Socializing Security

Data poisoning can corrupt the information AI and machine-learning systems rely on, with consequences ranging from misleading search results to risks for creators, security teams, and critical decisions. Brian and Milou explore offensive and defensive uses of data poisoning, including ways artists try to protect their work, and discuss practical defenses such as validating data sources, monitoring unusual access and changes, sanitizing inputs, and testing response plans.

Chapters

00:00 Understanding Data Poisoning

In this episode, Brian and Milou speak with Mark Kreitzman, a cybersecurity veteran and evangelist at Efani, about how a SIM swap attack took over his phone number and led him to build a mobile-security business. They unpack warning signs, the risks of SMS-based account recovery, practical ways to reduce exposure, and why Mark believes security now matters more than the increasingly elusive promise of privacy.

Cybersecurity Awareness Month is here, and this episode is your ultimate guide to transforming bland security training into engaging and effective programs. Join hosts Brian and Milou as they unravel the secrets behind building a culture of security awareness that goes beyond the checkbox mentality.

They dive deep into the current landscape of cybersecurity training, exploring why traditional methods often fail. Brian shares personal anecdotes about repetitive training experiences and how organizations can innovate to keep employees engaged. Milou highlights the importance of creating a culture around security behaviors rather than treating training as a mere obligation. 

Chapters

00:00 Celebrating Cybersecurity Awareness Month

03:09 Building a Culture of Security Training

05:50 The Effectiveness of Cybersecurity Training

08:46 Phishing Simulations: Testing or Trapping?

12:02 Metrics and Measurement in Cybersecurity Training

15:03 Creating a Security-Conscious Culture

18:06 Engaging Employees in Security Training

21:03 The Role of Leadership in Cybersecurity Training

24:09 Innovative Approaches to Cybersecurity Training

27:03 Conclusion and Future Directions

In this episode, Brian and Milou delve into the complexities of global privacy regulations, discussing GDPR, US state laws, and best practices for building a comprehensive privacy program. They explore how companies can operationalize privacy, manage cross-border data transfers, and ensure compliance across different jurisdictions.

In this episode, Brian and Milou explore the complexities of managing personal and work devices in a security-conscious environment. They discuss the pros and cons of using separate phones, the implications of mobile device management, and strategies for balancing security with privacy and convenience.

In this episode, Brian and Milou discuss the critical aspects of crisis communication during security incidents, emphasizing legal considerations, internal and external communication strategies, and the importance of preparation and transparency.

Chapters

00:00 Introduction to Crisis Communication in Security Incidents

In this episode, Brian and Milou explore the evolving landscape of patch management in cybersecurity, especially in the context of AI's impact on vulnerability detection and patch deployment. They discuss historical practices, current challenges, and future considerations for organizations aiming to stay secure amidst rapid technological changes.

Chapters

In this episode, cybersecurity expert Robert Siciliano shares insights on why traditional security awareness training often fails and how a human-centric approach can significantly improve security practices. He discusses the human blind spot, the Trinity of Vulnerability, and practical strategies to engage individuals in recognizing and managing risks effectively.

In this episode of Socializing Security, Brian and Milou delve into the critical topic of third-party vendor management, focusing on the importance of vendor reviews, risk assessments, and the processes involved in onboarding and managing vendors. They discuss the need for a coordinated approach among various departments, the significance of standardized evaluation processes, and the unique challenges posed by smaller vendors and AI technologies. The conversation emphasizes the necessity of documentation, contractual obligations, and ongoing vendor management to ensure compliance and security.

Chapters

00:00 Introduction to Third Party Vendor Management

01:24 Understanding Third Party Vendor Reviews

05:26 The Importance of Risk Assessment

08:31 Standardized Evaluation Processes

12:53 Navigating Smaller Vendors

16:57 Balancing Non-Negotiables and Flexibility 

19:25 Documenting the Evaluation Process

22:06 Contractual Obligations and Risk Acceptance

24:05 Ongoing Vendor Management

26:04 Special Considerations for AI Vendors

In this episode, Brian and Milou explore the concept of shadow IT, its implications for organizations, and practical strategies to manage and mitigate its risks. They discuss how shadow IT arises, the security and compliance challenges it presents, and how to establish effective policies and controls.