TechSpective Podcast

TechSpective Podcast Episode 085

The Winter Olympics are taking place right now in Beijing, China. It puts the teams and athletes in a sensitive and precarious situation because China is an economic and geopolitical adversary to most of the participating nations, and expectations are high that China will do everything it can to intercept communications and infiltrate devices to gather intelligence during the event.

It is also a prime opportunity for cybercriminals. Any time you have a massive event with tens or hundreds of thousands of attendees and millions of viewers around the world, cybercriminals can take advantage of heightened interest for phishing scams and other malicious attacks.

Lisa Plaggemier, Interim Executive Director at the National Cyber Security Alliance (NCSA), joins me on this episode to talk about the cybersecurity concerns for nations at the Winter Olympics in Beijing. We also talk about Russia, and hit on the cybersecurity risks around Valentine's Day with romance fraud schemes and how to recognize when people you know might be getting taken advantage of.

Check out the full episode for more insights on cybersecurity challenges at the Winter Olympics in China and what to look for with romance fraud schemes. You can also visit the NCSA website to access the links and resources we discuss in the episode. The NCSA provides infographics, guides, and other assets to help educate people on cybersecurity.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 084

The world has changed in dramatic ways over the past couple of years. The COVID-19 pandemic forced an overnight shift to a remote, work-from-home business model and accelerated digital transformation efforts. Those changes have cybersecurity consequences--making the attack surface more complex and introducing new risks for attackers to take advantage of.

Prabath Karanth, Head of Security Assurance, Compliance, and Trust for TripActions joins me to talk about some of the challenges of managing cybersecurity under these conditions. I spoke with Prabath previously while he was with Adobe, so we touched on the difference between working cybersecurity in a smaller, high-growth startup instead of a large, established enterprise like Adobe.

Check out the full episode for more insights on cybersecurity challenges and best practices and how to effectively hire and retain cybersecurity talent.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or TechSpective Podcast Episode 084

The world has changed in dramatic ways over the past couple of years. The COVID-19 pandemic forced an overnight shift to a remote, work-from-home business model and accelerated digital transformation efforts. Those changes have cybersecurity consequences--making the attack surface more complex and introducing new risks for attackers to take advantage of.

Prabath Karanth, Head of Security Assurance, Compliance, and Trust for TripActions joins me to talk about some of the challenges of managing cybersecurity under these conditions. I spoke with Prabath previously while he was with Adobe, so we touched on the difference between working cybersecurity in a smaller, high-growth startup instead of a large, established enterprise like Adobe.

Check out the full episode for more insights on cybersecurity challenges and best practices and how to effectively hire and retain cybersecurity talent.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.wherever you listen.

The concept of zero trust is not new. John Kindervag popularized the term back around 2010 when he was a Forrester analyst, and organizations have been implementing and deploying variations on the idea ever since. However, the combination of the continued expansion of the attack surface and threat landscape, the shift to working remotely from home due to the COVID-19 pandemic, and the dramatic rise in ransomware attacks has fueled renewed interest.

Den Jones, Chief Security Officer at Banyan Security, joins me on this episode of the TechSpective Podcast to talk about the current state of zero trust. Den was a guest on the podcast previously as well--back in 2018--to discuss how he and his team implemented a zero trust model at Adobe.

Interestingly, for something that has been around for over a decade, there is still a remarkable amount of confusion and disagreement about what it even is. What, exactly, does a security model need to have or do to qualify as "zero trust"? What is the true goal of implementing zero trust? What features and capabilities are considered essential?

Check out the full episode for more insights on zero trust, and the role that a zero trust model plays in improving security posture and protecting an environment more effectively.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 082

There is a steady evolution and progress of security in response to an ongoing game of cat and mouse with cyber attackers. As attackers adapt and innovate new tools and techniques, the way we approach cybersecurity has to change as well--both strategically and tactically. Extended Detection and Response--or XDR--seems to be the next thing.

My guest for this episode is my friend Anton Chuvakin. I have known Anton for many, many years--dating back before our work together on the original publication of PCI Compliance. Since then, Anton went on to be a Gartner analyst, and eventually joined Google Chronicle in a role that has evolved to where he is now as head of Security Solution Strategy for Google Cloud.

There are two reasons I wanted to have the XDR conversation with Anton. First, Anton is credited with coining the term Endpoint Detection and Response (EDR) while he was at Gartner. EDR had supplanted traditional and next-gen antivirus as the de facto endpoint protection solution, but in the years since then, the scope has expanded beyond the endpoint to encompass the whole environment--the "extended" part of XDR.

Actually, that is just one variation on how we got to XDR. It is not the only path--as Anton and I discuss. The second reason I wanted to chat with Anton about XDR is that he just recently joined Richard Stiennon to lead the XDR Demo Forum. There were roughly 30 vendors participating in that event--with a diverse array of tools and technologies with the name XDR slapped on the front. That gives Anton a uniquely broad and fresh perspective on the state of XDR and what is working best.

Check out the full episode for more about the state and future of XDR, as well as other fun and interesting discussions--including a chat about the triumphs and challenges of driving a Tesla.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 081

The world of cybersecurity and technology loves acronyms. You have compliance mandates like SOX (Sarbanes-Oxley), HIPAA (Health Insurance Portability and Accountability Act), and GDPR (General Data Protection Regulation), certifications acronyms like CISSP (Certified Information Systems Security Professional) and CEH (Certified Ethical Hacker), and fun things like ACL (Access Control List), BGP (Border Gateway Protocol, and DNS (Domain Name System). The list is endless.

My guest for this episode is my friend Michael Farnum, CTO of Set Solutions and co-founder of the Houston Security Conference (Hou.Sec.Con). He and I are also former coworkers from our time at Alert Logic. One other thing we have in common is that we are both former military--and if there is anywhere that loves acronyms more than cybersecurity, it's the military.

The reason we were talking about it at all is that Michael had recently posed a question on LinkedIn, asking if anyone could name what a bunch of acronyms stand for without looking them up.

The discussion about acronyms, and those acronyms specifically, also led to a chat about analysts. We were not anti-analyst, per se, but we have a good conversation about the limitations and human fallibility of analysts and why analyst reports and rankings are subjective to some extent and should be viewed in the proper context.

Check out the full episode for more fun and interesting discussions, including a quick bit at the end about Microsoft's struggles with cybersecurity and why they shouldn't be in the business of selling cybersecurity solutions. Also, make sure you mark your calendar for October 20-21, 2022 to attend the next Hou.Sec.Con. Registration will open early, so check the website and make a plan to be there.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 079

It isn't easy to maintain your security posture and be prepared to face the latest cyber attacks. Vulnerability management and threat research are two important elements that can help. Effective vulnerability management enables you to identify and mitigate weaknesses in your environment, and proactive threat research can provide you with valuable intelligence about what to look for.

Bharat Jogi,  Senior Manager of Vulnerability and Threat Research for Qualys, joins me on this episode to talk about the importance of vulnerability management and threat research, and share some insight into how Qualys and his team approach it. Jogi is a cybersecurity professional with over 12 years of experience in the industry. During his tenure, he has conducted research around vulnerabilities, malware, protocol analysis, evolving attack vectors and signature developments.

As leader of the vulnerability and threat research team at Qualys, he is primarily responsible for discovering zero-day vulnerabilities, as well as identifying vulnerabilities across various products, malware, and developing signatures for these threats.

Check out the full episode for valuable insights from Bharat on what it takes to be vigilant and his approach to identifying vulnerabilities and emerging threats.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 078

Wi-Fi security is plagued by some incorrect or outdated myths and misperceptions. Some stories refuse to die no matter how much time goes on or how verifiably false they are. For example, a significant percentage of people are positive that Stella Liebeck was just clumsy and trying to cash in--and that she got a payout of hundreds of millions of dollars from McDonald's after spilling coffee on herself. The reality is, almost none of that is true.

When it comes to Wi-Fi security, the stubborn story is built on an a truth--but it is a truth that has been outdated for over a decade. Once upon a time in the early days of Wi-Fi, the WEP encryption was flawed and easily cracked, and earned Wi-Fi security a bad reputation. A lot has changed since then, though, both with Wi-Fi security and Wi-Fi technology in general. Bottom line--this is not your father's Wi-Fi.

Kevin Robinson, Senior VP of Marketing for Wi-Fi Alliance, joins me on this episode of the TechSpective Podcast to debunk some common misperceptions and share some of the cutting edge features and capabilities of the current generation of Wi-Fi and WPA3 encryption.

Check out the full episode for insights from Kevin about the current state of Wi-Fi technology and Wi-Fi security. We also talk about the many ways that WPA3 improves and enhances security--particularly for things like connecting to open networks like public hotspots, and the ways that Wi-Fi technology has enabled companies and individuals to maintain productivity in the past year-plus during the COVID-19 pandemic.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 077

In theory, the fact that the internet provides virtually instantaneous access to the sum total of all human knowledge should make us smarter as a society. Unfortunately, it seems to be having the opposite effect in a lot of cases. As much information as their is out there, there is also a ton of mis-information, both incidental and intentional, and people appear to be very bad at telling the difference.

My guest for this episode of the TechSpective Podcast is Helen Lee Bouygues. Helen is a former partner with McKinsey, and is a graduate of Princeton University and Harvard Business School. She is the president of the Paris-based Reboot Foundation--which she established in order to elevate critical thinking and to promote richer, more reflective forms of thought in schools, homes, and businesses.

One of her primary focuses has been on the intersection of misinformation, “fake news,” and people's internet usage. The Reboot Foundation believes that the “fake news” crisis is ultimately a crisis of media literacy, and that more people need to develop the critical thinking skills necessary to be savvy, smart consumers of news online.

Check out the full episode for more insights from Helen about the challenges of critical thinking and what we need to do to be better consumers of online information. I also recommend that you check out the Reboot Foundation website and explore some of the valuable resources we discuss during the podcast.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 076

Compliance frameworks and mandates are just a fact of life for anyone working in IT or cybersecurity. The PCI-DSS (Payment Card Industry Data Security Standard) guidelines provided by the credit card industry has had a significant impact. When a compliance mandate includes penalties that might prevent a business from being allowed to accept or process credit card payments, executive management tends to pay more attention.

Jeff Man joins me on this episode of the TechSpective Podcast to chat about PCI-DSS compliance. We also talk about compliance in general, and some of the issues around auditing and organizations that do the bare minimum just to check a box and pass an audit.

Check out the full episode for more insights from Jeff about the current state of PCI-DSS compliance and his thoughts on how organizations can improve their security posture with effective compliance and compliance management.

If you’re looking to understand the intersection of regulations, compliance, and privacy with security, then you should also check out Security & Compliance Weekly--the podcast that Jeff hosts on the subject.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 075

What is the job of a CISO? Malcolm Harkins, Chief Security and Trust Officer for Epiphany Systems, joins me to answer this question--among other things.

We discuss the role of cybersecurity and the importance of contemplating risk. Malcolm stresses that organizations should not be caught completely off guard by things like the COVID-19 pandemic, and that if cybersecurity professionals do what they're supposed to do, something like a compromised password on a VPN account should not automatically lead to a system-wide breach.

Malcolm and I also talk about the cybersecurity summit held by President Biden last week. Biden invited 24 CEOs spanning tech, banking, finance, infrastructure, and education, to come up with a strategy to raise the bar for cybersecurity for the whole country. They came up with some solid initiatives and lofty goals, but we discuss what we can realistically expect to result from the efforts of the cybersecurity summit.

Check out the full episode for more insights from Malcolm about the current state of cybersecurity and his thoughts on what it takes to defend against today's attacks. We also talk about what it takes to manage risk and be an effective CISO.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.