TechSpective Podcast

TechSpective Podcast Episode 115

 

Adobe has worked with security researchers and managed a vulnerability disclosure or bug bounty program for years. It now has an invite-only Adobe-VIP Bug Bounty program as well, though--granting broader and early access to select researchers to help guide and secure Adobe products.

A recent blog post announcing the Adobe-VIP program explains, "The Adobe-VIP private bug bounty program is maintained by our Product Security Incident Response Team (PSIRT) and is designed for engagement with security researchers who are eager to work more closely with our teams to proactively identify and quickly resolve issues that could impact Adobe and our customers. The private bug bounty program offers rewards to researchers who successfully detect and report exploitable vulnerabilities to Adobe."

Dan Ventura, Manager of the Product Security Incident Response Team (PSIRT) at Adobe, joins this episode to talk about bug bounty programs and vulnerability disclosure and provide some details and insight into the Adobe-VIP program. We also get into some of the ethical intricacies of bug bounty programs and the role of freelance security researchers.

Check out the full episode for more on responsible vulnerability disclosure. The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 114

 

Gaming has come a long way since you had to actually travel to an arcade with a pocket full of quarters (or hope the change machine would actually accept and exchange the wrinkled dollar bills you carried) to play Pac-Man. Gaming today is defined by massive, multi-player, online games where individuals interact with--and sometimes partner with or compete against--relative strangers across the internet as a function of the game. It adds layers of excitement and engagement to the gaming experience, but it also enables children to be bullied or preyed upon in new ways.

Ron Kerbs, Founder and CEO of Kidas, joins me on this episode of the TechSpective Podcast to talk about these challenges and how to address them. Earlier this year, Ron wrote an article for TechSpective on the responsibility of video game developers to help keep kids safe online.

Ron points out that the evolution from text-based chat to real-time voice communication has complicated the issue of monitoring behavior. He also notes that it can be difficult to separate actual threats or concerning language from what might just be passionate gameplay or getting fully immersed in the character or game.

Check out the full episode to hear more. Ron and I talk about some of the challenges of online communication and engagement in general--and the ways that distance and relative anonymity seem to bring out tendencies that people would pretty much never exhibit in a face-to-face interaction.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 113

 

Do you have a right to privacy? Should you--as a consumer or individual--have control over your personal data, which companies are allowed to collect or access it, and how it is used? It seems reasonable, to be honest.

At the very least, consumers want--and expect--transparency. Building trust with customers relies on being transparent about what information is collected and why, and how it is used. There should also be a way for an individual to view their own personal information or request that a company remove or delete it.

Daniel Barber, co-founder and CEO of DataGrail, joins this episode to talk about data privacy and transparency. Barber shares insights and trends he is seeing with consumers around the world as it relates to their personal data. We also discuss why it's important for companies to be sensitive to those trends and have processes and tools that give consumers control of their data--both from a brand and reputation perspective, as well as from a legal and compliance perspective.

Check out the full episode to hear more about the trends in data privacy. We talk about research from Datagrail showing that a high percentage of data removal requests originate from nations or states that don't actually have personal data privacy regulations in place. Daniel and I also chat about the ways that sharing personal data is typically a transactional process--the question is, "What am I getting in exchange for sharing this information with you?"

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 112

 

In 2000 Marc Andreessen noted software is eating the world. Fast forward a couple decades, and I think it's fair to say he wasn't wrong.

Now that pretty much everything is code, and there are billions upon billions of lines of code, it is also more important to identify and resolve issues in the code to prevent or remove vulnerabilities and flaws that might be exploited.

The evolution from Waterfall to Agile to DevOps has dramatically accelerated the development lifecycle. It has also elevated the need for security to "shift left"--to incorporate security and code review earlier in the development process. Code review needs to be woven throughout the development lifecycle rather than a task that is performed at the "end" of development. To be fair, with DevOps principles and software development today, there is no "end." It's a self-feeding cycle.

Florian Noeding, Principal Security Researcher at Adobe, joins me on this episode to talk about Project Kodiak--an Adobe initiative that automates code review. We talk about the concept of security-as-code, or quality-assurance-as-code, and the benefits of automating code review.

Check out the full episode to hear more about the need to "shift left" and how automating code review streamlines development and helps ensure that code that goes into production is more secure.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 111

 

Identity plays a pivotal role for cybersecurity. Threat actors have a variety of tools and methods to crack and compromise credentials, which is why many attacks are--from the perspective of cyber defense--inside attacks. They are executed using valid credentials that have authorization to access or do the things they do. The crux of the issue comes down to both protecting identity data and impeding the ability of threat actors to infiltrate the network using hacked or stolen credentials. However, it is equally important to limit the scope of damage from a successful attack by ensuring that accounts and devices don't have authorization to access systems, applications, or data they don't need to.

Threat actors have evolved and adapted to a point where multifactor authentication and the legacy approach to identity and access management is no longer good enough. It isn't just about granting or revoking access--but ensuring that users and devices have access to what they need only when they need it--the right access at the right t time to get the job done. Alex Bovee, CEO of ConductorOne, shares his thoughts on the subject in this episode of the TechSpective Podcast.

Check out the full episode for our discussion of the future of identity and access management, the importance of least privilege access to limit the blast radius of a successful attack, and why Alex was driven to launch a new company to address these challenges.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 110

 

Once upon a time, Windows PCs were--by default--the chosen platform for businesses, and Apple computers were for consumers. Companies made exceptions for workers focused on creativity or design, but Apple devices were generally frowned upon at work.

When I first started working in IT, I supported an environment with about 200 PCs and about 50 Macs (it was an advertising agency, so we had a higher percentage of "creative" workers than most companies). Managing and supporting the Macs was a challenge--but that was a completely different era. Things have changed dramatically.

Dean Hager, CEO of Jamf, joins me on this episode of the TechSpective Podcast to discuss current BYOD (bring your own device) and CYOD (choose your own device) trends. Workers today expect to have some say in the devices they use for productivity--both their PC and their mobile device. Offering that freedom can be a key element in attracting and retaining quality employees.

As organizations embrace the democratization of choice, though, it creates challenges for the IT and IT security teams. Most of the infrastructure and the IT management and cybersecurity tools are geared toward a Windows PC world, and Apple's mobile devices are built on an operating system known for being a proprietary walled garden.

Hager talks about the steps Apple has taken to make their platforms and devices more enterprise-friendly. We also discuss the ways Microsoft has embraced changes in the IT environment and the features and tools available to manage and protect a diverse ecosystem of devices--including the unique ways Jamf enables organizations to use Apple devices securely.

Check out the full episode for our discussion of the BYOD transformation, providing choice for employees, and providing effective management and security of Apple devices in the enterprise. We also talk about the origin of the company name--what is "Jamf?"

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 109

 

I admit that I am cynical in general about customer experience. On the rare occasions I have to call for support or interact with customer service, I feel like it's often an exercise in both frustration and futility. It often takes hours and multiple transfers and escalations just to get to someone who either A) understands what the problem is, and B) actually has the knowledge and skill to help solve it. But, I am open to the possibility that generative AI might somehow improve things.

That is not to say that artificial intelligence is a "silver bullet" solution. Chatbots have been used by companies for years, and most of them are just as irritating--if not more so--than human customer service agents. The chatbot is a more rudimentary attempt at leveraging AI--essentially just following the same predetermined flowchart of questions and responses that level one customer service follows. Generative AI, however, improves things a bit.

Jon Aniano, SVP of Product for Zendesk, is a software product executive focused on building and growing products and companies in enterprise software. He is constantly thinking about customer engagement, connected devices, and the future of business software. Jon has more than 15 years of hands-on experience leading product vision, product strategy, go-to-market strategy, and operations within both small startups and large software companies. Proven experience leading product management teams and engineering teams to define product roadmap and execute product delivery. Comfortable leading or working with partners in marketing, sales and delivery to drive product positioning, sales enablement, marketing, pre-sales, sales and implementation activities.

Jon joins me on this episode to talk about how generative AI can elevate the customer experience. In the podcast, Aniano states, "The ability for these large language models to generate answers to questions will have a massive impact on the CX industry."

Check out the full episode for our discussion of how generative AI will transform customer experience--as well as a discussion of what its current limitations and what we shouldn't expect it to solve. We also chat about the tech scene in San Francisco and how many of the most recognizable names--like Zendesk--operate out of unassuming offices that you pass just walking down the street. With a few notable exceptions, they don't have compounds or campuses.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 108

 

Unless you've been camping off the grid for all of 2023 or recently emerged from a year-long coma, you're most likely aware of all of the buzz and hype around generative AI. Tools like ChatGPT, Dall-E, Google's Bard, and countless others have proliferated exponentially and captured the attention of both companies and consumers.

Generative AI tools are capable of relatively impressive results. A quick search online will find endless examples of people finding recipes, planning parties, crafting content, creating artwork, and more. There is an array of potential uses and benefits for generative AI. At the same time, there are a variety of ethical questions raised by the technology, as well as issues with the accuracy and veracity of AI responses. One of the top concerns, however, has been about the impact these tools will have on cybersecurity. As threat actors embrace and refine their use of generative AI tools, cyber attacks may increase in both volume and sophistication--especially when it comes to cyber threats that require crafting messages.

Patrick Harr, CEO of SlashNext, joins me on this episode to talk about the ways SlashNext is using generative AI as a tool to stay a step ahead of threat actors and proactively defend against generative AI threats--especially for BEC (business email compromise) and phishing threats.

Check out the full episode for our discussion of the benefits and challenges of generative AI. We also chat about the issue of how generative AI models are trained and where they get their data, and the difficulty of validating or verifying the responses it generates.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 107

 

IT security teams have a tough job--made more challenging by the growing complexity of the attack surface and technology landscape and the overwhelming volume of information. They need to be able to accelerate the processing and analysis of data so they can streamline the decision-making and incident response processes. That is where UEBA can help.

Kumar Vikramjeet, a Senior Security Engineer on the threat hunting team at Adobe, joins me on this episode of the TechSpective Podcast to talk about how he and his team leverage machine learning (ML) and artificial intelligence (AI) to conduct User and Entity Behavior Analytics (UEBA) to detect anomalous activity related to a user or device that might indicate malicious activity.

Kumar recently wrote about the topic in a blog post for Adobe titled, "Fast-Tracking Incident Detection with User and Entity Behavior Analytics (UEBA)." In the blog post, he states, "At Adobe, we chose to develop our UEBA framework in-house to fit within our security ecosystem, including our existing security information and event management (SIEM) and endpoint detection and response (EDR) platforms. Doing this has enabled us to prioritize the use cases that are most important to Adobe’s threat-hunting efforts — designed and developed by our internal team of threat hunters and security analysts according to prioritized threat models — rather than rely on a third-party vendor to make changes to their tool to meet our specific needs."

The blog post describes the six primary steps that comprise the UEBA framework employed at Adobe: Use Cases, Data, Analytics, Correlation, Enrichment, and Detection. Kumar summarizes that UEBA can reduce noise and accelerate the speed and accuracy of incident detection.

Check out the full episode for our discussion of streamlining incident detection with UEBA. We also chat about the distinction between UBA (user behavior analytics) and UEBA (user and entity behavior analytics).

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 106

 

Security analysts spend their days monitoring activity in applications and across the network to identify vulnerabilities, detect attacks, and take the appropriate actions to prevent or mitigate threats. However, a good percentage of the work that is done in a Security Operations Center (SOC) is tedious--tasks that must be done, but hinder the ability to focus on the more complex work of identifying and resolving issues.

John Gillis, a Senior Cybersecurity Analyst for the SOC at Adobe, joins me on this episode of the TechSpective Podcast to share how he uses custom browser extensions to automate routine and mundane tasks to streamline operations and free up time to do more complex work.

In a recent blog post, John explained how he uses browser extensions in the SOC and the impact that has for him and his team. "As a member of our SOC team, I always look for ways to help improve efficiency in how we do our jobs — every second of our time matters when we need to respond to and defend against ever-evolving threats. My effort here helps keep the focus on my analysis work by letting the browser automate the more mundane tasks. "

The analogy I use to describe this effort is a jigsaw puzzle. When you dump out the box of a 1,000-piece puzzle, the first thing you typically do is sort the pieces into general color groupings so you can more easily find a red piece or a green piece or whatever as you work to construct the puzzle. It is only after you do this tedious sorting that you can get down to business and analyze the pieces to figure out how they fit together and solve the puzzle. Effectively, what Gillis is doing is using browser extensions to automate the sorting of the pieces so he can leapfrog to the analysis and problem-solving aspects of the effort.

Aside from reducing the manual effort required for tedious tasks, this sort of automation also helps address alert fatigue. The automation can be used to take care of some of the initial triage of security event information to separate the signal from the noise and only elevate things that are more likely to be legitimate concerns to the human security analysts to examine more closely.

Check out the full episode for our discussion of automating routine security tasks using browser extensions, and insight from John on how these automations also reduce alert fatigue and help maintain consistency from analyst to analyst in how things are done. We also veer off to chat about the current explosion of generative AI models and the pros and cons of offloading tasks to generative AI tools and platforms across all industries and roles.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.