TechSpective Podcast

Inner Circle Podcast Episode 035

I've been a fan of Georgia Weidman for years, so it was an honor and a privilege to have her join me on the Inner Circle podcast. She is the author of Penetration Testing: A Hands-On Introduction to Hacking, and she is the founder and CEO of both Bulb Security and Shevirah. She is also one of the cybersecurity professionals featured in the Tribe of Hackers book that Marcus Carey and I discussed in a previous episode.

To be honest, one of the reasons I first became aware of Georgia is because she is a female in cybersecurity. Not just a female in cybersecurity--but a leader in cybersecurity who is also a woman, like Katie Moussouris, Wendy Nather, Lesley Carhart, Jennifer Steffens and many, many others. Thankfully, that list does seem to be growing, but we also seem to have a long way to go yet. We touched on how nice it will be when we reach the day when we don't feel it necessary to call out the fact that someone is female or put them on a separate pedestal because of that--where a cybersecurity professional is a cybersecurity professional regardless of gender, gender-identity, race, or other factors, and that we just compare people based on their own merits.

We did not focus our podcast conversation around women in STEM or cybersecurity roles, though. The podcast focuses on the purpose and value of penetration testing for organizations, and the triumphs and challenges of launching and managing a successful cybersecurity business (or two).

I also follow Georgia on Instagram and frequently see her post photos of her horse, Tempo. We talked about her extracurricular equestrian hobby, and the importance of having passions and interests outside of cybersecurity (or whatever your career is) to give your mind a break and allow yourself to mentally and emotionally recharge.

Check out the latest episode of the Inner Circle podcast below, or listen / subscribe on Apple or Google. Share your feedback and questions in the comments below.

Inner Circle Podcast Episode 034

Wolf Goerlich joins me for this episode of the Inner Circle podcast to talk about the state of cybersecurity today and his new role on the CISO Advisory Board for Duo Security. Wolf talks about his focus on zero trust--and somehow that segued into a conversation about the disruptive technology that led to the original jersey for the Toronto Raptors and other NBA teams during the mid 90s as we discussed technological tipping points and the impact it can have on entire industries.

The conversation also turns to the role of cybersecurity for a business, and its evolution over time. Security was traditionally seen as a hurdle or road block to productivity by the rest of the company, and cybersecurity professionals were often a bit zealous about enforcing rules for the sake of enforcing rules. Both sides have changed over time. As data breaches and network compromise have become daily events, the company in general has a better appreciation for security, and as cybersecurity has evolved, IT security professionals have a better understanding that their role is to protect the companies ability to generate profit--not get in the way of it.

We also talked about a recent social media post from Wolf where he shared an opinion that those new to cybersecurity or looking to get into cybersecurity should not be launching GoFundMe campaigns or going into debt to get to an event like the Black Hat and DefCon conferences coming up at the beginning of August. Mega events like RSA and Black Hat are awesome--and I try to never miss either--but they play a specific role. It's not that you can't meet people and do some very valuable networking at an event like Black Hat, but for the purposes of someone getting into cybersecurity, local groups and events are much more likely to offer the sort of guidance, mentorship, and opportunities necessary to build a successful career. The B-Sides conferences, and the Houston Security Conference, and hundreds of other smaller, regional events are probably a better investment of time and money for someone new to cybersecurity.

Check out this episode of the Inner Circle podcast and please share your thoughts and questions in the comments below.

Inner Circle Podcast Episode 033

Jeremiah Grossman, founder and CEO of Bit Discovery, joins me for this episode of the Inner Circle podcast. We talk about the focus of Bit Discovery and the importance of having an accurate inventory of assets on the network for an organization--as well as some of the challenges that make it difficult to maintain an accurate inventory.

We also talk about the core team of people that Jeremiah has worked with as he has founded multiple cybersecurity companies and moved through his career, and the balance between having a great idea and having the right team to execute the idea.

"Ideas and intelligence are a little overrated. I'd actually prefer a work ethic, you know--people that grind and work together really well and don't have much of an ego," explains Grossman. "Because, not everybody can be smart at all things at all times. So, if you're humble enough to--you run into a problem, you look at it, you accept it as a problem or you made a mistake, and solve it--and you just grind at it every single day, it's very difficult to lose. It's very difficult NOT to succeed when you're just willing to put in the sweat equity. People will bet on you when you show up."

Of course, no conversation with Jeremiah would be complete without touching on the topic of Brazilian Jiu Jitsu. It has become a thing that cybersecurity professionals get involved in the martial art--and it seems like Jeremiah is one of the primary inspirations or catalysts behind that movement.

Check out this episode of the Inner Circle podcast to learn more about Bit Discovery, asset inventory, the importance of a team and a solid work ethic, and why Brazilian Jiu Jitsu is a go-to extracurricular activity for cybersecurity professionals.

Inner Circle Podcast Episode 032

My guest for this episode of the Inner Circle podcast is Phil Dunkelberger, President and CEO of Nok Nok Labs. We chat about the history and current state of secure authentication and the role the FIDO (Fast ID Online) standard can play in streamlining and simplifying secure access.

Authentication is an integral part of technology. Whether you are connecting to a company email server, shopping on Amazon, chatting with your cousin over Facebook Messenger, or logging in to Netflix to binge watch the new season of Stranger Things, there has to be some way for the persons and systems on the other end of that transaction to verify that you are who you say you are and to limit your access to only those things you are legitimately authorized to access.

Usernames and passwords have been obsolete pretty much since they were invented, and yet they're still here. Bill Gates promised the death of the password 15 years ago, and yet it's still here. Passwords are exposed and compromised in data breaches almost daily, and yet they remain the dominant form of authentication.

Technology is finally catching up with the vision for better authentication, though, and a standard like FIDO helps the concept gain traction and become the mainstream default. Things like Windows Hello and FaceID facial recognition, fingerprint sensors on mobile phones, or using the phone itself as a hardware token to verify identity and grant access, we finally seem to be moving the needle a little--but there's a long way to go  yet before the password can officially be declared dead.

Check out the podcast episode and comment below to share your thoughts or ask questions.

Inner Circle Podcast Episode 031

Andrew Hay, COO of Lares, is my guest for this episode of the Inner Circle podcast. Andrew and I talk about the concept of part-time or "fractional" executives and the tremendous potential of allowing and hiring remote workers that many organizations miss out on.

Companies need executive leadership--but not all companies necessarily need all of the executive roles to be there 40 hours a week. You might not want a part-time CEO, but Andrew has worked with a variety of companies filling a virtual CISO role. The company needs someone to provide leadership and oversight of cybersecurity efforts. Instead of hiring a full-time executive to fill the CISO role, though, an organization can save a significant amount of money by enlisting the support of a part-time CISO. The organization gets the same expertise and the same executive leadership, but the individual filling the virtual CISO role only really needs to be engaged 1 or 2 days a week.

We also talk about the value of remote workers. Andrew is in Austin and his employer is in Denver--and that works just fine for both of them. Some companies or managers seem obsessed with the idea that a person can only deliver value or be productive if they sit in a designated cubicle at the office for 40 hours per week. There is certainly value to getting to know your peers and working together face-to-face, but commuting to and from work is a waste of time and there are a variety of situations and activities that occur during a work day that interrupt and distract from productivity.

Being open to hiring and working with remote employees drastically increases the potential pool of candidates. I don't care what role you're hiring for, there are many more qualified people for any given role in the world than there are within a 30 mile radius of your office. By hiring remote workers from areas with a lower cost of living, companies can pay less for the same or better productivity and reduce salary costs at the same time.

Organizations that fully embrace the concept could also scale down or eliminate the office entirely. Instead of renting and maintaining space for hundreds of employees, the company could lease a space a fraction of that size with a couple conference rooms for team meetings, and a collection of cubicles that anyone can use when they are in the office.

Check out the podcast and feel free to comment below to share your thoughts on fractional executives and the pros and cons of working remotely.

Inner Circle Podcast Episode 030

My guest for this episode of the Inner Circle podcast is Jamil Jaffer, Vice President for Strategy & Business Development at IronNet Cybersecurity. We discuss a recent report from IronNet--Collective Offense Calls for a Collective Defense: A Reality Check for Cybersecurity Decision Makers--which focuses on the value of sharing threat intelligence and the challenges organizations face when it comes to cooperating with others on threat intelligence.

Have you ever done a jigsaw puzzle? When I do a jigsaw puzzle, I usually have the top of the box the puzzle came in sitting right next to me as a reference. It lets me see what the picture is that I am trying to build and makes it easier to understand--at least in some broad, general sense--where in the puzzle a given piece might be likely to fit. Now, imagine that I just hand you two or three random pieces of a puzzle, but you have no idea what the finished picture is supposed to look like. Where would you begin? With only a few pieces and no idea what the end result should be, how would you make sense of the pieces you have?

That is what threat intelligence is often like. An organization may have a number of signals or indicators that malicious activity is occurring, but no idea what other indicators they're missing or any idea what the goal or purpose of the threat is. By cooperating with other organizations--sharing and collaborating on the random puzzle pieces each one has--it is possible to get a better view of what the threat is and how to effectively defend against it.

There are a number of interesting key findings from the IronNet report, such as:

Organizations Are Ready for Collective Defense

The vast majority (94 percent) of respondents’ organizations currently subscribe to or invest in some form of collective defense, including threat sharing of IPs, file hashes, domains, and other signature-based indicators.

94 percent of respondents stated that their organization would be willing to increase the level of threat sharing with their industry peers if it demonstrably improved their ability to detect threats.

Similarly, 92 percent say their organization would be willing to increase sharing with the government if it enabled the government to use political, economic, cyber, or other national-level capabilities to deter cyber attacks.

There’s a Disconnect Between Confidence Levels and Actual Vulnerability and System Maturity

55 percent of IT decision makers noted that they are confident that their cybersecurity capabilities are advanced and stated they are in better shape than others in their industry.

85 percent of respondents are most likely to rate their organization’s cybersecurity technology, systems, and tools as advanced.

In a 12 month span, respondents on average experienced 4 attacks on their organization, with 20 percent of respondents being hit 6 or more times.

Nearly a quarter of respondents identified that they are facing issues with each of the following: lack of real-time visibility across industrial control systems and IoT (27 percent), lack of timely threat intelligence information (25 percent), and too many cybersecurity tools and poor integration between them (24 percent).

Almost 8 in ten respondents stated their organization has had a cybersecurity incident so severe, it has required a C-level/Board meeting after.

AI and ML Investment is Robust, but Maturity is Key to ROI

Three-quarters (73 percent) of respondents state that their organization has invested in Artificial Intelligence (AI) or Machine Learning (ML) in the past 12 months.

Of the 27 percent of respondents who hadn’t invested in AI or ML in the past 12 months, 35 percent said their reason was that they were simply unsure of the value.

Check out this episode of the Inner Circle podcast and feel free to comment below to share additional thoughts or ask question on this topic.

Inner Circle Podcast Episode 029

Armorblox is a sponsor of TechSpective

My guest for this episode of the Inner Circle podcast is DJ Sampath--co-founder and CEO of Armorblox. We have a very interesting chat about the state of cybersecurity and the sense that we've been fighting the same battles for decades with little forward progress, as well as how AI, ML and NLU represent a fundamental shift in cybersecurity.

From our discussion, it seems like we are at a pivotal point in terms of technology and cybersecurity. Artificial intelligence, and machine learning (or deep learning) provide us with an unprecedented ability to automate more intelligent security and recognize and respond to threats more intuitively and effectively.

The complexity of networks--with mobile, containers, and hybrid or multi-cloud environments--and the sheer volume of the expanding threat landscape make it virtually impossible for traditional cybersecurity tools and processes to keep up effectively.

Sampath and his co-founders started Armorblox to leverage the latest advances in natural language processing (NLP) and deep learning. Armorblox built the world's first natural language understanding (NLU) platform for cybersecurity. Armorblox analyzes context, tone and writing styles across communications platforms to stop today's biggest attacks by detecting and preventing inbound threats and outbound data loss.

Check out this episode of the Inner Circle podcast and feel free to ask questions or share your thoughts in the comments below.

Inner Circle Podcast Episode 028

Brook Schoenfield, Master Security Architect and Director of Advisory Services for IOActive, joins me for this week's episode of the Inner Circle podcast.

We talk about the focus of the cybersecurity industry on vulnerability management and incident response, and why that reactive approach may not be the most effective way to address security issues. Brook talks about the importance of threat modeling and secure design to build better, more secure, more resilient software in the first place.

Understanding that--even with threat modeling and secure design--there is no such thing as invulnerable software, we also talk about the importance of the feedback loop and the ability to refine the threat model over time.

The concept of threat modeling and the idea that the software development lifecycle (SDLC) should be built around secure design are not new. Since developers started writing code, there have been cybersecurity experts pointing out that it would be better if security were considered and woven in from the start rather than tacked on after an application is developed.

Listen to this episode of the Inner Circle podcast and please share your thoughts and questions in the comments below.

Inner Circle Podcast Episode 027

My guest for this episode of the Inner Circle podcast is Ron Gula, co-founder of Gula Tech Adventures--a venture capital firm focused on investing in cutting edge cybersecurity startups. Prior to launching Gula Tech Adventures, though, Ron had established himself as a cybersecurity leader and visionary, most notably as co-founder and CEO of Tenable.

I've known Ron for years and had even interviewed for various roles at Tenable over the years before finally being hired to manage the Tenable community and social media efforts in 2015. I wasn't really looking for a corporate day job at the time, but a mutual friend brought the role to my attention and Ron was coincidentally "in the neighborhood" speaking at an event in San Antonio. I drove the three-plus hours from Houston to San Antonio to have dinner with Ron and talk about the role. I am grateful that Ron was willing to not only accept that I would also continue my personal efforts as a tech journalist and freelance content creator--but that he recognized that my role in the broader cybersecurity community was actually a benefit to Tenable and enhanced my value for the role I was being hired for.

Fast forward a few years, and neither of us is at Tenable at this point. Ron stepped down to pursue other ventures--namely launching Gula Tech Adventures--and I was abruptly separated from the company in the Great Marketing Purge of 2017. It seems like it has worked out pretty well for both of us, though.

Ron and I have a great conversation in this episode of the Inner Circle podcast--reminiscing about our ealry days in the US Air Force and the paths we've each taken to get where we are in the world of cybersecurity. Ron also shares some of his insights as an investor in cybersecurity startups, and the challenges we face as an industry because we all exist in a self-validating bubble.

Listen to the episode, and please feel free to share your thoughts or ask questions in the comments below.

Inner Circle Podcast Episode 026

This week I am joined on the Inner Circle podcast by Jack Danahy, Senior Vice President of Security for Alert Logic. As most of you know, I also work for Alert Logic by day as Senior Manager of Content Marketing.

Many of you may already be familiar with Jack. He is an innovative security technology leader with proven success creating, delivering, and promoting new security technologies and practices to address critical needs. He has founded and co-founded three successful security companies, holding CEO and CTO roles. Most recently, he was CTO at Barkly and previously at Qiave Technologies (acquired by WatchGuard Technologies in 2000) and Ounce Labs (acquired by IBM in 2009). He is also a prolific writer and speaker on security and security issues and has received multiple patents in a variety of security technologies.

At the beginning of March, Alert Logic launched a variety of new features and capabilities designed to reduce the attack surface and expand protection for customers. Extended endpoint protection, combined with capabilities like antivirus integration, AWS user behavior anomaly detection, Office 365 and expanded Azure integration, and Dark Web scanning enable Alert Logic SIEMless Threat Management to protect public cloud infrastructures, container workloads, and traditional data-centers and endpoints to give Alert Logic customers better security and peace of mind at a lower total cost than a do-it-yourself security approach or traditional outsourcing.

Jack and I talk about the new features and capabilities and how they help customers face the threat landscape today. We also discuss the pros and cons of different cybersecurity philosophies and the fact that customers don't really care about the specs or capabilities of security hardware and software. Ultimately, they simply want to buy security that works.