TechSpective Podcast

TechSpective Podcast Episode 105

 

It's more or less expected that organizations are "in the cloud" these days in some way, shape, or form, but having a cloud strategy is important. In the early cloud days, moving to the cloud gave organizations a competitive advantage. At this point--with pretty much everyone in the cloud--it's sort of the opposite. Being in the cloud is the default, and any business that is not in the cloud is simply sabotaging its own success.

That said--what does it mean, exactly, to be "in the cloud?" Just moving things to the cloud for the sake of moving them, or trying to simply move your on-premise servers, applications, and data to the cloud and continuing to do everything the same fails to understand or take advantage of the benefits of moving to the cloud. It can also get very costly, very quickly.

Cenk Ozdemir, Cloud and Data Lead with PwC, joins me for this episode of the TechSpective Podcast to talk about the results of a survey recently conducted by PwC, and the challenges and trends of cloud strategy in general.

Check out the full episode for our discussion of the PwC report, and insight from Cenk on the strategies and best practices that PwC recommends for customers to embrace the cloud strategically and take full advantage of its features and benefits.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 104

 

Organizations invest signficant money and resources in cybersecurity in a constant, 24/7 battle to protect applications and data from cyber adversaries. It's a bit of a cat-and-mouse game that has gone on for decades. Threat actors devise innovative exploits and attack techniques, and new security tools and strategies are introduced to defend against them, so threat actors come up with unique new attacks. Rinse and repeat. But, what if we had applications that could defend themselves--adversary aware applications?

Ammar Alim, Manager of DevSecOps Solutions at Adobe, is my guest on this episode of the TechSpective Podcast to talk about how they are creating adversary aware applications at Adobe. Ammar shares that he does some soccer coaching as well, and tells his players that either they are chasing the game, or the game is chasing them. "This is very applicable here in cybersecurity, where if you're waiting for an attacker--for a zero day--and then try to respond to that zero day you are reactive. There is a vulnerability, and then we're going to have all hands on deck, and we're going to do some patching."

The approach Ammar and Adobe are taking to change the game in their favor is to develop applications that are capable of recognizing threats and malicious activity and take action to defend themselves.

Check out the full episode for our discussion of application security and the virtues of adversary aware applications. We also chat about the challenges of the traditional approach to vulnerability and patch management, and why focusing on patching all vulnerabilities is Quixotic, at best.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 103

 

Security equals compliance--at least in theory, assuming it's effective security.

But compliance doesn't necessarily equal security.

Igor Volovich, VP of Compliance Strategy at Qmulos, joins me on this episode to talk about the goals and limitations of compliance frameworks and efforts. Some elements of cybersecurity compliance are in the "eye of the beholder," so to speak. Volovich shares great insight on separating data from opinion, and the pitfalls of basing compliance on subjective opinions about the environment.

Compliance audits or reports, in most cases, are also just a moment-in-time snapshot. Regardless of how secure or compliant you were at the point in time that the audit was conducted, it doesn't tell you anything meaningful about whether or not you're secure or compliant right now. It's part of the reason that focusing on passing compliance audits is a poor strategy. Focusing on effective cybersecurity means you're more likely to be secure day-to-day, and--as an added bonus--there's a fair chance you're also compliant.

Check out the full episode for our discussion of cybersecurity compliance--including trends in accountability for cybersecurity executives who sign off on compliance audits without understanding or validating that they're accurate.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 102

 

Identity security is crucial for effective cybersecurity. When it comes down to it, many attacks are successful because threat actors are able to somehow steal, hack, or otherwise circumvent identity controls.

The Identity Defined Security Alliance (IDSA) is an independent source of thought leadership, expertise, and practical guidance for identity security--comprised of identity and security vendors, solution providers, and practitioners. IDSA is a non-profit organization designed to foster community collaboration and provide education, best practices, and other resources to help organizations with protecting identities and identity data.

The organization commissioned a survey of more than 500 identity and security professionals to examine the progress with identity security and to understand the current state and the challenges organizations are facing today. The results were published in the 2022 Trends in Securing Digital Identities report.

On this episode of the TechSpective Podcast, Julie Smith, Executive Director of IDSA, joins me once again to talk about the insights and findings from the report. We also talk about what the report reveals in terms of guidance that organizations and security professionals can take into 2023 to try and raise the bar.

Check out the full episode for our discussion of the guidance from the 2022 Trends in Identity Security report from IDSA to help you improve identity security for 2023. Julie also shares that she has been selected to join the Board for IDSA, and they are actively searching for her replacement as Executive Director of the organization. If you're a CISO or security leader with a passion for identity security and you're interested in a new challenge, reach out to Julie and the IDSA.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 101

 

There are many facets to cybersecurity. Organizations seek to prevent or block as much as possible, while also constantly monitoring their environments, and--in most cases--working to detect and respond to any malicious code or behavior that somehow slipped past the outer defenses. Threat hunting is an element of cybersecurity that helps security operations teams proactively identify and take action against active threats.

Not everyone agrees on the definition of threat hunting, though. Is it a service? Is it a process? Can you buy a threat hunting tool that can just automate the whole thing for you? Gartner analyst Pete Shoard shared his thoughts in a 2020 blog post--including stating very clearly that he does not believe it is a service:

"If there is one thing I know well, that’s managed security services. Therefore, I can confidently say that threat hunting is NOT a service. Nobody ever said I want to buy some of that ‘threat hunting’ stuff. Buyers of security services should focus on outcomes, outcomes are based on a threat hunts being successful. Services that offer threat hunting as a value add or as a differentiator, well that’s different."

Done right, though, threat hunting can play a crucial role in effective cybersecurity. This episode of the TechSpective Podcast focuses on threat hunting--and more specifically how the team at Adobe approaches it.

My guest on this episode is Mark Thomas--a Senior Cyber Security Analyst at Adobe. Prior to joining Adobe, Mark served as a Security Analyst at a major financial institution applying his knowledge and skills from the DoD, building their threat hunting program from the ground up. He graduated from Texas State University in 2012 with a major in Computer Information Systems.

In his role Adobe, Mark is responsible for detecting threats across Adobe's environments using a variety of machine learning, data science, and deep learning techniques. His team strives to defend against malicious activities by decreasing dwell time and identifying previously undetected issues, visibility gaps, and other security risks.

Check out the full episode for more about threat hunting and the approach that Mark and his team at Adobe take to proactively seek and resolve potential threats.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 100

 

This is a milestone podcast--the 100th episode. Triple digits. In honor of the 100th episode, I invited the guest who helped launch the whole thing with Episode 001--Malcolm Harkins. Malcolm was CISO at Intel at one time, and served as Chief Security and Trust Officer at Cylance among many other roles. As it happens, Malcolm and I are now coworkers as well. Malcolm is the Chief Security and Trust Officer at Epiphany Systems, where I manage marketing.

He is also an independent board member and advisor to several organizations, and an executive coach to CISOs and others in a wide variety of information risk roles.  Malcolm engages in a wide variety of peer outreach activities to drive improvements across the world in the understanding of cyber risks and best practices to manage and mitigate those risks. Key areas of focus include the ethics around technology risk, social responsibility, total cost of controls, and driving more industry accountability.

In other words, Malcolm has a track record of success and years of wisdom and insight to bring to the table for a conversation on the role of a Chief Information Security Officer (CISO) and the ethical and legal implications of it. Our chat was particularly relevant in the wake of recent events like Peiter "Mudge" Zatko becoming a whistleblower about issues at Twitter--where he lead security until being let go earlier this year, and the potentially precedent-setting trial of former Uber CISO Joe Sullivan for his role in covering up a 2016 data breach.

Check out the full episode for more about the CISO role and Malcolm's perspective on the ethical and legal responsibilities that come with it.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 099

 

Do you like to do jigsaw puzzles? I generally don't have the patience, but my wife is a jigsaw puzzle fanatic. Gathering threat intelligence is a lot like assembling a jigsaw puzzle.

Whether you do jigsaw puzzles or not, you probably at least understand the concept enough to know that if I just give you 13 random pieces from a 1,000-piece puzzle and you don't have access to the box to see what the finished puzzle is supposed to look like, it's relatively useless. That is essentially how a lot of threat intelligence works. Different organizations and security vendors each have visibility to gather information--but only from their own perspective and without knowing what the big picture is.

Maggie MacAlpine, Cyber Engagement Lead for the Center for Threat Informed Defense at MITRE Engenuity, joins me on this episode to talk about the things they are working on at MITRE. Prior to joining MITRE, she served as a security strategist for Cybereason (where we were coworkers). During her decade-long career focused on cybersecurity, she also co-founded the DEF CON Voting Village, served as a contributing researcher on the “Security Analysis of the Estonian Internet Voting System” (in partnership with the University of Michigan), and appeared in the HBO documentary, “Kill Chain”. She has discussed cybersecurity threats at numerous conferences including DEF CON, the Diana Initiative, ShmooCon Hacker Conference, and PacSec Tokyo, and she has presented on Capitol Hill and at the US Naval War College.

The project that Maggie is most excited by addresses this jigsaw puzzle dilemma. MITRE developed the Sightings Ecosystem to advance our collective ability to see threat activity across organizations, platforms, vendors, and geographic boundaries. With participating organizations sharing their set of pieces from the jigsaw puzzle, Sightings Ecosystem provides visibility into trending attacks and helps organizations understand which techniques should be a higher priority.

Check out the full episode for more about threat intel with Sightings Ecosystem and what's going on at MITRE Engenuity and the interesting tools they're working on at the Center for Threat Informed Defense. We also digress into a discussion of election security and why I am opposed to state sovereignty on various levels.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 098

 

In theory, cybersecurity is a top priority for most organizations. The actual execution, on the other hand, often leaves a lot to be desired. Security enablement is essential for moving cybersecurity from an aspirational concept to a business reality.

Astrid Bailey, a Senior Security Operations Manager on the Security Engagement Team at Adobe, is my guest on this episode to talk about security enablement and the value of security champions. Astrid has been an IT Project / Program Manager for over a decade.  She has worked in numerous industries and on diverse efforts such as managing software development teams, coordinating large-scale vendor integrations to support corporate tradeshows, and, most recently, leading several key Security Programs at Adobe that focus on cross-org collaboration.  In 2022, Astrid completed a Master of Science in Information Systems (Cybersecurity Management) at the University of Utah.  Additionally, Astrid has her PMP and CISSP certifications.

In a recent blog post, Astrid explained that security champions at Adobe are dedicated members of product development teams--typically an engineer or program manager. She noted that security champions build deep relationships within their organizations and strive to understand backlogs, make strategic recommendations, and ensure security requirements are prioritized on development roadmaps.

Astrid lists three key traits for success for security champions:

Do they possess both in-depth and broad knowledge of their solution?

Do they have the capacity to anticipate potential security concerns and risks around their solution?

Are they empowered to impact change?

Check out the full episode for more about successful security enablement and empowering security champions, as well as a chat about the overlap of cybersecurity and writing or journalism--and why it's important for security professionals to be able to communicate clearly.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 097

 

Ransomware is one of the top things keeping CISOs and other company executives up at night. A Ransomware.org survey found that 83% consider the risk of getting hit by ransomware to be the same or higher than it was last year--and 84% consider ransomware to be a significant business threat.

Cybereason has conducted ransomware surveys over the past couple of years that highlight just how insidious ransomware attacks can be. Threat actors exfiltrate sensitive data and hold it hostage as additional extortion to compel organizations to pay the ransom, but it doesn't pay to pay. The 2022 Ransomware: The True Cost to Business study found that 80% of those who paid a ransom were victims of a second ransomware attack--with more than two-thirds getting hit less than a month later for a higher ransom demand.

The simple reality is that once the ransomware payload is executed and an organization's data is encrypted, there are no good options available.

Or is there?

My guest on this episode of the TechSpective Podcast is Ahmed Masud--co-founder and CEO of sāf.ai. Ahmed and sāf.ai have taken a different and innovative approach--using artificial intelligence to make data self-securing and resilient. We talk about the inspiration that started him down this path, and why he believes that making data self-aware, self-defending, and self-healing is the solution for the ransomware epidemic. 

Check out the full episode for more about the challenges of data protection and defending against ransomware attacks--and how saf.ai is empowering data to defend and heal itself with AI.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 096

 

Doing your own research makes sense.

You should not believe everything you see, or read, or hear. Critical thinking is a crucial skill. It is not only fair to question information and seek out alternative perspectives to determine what is right or true, it is advisable--if not imperative.

But, how? Sam Curry, CSO at Cybereason and President of Cybereason Government, joins me to chat about this issue.

There has been a dramatic rise in the last few years of people expressing opinions and dismissing debate with a simple "do your own research." The "do your own research" crowd, however, generally tends to be from the MAGA / Qanon cult side of the world, and the research falls far short of anything that can be described as "critical thinking." Many dismiss virtually all credible sources of news and information, while accepting faulty conclusions of propaganda and viral videos fed by a self-feeding circle of misinformation and disinformation that provides an illusion of truth or credibility by the sheer volume of sites and sources sharing it.

In most cases, "do your own research" is simply a euphemism for confirmation bias. People find information online that validates what they already believe, so assume that must be the "true" information and pat themselves on the back for "doing their own research." They often rely on sources at the far left or far right bottom of this infographic--while rejecting information from the credible sources in the upper middle.

Credit Ad Fontes Media

Check out the full episode for more insight and guidance about sifting through disinformation and misinformation online and doing your own research. We also talk about the "extravagant" life of attending industry conferences, and Sam's thoughts on the recent Black Hat conference.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.