Security Stories

After a bit of a break, Security Stories is back! And we're back with a brand new lineup. Joining Hazel and Ben in the virtual pod booth is Sana Yousuf, a Cisco security marketing leader and storyteller, responsible for a diverse set of threat-focused products and solutions that bring our security platform to life. She is a diversity and inclusion evangelist and author of research reports.

In this episode, we'll get to know Sana, as well as kick off a brand new opening feature. For each episode we’re going choose a topic that’s on our mind, and lead a discussion on it. There are no rules! This week it's Hazel's turn, and she leads a discussion on influential women in cybersecurity history, whose work may have gone under the radar. For more on this topic, check out this Time Magazine article: time.com/4974299/hacker-history-code-girls/

Also check out our brand new ebook, "Lifting each other up: A celebration of women in cybersecurity and their advocates" cisco.com/go/boostincybersecurity

Our guest this week is Dr Christine Izuakor (@Stineology). Christine is the founder of Cyber Pop up which helps small businesses with their cybersecurity needs and strategies. She’s had a really varied career, going from the corporate world to start up land, becoming an author, CEO and hacker along the way, and she is someone very motivated by injustice.  In this interview we hear about her life, why some people told her not to pursue a career in cybersecurity, and we chat about the opportunity divide and how we can make the field more accessible to more people.

Plus, we reveal the latest threat trends in DNS Security to help inform you on where to dedicate resources or training. For more of those great looking charts Ben talks about, head to https://blogs.cisco.com/security/threat-trends-dns-security-part-1

Episode time stamps:

02:40 Getting to know Sana

07:50 Influential women in cybersecurity history

19:12 Interview with Dr Christine Izuakor part 1

46:05 Threat trends: What DNS Security told us about the past year

59:38 Interview with Dr Christine Izuakor part 2

76:18 Outro

We're joined today by Wade Baker, co-founder of Cyentia Institute (@wadebaker) and Wolfgang Goerlich (@jwgoerlich), Advisory CISO at Cisco, for a fun discussion on security outcomes.

Wade and Wolf dissect the results from Cisco's 2021 Security Outcomes Study, which seeks to answer the ultimate question, "What actually works in cybersecurity?" using random sampling and statistical analysis. 

Together, we discuss how can we efficiently and effectively manage our cybersecurity risk, how is it that even the largest companies with the biggest security budgets still struggle to achieve certain outcomes, and with all the various options out there for achieving a successful cybersecurity program, which ones should practitioners focus on? New technology? More training? Better incident response procedures? Listen to find out!

The full report can be downloaded for free from www.cisco.com/go/securityoutcomes 

On today's show we welcome two guests onto the pod. First up is Esmond Kane, CISO of Steward Health care. Esmond spoke to Hazel and told her what it was like (and still is like) to be on the front lines of the pandemic, and how security is playing a part in helping the fight back against COVID-19. 

Esmond also gets pretty deep in describing what the role of a security leader is today, and we also learn how Sherlock Holmes and Dr Watson help him to find the best talent.

Our second guest is Edmund Brumaghin, threat researcher for Cisco Talos.  He joins Hazel and Ben live to discuss his research into Big Game Hunting (the security kind) and the evolution of ransomware over the past 12 months.

Plus, Ben and Hazel take a quick dive into the main topics from our latest threat report, out today. For the full picture, download the magazine "Defending against critical threats: A 12 month roundup"  

For our final episode of 2020, we're joined by two very special guests. First up is Fareedah Shaheed, CEO and founder of security consulting company Sekuva. As a serial entrepreneur, Fareedah has just embarked on a brand new path, which she reveals during our chat. 

Fareedah has also just been named on Forbes’ 30 under 30 list, which identifies those who are  making waves in technology. She has such a fascinating story, from growing up in Saudi Arabia to building her own businesses, to her explorations in how the human mind works, and developing her own identity. 

Secondly, Ben and Hazel are joined by Ben Munroe, Senior Director for Security Product Marketing at Cisco, for our Review of the Year. The three of us each count down our top 3 security moments, and reveal why we chose them.

In an incredibly testing year, we've found some moments to celebrate, some moments to be proud of, some moments to reflect on, and some moments we originally overlooked.  

Thank you so much for listening to Security Stories this year. We'll be back in January with more amazing guests, more stories, and some exciting new plans. We wish all our listeners a great festive season, and look forward to connecting with you again in 2021.

Episode time stamps:

0:00 Intro
07:48: Interview with Fareedah Shaheed
47:22: Review of the Year with Ben Munroe
01:39:12: Outro

In today's episode we're delighted to welcome Chloé Messdaghi, an infosec advocate and activist who is working to create a safe space for underrepresented groups within the industry.

Chloé is the CEO and founder of We are Hackerz, as well as the cofounder of Hacking is not a crime, Women of Security and The Hacker Book Club, and she is also VP of Strategy at Point3 Security.

We chat about the growing issue of burnout and how people can spot the signs within themselves and others.  Chloé also reveals how she comes up with her ideas, and how she is seeking to address certain issues in the cybersecurity industry such as women and underrepresented groups being trolled online. Plus, we discuss the fight for the truth in a growing age of misinformation.

Our second guest is Warren Mercer, a threat researcher from Cisco Talos who helped to discover the Olympic Destroyer attack in 2018.  Warren is in the studio with Ben and Hazel to discuss the research he’s being doing on the evolution of Remote Access Trojans, and one of the newest players, Poetrat. 

We also discuss his starring role in the new multi part documentary by Tomorrow Unlocked, called 'Who hacked the 2018 Winter games’. That then brings us onto the topic of why  attribution is so difficult in the threat landscape, and what some of the consequences are of misattribution.

Our guest today is one of the security industry's most prolific video bloggers, Javvad Malik. Javvad has a signature fresh and light hearted take on security, and during this interview he talks about how he found his own voice. He also has plenty of advice for our audience on how to put a great presentation together to keep your audience engaged.

In addition, Javvad's story on how he got into the security industry, and the people who helped him along the way, is well worth a listen to. Plus, we discuss the "Zombieland" rules for Security, and find out what kind of movie Javvad would make if he was put in charge of such a thing.

Also in this episode, we bid a fond farewell to Noureen who is moving on to an incredibly exciting new adventure. Before she goes however, she has some wonderful words of inspiration and wisdom for our listeners.

And finally Ben has some brand new threat research for us. He's here to tell us all about Remote Desktop Protocols. We examine the ways in which RDP has been a target of bad actors over the years, covering unauthorized logins, man-in-the-middle attacks, and vulnerabilities, including the ‘wormable’ BlueKeep exploit. You can learn more about this research at https://blogs.cisco.com/security/rdp-and-the-remote-desktop

Episode time stamps:

0.00 - 14.16: Intro and saying goodbye to Noureen
14.17 - 54.50: Interview with Javvad Malik
54.51 - 67.54: Threat of the month (RDP attacks) with Ben
67.55 - 69.09: Closing words

"Computers make excellent and efficient servants, but I have no wish to serve under them."

That Star Trek Spock quote is relevant in more ways than one today, because in this episode we meet Gabriel Gumbs, Chief Innovation Officer at Spirion, a company which specialises in data and security privacy.  Gabe's role is to lead the charge on where data security is going next, which includes the evolution of what Gabe lovingly refers to as the 'SPOC' (aka the security and privacy operations centre).

We also chat about Gabe's career trajectory, from when he was hacking portable devices at school. We also touch on how he’s been able to overcome personal fears of speaking in public.

After that, we welcome Nigel Houghton from Talos and Wolf Goerlich, one of our advisory CISOs for Duo Security at Cisco, to talk about the impact COVID-19 has had and potentially will have on security operations.

We also learn how Talos was able to transform itself into a entirely remote workforce, and the technical and non technical challenges that arose from that.  And Wolf talks about how organizations can modernise their security defences and take the path to passwordless. 

To learn more about this, do have a read of Wolf's paper 'Passwordless: The Future of Authenthication'

You can also check out Gabe's other podcast, 'Privacy Please' https://www.buzzsprout.com/622234

On today's episode we’re heading into the murky waters of online manipulation campaigns, and particularly how they’re used to try and influence political elections. 

To do that, we welcome back Theresa Payton, the first female CIO of the White House and author of 'Manipulated: Inside the Cyberwar to Hijack Elections and Distort the Truth'. We also welcome for the first time, Nick Biasini. Nick is a threat researcher within Cisco Talos and recently published a paper called ‘The Building Blocks of political disinformation campaigns’, which is part of Talos’ hands on research into election security.   

We chat about some of the things that shocked Theresa when she was doing her research into manipulation tactics, as well as the amplification methods that are being used to spread certain lies online. Plus, we talk about what can be done to curb these campaigns with only a few weeks to go until the United States general election.

This is a really fascinating discussion, and whilst it highlighted the huge challenges that we’re facing at the moment, Nick and Theresa shared a lot of great information on how we can overcome them.

Also in this episode, Ben Nahorney shares his latest research on current threat trends. This time we rank the Indicators of Compromise that organizations have encountered grouped by particular topics, including ransomware, credential stealing, and looking at the top operating system IoCs.

Link to Manipulated: Inside the Cyberwar to Hijack Elections and Distort the Truth'
Link to ‘The Building Blocks of political disinformation campaigns’

On today's episode, Hazel and Noureen are joined by Leticia Gammill, Cisco’s Channel leader for Canada and Latin America, and Matt Watchinski, Vice President of Cisco Talos.  

Together, we share our first hand experiences and stories on the impact of diversity in cybersecurity.  There are some brilliant insights here about where companies can find diverse talent, beyond the usual recruitment channels. 

We also discuss how organizations can build a culture of mentoring and support, so that members of diverse teams can feel appropriately valued, and retainment levels are strong. 

Also in this episode, Hazel chats to Cisco’s new CISO, Mike Hanley. Mike became our CISO in June, after 5 years in Duo where he was part of Duo Labs and then became Vice President of Security, and built and nurtured the team around him. 

From the importance of hiring a multitalented diverse team, to building a culture of appreciation, openness and fun, Mike’s interview is a fascinating listen for anyone leading a team today. 

We hope you enjoy this episode, and are inspired by both of these discussions as much as we were when we recorded them.

Episode timestamps:

0.00 Intro
02:27 Discussion on diversity in cybersecurity
46:49 Mike Hanley interview
1h 26: Closing remarks

For more on this subject, do check out our new eBook, "Diversity in cybersecurity: A mosaic of career possibilities".  It contains over 20 interviews with cybersecurity professionals from around the world.

We asked them how they all got their starts in the industry, and what they would tell their younger selves if given the chance.  You can read that ebook by visiting cisco.com/go/securitycareersebook

In the first of four special episodes being released during the month of October, today's episode is all about cybersecurity careers.

Hazel, Ben and Noureen are joined by guests Mitch Neff and Corien Vermaak, for a discussion on how we all got our starts in the cybersecurity industry. As it turns out, none of us took a conventional path! We also talk about the people and the mentors that helped us along the way, including some practical advice for anyone who wants to be a mentor, or gain a mentor.

We passionately tackle the topic of job descriptions and why they might be contributing to the so called "cybersecurity skills gap". We also talk about what hiring managers can do to make sure they're not putting the right people off with their words.

Before that, Hazel meets Curtis Simpson, Chief Information Security Officer at Armis to discover his story. A self taught cybersecurity geek, Curtis spent 20 years at Sysco, building a decentralized network.

He talks about how he turned around perceptions on cybersecurity being a cost centre, and focussed on how cybersecurity could contribute to business outcomes. He also touches on just how difficult a decision it was to leave after 20 years, but how he knew it was the right thing.

We also talk about his organisation's reaction to COVID-19, and Curtis' take on the current threat landscape, particularly around securing IoT devices.

We hope this episode proves that that there is no singular footpath into cybersecurity.  And that’s no bad thing.

Time stamps:

0.00 Intro
3.46 Interview with Curtis Simpson
47.26 Discussion on careers in cybersecurity
1.42.00 Close

Here are some more resources as mentioned in our careers discussion:

Noureen's cybersecurity mentoring hub: https://cybersecmentorship.org
Noureen's mentor and mentee group on LinkedIn: https://www.linkedin.com/groups/8673525/
Cisco NetAcademy courses: https://www.netacad.com/courses/cybersecurity
Blue Team Village Discord of which Talos are a sponsor: https://discord.com/invite/blueteamvillage

Also check out our just published eBook: Diversity in Cybersecurity: A Mosaic of Career Possibilities