TechSpective Podcast

TechSpective Podcast Episode 064

It wasn't that long ago--at least in human years--that developing an application was a tedious process with a beginning and an end. A process where modifications or updates took months to craft and had to wait for the next scheduled release. I realize that concept may be as foreign to developers today as floppy disks, corded landline telephones, or a functioning Republican Party that cares what their constituents want or what is good for the country--but I promise you that it was real.

Today, DevOps culture has taken over and everything is continuous. Development lifecycles have been compressed and accelerated, and there is no "end", per se, just the next iteration. Søren Pedersen, Co-founder of BuildingBetterSoftware and Agile leadership coach, joins me on this episode of the TechSpective Podcast to talk about DevOps culture and principles.

Check out the full episode for more about DevOps and how organizations can focus on quality. We also touch on maturity assessments, and how organizations can use them to streamline development, work more efficiently, and save time and money.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 063

What is a hacker? This is a question that has been debated for decades in the cybersecurity arena. Media conflated hacker and cybercriminal very early on, and it has been challenging to correct that error and separate the terms. I even wrote as far back as 2005 that the debate was lost and the word "hacker" had already been co-opted, and that we should give up and stop having that fight. Not everyone agreed--or agrees today.

Jayson Street--my guest for this episode of the TechSpective Podcast--is one of those people that continues the fight to reclaim the word hacker. Street explains that hacking and hackers predate the computer age, and that there is nothing inherently malicious or criminal about hacking. As he explains in the podcast--he is quite comfortable on that hill, and it's a hill he is willing to die on.

We also talk about Jayson's activities as a "professional bank robber"--and the crucial role that social engineering often plays. For fans of 80s movies, we manage to pull in references to "Fletch" and "Beverly Hills Cop" as well.

If you want to see more from Jayson and his views on hacking and cybersecurity, check out his website. It contains links to sites like iR0nin, books Street has written or contributed to, and clips of videos he appears in like this clip from National Geographic:

Check out the full episode for more about hacking and hackers. We also touch on the fact that we both live in Texas and the challenges of surviving the COVID-19 pandemic in a state that actively rejects science and logic as an ideological principle. Both of us are looking forward to resuming cybersecurity events in person and being able to hang out face to face in Las Vegas for Black Hat because we have both had the common sense to get vaccinated.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 062

My guest for this episode is my friend Wolf Goerlich. He is an advisory CISO with Duo Security and a respected cybersecurity strategist and speaker. He is also someone with a range of interests and hobbies that enlighten and inform his views on the world of cybersecurity.

People who work in technology and cybersecurity are often viewed as a stereotype--both by people outside of the industry and even by some in the industry. They are geeks and nerds and technology dominates their lives--or so it goes. The reality, though, is that cybersecurity is comprised of individuals, and those individuals have unique interests and perspectives outside of technology as well.

There is an entire sub-culture within cybersecurity of individuals who are into powerlifting and bodybuilding, and another group that is heavily involved in Brazilian Jiu-Jitsu. There are people who paint, play guitar, ride motorcycles, run marathons, and everything in between. Not only are these diverse interests a welcome and necessary mental and emotional break from the endless quest to defend against cyber threats, but they actually help people see things in a different way that helps them understand and solve problems within cybersecurity as well.

Listen to the podcast episode for a wide-ranging conversation about the value of diverse interests and perspectives, technological monoculture, and polarization of online information and engagement. We also cautiously look forward to the end of the COVID-19 pandemic and what we are looking forward to most as things return to some semblance of normal.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 061

My guest for this episode of the TechSpective Podcast is Dr. Eric Cole, author and founder and CEO of Secure Anchor. His latest book, 'Cyber Crisis: Protecting Your Business from Real Threats in the Virtual World', comes out June 1.

It has been a long, long time, but this is not the first time I have spoken with Dr. Cole. I actually interviewed him back around 2003 as well for his book 'Hiding In Plain Sight: Steganography and the Art of Covert Communication'.

A lot has changed since 2003. For starters, Cole obtained his doctorate and started a company. There have also been major changes in both the technology ecosystem and threat landscape in the last 18 years. At the same time, some things have not changed. Cybersecurity is still a major challenge and organizations still struggle with some of the basics.

The CISO role has emerged as one of the more crucial leadership roles for a company, but only if the expectations and execution are managed properly. The CISO has, unfortunately, been used as a scapegoat or fall guy position--the person who gets fired when a major cybersecurity incident occurs even though he or she had little authority and no budget to prevent it. Dr. Cole stresses that one of the problems is that many CISOs come from a technical background and the role is perceived as technical, but it is not--or at least should not be. According to Dr. Cole, the CISO is more of a business role than a technical one, and it takes an understanding of business to do the job right.

Check out the full episode to learn more about why Dr. Cole believes the role of the CISO is crucial for the future of cybersecurity, and his thoughts on what it takes to be an effective CISO. We also discuss the rising threat of ransomware, and why it's important for companies to be honest with customers and investors when they suffer an attack.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 060

Jack Danahy joined me for this episode of the TechSpective Podcast. I had the opportunity to work with and for Jack during our time together at Alert Logic, which acquired Barkly, a company he had co-founded. Prior to Barkly, Jack had been involved in launching other successful cybersecurity startups. Currently, he is using his years of experience and wisdom gained from working in the cybersecurity industry to act as an advisor and analyst for clients.

One of the main things we talked about is the state of cybersecurity today and what the future holds--or should hold. Jack shared why he believes that the logical direction for cybersecurity is for it to fully embrace the "as-a-Service" model. Some things you can do yourself, while for others it makes sense to work with professionals. If something is relatively simple to do, and/or the margin for error or consequences of messing it up are not very profound, then sure--do it yourself. However, if it is something that is complex and rapidly-evolving, and mistakes can have a significant impact, that is something you want to work with an expert on. Cybersecurity definitely falls into the latter camp.

Enjoy the full episode to learn more about Jack's philosophy on cybersecurity and how to address the challenges we face today. We also talk about the importance of marketing and how to effectively tell a story and help people understand rather than just trying to "sell" them something.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 059

If you have worked in or near cybersecurity in the last 20 years or so, there's a good chance you're familiar with Richard Stiennon. Richard is a former Gartner analyst who has established himself as a leading independent analyst--as well as an author and speaker in the field. His breadth of knowledge about cybersecurity is challenged only by the size of the Rolodex (Kids--that is like the Contacts app on your smartphone, except that every contact was written on its own physical index card and then...just Google for images of a Rolodex) he has accumulated over the years. Richard seems to know everyone in cybersecurity personally.

I have known Richard for well over a decade myself. As a cybersecurity analyst and author, I frequently reach out to Richard for his expert insight and commentary. Analysts and journalists generally cover similar topics from different perspectives, so we often swim in the same proverbial pool--attending the same conferences and events. As it turns out, we are also both from the Detroit area, so we are also out here representing the 313 (and the 248).

Our discussion on the podcast ranges all over. We talk about the upcoming second iteration of his Security Yearbook--a comprehensive compendium of the history and present state of the cybersecurity industry. Security Yearbook 2021 is available for pre-order now and will be released at the end of this month. Richard talks about the effort that goes into staying on top of a constantly shifting cybersecurity industry--as new startups pop up and old players get acquired or fade out of existence, and the need to follow emerging trends and new technologies that join the field.

Listen to the full episode to find out more about Richard's process ongoing research for the Security Yearbook and the vision for future iterations of the book. We also talk about cybersecurity in general, and the light at the end of the tunnel for COVID-19 quarantine as the world cautiously begins to open back up and in-person cybersecurity events start to become a thing again.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 058

What does it take to be a good leader? Well, if anyone should know, it would be my guest for this week's episode, Andy Ellis. Andy Ellis is known throughout the cybersecurity industry as a Hall of Fame CSO, former CSO of Akamai, and a diehard New England Patriots fan. As a lifelong Detroit Lions fan, though, I have to say it's easy to be a loyal fan of a team that wins. I'm not salty. Just sharing facts. Andy recently left Akamai to embark on a new journey--or journeys. He has joined YL Ventures as an Operating Partner, and he is hard at work writing a book on leadership.

He told me that the book started off being about decision-making, but he determined that making good decisions often comes down to a question of good leadership. So, the focus has evolved to be about what it takes to be a good leader, which will ostensibly lead to good decision-making as well.

Check out the podcast for more Andy on decision making and what it takes to be a good leader. We also talk about crucially important matters such as Marvel vs. DC and Andy shares some insights on the DC universe..

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 057

We frequently see data referred to as the "new oil" or the "lifeblood of business." Hyperbolic catch phrases aside, though, data is everywhere. All of the things are data. As the rate of data creation skyrockets exponentially, we are struggling as a global community with how to store it, or protect it, and what are the moral and ethical contracts we make related to our data.

Sam Curry, CSO of Cybereason, joins me for this episode of the TechSpective podcast to talk about a variety of things related to data privacy and ownership. Sam shares some thoughts on who owns the rights to an individual's data and whether or not that individual retains the right to be compensated for the use of their data.

Listen to the podcast for more insight from Sam on data privacy and ownership, as well as defending against ransomware and the pitfalls of developing and maintaining a business continuity plan. We also talk about the books we're reading right now, and a few things about Sam that you might not know about if you don't listen to the podcast.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 056

MITRE ATT&CK has quickly become an invaluable, third-party assessment that the cybersecurity industry and customers can reference as an objective demonstration of how the tools and platforms perform in real-world conditions. MITRE just released the results of the third MITRE ATT&CK Evaluation. 29 vendors participated in the exhaustive exercise to validate the capabilities of their products against Carbanak and Fin7--two threat groups that are known for using innovating techniques and tactics to target the financial sector.

Frank Duff, Director of ATT&CK Evaluations at MITRE Engenuity / Group Lead at MITRE, joined me for this episode of the TechSpective Podcast to talk about the origins, objectives, and value of the MITRE ATT&CK Evaluations.

One of the unique interesting things about the MITRE ATT&CK Evaluations is that MITRE doesn't declare a "winner" per se. It turns out that is actually both a pro and a con. On the one hand, it is admirable that MITRE chooses to approach the evaluation clinically and simply share the results and data to let customers review it and come to their own conclusions. The downside is that no clear or declared "winner" provides virtually every participating vendor an opportunity to spin the results so they somehow appear to have crushed the competition. It is easy to get "creative" about what you focus on or show, or conveniently exclude a vendor that was very competitive overall and even beat you in some areas from your talking points.

The marketing hype from the vendors can be confusing, but at least customers can still fall back on the actual MITRE ATT&CK Evaluation data and draw their own conclusions. There is also help from respected independent sources like former Forrester Analyst Josh Zelonis. Each year he has shed light on the MITRE ATT&CK Evaluation results and he provides source code for a tool to enable companies to generate their own custom analysis of the results.

Listen to the podcast for more insight on how the MITRE ATT&CK Evaluations are conducted, and how they evolve year over year based on previous tests and current attack trends. Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 055

People tend to think of the world as much more binary--more black and white than it really is. In most cases, though, reality lies in the vast gray area between the extremes. When it comes to cybersecurity and digital privacy, the lines between the extremes are getting more blurred as time goes on--expanding the ambiguous gray area where the real risks lie.

David Marcus joins me for this episode of the TechSpective Podcast. If you believe his LinkedIn profile, David is an infosec and intelligence dude, builder and leader of teams, lifter of heavy objects, and rider of Harleys. I have known David for many years, and--like many throughout the community--I consider him to be a credible and practical voice on cybersecurity topics. I would take his opinion on most things related to lifting weights and Harley Davidson motorcycles as well.

It wasn't really planned in advance, but it turns out that the running theme of my chat with David is "blurred lines." We start off the podcast talking about the blurred lines between traditional malware exploits and more sophisticated nation-state attacks, and end with a discussion on the privacy implications of social media and the information people share and the blurring of the lines between what is a useful or valuable use of personal and behavioral data, and what crosses the line to infringe on the privacy of the individual. We also hit on the issues created by the algorithms that govern our online interactions--and the way they paint people into a corner and result in reinforcing points of view through confirmation bias while making it very difficult to get an unbiased perspective even if you try.

It had been too long since David and I had an opportunity to chat and it was long overdue. I enjoyed the conversation and finished the podcast smarter than when I started it--not sure I can say the same for David.

The podcast itself is audio only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.