TechSpective Podcast

Inner Circle Podcast Episode 025

This week I have the privilege of speaking with Jeff Man. Jeff and I have known each other for a few years--since our days together at Tenable. Neither of us is at Tenable any longer and we've gone our separate ways, but I caught up with him recently during RSA and I appreciate that he was willing to take the time to join me for the Inner Circle podcast.

Jeff is a respected voice in cybersecurity. As a contributor to the book Tribe of Hackers, co-host of Paul's Security Weekly, and a frequent speaker at cybersecurity events, he is always willing to share his insight and experience with others.

It was a very interesting conversation--diving into Jeff's early days in cybersecurity at the NSA and the lessons he learned there. We also talked about what unique insight being in the NSA gives him and whether or not coming from the NSA might make him more jaded about the current or potential state of cybersecurity.

Jeff's insight is in high demand. He is making the conference circuit, touring the world presenting on cybersecurity. Here are some of the upcoming events Jeff will be at if you want to catch up with him:

Cyphercon - April 11-12

Hak4Kidz - April 13

ATLSECCON - April 24-25

BSides Baltimore - April 27-28

NolaCon - May 17-19

CircleCityCon - May 31 - June 2

You can connect with Jeff on Twitter at @MrJeffMan.

Inner Circle Podcast Episode 024

There are few individuals in the cybersecurity world as immediately recognizable as Jack Daniel. His height and his iconic beard distinguish him from the crowd just about anywhere. But, what really makes Jack stand out is his kindness and generosity. Jack is known to be a bit of a curmudgeon--but beneath a very thin shell of "curmudgery", Jack has a huge heart.

I've known Jack for years and I have the utmost respect for him--both as a cybersecurity professional and as a human being. For a brief period while I was at Tenable, we were also co-workers. It was my honor to have Jack join me as a guest for this episode of the Inner Circle podcast.

Most of my podcasts center around a particular theme--a product or event, or at least around a central question. Not this one. Jack and I talk about a wide range of things from the recent RSA Conference and the BSides conferences that are held around the world, to The Shoulders of InfoSec Project, to some of his extra-curricular activities like venturing into stand-up comedy, or his affinity for tiki bars.

Get yourself a caipirinha, kick back, and enjoy my conversation with Jack Daniel. Feel free to comment below if you have any questions, or if you want to share some feedback about the podcast. Also--stay tuned at the end to listen to the rest of the new podcast music--Summer Silk by UrbanPunks.

Inner Circle Podcast Episode 023

My guest for this episode of the Inner Circle podcast is Richard Stiennon. Richard has been waist-deep in cybersecurity for decades. He is a former Gartner analyst, who went on to be a VP of Threat Research at Webroot, and the Chief Marketing Officer of Fortinet, before launching his own analyst firm. Along the way, he has also authored a few books--including the recently launched 'Secure Cloud Transformation: The CIO's Journey'.

He is also a fellow Detroiter. Yes, I live outside of Houston and I've been in Texas since 2007--but that doesn't make me Texan. I am still a Detroiter...who happens to live in Texas outside of Houston. But, I digress.

Richard and I talk about the Secure Cloud Transformation and some of the common trends and pitfalls that organizations seem to face in their cloud and digital transformation journeys. His personal experience in the cybersecurity trenches and his years of researching and analyzing the trends and technologies in the cybersecurity industry enable him to share a unique, and valuable perspective on the subject.

You should check out the book--but first listen to the podcast. Feel free to comment below to share your opinions, ask questions, and let me know what you think.

Inner Circle Podcast Episode 022

My guest for this episode of the Inner Circle podcast is Marcus Carey--founder and CEO of Threatcare. Carey is also co-author of the book Tribe of Hackers, which was released just a couple weeks ago and has amassed a ton of positive reviews and feedback.

One of the things I like--and respect--about Carey is his willingness and desire to give back. If you follow his Twitter feed for a day or two, you will see message after message of positivity, authenticity and sharing of insight and wisdom.

In the introduction to the book, Carey explains:

I believe in giving as I go. In other words, instead of waiting until I "make it" to give back to others, I have been trying to mentor everyone I come across along the way. I have always been the type to want to help others, so I mean it when I say you're welcome to email or meet me for guidance about anything. I will always try my best to help.

In a nutshell, Tribe of Hackers is just an extension of that mentality. Carey has been around long enough and worked with and talked to enough people in cybersecurity to understand that everyone has their own unique story. He also knows there are people out there struggling to figure out how to pursue a career in cybersecurity and how to take the first step--and Tribe of Hackers is a brilliant way to share that information.

Styled after a recent Tim Ferris book--Tribe of Mentors, Tribe of Hackers contains the collective wisdom of 70 cybersecurity professionals. The contributors come from diverse backgrounds and represent a range of roles across the information security field--from practitioners, to visionaries, to founders, and everything in between.

Carey isn't just talk either. A PDF version of the book is available for free--because Carey wants to make sure that everyone who wants and needs the information in the book has access regardless of their financial situation. In addition, all profits from the book are being donated to charities to give back in other ways as well. If you can't afford the book, download the PDF. If you can afford the book, you should stop what you're doing and buy it right now.

Enjoy the podcast. Carey and I also talk about our time in the military (I served in the Air Force and he served in the Navy), and other random topics along the way. Feel free to ask questions or share your thoughts in the comments below.

Inner Circle Podcast Episode 021

I was honored to have Wendy Nather, head of advisory CISOs for Duo Security--now part of Cisco, join me as my guest for this episode of the Inner Circle podcast. Wendy is one of the most respected voices in cybersecurity today--which also explains why Marcus Carey and Jennifer Jin invited her to contribute on the recently released book Tribe of Hackers.

She and I discuss the book some during the podcast--but I had not yet received the book when we were recording. The book is filled with tremendous insight from a diverse array of cybersecurity veterans and visionaries. One of my favorite bits from Wendy is her answer to the question, "How is it that cybersecurity spending is increasing but breaches are still happening?"

Wendy responds:

"You can certainly spend more money on something and still not be doing it right. On the other hand, you can be doing a lot of things but not spending money in the right places. We tend to equate one with the other--that if you're spending a lot, you must be doing a lot; and if you're doing a lot, it must be effective. But I don't think any of those things follow, necessarily, from that. I think, in a lot of ways, we don't understand how to solve this problem yet. So we're throwing more money and lots of different techniques at it in the hope that we'll find the right thing--find that spaghetti that sticks to the wall--but I don't think we've gotten there yet. Therefore, spending more money doesn't necessarily equate to solving the problem."

The main focus of our discussion on the podcast, however, is zero trust security. Wendy and I talk about the need to elevate security beyond two-factor or multifactor authentication to a zero trust approach that continues to verify that a given user, device, or service is still who they say they are and that they still have a valid reason for accessing the data they're accessing and doing the things they're doing on your network.

Listen to the podcast and feel free to comment below to share your thoughts.

Inner Circle Podcast Episode 020

An application is no longer a product. In the world of cloud, and DevOps, and containers, an application is a process. There is no distinct beginning or end to development. The application is a living thing that cycles through a feedback loop--constantly identifying and resolving issues and consistently improving and evolving. When you have continuous development and continuous deployment, though, you also need continuous testing and continuous security that can keep up.

Ivan Novikov, co-founder and CEO of Wallarm, is my guest for this episode of the Inner Circle podcast. We talk about the need for continuous testing, and the philosophy and technology behind Wallarm. We also delve into the concept of fuzzing as a security testing technique.

Novikov explains that fuzzing techniques are based on a variety of assumptions about what normal data should look like. Using email as an example, you expect the input to consist of a unique email address, followed by the '@' symbol and then the domain. Novikov says fuzzing will add spaces, or insert Unicode characters and other unexpected input to determine what how the application will behave.

Once you find the unexpected or erratic application behavior, that is when the real fun begins. Listen to this episode of the Inner Circle to learn more.

Inner Circle Podcast Episode 019

Cybersecurity is generally an all or nothing game. Attackers are adept at finding and exploiting the weak link, so letting your guard down in any area is unwise. Kamal Shah, CEO of StackRox, joins me for this episode of the Inner Circle Podcast and we discuss the importance of protecting applications and data in containers, and why that means ensuring that you have secured all three phases of the container lifecycle: Build, Deploy, and Run.

There are container security solutions that focus on scanning container images to identify vulnerabilities before they're deployed. There are also container security tools to scan and detect vulnerabilities or configuration issues during deployment, and container security tools to monitor containers in real-time while they're in use. Each of these is a valid approach for container security, but each phase of the container lifecycle has unique issues and security concerns, and they are all part of a continuously self-perpetuating cycle. You can't have comprehensive container security without protecting the entire container lifecycle.

Shah talks about some of the challenges organizations face trying to maintain visibility and provide security for a dynamic, rapidly-changing environment like a container ecosystem. If your organization is developing and deploying apps using container technology, you should listen to this episode to gain insight on how to effectively secure apps and protect data in your container ecosystem.

Inner Circle Podcast Episode 018

...and vice versa. That should be part of the title too, but it was already quite lengthy. On this episode of The Inner Circle, I am joined by Kevin Livelli, Director of Threat Intelligence at Cylance, to talk about some interesting research and trends in cyber attacks.

There are two recent reports from Cylance that highlight opposite ends of a spectrum, more or less. On the one hand, there seems to be a trend by nation state attackers to leverage the same open source and publicly available tools and exploits as run-of-the-mill cybercriminals. On the other hand, cybercriminals are also working off of the nation state cyber attack playbook and taking steps to make their attacks appear to be state-sponsored.

In either case, the tactics cover up tracks that might lead back to the real attackers, which makes attribution that much harder for cyber attacks. Is the attack really from a known group of cybercriminals, or is it a nation-state that just happens to be using the same tools and techniques? Is that attack really a state-sponsored attack against the infrastructure of another country, or is it just a group of cybercriminals making an effort to appear to be a nation state?

Livelli also points out that it is not purely about obfuscation or trying to throw cyber investigators off of your scent. In some cases, it is also just a function of using what works. The line between cybercrime syndicate and nation state cyber attacks is blurred because each group studies the other and identifies what works and what doesn't. In the end, it's all part of the same evolution of exploit tools, techniques and processes.

Inner Circle Podcast Episode 017

Who can you trust? More importantly, how far should that trust extend? Andy Smith, VP of Product Marketing for Centrify, joins me on this episode of the Inner Circle podcast to talk about zero trust privilege. We talk about the reality of the threat landscape and the fact that attackers generally log in with compromised or stolen credentials. From a traditional authentication perspective, the attacker appears as "legitimate", and--without additional protection--would have free reign to any assets or data the actual owner of the compromised or stolen credentials has access to.

Zero trust security--or zero trust privilege--takes authentication to the next level. It is a combination of the concept of least privilege access and user behavior analysis to consistently monitor activity and verify the credentials of the individual as the individual (or credentialed service or API) moves about the network and accesses different resources.

It's crucial for organizations to understand that whether an attack is external or internal, it is most likely going to be executed with verified access using legitimate network credentials. Zero trust privilege raises the bar from standard authentication, or even two-factor authentication or least privilege access to provide stronger access management to guard against these attacks.

Inner Circle Podcast Episode 016

John Kinsella--co-founder and head of product for Layered Insight--is my guest for this episode of the Inner Circle podcast. Layered Insight is focused on container security, so that is a primary focus of our discussion, but we also diverge into a number of interesting tangents.

Containers are hot. Since Docker skyrocketed onto the scene, organizations have been eagerly adopting container technology and changing the way applications are developed and deployed to take advantage of the benefits of containers. And--as seems to happen with every hot technology no matter how much we know better--security was more or less an afterthought.

That is why there's been a diverse array of innovative tools and technologies developed to secure and protect containers and the apps and data they contain. John and I talk about some of the pros and cons of different approaches, and how he and the engineers at Layered Insight have approached the issue.

Along the way, we also manage to talk about how we have worked in and around security for two decades, and how technology has changed--as well as some of the ways it hasn't. That conversation leads to interesting threads on the noise and heat generated by computers, Mac vs. Windows, MacBook Air vs. Surface Pro, the benefits of syncing data with OneDrive, and other fun tech topics.