TechSpective Podcast

TechSpective Podcast Episode 074

It has been a wild year and a half since the world went into quarantine lockdown for the COVID pandemic in March of 2020. Organizations initially responded as if it were a short-term crisis -- like responding to an impending hurricane -- and quickly realized that this was different and they needed to shift gears for the long haul.

Alan Shimel, founder, CEO, and editor-in-chief of MediaOps, the company behind DevOps.com, Container Journal, Security Boulevard and Digital Anarchist, as well as co-founder of the DevOps Institute, joins me to talk about how he has navigated his company through the pandemic, and the impact on cybersecurity and trends in cybersecurity and DevSecOps that have been influenced by the pandemic.

Check out the full episode for more insights from Alan on cybersecurity and DevSecOps in the age of the COVID pandemic. We also talk about the impact on business models and the benefits and future of remote workers.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 073

My guest for this episode is my friend Marcus Carey. Marcus is currently an Enterprise Architect at ReliaQuest. He was founder and CEO of ThreatCare--which was acquired by ReliaQuest--and he is the creator of the 'Tribe of Hackers' book series. He is also well known on social media for being a job opening matchmaker and his willingness to help out people who are trying to get into a career in tech or cybersecurity.

The job market is always evolving. Sometimes it is more volatile than others. Industries fade into history as new technologies and innovations make them obsolete.

For example, as the automobile became the default mode of transportation, people who worked making horseshoes, or wagon wheels suddenly found that their skills were no longer in demand. More recently, we have also experienced massive job loss due to financial meltdown or the economic chaos of getting through a pandemic.

In almost every case, though, as some jobs become unnecessary, new industries are desperately seeking people with the right skills to help drive and maintain momentum. That is where many technology and cybersecurity companies are today. The challenge for people who are looking for a job is to acquire the knowledge and skills that job openings are looking for.

It is--and maybe always will be--still a challenge to get in the door in the first place. Many organizations use automated filters and algorithms to sift through résumés and the requirements listed for a given job are often ludicrous or unreasonable. That said, technology and cybersecurity are industries that have a huge need for people, and it's possible to get the education and training you need to break into the industry with little or no financial investment.

If you are not already following Marcus on Twitter, go follow @marcusjcarey right now. Check out the full episode for more insights from Marcus on training and certifications for tech and cybersecurity roles. Stay to the end to find out about our preferred whiskeys or bourbons.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 072

How many passwords do you have? Honestly, I am not really sure at this point. I've lost track. I do recall that Bill Gates declared that the password was going to die like 20 years ago, and yet somehow I seem to have 70 or 80 of them at any given time.

The mission to end passwords continues, though, and Transmit Security is trying to lead the way. My guest for this episode of the TechSpective Podcast is Mickey Boodaei, co-founder and CEO of Transmit Security. We talk about the friction that passwords--and the seemingly constant need to update or reset passwords--creates for users and how that ultimately impacts business. Removing the hurdle of passwords makes it easier for customers to just conduct business.

Check out the full episode for more insights from Mickey on authentication and the role of biometrics. It's a great conversation about balancing security with usability and how streamlining the process is a win-win for businesses and their customers.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 071

It almost seems cliché to talk about visibility when discussing cybersecurity. Many vendors repeat the mantra of "You can't protect what you can't see." Whether you're trying to do vulnerability management, patch management, or just monitor the network for suspicious or malicious activity, it is a simple fact that doing it effectively requires a foundation of comprehensive visibility.

My guest this week is Jake Kouns, co-founder and CEO of Risk Based Security. He is passionate about vulnerability data and ensuring organizations have a complete view of every vulnerability on their network. Many tools out there focus on vulnerabilities that have been assigned a CVE number, but Kouns cautions that CVEs only cover a limited subset of all of the vulnerabilities that are out there.

Check out the full episode for more from Jake on the importance of having the right data to enable risk-based security decisions. We also talk some about getting the fundamentals right rather than focusing on bells and whistles and flashy new cybersecurity tools, and how the 80/20 Rule can get most organizations a long way on the path to better security.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 070

How do you know where the weak spots are in your cybersecurity defenses? One of the best ways is to engage a third-party--an external set of eyes and skills--to conduct a penetration test and try to find them. John Sawyer, Director of Services, Red Team at IOActive, joins me on this episode of the TechSpective Podcast to talk about what red, blue, and purple team engagements are and why they're invaluable for companies to help improve cybersecurity.

Just as it is sometimes challenging to edit your own writing because your brain reads what you meant to write rather than what is actually on the page, it is also difficult to analyze your own security posture. You tend to see the problems you saw in the first place, and believe the solutions you have in place are sufficient. But, you don't know what you don't know, and you are often not the best judge of figuring it out. That is where engaging a red or purple team exercise with someone like John makes sense.

One of the specific issues we address in the podcast is the epidemic of alert fatigue. IT and IT security teams are inundated with an overwhelming volume of alerts. It is stressful and leads to apathy and/or critical alerts falling through the cracks. A purple team exercise can help identify useless alerts and separate important or critical alerts--providing valuable insight that can be used to fine tune systems to focus on the alerts that matter.

Check out the full episode for more from John about penetration testing and red and purple team engagements. We also talk about some of the ways the COVID-19 pandemic has affected purple team engagements in the past year, and the lasting impact the "new normal" may have on how red and purple team exercises are conducted.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 068

I've always been a huge fan of fighter jets and space exploration--so it was a huge privilege to have Jack Fischer join me for this podcast. Jack “2fish” Fischer (Colonel, U.S. Air Force, Retired) is a combat fighter pilot, test pilot, astronaut, and military space operations leader.

Fischer is a distinguished graduate of the U.S. Air Force Academy and a Massachusetts Institute of Technology Draper Fellow. He flew two combat tours in the F-15E as part of Operation Southern Watch, Operation Enduring Freedom and Operation Southern Focus.

As a distinguished graduate from the U.S. Air Force Test Pilot School, he conducted flight and weapons testing in multiple variants of the F-15 and the F-22. In 2008, he was selected as a Strategic Policy Intern in Washington, D.C, and served two six-month rotations with senior defense leadership in the Pentagon.

Colonel Fischer then served 9 years as an astronaut at the National Aeronautics and Space Administration, including a 2017 mission to the International Space Station where he logged 136 days in space with two spacewalks.

Following his NASA career, he returned to the U.S. Air Force Space Command as the Division Chief for the Global Space Operations Division, followed by being the Vice Commander of the 50th Space Wing at Schriever Air Force Base in Colorado Springs. He also served as the lead for “Task Force Tango,” a team charged with building the initial design for the U.S. Space Force.

He is now now serving as the VP of Strategic Programs for Intuitive Machines, as well as a military space consultant. We talk about the work Intuitive Machines is doing to develop technologies for the Moon, and the upcoming launches they have planned in 2022 to begin the work of getting man back on the Moon in the near future.

As it turns out, Intuitive Machines is "just around the corner" so to speak--here in the Houston area. I plan to go check out the facility and see what their up to first hand later this year.

Check out the full episode for insights from Jack on the importance of exploring the Moon and what it means for mankind's broader efforts to explore the solar system.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 068

Adam Philpott, Senior VP, EMEA for McAfee, is my guest for this episode of the TechSpective Podcast. With decades of experience in networking and cybersecurity, Adam brings tremendous insight to the table when it comes to zero trust and ZTNA (zero trust network access).

Zero trust is pretty mainstream at this point--an evolution or extension of the concept of least privileged access, but taking things to another level for improved security against today's advanced threats. As businesses around the world have embraced remote work and adopted a completely--or nearly completely--work-from-home workforce, the need for zero trust is greater than ever. The potential attack surface is massive when the internet is the company's network and every device and user is its own "perimeter".

Check out the full episode for more insights from Adam on cybersecurity in the post-COVID 19 pandemic era, and the role of zero trust and ZTNA in protecting applications and data.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 067

Vulnerabilities are everywhere and they will not be going away. That means they need to be researched and discovered and addressed. But, what is the right way to go about that process? Katie Moussouris, founder and CEO of Luta Security, is my guest for this episode of the TechSpective Podcast and she is uniquely qualified to discuss this topic since she essentially pioneered it and has had significant influence and input on the standards and practices being followed today.

What is the right or best way for someone who finds a vulnerability to let the software or hardware vendor know about the discovery without prematurely revealing the flaw to the public. The goal, ethically speaking, would be to address the vulnerability and develop a patch or fix for it before announcing it to the world and exposing all vulnerable systems to risk. The flip side, though, is that companies have to be kept accountable to actually address the flaws that are reported and not just sit on the information and keep their fingers crossed that the bad guys don't discover the vulnerability too. Coordinated vulnerability disclosure addresses both sides of that equation and provides a framework for cooperating and holding each other accountable for the greater good.

Check out the full episode for more from Katie on coordinated vulnerability disclosure. We also discuss the ways that bug bounty programs corrupt the system and are bad for both the researchers that try to report vulnerabilities through them and, in many cases, the companies that join the platforms. There is also a bit in there about the progress with COVID-19 vaccines and the hope that we will be able to safely convene for industry events again soon.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 066

It has been a rough year and a half since COVID-19 hit at the beginning of 2020. Thankfully, we are rolling out vaccines at a blistering pace and it seems like there is light at the end of the tunnel and that things will begin to open back up. That includes offices, and business travel, and industry events.

My friend Jack Daniel joins me on this episode of the TechSpective Podcast to talk about apprehension and anxiety about the "new normal" and the challenges with the ways some companies or managers seem to be handling the transition. Jack has long been an advocate for mental health and an evangelist against cybersecurity burnout, so I was very interested to get some perspective from him about the impact the quarantine lockdown has had, and what we should be thinking about as we emerge from the quarantine cocoon to get out and see people and work face-to-face again.

Check out the full episode for more insights on cybersecurity burnout and mental health during the age of COVID-19 quarantine and beyond. We also discuss the origin of the name "Jack Daniel"--and it is not what you think.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 065

Cybersecurity is constantly evolving. The threat landscape continues to expand and new technologies shift and extend the attack surface--both of which require new and innovative tools and practices to address. Ron Gula, co-founder and President of Gula Tech Adventures, joins me for this episode of the TechSpective Podcast to talk about the companies they are investing in and working with today, and the emerging trends he sees in cybersecurity in general.

Gula stresses the need for an engineering focus and looking for solutions that can fundamentally change the game rather than just reacting to the latest attack trend. We talk about newer cybersecurity technologies like browser isolation and deception, and some of the companies Gula Tech Adventures is supporting to bring the next generation of cybersecurity tools to market.

Check out the full episode for more about emerging trends in cybersecurity and the escalating Cyber Cold War. We talk about both the technology and the politics required to address our biggest nation-state adversaries.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.