TechSpective Podcast

TechSpective Podcast Episode 055

One of the hot trends right now is the NFT. NFT--pronounced by some as "nifty" because it is catchier than saying N-F-T--stands for "non-fungible token". NFTs exist in a world that few truly understand (and I don't claim to be one of them)--a mix of trendy technology buzzwords including blockchain and cryptocurrency. At face value, they seem to make little sense, and yet those who understand and know how to capitalize on the hype and demand can make insane money right now.

This blog post from KnowTechie.com does a better job of explaining NFTs than I can. It also shares, "On March 23, 2021, Jack Dorsey, founder of Twitter, sold his first-ever Tweet for 2.91 million USD. Pixelated icons known as crypto punks have sold for millions of USD – each. And a mysterious artist known as Beeple recently sold a compilation of his digital art for a gobsmacking 69 million USD – nice."

The combination of hot tech and get rich quick opportunity makes the NFT market prime for fraud as well. Tens of thousands of people who barely understand blockchain or the concept of NFTs are rushing to jump on the bandwagon--and attackers are preying on their naivete. Bolster offers technology built on machine learning (ML) and artificial intelligence (AI) designed to protect you from bad actors on the internet--including protecting against NFT fraud.

Shashi Prakash, co-founder and CTO for Bolster, joins me on this episode of the TechSpective podcast to talk about NFT fraud and how to avoid it. Bolster recently shared a blog post--the first in a 5-part series--highlighting some of the common scams related to NFT fraud, such as replica stores, fake NFT stores, counterfeit NFTs, airdrops or giveaways, and brand impersonation on social media.

Listen to the podcast for more insights about NFT fraud, and some of the challenges of cryptocurrency and blockchain. We also touch on a dramatic rise in typosquatting attacks.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 054

Navigating the web of regulatory compliance mandates and mitigating risk from a constantly evolving and expanding threat landscape is challenging. For a company like Adobe--a large enterprise with a global footprint that was also an early adopter of cloud technologies--managing governance, risk, and compliance (GRC) is even more complex. A leader from the Adobe Tech Governance, Risk, and Compliance (TechGRC) team at Adobe joins me on this episode of the TechSpective podcast to talk about the creative and innovative ways Adobe tackles GRC.

Adobe had to develop its own approaches to help ensure security controls are uniformly implemented across its diverse technology stack. They also wanted a system that enables proactive action to mitigate issues quickly if there is any deviation from the preferred state. The technology governance, risk, and compliance (TechGRC) team at Adobe developed the Strategic Technology Iniatives program to help meet these goals. A blog post from Adobe describes some of the key features of STI:

Driving strategic initiatives across Adobe to better ensure that our assets have the desired security configurations in place per industry best practices

Efficiently using data collected from our Operations security stack, Application security stack, and technical compliance requirements to create these initiatives to further drive our desired security governance

Driving the adoption of these initiatives/best practices into Adobe-wide sprints through our corporate standards and policies

Implementing automated controls around continuous adoption, monitoring, and tracking of potential deviations

Listen to the podcast for more insights about the challenges of GRC and the importance of managing governance, risk, and compliance effectively.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 053

March is Women's History Month, and also the month we celebrate International Women's Day. That also makes it the month that media outlets highlight the challenges and triumphs of women in society. My guest on this episode of the TechSpective Podcast is Sheela Sarva, a Senior Application Security Manager with Qualys, to talk about her experiences as a woman working in technology and cybersecurity, and insights and guidance she can offer young women considering what to do with their lives or just entering the workforce.

We discuss some of the struggles that women face in general, and the role of gender stereotypes. Although, we seem to be making some progress, there is still a distinct difference in the narratives that society tells about boys versus girls, and the somewhat predetermined nature of what is acceptable for boys or girls to do. Even when boys and girls are playing with the same toy, manufacturers still feel compelled to make a "masculine" and "feminine" version.

Even when there is progress, it often highlights just how far we still have to go as well. Hasbro recently made the progressive--and very practical--decision to merge Mr. Potato Head and Mrs. Potato Head into a single gender-neutral Potato Head toy that includes both masculine and feminine accessories together and many primitive-thinking people have lost their minds about it.

Hopefully, we will eventually get to a place where we treat everyone with equal respect regardless of gender, identity, religion, culture, or other factors. Women's History Month and International Women's Day are both great, but we should recognize the value and benefits of women all year--not just the month of March. Ultimately, diversity benefits businesses and society, and we all need to embrace more of it.

TechSpective Podcast Episode 052

Companies depend on technology. It really doesn't matter what a company actually does today--even companies that are not "tech" companies rely on technology in some way, shape, or form for day-to-day communications, operations, accounting, and other functions. With so much riding on technology, businesses need access to relevant details and information about the relative security of the devices they buy. Intel provides this sort of visibility for customers with a new report developed in cooperation with the Ponemon Institute: The Role of Transparency and Security Assurance in Driving Technology Decision-Making.

Some of the key findings of the report, shared in the press release announcing the report, include:

Seventy-three percent of respondents say their organization is more likely to purchase technologies and services from technology providers that proactively find, mitigate and communicate security vulnerabilities. Forty-eight percent say their technology providers don’t offer this capability.

Seventy-six percent of respondents say it is highly important that their technology provider offer hardware-assisted capabilities to mitigate software exploits.

Sixty-four percent of respondents say it is highly important for their technology provider to be transparent about available security updates and mitigations. Forty-seven percent say their technology provider doesn’t provide this transparency.

Seventy-four percent of respondents say it is highly important for their technology provider to apply ethical hacking practices to proactively identify and address vulnerabilities in its own products.

Seventy-one percent of respondents say it is highly important for technology providers to offer ongoing security assurance and evidence that the components are operating in a known and trusted state.

Suzy Greenberg, Vice President, Intel Product Assurance and Security at Intel Corporation, joined me on the TechSpective podcast to talk about the report and her thoughts on why Intel invests in security assurance, as well as what she believes the audience should get from reading the report. We discuss the motivation behind Intel's sponsorship of the study, trends she sees across the security industry, and the role of Intel's bug bounty program in uncovering vulnerabilities. She also shares why she believes transparency is important for customers, and how a focus on transparency and security assurance helps shape hardware innovation at Intel.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

TechSpective Podcast Episode 051

Every year around this time, tech and cybersecurity media take a look back at the year that is winding down, and experts and pundits make predictions about the year ahead. It is a holiday tradition.

From a cybersecurity perspective, it generally feels like the holiday we are celebrating is Ground Hog's Day, though. You could take the recap articles and prognostications from almost any year and switch them with another without really losing anything. This year, however, is unique. This time last year, nobody had "Global pandemic shuts down the world and forces companies to embrace remote work" on their 2020 bingo cards, and predictions for 2021 take on a unique perspective when you consider that we will (hopefully) be emerging from the COVID-19 pandemic lockdown and returning to something approaching normal--but that the "new normal" will not look anything like the normal we left behind.

Ben Carr, CISO of Qualys, joins me on this episode to chat about these things. We talk about the dramatic acceleration of digital transformation caused by the COVID-19 pandemic, and the cybersecurity challenges it has introduced. We also talk about the changing role of the CISO, and the fact that what was once largely seen as a scapegoat position--someone given no real budget or authority to address issues, but expected to take the fall when a breach or compromise occurred--has slowly achieved more respect and credibility in the C-Suite and plays a much more vital role in business operations today.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

Take care and stay safe.

TechSpective Podcast Episode 050

"Every company is a software company."

That is the quote that kicks off the Executive Summary page of the latest State of Software Security Report from Veracode. This is Volume 11 of the report, with a focus on looking ahead to identify how developers can continue to make applications better and more secure.

Obviously, some companies produce microwave ovens, and some businesses repair garage doors. In a purely technical sense, not every company is a software company. But, the point of the quote is that, increasingly, no matter what industry a business is in, software and application development play an integral role. Domino's Pizza has famously declared itself a "tech company that sells pizza."

So, what insights are revealed in Volume 11 of the State of Software Security report? I'm glad you asked. A press release from Veracode shared the following key findings from the report:

Flawed applications are the norm: 76% of applications have at least one security flaw, but only 24% have high-severity flaws. This is a good sign that most applications do not have critical issues that pose serious risks to the application. Frequent scanning can reduce the time it takes to close half of observed findings by more than three weeks.

Open source flaws on the rise: while 70% of applications inherit at least one security flaw from their open source libraries, SOSS 11 also found that 30% of applications have more flaws in their open source libraries than in the code written in-house. The key lesson is that software security comes from getting the whole picture, which includes identifying and tracking the third-party code used in applications.

Multiple scan types prove efficacy of DevSecOps: teams using a combination of scan types including static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA) improve fix rates. Those using SAST and DAST together fix half of flaws 24 days faster.

Automation matters: those who automate security testing in the SDLC address half of the flaws 17.5 days faster than those that scan in a less automated fashion.

Paying down security debt is critical: the link between frequently scanning applications and faster remediation times has been established in Veracode’s prior State of Software Security research. This year’s report also found that reducing security debt – fixing the backlog of known flaws – lowers overall risk. SOSS 11 found that older applications with high flaw density experience much slower remediation times, adding an average of 63 days to close half of flaws.

My guest for this episode of the TechSpective Podcast is someone uniquely qualified to talk about that very thing: Chris Eng, Chief Research Officer for Veracode.

This year's report includes data analyzed from more than 130,000 applications--an increase of more than 50% over the previous State of Software Security report. One of the things Eng touches on in our discussion is the topic of nature vs. nurture when it comes to application security, as well as the fact that using multiple application security scan types, and leveraging automated scanning both contribute to accelerating the remediation effort and improving application security in general.

Don't take my word for it. You can download Volume 11 of the State of Software Security report to check out for yourself by clicking here.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

Take care and stay safe.

TechSpective Podcast Episode 049

Malware is a massive problem that costs businesses around the world billions of dollars every year. Much of the effort to fight malware is a simple game of cat and mouse where attackers find a weakness and develop an exploit, security vendors and application developers implement solutions to prevent that exploit, and attackers come up with a new way to circumvent protection. That will probably always be the case to some extent because there is no such thing as perfect or absolute security. However, there is a way to dramatically reduce the threat by preventing the actions necessary to execute the exploit at the chip level. That is where Intel CET comes in.

Tom Garrison, Vice President and General Manager of Client Security Strategy & Initiatives at Intel, recently joined me on the TechSpective podcast to talk about the challenges organizations face dealing with malware threats, and how Intel Control-Flow Enforcement Technology (Intel CET) can help prevent entire categories of common attacks.

Because of how pervasive Intel technology is throughout  technology, Intel is in a unique position to be able to impact malware execution on a massive scale. Microsoft has also joined the battle, pledging to incorporate support for Intel CET into Windows 10 with Hardware-Enforced Stack Protection.

Please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the TechSpective podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

Take care and stay safe.

TechSpective Podcast Episode 048

Hello. It's been a while. In my defense, time is just a construct and it seems to have mostly lost meaning--at least for me--during the COVID-19 pandemic quarantine. Days, weeks, and months have little value when the routine is mostly the same regardless. To say that 2020 has been rough would be a wild understatement. It seems like each month we say "Man. It can't possibly get worse than this!" and the next month is like "Hold my beer."

That said, life goes on. Aside from working from home and staying in my house 99% of the time, I don't have anything to complain about, really. Relatively speaking, I am fine. There is still plenty to write about. In fact, in some respects there is more to write about. DJ Sampath, co-founder and CEO of Armorblox, joined me to talk about the rise in business email compromise (BEC) attacks and other cybersecurity threats that have occurred as a result of attackers looking to take advantage of entire companies suddenly working from home and the exposure to risk from the COVID-19 pandemic chaos.

DJ and I recorded this a few weeks ago. Although some states have relaxed stay at home orders and there has been some effort to resume normal life--albeit with social distancing and other guidelines in place--the fact is that nothing much has changed and the conversation is still very relevant. COVID-19 cases and fatalities continue to climb in many areas, and most companies are still working entirely--or at least mostly--from home. Some companies are implementing remote work from home arrangements permanently. These conditions are still ripe for BEC attacks.

I encourage you to please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the Inner Circle podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

Take care and stay safe.

Inner Circle Podcast Episode 047

My guest for this episode is Fabian Wosar, CTO of Emsisoft. Emsisoft is a New Zealand-based maker of antimalware and endpoint security solutions that has established itself as a leader in the fight against ransomware.

This is a really awesome conversation--so much so that we got off topic very quickly and never really got back to it. I promise to have Fabian back again soon so we can delve more deeply into the battle against ransomware and Emsisoft's role in that effort.

We digress pretty early into the realm of data privacy and end user license agreements (EULA) and the concept that nothing is really free. The basic premise is that if a company is offering you a product for "free", it's because you're actually the product. The reason they're able to offer you the product for free is that they are generally collecting demographic and usage data that can be sold to companies and leveraged for more targeted advertising or other similar efforts.

Fabian and I talk about the current state of data privacy and some of the challenges that consumers face. Individuals have to try and determine which companies to trust with their personal data in exchange for features and benefits that make life more convenient. We also discuss the fact that some relationships are not optional--like the data collected and stored by government agencies or credit bureau organizations, and the data privacy implications of that.

I encourage you to please ask questions and share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the Inner Circle podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.

Inner Circle Podcast Episode 046

My guest for this episode is Mike Beckley--co-founder and CTO of Appian. Appian has established itself as a leader in intelligent business process management systmes (iBPMS), dynamic case management (DCM), digital process automation (DPA), and low-code development. With the recent acquisition of Jidoka, Appian is now also in the business or robotic process automation (RPA).

Our conversation revolves mostly around low-code development--dispelling some myths about what it is and how it is used. I have written previously about the power of low-code development for empowering citizen developers and giving individuals the tools to build the apps and solutions they need rather than trying to figure out how to make off-the-shelf tools do what they need. My view of low-code development platforms was based solely on this perspective, but Beckley enlightens me on the value of low-code development even for large enterprises and seasoned developers. It streamlines and accelerates development and simplifies the process of patching and updating.

We also talk about the Jidoka acquisition and the value of robotic process automation--or automation in general. Organizations have embraced DevOps culture and one of the core tenets of DevOps is the drive to automate those things that can be automated so people can focus on bigger problems and innovative new solutions.

As always, feel free to ask questions or share your thoughts on the topic in the comments below. I appreciate your help to share the podcast and grow the audience. Also, please subscribe to the Inner Circle podcast through your favorite podcast platform, and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes, or wherever you listen.