In this episode, we delve into the recent cyber attack on CDK Global, a leading technology provider for the automotive industry. This incident, which disrupted operations for thousands of car dealerships across the United States, serves as a stark reminder of the vulnerabilities in our interconnected digital landscape.

Join us as we explore the immediate and long-term impacts of the attack, including significant operational disruptions and financial consequences that are expected to linger for months, if not years. We discuss the crucial lessons learned from this incident, highlighting the importance of robust cybersecurity measures, proactive threat detection, and the continuous evolution of security best practices.

We also examine the broader implications for operational continuity and resilience. Discover why it's essential for businesses to prepare for potential threats, implement redundancy and alternative strategies, and demand better security assessments and visibility from their service providers.

Furthermore, we address sector-specific challenges faced by automotive dealerships, such as the variability in resources and support structures, and the role of manufacturers in providing alternative software solutions.

Finally, we touch on the regulatory and legal landscape, including SEC breach disclosure requirements and related lawsuits, underscoring the necessity of compliance and transparency in cybersecurity.

Tune in to gain valuable insights into the critical importance of cybersecurity in today's digital age and learn how organizations can stay vigilant and proactive in protecting their operations and data.

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In this episode, Stan Wisseman and Rob Aragao welcome Justin Young to explore the transformative role of Software Bill of Materials (SBOMs) in enhancing software supply chain security. Justin shares his extensive experience and insights into how SBOMs contribute to the maturation of the software industry, drawing parallels with the auto and food industries' approaches to defect and ingredient tracking.

The discussion delves into the regulatory landscape, highlighting the FDA's SBOM requirements for medical devices, the U.S. National Cybersecurity Strategy, and various compliance mandates from CISA, DORA, PCI, and the EU CRA. Justin explains the importance of shifting liability to software vendors and away from end users and open-source developers, emphasizing the need for actively maintained and secure software components.

Listeners will gain an understanding of the different SBOM formats, Cyclone DX and SPDX, and their respective advantages. Justin also addresses the challenges organizations face in managing SBOMs, including procurement, validation, and the necessity of a dedicated SBOM program manager.

Finally, the episode explores the practicalities of SBOM implementation, from storage and cataloging to enrichment and vulnerability management, offering a comprehensive guide for organizations aiming to bolster their software security practices.

Tune in to learn how SBOMs are reshaping the software industry, driving transparency, and enhancing security across software supply chains.

Relevant Links:
Episode 88: Open-Source Software: Unlocking efficiency and innovation

Episode 41: Do a little dance, Time for some SLSA

Episode 26: Log4j Vulnerabilities: All you need to know and how to protect yourself

Episode 4: SolarWinds: Bringing down the building… Software Supply-Chain Pressure Points

Whitepaper: The need for a Software Bill of Materials

Software Supply Chain Hub page

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In this podcast episode, hosts Rob Aragao and Stan Wisseman are joined by Arun DeSouza, a renowned expert in connected vehicle security and former CISO at leading automotive companies. Arun begins by highlighting the critical challenges facing connected vehicles, emphasizing the importance of security by design throughout the development lifecycle. He stresses the need for rigorous vulnerability assessments and penetration testing to prevent vulnerabilities that could lead to remote hacking or data breaches.

Arun discusses the vital role of infrastructure connectivity and encryption in securing data transmission between vehicles and the cloud. He emphasizes the necessity of secure over-the-air software updates to patch vulnerabilities promptly. Addressing the risks associated with peripheral devices connected to vehicles, Arun advocates for robust system interface protections and micro-segmentation strategies to isolate critical systems from non-critical ones.

Privacy and data security emerge as central concerns, with Arun emphasizing the importance of adhering to privacy-by-design principles. He discusses the implications of GDPR-like standards for protecting sensitive data collected by connected vehicles and underscores the need for user consent frameworks in data handling practices.

The conversation extends to the complex automotive supply chain ecosystem, where Arun stresses the importance of implementing robust security measures across third-party suppliers. He highlights the role of continuous security assessments and collaborative efforts within the supply chain to mitigate cybersecurity risks effectively.

Concluding the episode, Arun offers practical advice for consumers considering connected vehicles, suggesting they seek transparency from manufacturers regarding cybersecurity features. He encourages leveraging industry networks and expert advice to make informed decisions about vehicle purchases in 2024.

Join us for an insightful exploration of the evolving landscape of connected vehicle security.

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In this episode, Rob Aragao and Stan Wisseman look at the intriguing transition from Chief Information Security Officer (CISO) to Chief Technology Officer (CTO). Drawing from a recent sidebar conversation among CISOs and an insightful article from Dark Reading, they examine why this trend is becoming more prominent. With examples from organizations like Bank of America, Fifth Third Bank, and Equifax, Rob and Stan discuss the key attributes that make this career move logical and beneficial.

The conversation highlights the importance of collaboration, strategic thinking, and the deep understanding of both technology and business impact that CISOs bring to the table.  They delve into how the roles of CISO and CTO overlap, particularly in driving innovation, increasing revenue, and embedding security by design into business solutions.

Rob and Stan also consider the broader influence a CTO has on an organization's technology strategy, the operational experience both roles share, and the potential motivations behind CISOs seeking to transition—whether to escape the increasing personal liability associated with security breaches or to pursue new professional growth opportunities.

Additionally, the episode touches on the challenges CISOs might face in this transition, such as the need for expertise in product development and the software lifecycle.

As discussed in this episode:
https://www.darkreading.com/cybersecurity-careers/ciso-as-a-cto-when-and-why-it-makes-sense

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

Reimagining Cyber is 100 episodes old! The podcast began in December 2020 as a bi-weekly dive into cybersecurity and cyber resiliency. It is now a weekly affair and has become a regular feature in the Apple Podcast Technology charts. It is also one of the most respected shows in the cybersecurity genre. 

Hosts Rob Aragao and Stan Wisseman alternate between head-to-head discussions on the latest cyber topics of the day and guest interviews.  This week’s guest is Mark Fernandes,  Global CISO at CAE. Mark heads a team focused on cyber resilience, particularly in the critical sectors like aviation, defense and security. CAE is a prominent force in the defense and government, but it's also equally recognized in their commercial pilot training programs. With over 28 years of experience in cybersecurity, Mark has extensive knowledge in governance, analytics, intelligence, and advanced threat defense.

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In this episode of Reimagining Cyber Rob and Stan look at the staggering costs and ongoing epidemic of data breaches and ransomware attacks. Did you know that the average cost of a mega breach involving 50 to 60 million records is a jaw-dropping $332 million? Ransomware, though less expensive, still costs businesses an average of $4.5 million per attack. It's clear that organizations must be better prepared to face these threats.

To shed light on effective strategies and insights Rob and Stan are joined by Shamoun Siddiqui, VP and Global CISO of the Upbound Group. He helps answer the burning question: Can businesses ever be truly breach-proof, even with unlimited funds? Shamoun emphasizes that while complete security is unattainable, companies can operate with risk management strategies, acknowledging limitations in funding, talent, and technology.

Shamoun shares real-world examples of vulnerabilities exploited during modernization efforts and stresses the importance of maintaining robust cybersecurity programs. He offers invaluable advice on building business justifications for cybersecurity investments, communicating effectively with boards of directors, and focusing on core security controls like multi-factor authentication and privileged access management.

He also delves into the critical role of external relationships with law enforcement and forensic companies during a breach, and how these interactions can impact the outcome. Shamoun highlights the importance of having a pre-established plan, managing internal and external communications, and the necessity of resilience and recovery strategies.

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

Cyber posture –what is its role in today’s digital landscape?  What are the essential components that make up a robust cyber posture?  What practical advice is there for organizations looking to bolster their defenses against ever-evolving cyber threats?

In this episode, Rob and Stan delve into the complex landscape of cybersecurity posture management. They dissect  posture management solutions in the market, highlighting the need to cut through marketing hype to focus on tangible outcomes. Emphasizing the importance of continuous monitoring, they explore the evolution of posture management from a static assessment to an ongoing process. Drawing on examples like cloud security posture management and data governance, they stress the need for comprehensive visibility across diverse environments. Rob and Stan discuss the challenges faced by organizations of varying sizes in achieving effective posture management, considering resource constraints and the role of automation. They also touch on the intersection between posture management and regulatory compliance, advocating for a risk-based approach over checkbox compliance. Throughout the discussion, they underscore the significance of people, processes, and technology in shaping an organization's cyber resilience. Looking ahead, they contemplate the potential role of AI-driven interfaces in facilitating efficient posture management and adaptation to evolving threats.

The Webinar recording Rob and Stan reference in the podcast is available on here

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In the latest episode of Reimagining Cyber, hosts Rob and Stan explore crisis management in cybersecurity with expert Kevin Dinino, founder of KCD PR. They stress the pivotal role of effective communication during cyber incidents, highlighting the need for a robust crisis communication plan, particularly for public companies. Kevin outlines key elements such as audience identification, messaging strategy, and communication methods. They delve into tailored responses for different incidents like ransomware attacks. The conversation underscores the importance of tabletop exercises in streamlining decision-making processes and avoiding unnecessary delays. They emphasize empowering teams to communicate promptly without excessive approvals. Establishing clear internal and external communication channels, including designated media contacts and backup methods, is critical. Proactively controlling the narrative and providing timely updates help prevent misinformation and maintain trust. Lessons learned include the necessity of alignment between parent and subsidiary companies in crisis communication. In essence, a proactive and coordinated approach is vital for successful crisis management in cybersecurity.

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In this episode of "Reimagining Cyber," join hosts Stan Wisseman and Rob Aragao as they explore the cutting edge of cybersecurity. They delve into the world of smart contracts and decentralized finance, examining both the revolutionary potential and the inherent risks. The conversation shifts to cybersecurity roadshows, where they highlight key insights from recent fireside chats with industry leaders about navigating the complexities of cybersecurity programs, gaining executive buy-in, and harnessing AI while maintaining data security.

Links relevant to this episode:
Unlocking Security in Smart Contracts with Fortify SCA
Cybersecurity in a Web 3.0 World
Cyber Risk Posture Management Webinar registration

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.

In this episode Stan and Rob delve into the critical issue of protecting seniors from cyber threats. Guest Michael Echols, author of "The Shield: Protecting Seniors From Hackers," sheds light on the alarming vulnerability of seniors in the digital age.

Drawing from personal experiences, Stan highlights how elderly family members are frequently besieged by scams, including fraudulent calls and phishing attempts. Michael unpacks the various tactics employed by cybercriminals, from romance scams to Medicare fraud, emphasizing the emotional manipulation used to exploit seniors' trust.

Michael also stresses the importance of proactive measures, such as credit freezes, to bolster cybersecurity defenses. He advocates for open dialogue and collaborative efforts within families and communities to combat cyber threats effectively.

Furthermore, the role of AI in both perpetrating and mitigating cyber risks is explored. While AI-driven attacks pose new challenges, innovative solutions like AI-powered call screening offer promising avenues for safeguarding seniors.

The episode concludes with a call to action: to recognize the gravity of the cybersecurity threat facing seniors and to take proactive steps to mitigate risks. By fostering awareness, implementing security measures, and fostering open communication, we can collectively shield seniors from the perils of cybercrime.

Follow or subscribe to the show on your preferred podcast platform.
Share the show with others in the cybersecurity world.
Get in touch via [email protected]

As featured on Million Podcasts' Best 100 Cybersecurity Podcast and Best 70
Chief Information Security Officer CISO Podcasts rankings.