TechSpective Podcast Episode 108

 

Unless you've been camping off the grid for all of 2023 or recently emerged from a year-long coma, you're most likely aware of all of the buzz and hype around generative AI. Tools like ChatGPT, Dall-E, Google's Bard, and countless others have proliferated exponentially and captured the attention of both companies and consumers.

Generative AI tools are capable of relatively impressive results. A quick search online will find endless examples of people finding recipes, planning parties, crafting content, creating artwork, and more. There is an array of potential uses and benefits for generative AI. At the same time, there are a variety of ethical questions raised by the technology, as well as issues with the accuracy and veracity of AI responses. One of the top concerns, however, has been about the impact these tools will have on cybersecurity. As threat actors embrace and refine their use of generative AI tools, cyber attacks may increase in both volume and sophistication--especially when it comes to cyber threats that require crafting messages.

Patrick Harr, CEO of SlashNext, joins me on this episode to talk about the ways SlashNext is using generative AI as a tool to stay a step ahead of threat actors and proactively defend against generative AI threats--especially for BEC (business email compromise) and phishing threats.

Check out the full episode for our discussion of the benefits and challenges of generative AI. We also chat about the issue of how generative AI models are trained and where they get their data, and the difficulty of validating or verifying the responses it generates.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 107

 

IT security teams have a tough job--made more challenging by the growing complexity of the attack surface and technology landscape and the overwhelming volume of information. They need to be able to accelerate the processing and analysis of data so they can streamline the decision-making and incident response processes. That is where UEBA can help.

Kumar Vikramjeet, a Senior Security Engineer on the threat hunting team at Adobe, joins me on this episode of the TechSpective Podcast to talk about how he and his team leverage machine learning (ML) and artificial intelligence (AI) to conduct User and Entity Behavior Analytics (UEBA) to detect anomalous activity related to a user or device that might indicate malicious activity.

Kumar recently wrote about the topic in a blog post for Adobe titled, "Fast-Tracking Incident Detection with User and Entity Behavior Analytics (UEBA)." In the blog post, he states, "At Adobe, we chose to develop our UEBA framework in-house to fit within our security ecosystem, including our existing security information and event management (SIEM) and endpoint detection and response (EDR) platforms. Doing this has enabled us to prioritize the use cases that are most important to Adobe’s threat-hunting efforts — designed and developed by our internal team of threat hunters and security analysts according to prioritized threat models — rather than rely on a third-party vendor to make changes to their tool to meet our specific needs."

The blog post describes the six primary steps that comprise the UEBA framework employed at Adobe: Use Cases, Data, Analytics, Correlation, Enrichment, and Detection. Kumar summarizes that UEBA can reduce noise and accelerate the speed and accuracy of incident detection.

Check out the full episode for our discussion of streamlining incident detection with UEBA. We also chat about the distinction between UBA (user behavior analytics) and UEBA (user and entity behavior analytics).

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 106

 

Security analysts spend their days monitoring activity in applications and across the network to identify vulnerabilities, detect attacks, and take the appropriate actions to prevent or mitigate threats. However, a good percentage of the work that is done in a Security Operations Center (SOC) is tedious--tasks that must be done, but hinder the ability to focus on the more complex work of identifying and resolving issues.

John Gillis, a Senior Cybersecurity Analyst for the SOC at Adobe, joins me on this episode of the TechSpective Podcast to share how he uses custom browser extensions to automate routine and mundane tasks to streamline operations and free up time to do more complex work.

In a recent blog post, John explained how he uses browser extensions in the SOC and the impact that has for him and his team. "As a member of our SOC team, I always look for ways to help improve efficiency in how we do our jobs — every second of our time matters when we need to respond to and defend against ever-evolving threats. My effort here helps keep the focus on my analysis work by letting the browser automate the more mundane tasks. "

The analogy I use to describe this effort is a jigsaw puzzle. When you dump out the box of a 1,000-piece puzzle, the first thing you typically do is sort the pieces into general color groupings so you can more easily find a red piece or a green piece or whatever as you work to construct the puzzle. It is only after you do this tedious sorting that you can get down to business and analyze the pieces to figure out how they fit together and solve the puzzle. Effectively, what Gillis is doing is using browser extensions to automate the sorting of the pieces so he can leapfrog to the analysis and problem-solving aspects of the effort.

Aside from reducing the manual effort required for tedious tasks, this sort of automation also helps address alert fatigue. The automation can be used to take care of some of the initial triage of security event information to separate the signal from the noise and only elevate things that are more likely to be legitimate concerns to the human security analysts to examine more closely.

Check out the full episode for our discussion of automating routine security tasks using browser extensions, and insight from John on how these automations also reduce alert fatigue and help maintain consistency from analyst to analyst in how things are done. We also veer off to chat about the current explosion of generative AI models and the pros and cons of offloading tasks to generative AI tools and platforms across all industries and roles.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 105

 

It's more or less expected that organizations are "in the cloud" these days in some way, shape, or form, but having a cloud strategy is important. In the early cloud days, moving to the cloud gave organizations a competitive advantage. At this point--with pretty much everyone in the cloud--it's sort of the opposite. Being in the cloud is the default, and any business that is not in the cloud is simply sabotaging its own success.

That said--what does it mean, exactly, to be "in the cloud?" Just moving things to the cloud for the sake of moving them, or trying to simply move your on-premise servers, applications, and data to the cloud and continuing to do everything the same fails to understand or take advantage of the benefits of moving to the cloud. It can also get very costly, very quickly.

Cenk Ozdemir, Cloud and Data Lead with PwC, joins me for this episode of the TechSpective Podcast to talk about the results of a survey recently conducted by PwC, and the challenges and trends of cloud strategy in general.

Check out the full episode for our discussion of the PwC report, and insight from Cenk on the strategies and best practices that PwC recommends for customers to embrace the cloud strategically and take full advantage of its features and benefits.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 104

 

Organizations invest signficant money and resources in cybersecurity in a constant, 24/7 battle to protect applications and data from cyber adversaries. It's a bit of a cat-and-mouse game that has gone on for decades. Threat actors devise innovative exploits and attack techniques, and new security tools and strategies are introduced to defend against them, so threat actors come up with unique new attacks. Rinse and repeat. But, what if we had applications that could defend themselves--adversary aware applications?

Ammar Alim, Manager of DevSecOps Solutions at Adobe, is my guest on this episode of the TechSpective Podcast to talk about how they are creating adversary aware applications at Adobe. Ammar shares that he does some soccer coaching as well, and tells his players that either they are chasing the game, or the game is chasing them. "This is very applicable here in cybersecurity, where if you're waiting for an attacker--for a zero day--and then try to respond to that zero day you are reactive. There is a vulnerability, and then we're going to have all hands on deck, and we're going to do some patching."

The approach Ammar and Adobe are taking to change the game in their favor is to develop applications that are capable of recognizing threats and malicious activity and take action to defend themselves.

Check out the full episode for our discussion of application security and the virtues of adversary aware applications. We also chat about the challenges of the traditional approach to vulnerability and patch management, and why focusing on patching all vulnerabilities is Quixotic, at best.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 103

 

Security equals compliance--at least in theory, assuming it's effective security.

But compliance doesn't necessarily equal security.

Igor Volovich, VP of Compliance Strategy at Qmulos, joins me on this episode to talk about the goals and limitations of compliance frameworks and efforts. Some elements of cybersecurity compliance are in the "eye of the beholder," so to speak. Volovich shares great insight on separating data from opinion, and the pitfalls of basing compliance on subjective opinions about the environment.

Compliance audits or reports, in most cases, are also just a moment-in-time snapshot. Regardless of how secure or compliant you were at the point in time that the audit was conducted, it doesn't tell you anything meaningful about whether or not you're secure or compliant right now. It's part of the reason that focusing on passing compliance audits is a poor strategy. Focusing on effective cybersecurity means you're more likely to be secure day-to-day, and--as an added bonus--there's a fair chance you're also compliant.

Check out the full episode for our discussion of cybersecurity compliance--including trends in accountability for cybersecurity executives who sign off on compliance audits without understanding or validating that they're accurate.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 102

 

Identity security is crucial for effective cybersecurity. When it comes down to it, many attacks are successful because threat actors are able to somehow steal, hack, or otherwise circumvent identity controls.

The Identity Defined Security Alliance (IDSA) is an independent source of thought leadership, expertise, and practical guidance for identity security--comprised of identity and security vendors, solution providers, and practitioners. IDSA is a non-profit organization designed to foster community collaboration and provide education, best practices, and other resources to help organizations with protecting identities and identity data.

The organization commissioned a survey of more than 500 identity and security professionals to examine the progress with identity security and to understand the current state and the challenges organizations are facing today. The results were published in the 2022 Trends in Securing Digital Identities report.

On this episode of the TechSpective Podcast, Julie Smith, Executive Director of IDSA, joins me once again to talk about the insights and findings from the report. We also talk about what the report reveals in terms of guidance that organizations and security professionals can take into 2023 to try and raise the bar.

Check out the full episode for our discussion of the guidance from the 2022 Trends in Identity Security report from IDSA to help you improve identity security for 2023. Julie also shares that she has been selected to join the Board for IDSA, and they are actively searching for her replacement as Executive Director of the organization. If you're a CISO or security leader with a passion for identity security and you're interested in a new challenge, reach out to Julie and the IDSA.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 101

 

There are many facets to cybersecurity. Organizations seek to prevent or block as much as possible, while also constantly monitoring their environments, and--in most cases--working to detect and respond to any malicious code or behavior that somehow slipped past the outer defenses. Threat hunting is an element of cybersecurity that helps security operations teams proactively identify and take action against active threats.

Not everyone agrees on the definition of threat hunting, though. Is it a service? Is it a process? Can you buy a threat hunting tool that can just automate the whole thing for you? Gartner analyst Pete Shoard shared his thoughts in a 2020 blog post--including stating very clearly that he does not believe it is a service:

"If there is one thing I know well, that’s managed security services. Therefore, I can confidently say that threat hunting is NOT a service. Nobody ever said I want to buy some of that ‘threat hunting’ stuff. Buyers of security services should focus on outcomes, outcomes are based on a threat hunts being successful. Services that offer threat hunting as a value add or as a differentiator, well that’s different."

Done right, though, threat hunting can play a crucial role in effective cybersecurity. This episode of the TechSpective Podcast focuses on threat hunting--and more specifically how the team at Adobe approaches it.

My guest on this episode is Mark Thomas--a Senior Cyber Security Analyst at Adobe. Prior to joining Adobe, Mark served as a Security Analyst at a major financial institution applying his knowledge and skills from the DoD, building their threat hunting program from the ground up. He graduated from Texas State University in 2012 with a major in Computer Information Systems.

In his role Adobe, Mark is responsible for detecting threats across Adobe's environments using a variety of machine learning, data science, and deep learning techniques. His team strives to defend against malicious activities by decreasing dwell time and identifying previously undetected issues, visibility gaps, and other security risks.

Check out the full episode for more about threat hunting and the approach that Mark and his team at Adobe take to proactively seek and resolve potential threats.

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 100

 

This is a milestone podcast--the 100th episode. Triple digits. In honor of the 100th episode, I invited the guest who helped launch the whole thing with Episode 001--Malcolm Harkins. Malcolm was CISO at Intel at one time, and served as Chief Security and Trust Officer at Cylance among many other roles. As it happens, Malcolm and I are now coworkers as well. Malcolm is the Chief Security and Trust Officer at Epiphany Systems, where I manage marketing.

He is also an independent board member and advisor to several organizations, and an executive coach to CISOs and others in a wide variety of information risk roles.  Malcolm engages in a wide variety of peer outreach activities to drive improvements across the world in the understanding of cyber risks and best practices to manage and mitigate those risks. Key areas of focus include the ethics around technology risk, social responsibility, total cost of controls, and driving more industry accountability.

In other words, Malcolm has a track record of success and years of wisdom and insight to bring to the table for a conversation on the role of a Chief Information Security Officer (CISO) and the ethical and legal implications of it. Our chat was particularly relevant in the wake of recent events like Peiter "Mudge" Zatko becoming a whistleblower about issues at Twitter--where he lead security until being let go earlier this year, and the potentially precedent-setting trial of former Uber CISO Joe Sullivan for his role in covering up a 2016 data breach.

Check out the full episode for more about the CISO role and Malcolm's perspective on the ethical and legal responsibilities that come with it.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 099

 

Do you like to do jigsaw puzzles? I generally don't have the patience, but my wife is a jigsaw puzzle fanatic. Gathering threat intelligence is a lot like assembling a jigsaw puzzle.

Whether you do jigsaw puzzles or not, you probably at least understand the concept enough to know that if I just give you 13 random pieces from a 1,000-piece puzzle and you don't have access to the box to see what the finished puzzle is supposed to look like, it's relatively useless. That is essentially how a lot of threat intelligence works. Different organizations and security vendors each have visibility to gather information--but only from their own perspective and without knowing what the big picture is.

Maggie MacAlpine, Cyber Engagement Lead for the Center for Threat Informed Defense at MITRE Engenuity, joins me on this episode to talk about the things they are working on at MITRE. Prior to joining MITRE, she served as a security strategist for Cybereason (where we were coworkers). During her decade-long career focused on cybersecurity, she also co-founded the DEF CON Voting Village, served as a contributing researcher on the “Security Analysis of the Estonian Internet Voting System” (in partnership with the University of Michigan), and appeared in the HBO documentary, “Kill Chain”. She has discussed cybersecurity threats at numerous conferences including DEF CON, the Diana Initiative, ShmooCon Hacker Conference, and PacSec Tokyo, and she has presented on Capitol Hill and at the US Naval War College.

The project that Maggie is most excited by addresses this jigsaw puzzle dilemma. MITRE developed the Sightings Ecosystem to advance our collective ability to see threat activity across organizations, platforms, vendors, and geographic boundaries. With participating organizations sharing their set of pieces from the jigsaw puzzle, Sightings Ecosystem provides visibility into trending attacks and helps organizations understand which techniques should be a higher priority.

Check out the full episode for more about threat intel with Sightings Ecosystem and what's going on at MITRE Engenuity and the interesting tools they're working on at the Center for Threat Informed Defense. We also digress into a discussion of election security and why I am opposed to state sovereignty on various levels.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.