Redefining CyberSecurity

By Sean Martin, ITSPmagazineBusiness Technology Education

Redefining CyberSecurity episodes

October 17, 2023 The California Delete Act: Emerging Changes for Data Brokers and Its Impact on Data Privacy | A Conversation with Nia Luckey | Redefining CyberSecurity Podcast with Sean Martin
Guest: Nia Luckey, Senior Cybersecurity Business Consultant at Infosys [@Infosys]
On LinkedIn | https://www.linkedin.com/in/nia-f-713270127/
____________________________
Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
This Episode’s Sponsors
Imperva | https://itspm.ag/imperva277117988
Pentera | https://itspm.ag/penteri67a
___________________________
Episode Notes
In this episode of Redefining CyberSecurity Podcast, host Sean Martin and guest Nia Luckey discuss the California Delete Act (California Senate Bill 362) and its impact on data privacy and protection. They delve into the concept of data brokers and the sensitive information they gather, such as personal details, credit data, facial recognition, and driving behaviors.
Presenting a couple examples, the conversation raises questions about responsibility for data protection in the realms of autonomous vehicles and platforms like Meta. They emphasize the need for businesses to understand the data they collect, educate themselves on data privacy regulations, and consider offering opt-out options for customers. Of course, providing the option to delete data is going to be a non-negotiable customer feature.
The discussion also touches on the challenges faced by smaller organizations in complying with the bill and provides advice on data inventory and protection. They stress the importance of knowing what data is being collected, where it is stored, and how to protect it to an appropriate standard. They highlight the need for businesses, regardless of size, to prioritize data protection and privacy. The ultimate aim is to empower individuals and businesses to have control over their data and protect privacy in an interconnected world.
The conversation takes a consumer-centric approach, discussing the implications for individuals and their rights to opt out of data collection. They explore the potential difficulties in deleting data from various platforms and emphasize the importance of making the process accessible and user-friendly.
Throughout the episode, Sean and Nia engage in a thoughtful and informative conversation, touching on topics such as data classification schemes, data handling practices, and the overall spirit of the California bill. They encourage businesses to proactively manage risk and ethics and take steps to protect data and privacy.
By listening to this episode, listeners can expect to gain a deeper understanding of the California Delete Act, its implications for data privacy, and the responsibilities businesses have in protecting sensitive information. They provide practical advice and insights to help individuals and organizations navigate the complex landscape of data protection and privacy regulations.
____________________________
Watch this and other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources
An Analysis of California Senate Bill 362 - The California Delete Act: https://www.linkedin.com/pulse/analysis-california-senate-bill-362-delete-act-nia-f-luckey-lssbb
International Association of Privacy Professionals (IAPP). California Legislature Passes Delete Act for PI Aggregated by Data Brokers: https://iapp.org/news/a/california-legislature-passes-delete-act-for-pi-aggregated-by-data-brokers/#:~:text=The%20California%20State%20Legislature%20passed,information%20collected%20by%20data%20brokers
California Legislature. (2023). Senate Bill 362.: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362
California's 'Delete Act' Could Let You Scrub Your Data From Brokers' Files.: https://fortune.com/2023/09/15/california-delete-act/
____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
47 min
October 14, 2023 The Game Show: CISO Jeopardy! | How Many CISOs Does an Organization Really Need? | A Musing On the Future of Cybersecurity and Humanity with Sean Martin and TAPE3 | Read by TAPE3
Join us for an immersive fictional game show story that delves into the critical factors and decisions driving the number of CISOs an organization might need in today's complex cybersecurity landscape.
________
This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.
Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.
Sincerely, Sean Martin and TAPE3
________
Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.
TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.
8 min
October 13, 2023 The Future of Secure Business Browsing: Isolation and Protection | Browser Security : Isolation-101 | A SecTor Event Coverage Conversation with Evgeniy Kharam
Guest: Evgeniy Kharam, Cybersecurity Professional, Security Architecture Podcast [@secarchpodcast]
On Linkedin | https://www.linkedin.com/in/ekharam/
____________________________
Hosts:
Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
Episode Notes
In this episode of the Redefining CyberSecurity Podcast, host Sean Martin is joined by Evgeniy Kharam to explore the world of browser security and browser isolation. They discuss the user experience and the policies that organizations can apply to protect against security threats.
The conversation delves into the concept of remote browser isolation and its application in ensuring user safety when visiting unknown or malicious websites. They also dive into the benefits of using enterprise browsers and the control they provide over website access, malware scanning, data loss prevention, and more.
The episode touches on the impact of browser security on security programs, team structures, and the tech stack. They discuss the relatively new browser security space and its potential to disrupt the SASE and SSE markets. Evgeniy shares insights into the potential transformation of the cybersecurity landscape and predicts that endpoint solutions may incorporate isolation technology. The episode concludes with a preview of Evgeniy's upcoming session at the SecTor security conference in Toronto, where he will dive deeper into browser security isolation.
Overall, this episode offers valuable insights into the evolving world of browser security and its potential impact on cybersecurity practices. Listeners can expect an engaging conversation that combines technical knowledge with practical applications.
About Evgeniy's SecTor Session: There has been renewed hype about adding more security efforts around the browser. New security startups and the bigger players as well have been making the case that because browsing is such an inherent part of our work and personal lives, we should address phishing and other attacks there. After interviewing and analyzing the offerings of many providers, I will share my findings and perspective on the market. This session will go over key points on how such a technology might be used in your organization, the pitfalls and how it fits in with / competes with other product suites like SASE and EDR. What you will learn:
- Use cases for browser isolation/enterprise browser
- ZTNA using browser isolation/enterprise browser
- Where browser isolation/enterprise browser fits in an environment
- Vendor land space
- What we should expect in the next 12-18 months
____________________________
Watch this and other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources
Browser Security / Isolation-101 (session): https://www.blackhat.com/sector/2023/briefings/schedule/#browser-security--isolation-101-34279
Learn more about SecTor 2023: https://www.blackhat.com/sector/2023/
____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
37 min
October 11, 2023 Prioritize with Purpose: Unleashing the Promise of Risk-Based Vulnerability Management | A Conversation with Andrew Braunberg | Redefining CyberSecurity Podcast with Sean Martin
Guest: Andrew Braunberg, Principal Analyst at Omdia [@OmdiaHQ]
On Linkedin | https://www.linkedin.com/in/andrew-braunberg-74a69/
On Twitter | https://twitter.com/abraunberg
____________________________
Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
This Episode’s Sponsors
Imperva | https://itspm.ag/imperva277117988
Pentera | https://itspm.ag/penteri67a
___________________________
Episode Notes
In this episode of Redefining CyberSecurity Podcast, host Sean Martin engages in a thought-provoking conversation with Andrew Braunberg, a principal analyst at Omdia. They explore the world of risk-based vulnerability management and its potential to revolutionize security operations and risk management programs.
The discussion delves into the challenges of traditional vulnerability management, including the reliance on Common Vulnerability Scoring System (CVSS) scores and the increasing volume of software vulnerabilities. They stress the importance of context, value, and verifiable risk reduction in prioritizing actions to effectively mitigate risk.
Andrew shares insights on the convergence of risk management and vulnerability management, as well as the role of telemetry in gaining a comprehensive view of the digital landscape. The conversation also touches on the need to understand the external threat landscape and consolidate threat information for better predictions. They discuss the expansion of vulnerability management into dev environments and the broader view of vulnerability, encompassing exposure management and misconfigurations.
The potential for self-serve tools and services in risk-based vulnerability management is explored, along with the consolidation of security control validation and attack path validation capabilities. Throughout the episode, the importance of rethinking security programs and embracing a proactive security posture based on risk reduction is emphasized. Collaboration and communication between security teams, asset owners, and management are highlighted as crucial for effective vulnerability management and risk mitigation.
The conversation provides valuable insights into the world of risk-based vulnerability management and the shift towards proactive cybersecurity. So if you're seeking innovative approaches to vulnerability management and risk reduction, tune in to this enlightening episode of Redefining CyberSecurity Podcast with Sean Martin and Andrew Braunberg.
____________________________
Watch this and other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources
Omdia research finds risk-based vulnerability management set to encompass the vulnerability management market by 2027 (press release): https://omdia.tech.informa.com/pr/2023/09-sep/omdia-research-finds-risk-based-vulnerability-management-set-to-encompass-the-vulnerability-management-market-by-2027
____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
44 min
October 09, 2023 Shaking Up the Cybersecurity Market: The Potential Implications of Splunk's Intended Acquisition by Cisco | A Conversation with Allie Mellen | Redefining CyberSecurity Podcast with Sean Martin
Guest: Allie Mellen, Senior Analyst at Forrester [@forrester]
On Linkedin | https://www.linkedin.com/in/hackerxbella/
On Twitter | https://twitter.com/hackerxbella
____________________________
Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
This Episode’s Sponsors
Imperva | https://itspm.ag/imperva277117988
Pentera | https://itspm.ag/penteri67a
___________________________
Episode Notes
In the fast-paced world of cybersecurity, market dynamics constantly evolve, driven by technological advancements, strategic partnerships, and acquisitions. One recent development that has captured the industry's attention is Cisco's intended acquisition of Splunk. This move promises to reshape the cybersecurity landscape and prompts us to explore the implications it holds for market competitiveness and security program effectiveness. In this conversation, Sean Martin and Allie Mellen take a journey into the intricacies of this acquisition, examining its impact on the dynamics of the cybersecurity space overall.
Sean and Allie discuss some of the key drivers behind the acquisition, touching on the challenges Splunk has faced and the industry’s need for more innovation in security operations. They dive into the challenges faced by security teams, particularly regarding SIEM cost management and a lack of innovation. They also touch on the importance of talent management, training beyond the tools, and improving the analyst experience to drive transformation efforts.
The conversation expands to consider the broader market impact of the acquisition. They discuss the opportunities for other security analytics and SIEM vendors to position themselves as alternatives to Splunk. The emergence of the XDR market expanding deeper into the security response space is also explored, focusing on its potential to provide bundled offerings that replace some of the traditional SIEMs on the market.
Sean and Allie also discuss the potential vision for SIEM and whether the shift towards XDR and endpoint-focused solutions limits the potential for a broader security operations scope. While XDR vendors aim to expand beyond endpoints, the discussion acknowledges the need for more comprehensive solutions like Splunk that remain ready to handle events and incidents that occur beyond the endpoint.
They also have a discussion on potential future trends, such as federated search and access of data, and the interest in building a more comprehensive, sustainable IT operations platform.
____________________________
Watch this and other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources

____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
41 min
October 07, 2023 Sourcing for Cyber: Addressing the Cybersecurity Talent Gap | A Conversation with Devon Bryan, Kimberly Quan, Katrina M, Dr. Elizabeth Kolmstetter, Licole Bursey | Redefining CyberSecurity Podcast with Sean Martin
Guests:
Devon Bryan, Global CIO at Carnival Corporation
On LinkedIn | https://www.linkedin.com/in/devonabryan/
Kimberly Quan, Senior Manager, Cyber Fusion at Juniper Networks [@JuniperNetworks]
On LinkedIn | https://www.linkedin.com/in/kimberlyq/
Katrina M, VP of Product Security at Akamai Technologies [@Akamai]
On LinkedIn | https://www.linkedin.com/in/katrina-m-8477361/
Dr. Elizabeth Kolmstetter, Chief People Officer at Cybersecurity and Infrastructure Security Agency [@CISAgov]
On LinkedIn | https://www.linkedin.com/in/elizabeth-kolmstetter-8217289/
Licole Bursey, Alumni, NPower [@NpowerOrg]
On LinkedIn | https://www.linkedin.com/in/licole-bursey-5a25a3176/
Event Host: Nelson Abbott, Senior Director, Advanced Program Operations at NPower [@NPowerOrg]
On LinkedIn | https://www.linkedin.com/in/nelson-abbott/
____________________________
Moderator: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
This Episode’s Sponsors
___________________________
Episode Notes
With over 630K open cyber jobs in the US, NPower continues to produce a strong network of diverse cybersecurity professionals for in-demand cyber roles. Hear from industry execs Devon Bryan of Carnival Corporation, Kimberly Quan of Juniper Networks, Katrina M. of Akamai Technologies, Dr. Elizabeth Kolmstetter of Cybersecurity and Infrastructure Security Agency (CISA), and NPower alumni, Licole Bursey in a panel discussion on the cyber talent gap and ways to tap into a viable pipeline of nontraditional cyber talent.
The panel delves into various aspects of the talent gap in cybersecurity, including the challenges organizations face in recruiting and retaining cyber talent, the need for diverse talent pipelines, and the importance of creating a sense of belonging in the workplace.
Dr. Kolmstetter highlights the importance of purpose and making a connection with the organization's mission to attract diverse talent. She emphasizes the need for a workplace environment that celebrates diversity of opinions and thoughts, where people can thrive and feel they are making a difference.
Devin discusses the image problem that cybersecurity still faces and the need for representation of diverse practitioners. He stresses the importance of visibility and showcasing cybersecurity’s fun and exciting aspects to attract more people, especially those from underrepresented communities.
Licole shares her personal experiences and insights as someone who has successfully navigated the job market in cybersecurity. She discusses the importance of having a diverse skill set and approaching the job search with a holistic mindset, focusing on mental and physical readiness.
Throughout the episode, the panelists emphasize the progress that has been made in addressing the talent gap, but acknowledge that more work needs to be done. They discuss strategies for attracting and retaining diverse candidates, such as removing degree requirements and leveraging non-traditional recruiting streams.
The conversation offers practical insights and solutions for organizations and individuals in the cybersecurity field. It is a valuable listen for anyone interested in understanding the challenges and opportunities in closing the talent gap, promoting diversity and inclusion, and building successful cybersecurity careers.
____________________________
Watch the NPower video on YouTube: https://www.youtube.com/watch?v=LV4y_b26G5k
Watch other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources
Engaging with Advancing Tech Careers Collaborative for partnership opportunities: https://www.npower.org/get-involved/atcc/
Command Shift Diversity Directive toolkit: https://diversity.commandshift.org/diversitydirective/
NICE Job Description Toolkit: https://www.nist.gov/system/files/documents/2023/09/22/MTM%20Guidance%20on%20Writing%20a%20Hiring%20Rubric.pdf
NPower Virtual Career and Resource Fair: https://app.premiervirtual.com/events/15495c07-5f3a-4639-8b08-fe90b3ddfd24/npower-virtual-career-and-resource-fair/organization
____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
1 hr 1 min
October 07, 2023 It’s About Time: The Turning Tide for Cyber Transformation | A Musing On the Future of Cybersecurity and Humanity with Sean Martin and TAPE3 | Read by TAPE3
Join us for this fictional tale where we follow a cybersecurity team, long overshadowed, as they rise to embrace transformation and pioneer a new era in cyber defense.
________
This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.
Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.
Sincerely, Sean Martin and TAPE3
________
Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.
TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.
10 min
October 04, 2023 From Concealment to Accountability: The SEC's Call for Transparency to Safeguard Shareholders | A Conversation with Matthew Rosenquist | Redefining CyberSecurity Podcast with Sean Martin
Guest: Matthew Rosenquist, CISO at Eclipz.io
On LinkedIn | https://www.linkedin.com/in/matthewrosenquist/
On Twitter | https://twitter.com/Matt_Rosenquist
On Medium | https://matthew-rosenquist.medium.com/
____________________________
Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
This Episode’s Sponsors
Imperva | https://itspm.ag/imperva277117988
Pentera | https://itspm.ag/penteri67a
___________________________
Episode Notes
In this thought-provoking episode of the Redefining CyberSecurity Podcast on the ITSPmagazine Podcast Network, host Sean Martin connects with Matthew Rosenquist to engage in a discussion about the recent SEC notification ruling. They explore the importance of transparency and accountability in cybersecurity for public companies as they dig into topics such as the need for transparency in security posture, the impact on shareholders and potential investors, and the role of privacy regulations in raising the security posture of industries like healthcare. They emphasize the value of notification and the balance between providing timely information to shareholders and avoiding potential lawsuits.
The conversation highlights the ethical implications of concealing information and the changing role of legal counsel in incident response. They discuss the potential emergence of whistleblowers to expose non-compliant companies and the impact of fines and penalties. They also touch on how transparency can drive accountability and impact business partners, vendors, and suppliers.
Recognizing the challenges faced by companies in operationalizing security and stress the importance of continuous monitoring and evaluation of cybersecurity measures, the episode discusses the potential for companies to face lawsuits and the role of the board in overseeing cybersecurity controls.
Overall, this episode offers valuable insights into the SEC notification ruling, providing listeners with a deeper understanding of its implications for cybersecurity, transparency, and accountability in public companies.
____________________________
Watch this and other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources
SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies: https://www.sec.gov/news/press-release/2023-139
Matthew's post on LinkedIn: https://www.linkedin.com/posts/matthewrosenquist_clorox-says-last-months-cyberattack-is-still-activity-7109565860331065344-yRec/
____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
43 min
September 30, 2023 Zero-Day Showdown—Is the wrEchoChamber Vulnerability Worse Than Log4Shell? | Navigating Cyber Threats in the Age of AI and Instant News | A Musing On the Future of Cybersecurity and Humanity with Sean Martin and TAPE3 | Read by TAPE3
Join us for a fictional tale of two security leaders—Sarah and Roger—and their contrasting approaches to zero-day crisis management.
________
This fictional story represents the results of an interactive collaboration between Human Cognition and Artificial Intelligence.
Enjoy, think, share with others, and subscribe to "The Future of Cybersecurity" newsletter on LinkedIn.
Sincerely, Sean Martin and TAPE3
________
Sean Martin is the host of the Redefining CyberSecurity Podcast, part of the ITSPmagazine Podcast Network—which he co-founded with his good friend Marco Ciappelli—where you may just find some of these topics being discussed. Visit Sean on his personal website.
TAPE3 is the Artificial Intelligence for ITSPmagazine, created to function as a guide, writing assistant, researcher, and brainstorming partner to those who adventure at and beyond the Intersection Of Technology, Cybersecurity, And Society. Visit TAPE3 on ITSPmagazine.
6 min
September 26, 2023Is Shift Left Overrated? | An Imperva Brand Story With Peter Klimek
In this Brand Story episode, hosts Marco and Sean have a thought-provoking discussion with Peter Klimek from Imperva about the concept of "shift left" in application security. Have we gone too far?
The conversation revolves around the challenges and benefits of identifying vulnerabilities earlier in the software development lifecycle and the need for collaboration between development and security teams. Peter emphasizes the importance of finding a balance between tools and human expertise in addressing vulnerabilities. He highlights the common issue of organizations having a backlog of vulnerabilities that need to be fixed, rather than a problem of finding vulnerabilities—it's "easy" to find them, harder to fix them all.
The conversation also touches on the measurement of closure velocity and the significance of development team velocity as a core metric in application security. They discuss the role of APIs, platform engineering, and infrastructure as code in improving collaboration, automation, and trust in systems.
Peter draws a parallel between guardrails on a highway and the need for guardrails in application security, emphasizing the importance of providing development teams with time to address critical vulnerabilities. They also explore the challenges of coordinating multiple teams and the role of operations in orchestrating the development and security processes.
The need for a defensive mindset and the importance of leveraging the guardrails Peter noted to prevent fatal vulnerabilities is also discussed as they emphasize the significance of collaboration, measurement, and a balance between development and security teams in implementing shift left practices effectively.
The episode provides valuable insights into the nuances, challenges, and benefits of integrating shift left practices into application security, while emphasizing the need for collaboration, balance, and the ethical use of tools.
Note: This story contains promotional content. Learn more.
Guest: Peter Klimek, Director of Technology - Office of the CTO at Imperva [@Imperva]
On LinkedIn | https://www.linkedin.com/in/peter-klimek-37588962/
Resources
Learn more about Imperva and their offering: https://itspm.ag/imperva277117988
DevOps Research and Assessment (DORA): https://dora.dev
2023 Imperva Bad Bot Report: https://itspm.ag/impervv0sg
47.4% of internet traffic wasn’t human in 2022! Get the research from @Imperva to learn how bots are taking over the internet.
The Impact Of Log4j Since Its Disclosure | Steps Businesses Can Take To Maintain Software Supply Chain Security:
Part 1: https://redefining-cybersecurity.simplecast.com/episodes/the-impact-of-log4j-since-its-disclosure-steps-businesses-can-take-to-maintain-software-supply-chain-security-part-1-of-2-an-imperva-story-with-gabi-stapel
Part 2: https://redefining-cybersecurity.simplecast.com/episodes/why-protecting-your-business-data-is-more-like-securing-a-museum-than-a-bank-demystifying-data-protection-an-imperva-story-with-terry-ray-07mq5xex-q5rc-fw8
From Enrolling In College To Gambling, Traveling, And Shopping, Evasive Bad Bots Are A Major Source Of Online Fraud | The Bad Bot Report 2022 | An Imperva Brand Story With Ryan Windham:
Part 1: https://redefining-cybersecurity.simplecast.com/episodes/from-enrolling-in-college-to-gambling-traveling-and-shopping-evasive-bad-bots-are-a-major-source-of-online-fraud-the-bad-bot-report-2022-part-1-an-imperva-story-with-ryan-windham
Part 2: https://redefining-cybersecurity.simplecast.com/episodes/from-enrolling-in-college-to-gambling-traveling-and-shopping-evasive-bad-bots-are-a-major-source-of-online-fraud-the-bad-bot-report-2022-part-2-an-imperva-story-with-ryan-windham
Catch more stories from Imperva at https://www.itspmagazine.com/directory/imperva
Are you interested in telling your story?
https://www.itspmagazine.com/telling-your-story
41 min