, and cyber insurance. 

During their discussion, Tuma shares a wealth of knowledge stemming from his deep involvement in thousands of cyber incident responses. He discusses the evolving cyber threat landscape, singling out business email compromises as now topping the list and how the evolution of threat actor tactics has exploited the human element in organizations.

The conversation segues into the crucial role of insurance in incident response planning. Tuma goes into detail about the issues that organizations face with insurance, especially when they aren't familiar with the terms stipulated in their policies. He also emphasizes the importance of getting the insurance carrier involved early on and the necessity for businesses to have pre-approved incident response teams.

The episode wraps up with Tuma’s advice on building a robust incident response plan and how insurance plays a key part in the strategy.

Key Insights Provided:

• Though cyber threats continue to evolve, business email compromises now top the list over ransomware attacks because threat actors are manipulating the human element in organizations.
• Insurance carriers play an indispensable role in incident response planning; it's crucial to get them involved early on and for businesses to have pre-approved incident response teams.
• In building a robust incident response plan, businesses must understand their risk, be familiar with the terms stipulated in their policies, and ensure the implementation of measures that limit their vulnerabilities.

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guests:

Phil Reitinger, President and CEO, Global Cyber Alliance [@GlobalCyberAlln]

On Linkedin | https://www.linkedin.com/in/philipreitinger/

On Twitter | https://twitter.com/CarpeDiemCyber

Joshua Corman, Founder, I am The Cavalry [@joshcorman]

On Twitter | https://twitter.com/joshcorman

On LinkedIn | https://www.linkedin.com/in/joshcorman/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Devo | https://itspm.ag/itspdvweb

___________________________

Episode Notes

In this episode of the Redefining CyberSecurity Podcast, host Sean Martin engages with guests Phil Reitinger and Josh Corman to discuss the importance of financial backing and coordinated efforts in maintaining the security of the internet's infrastructure. Both guests emphasize the necessity for systemic approaches to sustain critical online operations, and the need to move from a reliance on generous volunteers towards more strategic, financially supported initiatives.

Reitinger and Corman cite several initiatives and organizations they've been involved with, such as Global Cyber Alliance, I Am The Cavalry, and others, illuminating their efforts to address cybersecurity issues. They also express the hope that the collaboration they've begun with the Common Good Cyber initiative, will lead to broad systemic solutions. The podcast brings to light key industry players, from large corporations to governments, and non-profits. The episode serves as a solid call to action, urging everyone to be part of a 'coalition of the willing' to secure the common good of the internet.

The Common Good Cyber initiative kicks off with a workshop in Washington DC. The workshop exists as a platform to gather diverse perspectives from cybersecurity stakeholders ranging from government representatives, corporations, to non-profit organizations. It is designed as a three-part effort, starting with understanding the urgency and identifying existing solutions, followed by brainstorming new solutions, and finally merging into a joint action plan to address the identified problems. The entire idea is to transition from simple plans to concrete action, which is the most challenging step. Moreover, the workshop is not just a one-off event but a launchpad for the Common Good Cyber initiative. It aims to understand the most viable solutions from the community, develop coherent strategies, and work on implementation beyond just the initial event.

Key insights discussed:

• There's a recognized gap in funding for critical internet infrastructure security, which has largely been dependent on volunteer efforts and small non-profit organizations.
• The Common Good Cyber initiative is an effort to bring together multiple stakeholders, including governments, corporations, and non-profits, to brainstorm and implement sustainable solutions to cybersecurity problems.
• Collaborative efforts, transparency, and a shared purpose are seen as crucial elements in addressing the challenges of internet security and operationalizing security tools and processes.

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1Y

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

About Common Good Cyber: https://commongoodcyber.org/

Workshop Overview: https://commongoodcyber.org/events/

Workshop Agenda: https://commongoodcyber.org/wp-content/uploads/2024/02/Common-Good-Cyber-February-Workshop-Agenda.pdf

Wendy Nather's Cyber Poverty Post: https://www.linkedin.com/posts/wendynather_securitypovertyline-cyberpoverty-cybercivildefense-activity-7165733967113957376-80jy

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guests:

Eric Parizo, Managing Principle Analyst at Omdia [@OmdiaHQ]

On Linkedin | https://www.linkedin.com/in/ericparizo/

On Twitter | https://twitter.com/EricParizo

Richard Stiennon, Chief Research Analyst at IT-Harvest [@cyberwar]

On Twitter | https://twitter.com/stiennon

On LinkedIn | https://www.linkedin.com/in/stiennon/

On YouTube | https://www.youtube.com/channel/UCJbNLvhmVGnRerhrSU1mFug

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Devo | https://itspm.ag/itspdvweb

___________________________

Episode Notes

In this episode of the Redefining CyberSecurity Podcast, host Sean Martin engages in an enlightening dialogue with industry analysts and cybersecurity veterans, Eric Parizo and Richard Stiennon. The trio explored various aspects of the vendor space in cybersecurity, discussing topics like vendor consolidation, market contraction, and the state of M&A inundating an already-overwhelmed IT environment with complex products.

Parizo, a managing principal analyst, counters the narrative of large vendors, stating that most companies desire best-of-breed solutions that offer better integration and measurable outcomes. However, he sees challenges in getting standalone solutions to work together efficiently. To tackle this, Parizo envisages a shift from product integration to data integration, enabling enterprises to handle security data in centralized repositories like Amazon Security Lake.

Stiennon, a chief research analyst, points out that security will always be a subpart of the next big thing. Despite the increase in intelligent security systems and development in DevSecOps, Stiennon expresses doubt about a total transformation in security due to the potential disruption to business productivity. Instead of seeking transformation in security, he urges CISOs to first identify and reduce the number of redundant products they pay for, as vendors often progressively add features that might already be available in their product pool.

Parizo and Stiennon both offered unique insights into the future of cybersecurity platforms. Parizo acknowledged the merits of the platform approach but challenged the assertion made by large vendors about the superiority and cost-effectiveness of cybersecurity platforms over standalone solutions. He suggested most companies prefer best-of-breed solutions due to enhanced integration and measurable performance outcomes. Conversely, Stiennon expressed skepticism about cybersecurity platforms becoming predominant in the market, asserting that new threats and ongoing innovation make it impossible for one vendor to fully secure an enterprise. Both analysts indicate that, although cybersecurity platforms offer some benefits, the continually evolving security landscape ensures that no single platform approach will dominate the market.

Ultimately, Parizo and Stiennon believe that, while consolidation and platform approaches have some benefits, the key to organizational security lies in continuous innovation, knowing the full capabilities of products, and utilizing comprehensive data management to communicate more effectively and make better decisions. Despite the inherent challenges, both experts also remain optimistic about the evolving role of data and AI in driving efficient cyber security practices.

Top questions addressed:

• What is the current status of cybersecurity platforms in the market and how accepted are they by the enterprise?
• How is data management influencing the security landscape and what role does AI play in its evolution?
• How successful and realistic are the efforts towards consolidating security capabilities within organizations?
• What is the current trajectory of mergers, acquisitions, and consolidation in the market?

Companies referenced in this conversation:

Palo Alto, Cisco, Fortinet, Azure, Symantec, Google, Chrome, Norton LifeLock, AVG, Amazon, Elastic, Splunk, Snowflake, AWS, Cribl

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

Inspiring Post: https://www.linkedin.com/posts/ericparizo_omdia-standalone-security-products-outsell-activity-7148426159632826368-Z2jd

There Is No Such Thing As a Cybersecurity Platform: https://www.linkedin.com/posts/stiennon_there-is-no-such-thing-as-a-cybersecurity-activity-7166219637024575489-gAut

The Future of Cybersecurity Newsletter — Balancing Platforms and Point Solutions: Insights from a Product Manager, Industry Analysts, and the Market: https://www.linkedin.com/pulse/balancing-platforms-point-solutions-insights-from-product-sean-martin-f0lae

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guests: 

Julie Haney, Computer scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology [@NISTcyber]

On Linkedin | https://www.linkedin.com/in/julie-haney-037449119/

On Twitter | https://x.com/jmhaney8?s=21&t=f6qJjVoRYdIJhkm3pOngHQ

Jason Nurse, Reader in Cyber Security and Director of Science & Research, University of Kent [@UniKent] and CybSafe [@CybSafe]

On Linkedin | https://www.linkedin.com/in/jasonrcnurse

On Twitter | https://twitter.com/jasonnurse

On Mastodon | https://infosec.exchange/@jasonnurse

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Devo | https://itspm.ag/itspdvweb

___________________________

Episode Notes

In this episode of the new (first!) episode of the Human-Centered Research Series on the Redefining CyberSecurity Podcast, host Sean Martin and co-host Julie Haney from the Human Centered Cybersecurity program at NIST, chat with Dr. Jason Nurse, a reader in cybersecurity at the University of Kent in the UK. The discussion revolves around the role of cyber insurance in organizational risk management.

Jason elucidates cyber insurance’s function as a residual risk mitigation tool when dealing with cyber attacks, helping businesses recover and connect with response teams. They discuss how cyber insurance can incentivize better security practices but highlight challenges related to assessing security postures across diverse businesses. While ransomware features heavily in discussions of cyber risks, Jason points out that insurers don't always encourage ransom payments. Julie raises the issue of accessibility of cyber insurance for small businesses and suggests insurers offer 'pre-breach services'.

Sean, Julie, and Jason debate the role of human behavior in cyber risk, and how it affects organizations and insurance policies. They underscore the value of research in enhancing security practices and conclude by pondering ways to bridge the gap between academic research and practical implementation in cybersecurity.

Key Questions Addressed:

• What is the role and impact of cyber insurance in organizational risk management?
• How does cyber insurance interact with a business's cybersecurity practices, and how could it incentivize better measures?
• How does human behavior factor into cyber risks and insurance policies, especially in the context of ransomware and small-medium enterprises?

___________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

___________________________

Resources

Between a rock and a hard(ening) place: Cyber insurance in the ransomware era: https://www.sciencedirect.com/science/article/pii/S016740482300072X

Cyber Insurance and the Cyber Security Challenge: https://kar.kent.ac.uk/89041/1/RUSI-Kent-OP-Cyber-insurance.pdf

Mapping the coverage of security controls in cyber insurance proposal forms: https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y

Impact 2024: https://www.theimpactconference.com/impact-usa/

___________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network