Security by Default

The focal point of today’s discourse centers on the crucial importance of identity security and privileged access management in contemporary organizational frameworks. I am joined by the esteemed Charles Chase, who shares his extensive experience in the realm of identity security, elucidating the pressing trends and best practices that organizations must adopt to safeguard their digital assets. Our conversation delves into the regulatory pressures that compel businesses to enhance their security measures, particularly in light of evolving threats and compliance requirements. Furthermore, we explore the significance of understanding the unknowns within identity management systems and the necessity of maintaining rigorous hygiene practices to mitigate potential vulnerabilities. Through this dialogue, we aim to illuminate the transformative impact of effective identity management strategies on organizational security and operational efficiency.

In this episode of the Security by Default podcast, host Joe Carson speaks with Charles Chase about his journey into the cybersecurity field, focusing on identity security and privilege access management. They discuss the evolving trends in identity security, the importance of maintaining identity hygiene, and the impact of regulations like NIST 2 and DORA on organizational practices. The conversation also covers the shift towards passwordless security, the role of AI in identity management, and resources for those looking to enter the field. The episode concludes with reflections on the importance of identities in business and society.

Takeaways

• Charles Chase fell into cybersecurity from a military background.
• The importance of understanding what you don't know in identity security.
• Organizations often have dormant accounts that pose security risks.
• Regulatory bodies are pushing organizations to improve their identity security practices.
• The shift towards passwordless security is gaining momentum.
• AI is becoming a valuable tool in identity management.
• Identity hygiene is crucial for reducing risks in organizations.
• The commoditization of identity solutions allows smaller businesses to implement security measures.
• Engaging with customers is key to understanding their unique identity security needs.
• The future of identity management is focused on user experience and automation.

Keywords

cybersecurity, identity security, privilege access management, trends, best practices, passwordless security, AI in identity management, regulatory impact, identity hygiene, resources for cybersecurity

The podcast commences with an engaging introduction by host Joe Carson, who expresses his enthusiasm for sharing insights and knowledge with the audience. He introduces his guest, Charles, who possesses an extensive background in identity security and privileged access management. Charles recounts his journey into the cybersecurity industry, highlighting his initial experiences in the U.S. Air Force as a network engineer and the serendipitous nature of his entry into the realm of privileged access management. The conversation swiftly transitions to the evolving landscape of identity security, where both speakers reflect on the advancements in tools and practices that have emerged over the years. They discuss the significance of understanding the regulatory landscape and the implications it has for organizations striving to enhance their security posture. Charles emphasizes the necessity for organizations to proactively address their security vulnerabilities and to adopt best practices that mitigate risks associated with identity and access management. He shares anecdotes from his experiences working with various clients, illustrating the startling discoveries often made when analyzing their systems, including the prevalence of dormant accounts and orphaned identities that pose significant security risks. As the dialogue progresses, the speakers delve into current trends in identity security, particularly the move towards passwordless authentication methods and the integration of multifactor authentication solutions. Charles elucidates how organizations are increasingly prioritizing the security of their identity frameworks to comply with regulatory demands while ensuring the integrity of their operations. He shares insights on the importance of continuous learning and adaptation in the field of cybersecurity, noting that each organization's journey is unique, and tailored approaches are essential to address specific challenges. The conversation culminates in a discussion on the future of identity management, where both speakers express optimism about the potential of emerging technologies and the need for organizations to remain vigilant in their security efforts. Ultimately, the episode underscores the critical role that effective identity management plays in safeguarding organizational assets and maintaining trust in today’s digital landscape.

Takeaways:

• The conversation highlighted the significant evolution in identity security practices over the years, emphasizing the necessity of adopting modern tools and strategies.
• A recurring theme was the critical importance of addressing dormant and orphaned accounts to enhance overall security posture within organizations.
• Regulatory pressures have escalated, compelling organizations to prioritize identity management and security protocols to mitigate risks effectively.
• The speakers discussed the growing trend towards passwordless authentication and the integration of biometric solutions in identity security frameworks.
• The episode underscored the necessity of maintaining a proactive identity hygiene program to prevent security vulnerabilities.
• The importance of continuous education and awareness for professionals entering the identity and access management field was a key discussion point.

The Grugq, a distinguished expert in the realm of open-source intelligence (OSINT) and cyber operations, elucidates the intricate interplay between information warfare and contemporary security challenges. He articulates the notion that during times of conflict, traditional rules governing cyber operations, such as deniability and stealth, become markedly less pertinent. Instead, the focus shifts towards achieving mission objectives without the necessity for concealment, as the stakes escalate in the context of warfare. Throughout our discourse, we explore the evolution of cyber tactics, emphasizing the shift from sophisticated methodologies to more rudimentary yet effective tools, reflecting a pragmatic approach to cyber engagements. Ultimately, our conversation serves as a profound examination of the current landscape of cyber warfare, underscoring the necessity for adaptability and a nuanced understanding of operational security in an era marked by rapid technological advancements and shifting geopolitical dynamics.

In this episode of the Security by Default podcast, host Joseph Carson engages with the Grugq, a cybersecurity expert and PhD student, discussing his journey into the field, the evolution of cybersecurity practices, and the complexities of information warfare. The Grugq shares insights on anti-forensics, the importance of understanding human behavior in cybersecurity, and the current landscape of cyber warfare, particularly in the context of the ongoing conflict in Ukraine. The conversation highlights the challenges and changes in the cybersecurity field, emphasizing the need for clarity and understanding in a chaotic information environment.

Takeaways

• The Grugq's journey into cybersecurity began with a Unix book.
• He transitioned from internships to freelancing in cybersecurity.
• Moving to Thailand helped reduce living costs while consulting.
• Understanding anti-forensics is crucial for effective cybersecurity.
• The rules of cyber warfare differ significantly from peacetime operations.
• Information warfare involves changing how people interpret information.
• The Grugq emphasizes the importance of human behavior in cybersecurity.
• Staying updated in cybersecurity requires monitoring current events and engaging with experts.
• The evolution of cybersecurity tools has made it easier for new actors to operate.
• The Grugq's PhD research focuses on the realities of cyber warfare.

Additional Resources:

https://x.com/thegrugq

https://github.com/grugq

Engaging with the multifaceted realm of Open Source Intelligence (OSINT) and Cyber Operations, this podcast episode presents an erudite dialogue featuring The Grugq, an esteemed expert in the field. The conversation is initiated by the host, who invites The Grugq to share his origin story, tracing his journey through the labyrinthine world of cybersecurity, beginning from his formative experiences with UNIX systems. The Grugq elucidates how he transitioned from being an independent security researcher to an academic, currently pursuing a PhD focused on cyber warfare. This episode delves into the complexities of operational security, the principles underpinning successful cyber operations, and the significance of understanding human behavior in the cybersecurity domain. The discourse further explores the dynamic interplay between OSINT and cyber operations, emphasizing the critical importance of meticulous analysis and strategic deception in contemporary cyber warfare. The Grugq articulates the evolving nature of threats in this space, and how adversaries utilize increasingly sophisticated techniques to obfuscate their activities. Throughout the episode, listeners are afforded a unique glimpse into the methodologies that underpin effective cyber operations, highlighting the necessity of adapting to the ever-shifting landscape of cybersecurity. Amidst the complexities of the cyber domain, The Grugq offers profound insights into the ethical implications of cyber operations, urging practitioners to consider the broader ramifications of their actions. This episode serves not only as a repository of knowledge but also as a call to action for cybersecurity professionals to reflect on the ethical dimensions of their work. By the conclusion, listeners are left with a rich understanding of the intersection of OSINT and cyber operations, equipped with the knowledge to navigate the tumultuous waters of the cybersecurity landscape with greater acumen and awareness.

Takeaways:

• The Grugq emphasizes the importance of understanding the principles of operational security and their historical context in the realm of cyber warfare.
• In the discussion, we explore the evolution of cyber operations, highlighting how the dynamics of war have shifted the focus from stealth to achieving mission objectives.
• A key takeaway is the recognition that modern cyber actors often utilize pre-existing techniques rather than creating new ones, complicating attribution efforts in cyber incidents.
• The podcast delves into the significance of information warfare, stressing that the ability to manipulate perceptions is as crucial as the actual data being presented.
• The Grugq shares insights on how the principles of access, humanity, and economy underpin successful cyber operations, framing them within the context of both offense and defense.
• We discuss the blurred lines in modern cyber conflicts, where traditional rules of engagement may not apply, particularly in ongoing large-scale cyber warfare scenarios.

The paramount theme of this podcast episode revolves around the critical necessity of preparing for crises within cybersecurity frameworks. As we navigate an increasingly chaotic landscape, it becomes evident that security must be accessible and comprehensible for all stakeholders involved. We engage in an enlightening dialogue with our esteemed guest, Joe Sullivan, who elucidates his remarkable journey from a federal prosecutor to a prominent figure in security leadership across major tech enterprises. Throughout our conversation, we emphasize the importance of cultivating resilience in the face of potential adversities, advocating for a paradigm shift from mere prevention to proactive crisis management. This episode serves not only as an exploration of individual experiences but also as a clarion call for organizations to invest in robust preparedness strategies to mitigate the impacts of inevitable security incidents.

In this episode of the Security by Default podcast, host Joseph Carson interviews Joe Sullivan, a prominent figure in cybersecurity. They discuss Joe's journey from a federal prosecutor to the Chief Security Officer at Facebook, exploring the challenges and expectations in transitioning from government to private sector roles. The conversation delves into the evolving landscape of cybersecurity, the impact of ransomware, and the importance of crisis management and preparedness. Joe shares valuable lessons for aspiring security executives and highlights the significance of understanding technology in leadership roles. The episode concludes with Joe's current projects, including his nonprofit initiative, Ukraine Friends, which provides laptops to children affected by the war in Ukraine.

Takeaways

• Security is possible for everyone.
• Joe Sullivan's journey reflects a unique path into cybersecurity.
• Transitioning from government to private sector presents challenges.
• Understanding corporate culture is crucial for success.
• Measuring success in cybersecurity requires clear metrics.
• Ransomware has fundamentally changed the cybersecurity landscape.
• Security leaders are increasingly reporting to CEOs.
• Crisis management is essential for organizational resilience.
• Aspiring security executives should focus on business understanding.
• Giving back to the community is a vital part of the cybersecurity profession.

Sound bites

• "Security is possible for everyone."
• "I got an MBA through osmosis."
• "The expectations were so high."

Chapters

• 00:00 Introduction to Security by Default Podcast
• 01:02 Joe Sullivan's Journey into Cybersecurity
• 05:10 Transition from Government to Private Sector
• 11:06 Navigating the Corporate Landscape
• 15:48 Measuring Success in Security
• 20:04 The Impact of Ransomware on Cybersecurity
• 28:01 The Evolving Role of Security Leaders
• 30:57 Understanding Business Strategy in Security
• 32:59 Risk Management and Business Partnership
• 33:52 Navigating Technology Risks
• 35:54 The Race for AI Innovation
• 38:03 Crisis Management and Preparedness
• 39:59 Building Resilience in Security Teams
• 42:16 The Importance of Response Training
• 44:10 Lessons from Emergency Services
• 47:41 Community Impact through Technology

Additional Resources:

https://www.joesullivansecurity.com/about

https://ukrainefriends.org/

https://www.linkedin.com/in/joesu11ivan/

https://en.wikipedia.org/wiki/Joe_Sullivan_(cybersecurity)

The discourse presented in this episode of the Security By Default podcast delves into the intricacies of cybersecurity through a rich narrative framed by the experiences of Joe Sullivan, a distinguished figure in the cybersecurity landscape. The conversation commences with a reflection on the current state of security in a world rife with chaos and challenges, emphasizing the necessity for clarity and preparedness in addressing security concerns. Sullivan recounts his unique journey into the realm of cybersecurity, marked by an initial aspiration to pursue law, which ultimately led him to blend his legal expertise with a burgeoning interest in technology. This intersection of law and technology is pivotal in understanding the evolution of cybersecurity practices, as Sullivan highlights the early days of his career at the Department of Justice, where he was thrust into the intricate dynamics of cybercrime prosecution. His narrative underscores the significant shifts in the cybersecurity landscape, illustrating how the role of cybersecurity professionals has evolved into one that requires not only technical prowess but also a profound understanding of business operations and risk management. As the discussion unfolds, listeners are introduced to the concept of operational resilience, a theme underscored by Sullivan's experiences at major corporations such as eBay, PayPal, and Facebook. He elucidates the necessity for security leaders to transition from a purely defensive posture to one that encompasses proactive crisis management and resilience building. Sullivan’s observations regarding the expectations placed upon security professionals in the private sector contrast sharply with his experiences in government service, where the pace and metrics of success differ markedly. This dichotomy serves to illuminate the complexities faced by modern security executives who must navigate not only the technical challenges of cybersecurity but also the imperative to align their strategies with broader business objectives. In conclusion, the episode encapsulates the essence of security as a multifaceted discipline that extends beyond mere technical solutions. Sullivan advocates for a paradigm shift in how organizations perceive and invest in security, urging a balanced allocation of resources towards both prevention and crisis preparedness. His insights serve as a clarion call for security professionals to engage more deeply with the business side of their organizations, fostering a culture where security is seen as an integral component of operational success rather than a mere compliance obligation. The conversation ultimately reinforces the notion that in the face of evolving threats, a proactive and well-prepared security posture is paramount for organizational resilience and success in an increasingly digital world.

This podcast episode delves into the often-overlooked notion that the field of cybersecurity can be both enjoyable and engaging, rather than solely characterized by its daunting challenges and threats. We, Joe Carson and Ian Murphy, reflect on our shared experiences within the industry, emphasizing the importance of maintaining a sense of humor and joy amidst the chaos often associated with cybersecurity. Ian recounts his journey from the early days of the internet and his unconventional entry into the cybersecurity realm, highlighting how his background in mechanics and passion for storytelling have shaped his unique approach to security awareness. Our conversation touches on the significance of creativity in effectively communicating complex topics, as well as the necessity of fostering a more approachable and less fear-driven narrative within the cybersecurity space. Ultimately, we aspire to illuminate the path toward a more vibrant and connected community, where laughter and camaraderie thrive alongside security.

In this episode of the Security by Default podcast, host Joseph Carson welcomes Ian Murphy, a cybersecurity expert and stand-up comedian. They discuss Ian's unconventional journey into cybersecurity, his experiences at the MOD and Symantec, and his transition to self-employment and comedy. Ian shares insights on the importance of storytelling in both cybersecurity awareness and comedy, as well as navigating online criticism and audience interactions. The conversation highlights the need for humor in serious industries and the value of real human connections.

Takeaways

• Ian's journey into cybersecurity was unplanned and unconventional.
• The importance of storytelling in both cybersecurity and comedy.
• Self-employment offers freedom but comes with challenges.
• Humor can be a powerful tool in serious industries.
• Navigating online criticism requires thick skin and perspective.
• Comedy is subjective, and not everyone will appreciate it.
• Real human interactions are essential in today's digital age.
• Learning from experiences is crucial for growth in any field.
• Networking and peer relationships are vital for success.
• Life is better when you find joy and laughter in everyday situations.

Sound bites

"I wanted to be a footballer."

"Comedy is subjective."

"You need to grow the fuck up."

Chapters

• 00:00 Introduction to the Podcast and Guest
• 00:56 Ian's Origin Story and Journey into Cybersecurity
• 06:29 Experiences at MOD and Symantec
• 10:44 Transitioning to Self-Employment and Freedom
• 14:27 The Switch to Stand-Up Comedy
• 22:05 The Impact of Humor in Cybersecurity Awareness
• 30:06 Audience Feedback and Social Media Interaction
• 31:54 The Power of Audience Engagement
• 34:49 Navigating Controversy in Comedy
• 37:43 The Art of Timing and Response
• 40:47 Comedy as a Reflection of Life
• 43:44 The Evolution of Comedy and Storytelling
• 49:53 Learning and Growth Through Comedy
• 53:50 Connecting with the Audience

Takeaways:

• The podcast emphasizes the importance of maintaining joy and humor in the cybersecurity field despite its often serious nature.
• We explored how humor can be a powerful tool in security awareness, making the subject more engaging for audiences.
• Ian shared his remarkable journey from mechanic to cybersecurity expert, illustrating the value of diverse experiences in shaping one’s career.
• The discussion highlighted the challenges of transitioning from corporate environments to freelance work, emphasizing the freedom and responsibility it entails.
• Both speakers reflected on the necessity of fostering human connections in the tech world, counteracting the isolation often felt in digital spheres.
• The podcast concluded with a call to action for listeners to embrace humor and creativity in their professional lives, enhancing both workplace culture and personal fulfillment.

This podcast episode features an enlightening conversation with Alissa Knight, a notable figure in the cybersecurity landscape, who shares her unique journey into the realm of hacking and cybersecurity. From her early days of curiosity and mischief, starting at the tender age of thirteen, to her transformative experiences following a pivotal arrest, Alissa reflects on the lessons learned and the paths forged in the aftermath. The discussion delves into the evolution of hacking practices and the current landscape of API security, which Alissa identifies as a critical area of concern due to its expanding attack surface in contemporary technology. As we navigate through the complexities of artificial intelligence's role in cybersecurity, Alissa emphasizes the necessity of integrating security practices into the development process. This episode serves not only to illuminate Alissa's personal narrative but also to provide valuable insights for aspiring cybersecurity professionals and organizations alike.

In this episode of the Security by Default podcast, host Joe Carson engages with cybersecurity expert Alissa Knight, who shares her unique journey into the world of hacking and cybersecurity. They discuss the evolution of hacking, the challenges of API security, and the transformative impact of AI on the industry. Alissa emphasizes the importance of continuous learning and adapting to new technologies, while also reflecting on her career shifts and the significance of storytelling in cybersecurity marketing. The conversation highlights the need for organizations to invest in their employees' education and the future of cybersecurity innovation.

Takeaways

• Alissa started hacking at the age of 13, driven by curiosity.
• The early days of hacking were like the wild west, with fewer resources.
• A significant turning point in Alissa's life was her arrest at 17.
• Cybersecurity offers lucrative career opportunities for skilled individuals.
• API security is a growing concern as more services rely on APIs.
• AI is reshaping the cybersecurity landscape, creating new challenges and opportunities.
• Continuous learning is essential in the fast-evolving field of cybersecurity.
• Organizations must invest in training their developers in secure coding practices.
• Storytelling can be a powerful tool in cybersecurity marketing.
• The future of cybersecurity will heavily involve AI and automation.

Sound bites

"It was the wild, wild west."

"I was arrested on my school campus."

"This industry pays very well."

Chapters

• 00:00 Introduction to the Podcast and Guest
• 00:57 Alissa Knight's Unique Origin Story
• 05:30 The Evolution of Hacking and Cybersecurity
• 10:54 Turning Points and Career Shifts
• 16:10 The Impact of DDoS Attacks on Career Paths
• 20:57 The Importance of API Security
• 24:06 Hacking APIs and Security Vulnerabilities
• 27:52 The Evolution of AI in Coding
• 31:30 From Cybersecurity to Hollywood
• 36:32 Introducing ARIES: AI for Cybersecurity
• 39:03 The Importance of Continuous Learning in Cybersecurity

Resources

https://www.linkedin.com/in/alissaknight/

https://www.knightgroup.co/

https://microreels.com/

https://www.youtube.com/@AlissaKnightArchives

The Security By Default podcast presents an engaging dialogue between Joe Carson and Alissa Knight, a seasoned cybersecurity expert with a rich and unique background in hacking and security. Alissa recounts her journey into the cyber realm, beginning at the tender age of thirteen when her curiosity led her to explore the inner workings of technology. Her early experiences with bulletin board systems (BBS) and the hacking community shaped her understanding of cybersecurity, illustrating the evolution from the rudimentary practices of the past to the sophisticated techniques employed today. Alissa reflects on her misadventures, including a pivotal incident that resulted in her arrest at seventeen, which ultimately redirected her path towards a career in cybersecurity. This incident, rather than being a mere setback, served as a catalyst for her transformation, providing her with insights into the resilience required in the face of adversity. Throughout the discussion, Alissa emphasizes the importance of continuous learning and adaptation in the ever-evolving field of cybersecurity. She highlights the shift in focus towards API security and the challenges posed by artificial intelligence in code development. The conversation delves into the significance of secure coding practices and the necessity for organizations to invest in the education of their developers. Alissa's insights illuminate the critical nature of understanding the vulnerabilities that arise in modern applications and the imperative for cybersecurity professionals to stay abreast of these developments. The episode encapsulates a narrative of growth, resilience, and the pursuit of knowledge, encouraging listeners to embrace their journeys and strive for continuous improvement in the cybersecurity domain.

This podcast episode elucidates the essential nature of customer success within the realm of cybersecurity, positing that the discipline transcends mere technical proficiency to encompass a broader business perspective. I convey that security is no longer confined to IT; rather, it is a multifaceted issue that intertwines with various organizational domains such as finance, sales, and human resources. The dialogue with our esteemed guest, David Muniz, highlights the importance of understanding customer expectations and the role of trust in fostering meaningful relationships between organizations and their clients. We explore the distinction between customer support and customer success, emphasizing that the latter is a long-term endeavor focused on guiding clients toward their defined objectives. Ultimately, our conversation underscores the imperative of adopting a customer-centric approach to ensure that cybersecurity solutions not only protect but also enhance the overall business experience.

In this episode of the Security by Default podcast, Joseph Carson engages with David Muniz to explore the evolving landscape of cybersecurity. They discuss the importance of diversity in the field, the distinction between customer success and support, and the critical role of trust in business relationships. The conversation also delves into the Zero Trust paradigm, emphasizing the need for a human-centric approach in cybersecurity. David shares insights on staying updated in a rapidly changing industry and the significance of happiness in the workplace, concluding with thoughts on the human element in cybersecurity.

Keywords

cybersecurity, customer success, zero trust, trust in business, diversity in tech, human relationships, customer support, industry insights, happiness in work, staying updated

Takeaways

· Customer success focuses on long-term relationships, not just immediate problem-solving.

· Trust is a key component in building successful customer relationships.

· Zero Trust is about managing trust dynamically, not eliminating it.

· Customer success involves understanding what success means to the customer.

· Building trust requires consistent and reliable service.

· Human interactions are crucial in customer success, even in a digital world.

· Customer success can lead to increased revenue through renewals and up-selling.

· Trust in cybersecurity involves both technical and human elements.

· Effective customer success strategies can differentiate a company in the market.

· Balancing security with user experience is essential for customer satisfaction.

Sound bites

· "Customer success is about long-term relationships."

· "Trust is not just assumed; it must be earned."

· "Zero Trust is about managing trust, not eliminating it."

· "Success is defined by the customer's perspective."

· "Human interactions are crucial in a digital world."

· "Trust leads to increased revenue and loyalty."

· "Cybersecurity involves both technical and human elements."

· "Balancing security with user experience is key."

· "Customer success can differentiate a company."

· "Trust is a business differentiator."

Chapters

00:00 Introduction to Cybersecurity and Guest Background

04:10 The Importance of Diversity in Cybersecurity

08:41 Understanding Customer Success vs. Customer Support

12:52 Building Trust in Customer Relationships

17:15 The Role of Zero Trust in Cybersecurity

22:07 Understanding Zero Trust and Its Implications

27:33 The Dynamic Nature of Trust in Cybersecurity

32:01 The Human Element in Building Trust

Additional Resources

The Trust Paradox: A Cybersecurity Mindset for Human Relationships

https://www.linkedin.com/pulse/trust-paradox-cybersecurity-mindset-human-david-muniz-f9fzf

The Hidden ROI of Trust in Business and Cybersecurity

https://www.linkedin.com/pulse/hidden-roi-trust-business-cybersecurity-david-muniz-7r3jc

https://segura.security/

https://segura.security/blog

https://en.wikipedia.org/wiki/The_Power_of_Now

The podcast episode delves into the intricate subject of cybersecurity, emphasizing the necessity for clarity amidst the chaos that often accompanies it. The host, Joseph, expresses his enthusiasm for engaging with industry luminaries and cultivating thought-provoking discussions that aim to enhance the safety and security of organizations and individuals alike. Joseph is joined by David Muniz, a seasoned professional with a diverse background in computer science, project management, and cybersecurity. David recounts his unconventional journey into the field, highlighting how his academic pursuits led him to realize his passion for addressing issues related to fraud detection and risk management. The conversation gradually transitions to the importance of customer success within the realm of cybersecurity. David delineates the distinction between customer support and customer success, asserting that the latter is focused on understanding the customer's definition of success and facilitating their achievement of it. This involves a long-term commitment to building relationships and trust, as well as comprehending the various business objectives that drive customers to adopt cybersecurity solutions. The podcast underscores the need for a shift in perspective, viewing cybersecurity not merely as a technical challenge but as a fundamental business issue that necessitates the involvement of diverse stakeholders across an organization. Throughout the episode, a recurring theme emerges: the emphasis on trust as a cornerstone of effective cybersecurity practices. Both speakers advocate for a change in hiring practices, proposing that organizations should prioritize passion and willingness to learn over rigid certification requirements. As the discussion unfolds, the duo reflects on the evolving landscape of cybersecurity, addressing the concept of zero trust and the importance of a dynamic approach to risk management. They conclude by reiterating that the epitome of customer success is rooted in the cultivation of genuine relationships, where trust and open communication play pivotal roles, ultimately enabling organizations to navigate the complexities of cybersecurity with greater efficacy.

The primary focus of today's discussion revolves around the profound implications of artificial intelligence (AI) on the cybersecurity landscape, particularly emphasizing the heightened sophistication and frequency of cyberattacks. As we navigate through the intricacies of this evolving domain, we aim to elucidate how the advent of advanced AI technologies is transforming both the methods employed by threat actors and the strategies utilized for organizational defense. Our esteemed guest, Michael Waite, brings invaluable insights from his extensive experience in technology and cybersecurity, highlighting the necessity for a paradigm shift in how we approach security awareness and training. We delve into the critical need for personalized training programs that address specific risks associated with individual roles within an organization, moving away from outdated, one-size-fits-all methods. Ultimately, our dialogue seeks to foster a deeper understanding of the current threat landscape, advocating for a collaborative and informed approach to safeguarding not only corporate environments but also the personal digital lives of individuals.

In this episode of Security by Default, host Joe Carson sits down with Michael Waite from Dune Security to explore how AI is reshaping cybersecurity and why it’s time to rethink traditional awareness training.

As cyber threats become more sophisticated, personalized, and AI-powered, organizations can no longer rely on outdated, one-size-fits-all learning models. Joe and Michael break down what modern cybersecurity training should look like, how to engage employees more effectively, and why empowering people both inside and outside the office is essential to strong defense.

• How AI is transforming both cyber attacks and defensive strategies
• Why the volume and quality of phishing attempts continue to rise
• The limitations of traditional annual awareness training
• The shift toward personalized, role-based learning
• How real-time intervention improves security habits
• Why cybersecurity awareness must extend beyond the workplace
• Practical ways to engage employees and build a security-first culture
• The importance of collaboration and communication across teams
• How threat intelligence informs more effective training programs

• AI is rewriting the threat landscape.
• Attackers are faster, more convincing, and more scalable than ever.
• Generic awareness training is no longer enough.
• Personalization is essential to reducing real-world risk.
• Engagement drives stronger security culture and better outcomes.
• Cybersecurity begins at home, not just at work.
• Bite-sized, real-time lessons are more effective than long annual videos.
• Employees are part of the detection engine—and must be empowered accordingly.

• “Cybersecurity doesn’t start in the office.”
• “The one size fits all approach is dead.”
• “We need to democratize security.”
• “Let’s give individuals the tools they need.”
• “We need to make cybersecurity more fun.”
• “This is my favorite thing to talk about.”

00:00 – Introduction to the Chaos of Cybersecurity

03:05 – The Impact of AI on Cybersecurity

09:40 – Best Practices for Cybersecurity Awareness

18:51 – Personalizing Cybersecurity Training

27:00 – Engaging Employees in Cybersecurity

29:20 – Resources for Further Learning

Additional Resources:

https://www.linkedin.com/in/mr-michael-waite/

https://www.dune.security/

https://www.dune.security/threat-intelligence-report

The dialogue commences with a cordial greeting, establishing a warm rapport between the host, Joe Carson, and his guest, Michael Waite. The podcast elucidates the dynamic and tumultuous landscape of cybersecurity, accentuating the incessant evolution of technological advancements and the corresponding threats that arise therein. Joe articulates a desire to dispel the chaos that often pervades the security realm, striving instead to illuminate the positive strides being made to foster a safer digital environment. Michael subsequently shares his professional journey, revealing a notable transition from a decade-long consultancy with Accenture to a foray into the cybersecurity sector. This pivot was serendipitously catalyzed by a chance encounter during a flight, wherein a conversation with a fellow passenger sparked the inception of his entrepreneurial aspirations in security.

Satu Korhonen elucidates the intricacies of hacking artificial intelligence, emphasizing the necessity of understanding both the vulnerabilities and ethical considerations inherent in AI systems. She advocates for a paradigm shift where cybersecurity and AI development converge, fostering collaboration rather than division among these domains. Central to her discussion is the notion that AI, while a powerful tool, is fundamentally probabilistic, thereby requiring a critical approach to its outputs and implications. Korhonen further highlights the educational imperative of familiarizing individuals with AI vulnerabilities, suggesting that playful engagement through gamified experiences can enhance comprehension and awareness. This discourse not only illuminates the challenges posed by AI but also underscores the potential for human-AI synergy in navigating the complexities of modern technology.

In this episode of the Security by Default podcast, Joseph Carson and guest Satu Korhonen a passionate practitioner, researcher and founder of Helheim Labs delve into the intersection of AI and cybersecurity. They discuss the challenges and opportunities in creating trustworthy AI systems, the importance of collaboration between AI and cybersecurity professionals, and the role of regulation in ensuring AI safety. Satu shares her journey from education to AI, highlighting key moments and insights from her career. The conversation also touches on the EU AI Act, the importance of understanding AI's limitations, and the need for a balanced approach to AI development.

Key Takeaways

• AI systems are fundamentally probability-based, not perfect.
• Collaboration between AI and cybersecurity is crucial for safety.
• The EU AI Act focuses on human rights and risk management.
• Understanding AI's limitations is key to using it effectively.
• AI can enhance productivity but requires careful implementation.
• Training AI with both good and bad data improves its robustness.
• AI should serve humans, not the other way around.
• Hacking AI can reveal vulnerabilities and improve security.
• Community events like hacker camps foster innovation and learning.
• AI's role in society should be carefully considered and discussed.

Chapters

00:00:00 Introduction to AI and Cybersecurity

00:03:00 Satu's Journey into AI

00:09:00 Trustworthy AI and the EU AI Act

00:15:00 Challenges in AI and Cybersecurity Collaboration

00:21:00 The Role of Community and Events in AI

Resources:

https://hackai.quest/

https://helheimlabs.ai/

https://helheimlabs.ai/about-satu-korhonen/

https://www.linkedin.com/in/satu-m-korhonen/

https://why2025.org/

https://www.ccc.de/en/home

https://events.ccc.de/en/

https://disobey.fi/2026/

In a riveting dialogue with cybersecurity expert Satu Korhonen, we embark on a comprehensive exploration of the intricate dynamics between artificial intelligence and security vulnerabilities. Korhonen, whose journey into the cybersecurity realm was catalyzed by the surge of AI technologies around 2016, delves into the ethical challenges and potential risks posed by these advancements. She emphasizes the necessity of integrating security practices early in the AI development process, highlighting the perilous consequences of neglecting this crucial aspect. The conversation elucidates how AI systems, often perceived as independent entities, are inextricably linked to cybersecurity protocols. Korhonen shares her insights on fostering collaboration between AI developers and cybersecurity professionals, advocating for a unified approach to mitigate risks and enhance system reliability. As we dissect the role of frameworks like the EU's AI Act, the dialogue crystallizes around the importance of human rights considerations in AI deployment, urging the need for regulatory measures that prioritize ethical standards and accountability.

This podcast episode delves into the pressing issue of identity threats and the evolving trends surrounding them. Our esteemed guest, Philippe Peters, who leads Identity Threat Labs at Segura, provides invaluable insights into the methodologies employed by cybercriminals in their quest to exploit vulnerabilities associated with credentials. We explore the alarming shift in tactics, where attackers increasingly purchase credentials rather than relying solely on zero-day exploits, highlighting the importance of vigilance in monitoring user behavior and implementing robust security measures. Moreover, we discuss the significance of events such as BSides, which serve as platforms for knowledge exchange, networking, and community engagement in the cybersecurity landscape. This episode aims to equip listeners with a deeper understanding of identity threats and the proactive steps necessary to mitigate these risks in their organizations.

In this episode of the Security by Default podcast, host Joe Carson welcomes back Filipi Pires, Head of Identity Threat Labs & Global Product Advocate at Segura® to discuss the latest trends in identity threats and cybersecurity. They explore the evolution of attacks, particularly focusing on social engineering and the role of AI in both offensive and defensive strategies. Filipi shares insights from recent events, including the significance of BSides conferences in fostering community and knowledge sharing. The conversation emphasizes the importance of a zero trust approach and the need for continuous education in cybersecurity.

Key Takeaways

• The BSides community is essential for cybersecurity education.
• Attackers are increasingly using social engineering techniques.
• AI is being leveraged by both attackers and defenders.
• Zero trust is a critical framework for modern security.
• Organizations must implement multiple layers of protection.
• Credential theft is a major concern in identity threats.
• B-Sides events provide networking opportunities for newcomers.
• Cybersecurity Awareness Month is a time for reflection and improvement.
• The rise of AI in social engineering poses new challenges.
• Community-driven events like B-Sides foster collaboration and learning.

Chapters

• 00:00 Introduction to Security by Default Podcast
• 01:59 Understanding BSides Events
• 05:57 Current Trends in Identity Threats
• 11:50 The Evolution of Authentication Methods
• 14:57 The Rise of InfoStealer Malware
• 18:52 AI's Role in Cybersecurity Threats
• 21:13 AI in Cybersecurity: Defensive and Offensive Perspectives
• 24:36 The Role of APIs and Observers in Cybersecurity
• 26:06 Best Practices for Securing AI in Organizations
• 31:04 BSides Porto: Community and Event Insights
• 39:06 Future BSides: Expanding to Porto Alegre

Resources:

https://www.linkedin.com/in/filipipires/

https://segura.security/

https://www.instagram.com/filipipires.sec/

https://segura.security/events/filipi-pires

https://www.linkedin.com/showcase/identity-threat-labs/about/

https://labs.segura.blog/

About Segura®

Segura® is an Identity Security Platform built to help organizations secure privileged access, detect identity threats, and respond rapidly to attacks targeting human and machine identities.

Designed for hybrid and high-risk environments, Segura delivers identity threat detection and response (ITDR), secure remote access, and privileged session protection — ensuring that only verified users, devices, and applications can access critical systems.

From infrastructure and servers to cloud platforms and the supply chain, Segura provides unified visibility and control across every identity interaction. By combining advanced analytics, behavioural detection, and Zero Trust access principles, Segura empowers companies to prevent credential misuse, lateral movement, and privilege escalation before damage occurs.

The salient point of this episode revolves around the intricate relationship between cybersecurity and cyber law, emphasizing the challenges faced in regulating the rapidly evolving digital landscape. I, Joe Carson, host of the Security By Default podcast, engage in a profound dialogue with our esteemed guest, Pamela Victor Ibitamuno, a legal expert with a unique background in penetration testing. Pamela elucidates her journey from experiencing cybercrime victimization to her commitment to merging her passions for law and cybersecurity through the field of cyber law. This discussion critically examines the difficulties legal professionals encounter in comprehending technical aspects of cyber incidents, as well as the pressing need for legal frameworks that genuinely address the complexities of cybercrime rather than merely responding to technological advancements in haste. Ultimately, we explore the necessity for a collaborative approach between legal practitioners and cybersecurity experts to establish effective regulations that safeguard society while fostering innovation.

In this episode of the Security by Default podcast, host Joe Carson engages with Pamela Victor Ibitamuno, a lawyer with a unique background in penetration testing. They discuss the critical intersection of cyber law and cybersecurity, exploring the challenges faced in prosecuting cyber crimes, the importance of understanding intent, and the need for adaptive legal frameworks in the face of rapid technological advancements. The conversation also delves into the role of AI in the legal field and how professionals can stay updated in this ever-evolving landscape.

Takeaways

• Pamela's journey from penetration testing to cyber law highlights the importance of understanding both fields.
• Legal professionals often struggle to grasp the technicalities of cybersecurity.
• Regulations may not effectively address the problems they aim to solve.
• Cyber crime often transcends borders, complicating prosecution efforts.
• Partnerships between tech companies and governments can enhance cyber crime prevention.
• Misconceptions about hacking can hinder legal processes.
• Intent is a crucial factor in determining the legality of cyber actions.
• The law is lagging behind technological innovations, necessitating updates.
• AI can streamline legal processes but cannot replace human empathy.
• Staying informed through conferences and subscriptions is vital for legal professionals.

Chapters

• 00:00 Introduction to Cyber Law and Its Importance
• 02:57 Pamela's Journey: From Penetration Testing to Cyber Law
• 06:08 The Intersection of Law and Cybersecurity
• 08:50 Challenges in Cyber Crime Prosecution
• 12:04 The Role of Intent in Cyber Crime
• 14:58 The Need for Adaptive Legal Frameworks
• 17:50 AI's Impact on Cyber Law
• 20:53 Staying Updated in Cyber Law
• 23:59 Conclusion and Future Outlook

The exploration of cyber law within the context of cybersecurity unfolds through a compelling dialogue between myself, Joe Carson, and Pamela Victor Ibitamuno, a legal expert whose background in penetration testing profoundly informs her perspective. Pamela recounts the genesis of her interest in cyber law, rooted in her experiences as a victim of cybercrime, which ignited her curiosity about the methodologies employed by cybercriminals. This personal narrative sets the stage for a broader examination of the systemic challenges that legal professionals encounter when attempting to navigate the complexities of cyber law. We delve into the critical interplay between legal frameworks and the rapidly evolving landscape of technology, emphasizing the necessity for laws that are not only reflective of current threats but also adaptable to future innovations. A salient point of our discussion revolves around the urgency of establishing cohesive regulatory measures that adequately address the dynamic nature of cyber threats. Pamela articulates the difficulties that arise when legal statutes lag behind technological advancements, particularly in the realm of international cybercrime. The conversation highlights the imperative for legal practitioners to possess a comprehensive understanding of the technical intricacies involved in cybersecurity to ensure effective prosecution and enforcement of laws. Furthermore, we explore the challenges of jurisdictional discrepancies that complicate the investigation and prosecution of cybercriminals, underscoring the need for enhanced international cooperation and standardized protocols to combat these global offenses. As we traverse the complexities of cyber law, we also consider the potential implications of artificial intelligence on legal practices. While acknowledging the advantages of employing AI to streamline legal processes, we emphasize the irreplaceable role of human judgment and empathy in delivering personalized legal counsel. The episode culminates in a thoughtful reflection on the future of cyber law, advocating for a legal system that evolves dynamically in response to technological advancements, thereby fostering a secure and just digital environment. This discussion illuminates the critical need for ongoing collaboration between cybersecurity experts and legal authorities to effectively address the multifaceted challenges posed by cybercrime.