Redefining CyberSecurity

Guests: 

Pedro Adão, Associate Professor, Instituto Superior Técnico, Universidade de Lisboa [@istecnico

On Linkedin | https://www.linkedin.com/in/pedro-ad%C3%A3o-b5b792/?

Marco Squarcina, Senior Scientist, TU Wien [@tu_wien]

On Linkedin | https://www.linkedin.com/in/squarcina/?originalSubdomain=at

Website | https://minimalblue.com/
____________________________

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast and Audio Signals Podcast

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

This Episode’s Sponsors

Island.io | https://itspm.ag/island-io-6b5ffd

____________________________

Episode Notes

In this Chats on the Road to Black Hat USA, hosts Sean and Marco are joined by guests Pedro and Marco to explore the vulnerabilities and challenges of web security. The conversation begins with an explanation of the Double Submit and Synchronized Token patterns used to protect against CSRF (cross site request forgery) attacks. They discuss the limitations of these patterns, particularly when it comes to the integrity of cookies.

The guests highlight the potential for attackers to modify cookies and the need for better solutions. The conversation then unpacks the complexities of web security, including the difficulties of maintaining backward compatibility and the challenges of multiple components and parties involved in web development, delivery, and operations. They address the importance of revising the security of subdomains and implementing security mechanisms like HSTS (HTTP strict transport security) with the inclusive domain directive.

The conversation also raises philosophical questions about the responsibility of companies and the development community in addressing web security, as well as the role of legislation in this space. The group emphasizes the need for better platforms and frameworks that prioritize security from the start.

The conversation concludes with a discussion on the importance of ongoing research, reporting vulnerabilities to developers, and finding solutions to improve the overall security of web applications. Listeners can expect to gain a deeper understanding of web security challenges and the ongoing efforts to address vulnerabilities and improve the security of the internet ahead of Pedro's and Marco's research presentation at Black Hat USA 2023.

Stay tuned for all of our Black Hat USA 2023 coverage: https://www.itspmagazine.com/bhusa

____

Resources

Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities: https://blackhat.com/us-23/briefings/schedule/#cookie-crumbles-unveiling-web-session-integrity-vulnerabilities-32551

For more Black Hat USA 2023 Event information, coverage, and podcast and video episodes, visit: https://www.itspmagazine.com/black-hat-usa-2023-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story in connection with our Black Hat coverage? Book a briefing here:
👉 https://itspm.ag/bhusa23tsp

Want to connect you brand to our Black Hat coverage and also tell your company story? Explore the sponsorship bundle here:
👉 https://itspm.ag/bhusa23bndl

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/podcast-series-sponsorships

Guests: 

Steve Luczynski, Senior Manager / Critical Infrastructure Security, Accenture Federal Services [@Accenture] and Chairman of the Board for the Aerospace Village [@secureaerospace]

On LinkedIn | https://www.linkedin.com/in/steveluczynski/

On Twitter | https://twitter.com/cyberpilot22

Lillian Ash Baker, Product Security Engineer, Boeing and Call for Papers Organizer for the Aerospace Village [@secureaerospace]

On LinkedIn | https://www.linkedin.com/in/zap-bang/

____________________________

Hosts:

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli
____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Pentera | https://itspm.ag/penteri67a

___________________________

Episode Notes

In this episode of the ITSPmagazine podcast, hosts Sean and Marco are joined by guests Steve Luczynski and Lillian Ash Baker to discuss the Aerospace Village 2023 at DEF CON during Hacker Summer Camp in Las Vegas. The conversation highlights the diverse range of topics covered in the village, including CubeSat resilience, ransomware resilience, and attack chains for low orbit satellites.

The guests emphasize the involvement of government agencies like the White House and TSA, as well as industry giants like Boeing and Lockheed. The hosts express their excitement for the hands-on activities at the village, such as capture the flag events, and the opportunity to learn from experts in the field.

They also discuss the importance of inspiring and promoting cybersecurity in the aviation and space sector, particularly for students and newcomers. The presence of SpaceX and their partnership with the village is highlighted as well. Listen to get a comprehensive overview of the Aerospace Village, showcasing the intersection of cybersecurity, aviation, and space, and the opportunity for attendees to engage with experts and participate in hands-on activities.

The conversation also take a trip down memory lane, looking at the history of the village and its evolution over the years, highlighting the increasing number of submissions and the involvement of government agencies. The guests discuss their respective roles in the village and share their perspectives on the importance of cybersecurity in the aerospace industry. The hosts express their enthusiasm for the presentations and the chance to connect with professionals in the field. They also reflect on the growth and impact of the village, noting the increasing interest and participation from students and researchers. 

____________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllQZ9kSG7X7grrP_PsH3q3T3

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

____________________________

Resources

Aerospace Village (Website): https://www.aerospacevillage.org/defcon-31

____________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guest: Johannes Willbold, Doctoral Student, Ruhr University Bochum [@ruhrunibochum]

On Linkedin | https://www.linkedin.com/in/jwillbold/

On Twitter | https://twitter.com/jwillbold

Website | https://jwillbold.com/
____________________________

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

This Episode’s Sponsors

Island.io | https://itspm.ag/island-io-6b5ffd

____________________________

Episode Notes

In this Chats on the Road to Black Hat USA, hosts Sean and Marco invite Johannes Willbold to discuss the security of low Earth orbit (LEO) satellites. Johannes shares his research on satellite vulnerabilities and the challenges in securing satellite systems. They discuss security by obscurity and the lack of standardized protocols in satellite technology.

Johannes emphasizes the importance of addressing security concerns in space technology and the need for organizations like NASA and the European Space Agency (ESA) to come together to address these challenges. They spend time looking into the difficulties of implementing security measures on satellites and the slow adoption of fixes due to the time-consuming nature of satellite testing and deployment.

The trio also touch on the lack of everyday defenses and mitigating controls for satellite security, as well as the challenges of monitoring and responding to threats while satellites are in orbit. Johannes highlights ongoing efforts by organizations like ESA to improve security in space and host workshops to encourage research in this area.

The hosts also cover some of the points from Johannes's upcoming talk at Black Hat USA, where he will share more details about his research. 

Stay tuned for all of our Black Hat USA 2023 coverage: https://www.itspmagazine.com/bhusa

____

Resources

Houston, We Have a Problem: Analyzing the Security of Low Earth Orbit Satellites: https://www.blackhat.com/us-23/briefings/schedule/index.html#houston-we-have-a-problem-analyzing-the-security-of-low-earth-orbit-satellites-32468

Space Odyssey research paper: https://jwillbold.com/paper/willbold2023spaceodyssey.pdf

For more Black Hat USA 2023 Event information, coverage, and podcast and video episodes, visit: https://www.itspmagazine.com/black-hat-usa-2023-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story in connection with our Black Hat coverage? Book a briefing here:
👉 https://itspm.ag/bhusa23tsp

Want to connect you brand to our Black Hat coverage and also tell your company story? Explore the sponsorship bundle here:
👉 https://itspm.ag/bhusa23bndl

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/podcast-series-sponsorships

In this Their Story podcast episode, as part of our Black Hat USA conference coverage, hosts Sean Martin and Marco Ciappelli connect with Brian Kenyon, the Chief Strategy Officer at Island, to unpack the intricate world of enterprise browsers. Together, they explore the pressing need for robust web security and the challenges that orbit it. As the conversation unfurls, they navigate the evolution of browsers, their pivotal role in today's work operations, and how modern frameworks like Chromium have replaced relics like Flash and Silverlight, simplifying web backend and significantly enhancing a consistent user experience.

The trio brings to light the persistent problem of technical debt within enterprise environments, where the existence of outdated applications and frameworks continues to be a daunting issue. They assert the need for an enterprise browser capable of maintaining compatibility with older systems while simultaneously keeping pace with the advancements of the digital era. In addition, the dialogue expands to include the integration of browser technologies in cloud-based applications like Salesforce and ServiceNow, and the challenges inherent in applying policies and ensuring data security within such environments.

The pivotal value of an enterprise browser emerges strongly throughout the discussion, highlighting its ability to augment productivity and provide unique cybersecurity solutions. The conversation orbits around the value of an enterprise browser integrating with an organization's identity and access management systems, yielding granular control over access and actions within applications. Furthermore, Brian draws attention to the deployment flexibility of an enterprise browser, with its ability to be utilized across an entire organization or targeted towards specific departments or teams.

In a concluding note, Sean, Marco, and Brian emphasize the pivotal role of end-user experience in enhancing productivity and the transformative role browsers play in this scenario. They discuss the additional functionality that an enterprise browser can offer - such as built-in copy and paste palettes, PDF editors, and password managers — and caution about potential risks tied to browser extensions, underscoring the need for visibility, governance, and control in this area while allowing the end-users to drive the requests to ensure they get their work done.

A secure enterprise browser, such as the one offered by Island.io, is pivotal in transforming the business narrative, where security ceases to be a mere protective measure and becomes a business enabler. By ensuring a seamless and secure web browsing experience, it aligns with the company's strategic objectives, directly contributing to desired outcomes and fostering an environment where safety and efficiency coexist, driving the business towards new heights of digital innovation.

Ultimately, this episode provides valuable insights into the challenges and benefits of leveraging an enterprise browser within the evolving digital landscape, offering a thought-provoking, informative, and practical discourse for organizations striving to enhance their web security and improve end-user experiences.

Note: This story contains promotional content. Learn more: https://www.itspmagazine.com/their-infosec-story

Guest: Brian Kenyon, Chief Strategy Officer at Island [@island_io]

On LinkedIn | https://www.linkedin.com/in/brianmkenyon/

Resources

Learn more about Island.io and their offering: https://itspm.ag/island-io-6b5ffd

What if the browser was designed for the enterprise? See for yourself at Black Hat - Visit Booth #1474 https://itspm.ag/islandl724

For more Black Hat USA 2023 coverage: https://itspmagazine.com/black-hat-usa-2023-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story?
https://www.itspmagazine.com/telling-your-story

Guest: Fredrik Heiding, Research Fellow at Harvard University [@Harvard]

On Linkedin | https://www.linkedin.com/in/fheiding/
____________________________

Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin

Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli

____________________________

This Episode’s Sponsors

Island.io | https://itspm.ag/island-io-6b5ffd

____________________________

Episode Notes

In this Chats on the Road to Black Hat USA, hosts Sean and Marco discuss the use of AI in hacking and cybersecurity with guest Frederick Heiding, specifically large language models, such as GPT-3 and GPT-4 (ChatGPT). They explore the concept of using AI to create realistic phishing emails that are difficult to detect, and how cybercriminals can exploit this technology to deceive individuals and organizations.

The episode also looks at the ease with which AI can generate content that appears real, making it a powerful tool in the hands of attackers. The trio discuss the potential dangers of AI-powered phishing emails and the need for more sophisticated spam filters that can accurately detect the intent of these emails, providing more granular information and recommended actions for users.

Throughout the episode, there is a recognition of AI as a tool that can be used for both good and bad purposes, emphasizing the importance of ethics and the ongoing race between cybercriminals and cybersecurity professionals. The conversation also touches on the positive applications of AI in detecting and preventing phishing attacks, showcasing the efforts of the "good guys" in the cybersecurity world. They discuss the potential for AI to help in blocking phishing emails and providing more granular information and recommended actions for users.

About the Session

AI programs, built using large language models, make it possible to automatically create realistic phishing emails based on a few data points about a user. They stand in contrast to "traditional" phishing emails that hackers design using a handful of general rules they have gleaned from experience.

The V-Triad is an inductive model that replicates these rules. In this study, we compare users' suspicion towards emails created automatically by GPT-4 and created using the V-triad. We also combine GPT-4 with the V-triad to assess their combined potential. A fourth group, exposed to generic phishing emails created without a specific method, was our control group. We utilized a factorial approach, targeting 200 randomly selected participants recruited for the study. First, we measured the behavioral and cognitive reasons for falling for the phish. Next, the study trained GPT-4 to detect the phishing emails created in the study after having trained it on the extensive cybercrime dataset hosted by Cambridge. We hypothesize that the emails created by GPT-4 will yield a similar click-through rate as those created using V-Triad. We further believe that the combined approach (using the V-triad to feed GPT-4) will significantly increase the success rate of GPT-4, while GPT-4 will be relatively skilled in detecting both our phishing emails and its own.

Stay tuned for all of our Black Hat USA 2023 coverage: https://www.itspmagazine.com/bhusa

____________________________

Resources

Devising and Detecting Phishing: Large Language Models (GPT3, GPT4) vs. Smaller Human Models (V-Triad, Generic Emails): https://www.blackhat.com/us-23/briefings/schedule/#devising-and-detecting-phishing-large-language-models-gpt-gpt-vs-smaller-human-models-v-triad-generic-emails-31659

For more Black Hat USA 2023 Event information, coverage, and podcast and video episodes, visit: https://www.itspmagazine.com/black-hat-usa-2023-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story in connection with our Black Hat coverage? Book a briefing here:
👉 https://itspm.ag/bhusa23tsp

Want to connect you brand to our Black Hat coverage and also tell your company story? Explore the sponsorship bundle here:
👉 https://itspm.ag/bhusa23bndl

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/podcast-series-sponsorships

Guest: Laurent Hausermann, Entrepreneur

On Linkedin | https://www.linkedin.com/in/laurenthausermann/

On Twitter | https://twitter.com/lhausermann

Website | https://cyberbuilders.substack.com/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Pentera | https://itspm.ag/penteri67a

___________________________

Episode Notes

In this episode of Redefining CyberSecurity Podcast, host Sean Martin and guest Laurent Hausermann discuss the process of building security products. They emphasize the importance of understanding customer needs and pain points before developing a product. Laurent shares his experience in the IoT security space and the significance of gathering feedback from potential customers. The conversation highlights the role of a product manager in championing the value and experience of a product, without overselling it to security practitioners. They discuss the challenges of marketing security products and the need for realistic expectations.

The discussion explores the user experience of security products, from installation to operational ease. They discuss the importance of a well-defined product development process and the role of the product manager in bridging user experience, technology, and business. They touch on the evolving nature of product management in a world where almost everything is built using a SaaS model. They also discuss the concept of time to value, emphasizing the need for quick delivery of value to users. They also address the role of product marketing in promoting the product and supporting sales, including the creation of collateral such as sales decks, briefs and papers, user testimonials, and webinars.

The conversation concludes by discussing the organizational structures and responsibilities for product management and product marketing. Sean and Laurent highlight the need for a clear understanding of the product manager's role and the distinction between product management and product marketing. They emphasize the importance of a collaborative product development process, where the product manager serves as a bridge between various aspects of the product.

Overall, this episode provides valuable insights into the world of building security products, emphasizing the importance of considering customer needs, user experience, and marketing strategies. The conversation is informative and thought-provoking, offering practical advice and discussing the challenges faced by security product teams. The host, Sean Martin, and guest, Laurent Hausermann, bring their expertise and experiences to the discussion, making it engaging and relevant for listeners in the cybersecurity industry.

____________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

____________________________

Resources

Inspiring Post | Unlocking the Secrets of Cybersecurity Product Teams: https://cyberbuilders.substack.com/p/unlocking-the-secrets-of-cybersecurity

____________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guest: Ryan Leirvik, CEO of Neuvik [@Neuvik]

On LinkedIn | https://www.linkedin.com/in/leirvik/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Pentera | https://itspm.ag/penteri67a

___________________________

Episode Notes

In this episode of Redefining Cybersecurity podcast, host Sean Martin discusses the fundamentals of risk management in cybersecurity with Ryan Leirvik, author of "Understand, Manage and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program." The conversation centers around the importance of understanding risk management in cybersecurity, categorizing assets, and identifying what's important to the business versus what's important to the individual. 

They also discuss the need to use frameworks like NIST-CSF to define and categorize risks and the importance of responding quickly to active threats and having a plan in place for recovery. Sean and Ryan provide practical advice for creating a sustainable cyber program that prioritizes risk management and explain how to set the stage for conversations about cybersecurity with stakeholders. Overall, the episode provides valuable insights into risk management in cybersecurity and how to prioritize and protect critical assets.

ABOUT THE BOOK

When it comes to managing cybersecurity in an organization, most organizations tussle with basic foundational components. This practitioner’s guide lays down those foundational components, with real client examples and pitfalls to avoid.

A plethora of cybersecurity management resources are available―many with sound advice, management approaches, and technical solutions―but few with one common theme that pulls together management and technology, with a focus on executive oversight. Author Ryan Leirvik helps solve these common problems by providing a clear, easy-to-understand, and easy-to-deploy "playbook" for a cyber risk management approach applicable to your entire organization.

This second edition provides tools and methods in a straight-forward, practical manner to guide the management of a cybersecurity program. Expanded sections include the critical integration of cyber risk management into enterprise risk management, the important connection between a Software Bill of Materials and Third-party Risk Programs, and additional "how to" tools and material for mapping frameworks to controls.

Who This Book Is For

CISOs, CROs, CIOs, directors of risk management, and anyone struggling to pull together frameworks or basic metrics to quantify uncertainty and address risk

____________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

____________________________

Resources

Understand, Manage, and Measure Cyber Risk: Practical Solutions for Creating a Sustainable Cyber Program (Book): https://www.amazon.com/Understand-Manage-Measure-Cyber-Risk-dp-1484293185/dp/1484293185/

____________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guest: Steve Wylie, Vice President, Cybersecurity Market at Informa Tech [@InformaTechHQ] and General Manager at Black Hat [@BlackHatEvents]

On LinkedIn | https://www.linkedin.com/in/swylie650/

On Twitter | https://twitter.com/swylie650
____________________________

This Episode’s Sponsors

runZero | https://itspm.ag/runzervvyh

Island.io | https://itspm.ag/island-io-6b5ffd

____________________________

Episode Notes

Black Hat USA 2023 conference's keynote sessions promise engaging and insightful conversations. Steve Wylie, the General Manager, highlighted one of the key discussions that will occur during the event, a fireside chat between Jen Easterly, the director of Cybersecurity and Infrastructure Agency (CISA), and Viktor Zhora, who is responsible for defending Ukraine's digital infrastructure. Easterly, having been appointed in 2021, participated in a Black Hat keynote stage three weeks later, where she effectively discussed her vision for the collaboration of hackers, government, and the private sector. Now, after a couple of years in her role, she's expected to bring in more nuanced perspectives.

The discussion will focus on the pressing issues faced by the cybersecurity world, including the war in Ukraine and the country's efforts to defend its digital infrastructure. This fireside chat is set to foster insightful exchanges from two significant figures, each from different governments, giving attendees a unique view into real-world security operations.

The Thursday morning keynote will feature Kemba Walden, the Acting National Cyber Director for the Executive Office of the President. Her contributions to major cybersecurity initiatives, such as the implementation of Executive Order 14028, make her an exciting addition to the conference. This order, which aimed to improve the nation's cybersecurity, addressed significant issues like public-private cooperation, sharing of intelligence between agencies, and supply chain security.

As the conference unfolds, more technical discussions will also take place. Wylie mentioned the Black Hat briefings which are typically quite technical and provide insights into the current cybersecurity landscape. One notable briefing includes James Kettle's session, "Smashing the State Machine: The True Potential of Web Race Conditions," highlighting an unexpected flaw in web applications. Other sessions cover important topics such as the recent Viacom satellite attack in Ukraine and global DDoS trends, as observed by the FBI.

The Black Hat USA 2023 conference offers a diverse range of topics for attendees, from policy-related big-picture conversations to more technical, detail-oriented discussions, plus hands-on activities taking place in the Arsenal. There's also an entrepreneur track, where innovative solutions are pitched to judges and are on display in the business hall.

Black Hat USA 2023 aims to provide both overarching perspectives and in-depth analyses to ensure a comprehensive understanding of today's cybersecurity challenges.

Stay tuned for all of our Black Hat USA 2023 coverage: https://www.itspmagazine.com/bhusa

____________________________

Resources

Black Hat USA 2023 Trainings: https://blackhat.com/us-23/training/schedule/index.html

Black Hat USA 2023 Briefings: https://blackhat.com/us-23/briefings.html

For more Black Hat USA 2023 Event information, coverage, and podcast and video episodes, visit: https://www.itspmagazine.com/black-hat-usa-2023-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story in connection with our Black Hat coverage? Book a briefing here:
👉 https://itspm.ag/bhusa23tsp

Want to connect you brand to our Black Hat coverage and also tell your company story? Explore the sponsorship bundle here:
👉 https://itspm.ag/bhusa23bndl

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/podcast-series-sponsorships

Guests: 

Allie Mellen, Senior Analyst at Forrester [@forrester]

On Linkedin | https://www.linkedin.com/in/hackerxbella/

On Twitter | https://twitter.com/hackerxbella

Jeff Pollard, VP & Principal Analyst at Forrester [@forrester]

On LinkedIn | https://www.linkedin.com/in/jpollard96/

On Twitter | https://twitter.com/jeff_pollard2

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Pentera | https://itspm.ag/penteri67a

___________________________

Episode Notes

In this new episode of Redefining CyberSecurity with Sean Martin, Allie Mellen, and Jeff Pollard engage in an in-depth conversation exploring security metrics' critical role and power in the infoSec decision-making processes. Throughout the dialogue, listeners can gain an understanding of the importance of implementing relevant metrics, such as Mean Time To Detect (MTTD) and Mean Time To Respond (MTTR), for tracking growth within cybersecurity contexts. However, there’s much more to metrics than just these two figures.

Both Allie and Jeff emphasize that metrics should be perceived not merely as numerical values but as valuable guideposts aiding decision-making. This perspective, attributed to the Lean Startup philosophy by Eric Ries, encourages using metrics to guide future actions, understand current decisions, or evaluate past outcomes. They stress that metrics should have a genuine purpose and contribute meaningfully rather than just providing quantitative data.

Furthermore, the conversation underscores the relevance of metrics to the decision-making audience. Allie and Jeff agree that metrics should differentiate between what matters only to your team and what's necessary for strategic decisions in the broader organization. They become truly impactful by ensuring metrics support decision-making and reach the right audience, whether it's senior leadership, the security program, or the tactical metric practitioners.

Storytelling's role is highlighted as vital in presenting these metrics to various stakeholders, making the data more meaningful, understandable, and actionable. The conversation extends the notion of metrics, applying concepts like readmission rates, commonly used in healthcare, to measure incident recurrence in cybersecurity.

The trio also spotlights the need for a synergistic relationship between the Security Operations Center (SOC) and Vulnerability Risk Management (VRM). Such a relationship fosters improved security posture through effective incident management and prevention, with Allie reasoning that translating data into something meaningful for other business units is crucial.

Touching upon individual metrics in the context of career progression, both Allie and Jeff emphasize the necessity for individuals to define their career-oriented metrics based on their personal goals and organizational expectations. This understanding can help leaders prove their program's success and influence others.

The conversation ultimately underscores the importance of the right data sources for calculating meaningful metrics. Without the correct data, generating truly impactful and actionable metrics becomes impossible. Jeff cites an example of a financial organization that used a unique metric to measure insider risk, emphasizing the complexities and challenges of deriving meaningful and actionable cybersecurity metrics.

There’s a lot to unpack in this conversation. Listen to the entire episode so you don’t miss a beat.

____________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

____________________________

Resources

The Lean Startup: https://theleanstartup.com/

____________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network

Guests: 

Logan Finch, Principal Engineer at Cromulence [@cromulencellc]

On Linkedin | https://www.linkedin.com/in/logan-finch/

On Twitter | https://twitter.com/hack_a_sat

Jason Williams, Co-Founder and CEO of Cromulence [@cromulencellc]

On Linkedin | https://www.linkedin.com/in/jason-williams-5858c3

On Twitter | https://twitter.com/hack_a_sat

Aaron Myrick, Project Leader at The Aerospace Corporation [@AerospaceCorp]

On Linkedin | https://www.linkedin.com/in/aaron-myrick-677b8474/

____________________________

Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]

On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________

This Episode’s Sponsors

Imperva | https://itspm.ag/imperva277117988

Pentera | https://itspm.ag/penteri67a

___________________________

Episode Notes

In this episode of Redefining CyberSecurity with Sean Martin, Logan Finch, Jason Williams, Aaron Myrick discuss the history and evolution of the Hack-A-Sat program, which aims to bridge the gap between the cybersecurity and aerospace communities and showcase the capabilities of extreme programming and hacking to secure space systems. The Moonlighter CTF challenge is a key part of the program, which emulates real-world attacks on space systems, and the guests share insights on the different disciplines involved in securing space systems.

This episode also explores the ethical considerations of hacking and cybersecurity, the importance of diversity in the space and cybersecurity industries, and the need for collaboration between the different communities to create a holistic approach to securing space and satellite systems. The group highlights the importance of a new mindset and approach to securing these systems, which are critical to our lives and the economy, and showcases the capabilities of the cybersecurity and aerospace communities.

____________________________

Watch this and other videos on ITSPmagazine's YouTube Channel

Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq

ITSPmagazine YouTube Channel:

📺 https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

____________________________

Resources

Hack-a-Sat CTF Website: https://hackasat.com/

____________________________

To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:

https://www.itspmagazine.com/redefining-cybersecurity-podcast

Are you interested in sponsoring an ITSPmagazine Channel?

👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network