Join us as we delve into the world of incident response with our guest expert Giorgio Peticone, a seasoned incident detection and response consultant.In this insightful podcast, we explore real-life incident scenarios, key components of a robust incident response plan, and the critical importance of team collaboration and effective communication. Learn valuable lessons from past incidents, discover how to navigate the challenges of shifting from detection to containment, and gain insights into managing stress and burnout within the incident response team.

00:00 Teaser and Introduction

06:30 Real-life experience of a security incident

09:36 Lessons learned from security incidents

12:47 Key components for building an incident response plan

16:51 Testing and validating an incident response plan

23:46 Team collaboration challenges faced during an incident

27:47 Team collaboration challenges before and after an incident has occurred

31:55 Shift from detection to containment

37:35 Challenges faced when shifting focus from detection to containment

42:00 The Most challenging phase of an incident response

44:50 Approaching a client who recently faced an incident

49:35 Role of automation in improving the efficiency of incident response

52:30 Ensuring automation does not compromise security

55:00 Role of Human Analysts in Incident Response

58:08 Managing stress and burnout after an incident response

01:02:14 Advice for upcoming incident response leaders

01:07:07 How not build a detection engineering capability in an organization?

01:09:55 Summary

01:10:50 Learning recommendation from Giorgio

ScaleToZero: https://scaletozero.com/

Join us as we delve into the complex world of cybersecurity with our guest Ross Young, a seasoned CISO.

Join us as we delve into privacy engineering with our guest speaker Apoorvaa Deshpande, a seasoned privacy expert. Apoorvaa is currently a Senior Privacy Engineer at Google Cloud, working on privacy design, privacy-enhancing technologies (PETs), and data governance for AI. Prior to that, she was a tech lead at Snap Inc., leading the design and execution of several innovative PETs. Before that, she completed her PhD in Computer Science (cryptography) from Brown University.

Join us as we delve into the world of cloud pen-testing with our guest Scott Weston, a seasoned cybersecurity expert. In this insightful podcast, we discuss the development of GCPwn, a powerful tool for identifying vulnerabilities in Google Cloud Platform (GCP) environments. Learn about the tool's capabilities, limitations, and future roadmap.

00:00 Teaser and Introduction

04:35 Introducing self-developed tool GCPwn

07:30 Is GCPwn an active or passive pen testing tool?

08:47 Envisioning GCPwn for users

10:15 Areas GCPwn does not suit well

12:16 Future Roadmap of GCPwn

13:41 AWS Pwn landscape after year 2016

15:51 Describing Shared Responsibility Model

19:20 Security considerations of cloud platforms as a cloud pentester

22:25 Are pentesting certifications enough?

28:07 Common cloud misconfiguration to look for

35:26 Tools to get started with pen-testing

38:38 Cloud platforms to focus on as a beginner

41:30 Where to get started as a cloud pentester

44:00 Learning resources

53:29 Summary

54:30 Reading and other recommended resources

Join us as we delve into the world of Zero Trust security with Dr. Natalia Semenova, a seasoned cybersecurity expert.

06:05 Defining Zero Trust

07:40 Zero Trust vs. Traditional Defence Approach

10:25 Challenges of Adopting to Zero Trust Architecture

12:23 Overcoming the Challenges of Zero Trust

15:00 Getting Started with Zero Trust Journey

17:00 Prioritizing Security Areas and Approaching Stakeholders for Buy-In

20:15 Providing Data Access to the Teams Working in Remote-First Culture

23:25 Introducing Security Maturity Models

25:27 Levels of Security Maturity Models

28:17 Mapping the Levels of Security Maturity Models to Overall Security Architecture

31:50 Additional Frameworks that Expert Follows

33:44 How security leaders can transition to the AI Security domain

37:27 Getting Started with Threat Modeling

39:51 Summary

40:51 Learning Recommendations

Are you struggling to navigate the complex landscape of cloud security? Our latest podcast episode features Richard Stiennon, a seasoned cybersecurity expert who shares invaluable insights and practical advice. From vendor selection to multi-cloud strategies and beyond, this podcast covers it all.

YouTube: https://youtu.be/XVcXBZVgfeA

00:00 Teaser and Introduction

05:58 Key factors to evaluate cloud security needs - vendor selection.

14:29 Key considerations in case of multi-cloud environments.

16:34 Common mistakes organizations make while evaluating cloud security platforms.

18:18 Showing security tool values to business leaderships.

20:57 How to avoid mistakes and get better at tool selection process.

22:53 Do Gartner Leader Reports add value to CISOs?

26:44 Are partnerships between security vendors and insurance companies worth it?

30:38 What to look for in vendor support and training resources?

32:02 Impact of Agile methodologies on vendors as well as customers.

35:42 Right time to invest in Zero Trust Security.

39:35 Observations of sophisticated attack on Solarwinds.

43:50 Preparing for emerging threats in security space.

46:25 Burnout and stress in CISO's life and How to handle.

50:10 End of IDS (Intrusion detection system).

57:24 Summary

58:19 Learning recommendations from Richard.

59:54 Thank you and Closure

In this episode of the ScaletoZero podcast, we have discussed how to build a resilient cloud security posture with cybersecurity expert Hilal. We have also covered some of the important areas of incident response like incident response teams, planning, tools, vulnerabilities, the role of AI, and more. Discover expert insights and best practices.

Watch complete episode on YouTube: https://youtu.be/ydA82eUXmA0

00:00 Teaser and Introduction

07:17 Structuring incident response teams to effectively handle cloud-based incidents.

09:57 Developing and maintaining a comprehensive incident response plan.

12:35 Tooling or processes should be in-house or outside of the organization?

15:51 Top 3 areas to define security controls around vulnerabilities or incidents.

19:01 Practical example of handling an incident response.

24:24 Lessons Learned from a security incident.

26:35 Scrutinizing an open-source library.

30:09 Continuous monitoring for AWS and multi-cloud organizations, and effectiveness of OSS in it.

35:35 Use of Generative AI to generate incident response playbooks and other security challenges.

42:28 Staying updated in the threat landscape and using generative AI in it.

45:46 Skills and expertise required in high-performing detection engineering teams.

48:41 Handling stress and burnouts.

52:44 Summary

53:26 Learning recommendations from Hilal for security leaders.

In this episode of ScaletoZero podcast, join us for an insightful exploration of the role of generative AI in cybersecurity. Discover the challenges it presents for practitioners, the importance of explainability and privacy, and the limitations of traditional cybersecurity frameworks. Learn how to harness the power of AI while mitigating inherent risks and ensuring a robust security posture.

00:00 Teaser and Introduction

05:38 Role of generative AI in cybersecurity.

10:54 Generative AI - A challenge for cybersecurity practitioners.

12:32 Concept of Explainability and its importance when it comes to generative AI.

17:02 Designing AI-powered security solutions to respect user privacy.

21:07 What is Differential Privacy and its role in generative AI.

30:15 Cybersecurity frameworks fall short when it comes to inherent cybersecurity risks.

34:53 Consequences of organizations solely relying on cybersecurity frameworks.

39:11 Key considerations to prioritize when addressing inherent cybersecurity risks.

44:50 Cybersecurity vs. Risk Management vs. Privacy.

46:50 Summary

47:47 Rating Security Practices Section

In this episode of the ScaletoZero podcast, discover the transformative potential of auto-remediation in cloud environments. Learn how to prioritize remediation activities, measure their impact, and choose between IaC and auto-remediation. Explore the challenges and benefits of implementing auto-remediation, and gain valuable insights from a seasoned expert Lily Chau.

00:00 Introduction and teaser

04:27 Role of auto-remediation in cloud security program

07:21 Benefits of auto-remediation

08:37 Factors to consider in prioritizing auto-remediation

13:09 How to measure the impact and ROI of remediation activities

15:22 IaC or Auto-remediations - where to focus?

19:24 How to avoid security mishaps?

21:10 Better alternatives to auto-remediation

22:45 Challenges of designing and implementing auto-remediation

25:35 Stakeholders involved in implementing auto-remediation

27:06 Recommendation for organizations implementing auto-remediation

29:30 How to stay updated on new security vulnerabilities

31:10 Future of auto-remediations

33:25 Challenges of AI in security space

35:50 Cybersecurity framework that has helped Lily

37:18 Summary

38:15 Rating Security Practices Section

In this episode of ScaletoZero, Join us for an in-depth exploration of IAM, a critical component of cloud security. Discover key considerations for setting up IAM, common vulnerabilities, and best practices for securing remote access and sensitive data. Learn how to balance compliance with effective security, evaluate the right solutions, and promote a security-conscious culture within your organization.

Transcript: https://www.scaletozero.com/episodes/demistifying-identity-and-access-management-with-john-giglio/

What is IAM: https://www.cloudanix.com/learn/what-is-iam