Security Confidential

James Azar is a CISO (Chief Information Security Officer) that works, leads, and is dedicated to the security and business mission to ensure the continuity and fluidity of cybersecurity within the business. In his experience, James has served as CTO, CIO, and CISO but his passion is the intersection of Security and Business where innovation and out of box thinking are needed to succeed.  James is the host of the cybersecurity podcast The CyberHub and CISO Talk, and a new and noteworthy privacy podcast called Goodbye Privacy.

James is a public speaker and event host that hosts the annual CyberHub Summit in Atlanta and has spoken in events across the globe from CyberTech Israel, RSA, Data Connectors, and has been published in Fox, OAN, AJC, ABC, and many more publications  James has served on the Board of Advisors for the NTSC and currently serves as Vice President of Programming for AFCEA Atlanta Chapter, IAC (Israeli American Council) Eitanim Mentor, and works with the Veteran community as well as supports several Non-Profits.

00:18 Introduction to James Azar

To learn more about James Azar visit https://www.linkedin.com/in/james-j-azar/ 

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com

To view the videocast visit https://youtu.be/IWRU0WJzs2E

Karl Sharman is head of cybersecurity of solutions and consultancy for Stott and May in North America. He has helped build and scale teams across multiple types of business including Fortune 500, Pre-IPO late stage ventures, early stage startups, security consultancies and MSSPs. Karl Sharman is often brought on by companies for either extremely difficult hires, mass hires at speed and scale or discreet leadership hires. As a contributor and a consultant to the cybersecurity sector, Karl contributes with regular white papers, podcasts and public speaking, He was was recently featured in the top 1% of Search & Staffing Professionals globally by LinkedIn.

The discussion in this episode covered the following

Additionally Karl's knowledge and experience cover the following:  

Specialities: CISO, Compliance, Risk, Incident Response, Digital Forensics, Ransomware, Architecture & Engineering, Governance, Audit, Security, Cyber, Physical Security, Resilience, Business Continuity, Cyber Insurance, Product Security, Mobile Security, Application Security, IAM, Disaster Recovery, Strategy, Operations.

Frameworks: NIST, ISO, PCI, COBIT, HiTrust & NERC  Regulations: NYDFS, GDPR, CCPA, HIPAA, FISMA

To learn more about Karl Sharman visit 

To learn more about Dark Rhino Security

The video cast for this episode can be found here

This episode of Dark Rhino Security's, Security Confidential podcast and video cast features Dr. Calvin Nobles as the guest and he discusses how human factors can impact cybersecurity. The topics covered in the discussion are:

The link to the videocast

About Dr. Calvin Nobles

Dr. Calvin Nobles is a cybersecurity professional and human factors practitioner with more than 25 years of experience. Dr. Nobles retired from the U.S. Navy and currently works in the financial services industry as a Cybersecurity / Information Security subject matter expert. He recently earned a Doctor of Philosophy in Human Factors. His previous degrees are Doctor of Philosophy in Management and Engineering, graduate degrees in Information Systems Security, Aeronautical Science, Business Administration, Military Strategy and Operational Art. Additionally, He has completed several certificates in cybersecurity from Harvard University.

Calvin is an adjunct faculty member at several universities teaching cybersecurity and MBA courses. He authored a book on the integration of technologically advanced aircraft in general aviation. Dr. Nobles’ personal story is featured in the book Black Men Changing the Narrative Through Education. He recently completed a Cybersecurity Policy Fellowship with the New America Think Tank in Washington, DC. Dr. Nobles serves on the Cybersecurity Advisory Board for Stillman College and serves on the Cyber Council for the Intelligence and National Security Alliance.

Dr. Nobles led a global Cyber Intelligence Planning Group to align cybersecurity objectives for multiple international entities. He spearheaded a national-level technology prototype project enabling the U.S. to deploy strategic capabilities around the world, which established precedence of leveraging emerging technologies using agile practices. Dr. Nobles served as an advisor to senior executives to optimize cyber operations, developed business continuity and disaster recovery procedures, enhanced the information security strategies, and provided consultancy on big data analytics, machine learning, the internet of things, and artificial intelligence.

To learn more about Dark Rhino Security

Host: Manoj Tandon

How the OITA is helping technology companies in Ohio is of relevance to all in the Tri-State Region. Nick York the president of OITA joins Security Confidential in this episode and discusses the many activities OITA is involved with. In addition to being the president of OITA, Nick is an entrepreneur and an attorney with 20 years of practice experience and a strategic advisor to large and small companies, non-profits, and educational institutions. Nick is the co-founder of and serves as the CEO of the Transom Group.  Nick has served as Vice Chair of the University of Akron Board of Trustees, focused extensively on Strategic Planning and Student Success initiatives. He has been a champion of entrepreneurship on the national level as a Board Member of the National Small Business Association (NSBA) in Washington, DC, and as Vice Chair of the Council of Smaller Enterprises (COSE) the largest small business member organizations in the country.  

Nick is also a Co-founder of the Mindful Nation Foundation (MNF). Inspired by the book, A Mindful Nation, Nick helped launch the organization to bring together the best in cognitive science, community leadership and proven techniques to develop programs to improve the lives of Veterans, Children, Teachers, Healthcare providers and Leaders.

The following topics are discussed in this episode  

00:00 Introduction

The link to the video cast can be found here

To learn more about the OITA click here

To learn more about Dark Rhino Security

To learn more about Nick York 

Why is cybersecurity hard? Why do women make more money? These are just some the questions Karla Reffold discusses on Dark Rhino Security's Security Confidential. Karla is an experienced business owner and business leader. She has large international network in cybersecurity and is well versed on the many topics relevant to the industry. She founded the international recruitment business, BeecherMadden in 2010 before overseeing the acquisition by Nicoll Curtin. In 2020 she joined  Orpheus Cyber as the Chief Operating Officer (COO). Orpheus is a threat intelligence company with a SAAS platform that helps organizations manage their own risk, and that of their third parties, with an easy to understand cyber risk score. Karla is the host of industry interviews on the Cyber Talks media platform and the Zero Hour Podcast. She was included in SC Magazine's Top 50 Women in Security in 2019.  Karla discusses her transition from a recruiting firm to COO of Orpheus. She discusses gender differences in male dominated cybersecurity and why women in cybersecurity make 30% more money than men, in the field. 

00:00 Introduction

To learn more about Karla Reffold please visit https://www.linkedin.com/in/karlareffold/ 

To learn more about Dark Rhino Security please visit https://www.darkrhinosecurity.com 

To learn more about Orpheus please visit https://orpheus-cyber.com/

To watch the videocast https://youtu.be/sOdy3Ct-uVA

Host: Manoj Tandon

Guest Karla Reffold

Healthcare IT and Innovation at the speed of life is discussed in detail with Chenoa Moss. Chenoa is a gifted Healthcare IT professional who has extensive experience in working with very large health systems on the many of IT and compliance prevalent in large complex environments. The impact of Covid has been extensive on the health systems in the United States and around the world. One of the key items Chenoa points out is the impact of the pandemic on innovation in healthcare. Large health systems are typically very slow to move and Covid forced changes at a large scale across systems resulting in great innovation. This has resulted in a paradigm shift in Healthcare and how services like Telemedicine will become more the norm than the exception going forward. Some changes are going to be permanent in Healthcare with very positive outcomes.

Cybersecurity in healthcare is also discussed with the proliferation of ransomware across health systems which has resulted in denial of service in some instances to patients. Chenoa discusses how healthcare is addressing these threats. SOC2, HIPAA, and Hi-Trust compliances and their applicability to various healthcare entities.

The Video cast for the episode can be found https://youtu.be/YtXpOthARvc

To learn more about Dark Rhino Security please visit https://www.darkrhinosecurity.com

Was it all worth it? Lessons learned. This week on Dark Rhino's Security Confidential Kevin Casey turns the tables and interviews Manoj Tandon, who is the regular host. Kevin presents 9 questions to Manoj. They must be answered in 3 min or less. The questions span critical lessons learned during the course of developing a career and going through life. Questions centered around regrets, failures, successes, family, education, career, and influencers in life. The listeners will find many commonalities with their own paths in life and perhaps gain an alternate perspective on achieving happiness, a concept so central to everyone's pursuit in life.

This conversation is different from the regular cybersecurity discussions on Security Confidential. Both Kevin Casey and Manoj Tandon share with fellow cybersecurity colleagues and entrepreneurs some of their experiences on the journey thus far.

The video for this episode can be found at https://youtu.be/UDyJi7LGqsc

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com

Dark Rhino's Security Confidential is honored to have Karen Hough the founder and CEO of ImprovEdge back as a guest. This past year has presented companies and people with severe never before navigated challenges. For many, 2020 could not end soon enough. 2021 is a new beginning. Improvisation and resilience are themes from last year that carry into this year and will be with us well into the future. Cybersecurity is about helping companies become more resilient. Becoming resilient requires us to become more comfortable with improvisation. Karen helps us navigate this. The discussion focuses on improv, overcoming preconceived notions, and being resilient. There is advice and exercises that would benefit all.  Karen is a #1 Amazon bestselling author, recipient of the Silver Stevie Award for Most Innovative Business of the Year, and won both the WNBA Inspiring Woman Award and the WBENC PitchPivot Grand Prize. She is a philanthropist, Yale grad, avid hiker and lives in Ohio with her husband and 3 children. Her books include: “The Improvisation Edge: Secrets to Building Trust and Radical Collaboration at Work”, “Be the Best Bad Presenter Ever: Break the Rules, Make Mistakes and Win Them Over”, and “Go With It: Embrace the Unexpected to Drive Change”. We are also joined by Tyler Smith and Jordan Graham in the discussion.  Both Tyler and Jordan are former military veterans whose former line of work required the extensive use of their ability to improvise to a situation and make split second decisions. Their insights on managing up are invaluable.

To watch the video of this episode please visit https://youtu.be/nPcUm25GiMA

To learn more about Dark Rhino Security click here

To learn more about ImprovEdge click here

To learn more about Karen Hough click here

Mind the Gap, Avoid the Prevention Paradox

The more focus a company puts on prevention of cyber-attacks, paradoxically, the more unsecure it becomes. In an environment where a heavy prevention strategy is used the dwell time of attackers can be indefinite. This episode of Dark Rhino’s Security Confidential focuses on the Prevention Paradox and how to avoid it. There are three pillars of cybersecurity: prevention, detection, and response. There is a tendency, for companies, to focus extensively on prevention. In the SANS sliding scale of cybersecurity prevention is at the forefront with detection and response more to the right on the scale. Many a company following the SANS Sliding Scale end up with extensive focus on prevention for a host of reasons which are discussed. Prevention can take several forms, one of the most common being the use of endpoint protection tools like Next Generation Anti-Virus (NGAV). The advances made in these tools have been significant over the past many years with the incorporation of artificial intelligence with machine learning into their detection engines. These advanced technologies are not enough. Why?

There are three levels of unknowns as one climbs the Pyramid of Pain. There are: known-knowns, unknown-knowns, and unknown-unknowns. Known-knowns are easy to deal with it. Their signatures are known and their exploits well documented. Unknown-knowns are a bit tricker but with behavior detection through machine learning in NGAV they can be handled with great effectivity. The unknown-unknowns are the most difficult to deal with and they are at the pinnacle of the pyramid of pain. They make use of novel tools, tactics, and procedures (TTPs) that are not yet within the grasp of detection through automation or pattern recognition. The uncovering of attacks based on novel TTPs is not within the domain of a vendor and requires proactive human based threat hunting. This is best evidenced in recent times by the exploitation of the Solarwinds vulnerability with Sunburst. The TTPs used were so advanced that Fireye and the US Federal Government could not detect the attack with the plethora of tools, processes, and technologies they had in place for their cyber defense. It was only detected by human intelligence.

The more focus that is put on prevention the more data becomes available to attackers on the methods of prevention. They keep testing cyber defenses and are able to come up with alternative methods to by-pass those defenses. On the part of the defender, the belief is that they are well protected, and they may not readily realize their methods have been compromised and thus allow indefinite dwell times on the part of the attacker. This is the prevention paradox. The panelists, Manoj Tandon, Chris Gerritz, and Tyler Smith discuss the prevention paradox. Both Chris Gerritz and Tyler Smith are ex US Military. With Chris Gerritz spending his service time in the US Air Force. It was in the US Air Force that the term “The Prevention Paradox” was coined. It has not been extensively talked about till now.

The panelists discuss much an organization can do to avoid the prevention paradox. The first thing that must be done is a distinct separation of the detect and response tools from the endpoint protection tools must be had. It is very tempting to have a single vendor for detection, response, and endpoint protection. Many organizations use one vendor for protection, detection, and response. This causes organizations to fall into the prevention paradox. Layering in the Dark Rhino Security’s Six Sigma based Iπ&r process for detection and response, which utilizes the underlying technology of Infocyte, enables rapid analytics-based hypotheses to be formed and tested rapidly across the entire network further prevention the Prevention Paradox.

The Video Cast of the webinar https://youtu.be/A_3K86tKOxY

Panelists: Manoj Tandon, Chris Gerritz, Tyler Smith