TechSpective Podcast

TechSpective Podcast Episode 125

 

Cybersecurity is cyclical. Over the past two decades that I have been working in and writing about security, the market has gone from an array of point solutions to consolidated "Swiss Army knife" platforms that do it all and back again. It seems like we are in a consolidation phase right now.

My friend Wolf Goerlich joins me on this episode of the TechSpective podcast to discuss the dynamics of the cybersecurity industry and the challenges organizations face. Wolf is an Advisory CISO with Cisco, bringing a wealth of experience and insight from his past endeavors consulting and establishing apprenticeships, security conferences, and communities. Wolf is widely respected as an ambassador of the industry--emphasizing support for both current and next-generation professionals in the cybersecurity field.

In the podcast, we talk about the ebb and flow of the cybersecurity market and how companies often spring up to solve very specific use cases that are valuable for organizations but often make more sense as a feature of a product or platform rather than a separate tool to implement and manage.

We also talk about the challenges CISOs face in balancing budgetary constraints and cybersecurity product selection to achieve the desired security outcomes and the role of strategic priorities in shaping an organization's cybersecurity product portfolio. Of course, we also have to talk about the "elephant in the room" (and crashing through the walls and dancing down the street): ransomware.

Check out the full episode for more on innovations and evolution in the cybersecurity space. Wolf and I--both being from the Detroit area--also discuss the triumphs and tragedies of Detroit sports teams and the amazing success of the Detroit Lions this season.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 124

 

The technology and cybersecurity markets have been a bit rocky over the past couple years. At least, that seems to be the general perception. Companies once on track to IPO have withered on the vine, and organizations of all sizes have laid off tens of thousands and scaled back initiatives to conserve capital in a rough economy. At the same time, though, there have been investments, and there have been mergers and acquisitions. New companies and technologies have emerged. It's not all gloom and doom.

Kate Burkhardt, VP at YL Ventures, joins me on this episode to talk about the state of the cybersecurity market--particularly as it relates to cybersecurity jobs, the prevailing belief that there are millions of unfilled roles, and the role of venture capital. We scrutinize the validity of the perceived skills shortage, considering how economic factors and job market dynamics might paint a different picture.

Our conversation also explores how AI is reshaping cybersecurity roles, emphasizing the importance of adapting to AI tools for enhanced productivity and job security. Finally, we touch on the global nature of cybersecurity challenges, reflecting on how geopolitical events and natural disasters can affect the industry and the necessity of having robust strategies to maintain business continuity.

Check out the full episode for more on the cybersecurity job market and perspective on the cybersecurity investment landscape. We also chat about the scourge of ransomware and the rise of more effective phishing attacks and whether there are companies or technologies on the horizon to provide more effective defense against these attacks.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 123

 

Customer experience is crucial for the success of a brand. However, it can be costly for a company to properly staff and train agents to address customer needs, and it is often a maddening exercise for customers seeking help. Generative AI may hold the key to solving both ends of that equation and delivering better results for both the company and the customers. Naomi Nuta, VP of Marketing at Cogito, joins this episode of the TechSpective Podcast to talk about the impact of AI on customer service and how brands can enhance and improve their competitive advantage by leveraging artificial intelligence tools.

Naomi first realized the value of emotion in communications through her work at Nielsen, where she helped establish a custom research organization that leveraged consumer neuroscience to help Fortune 100 consumer brands and media organizations produce emotionally resonant advertising. Before that, Naomi represented WPP’s BCW, a global communications agency, where she developed a foundational program to ensure that market research informed every client’s account strategy.

Check out the full episode for more on the power of artificial intelligence to enhance customer experience and strengthen a company brand. We also get into some of the (VERY) frustrating experiences of reaching out to customer service to troubleshoot an issue and being forced to walk through a flow chart of basic steps you've already tried twice by someone who knows far less than you do about the issue or technology in the first place. But, maybe that's just me.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 122

 

There are a number of steps involved in cyber threat analysis to review event information and determine which events are benign or innocuous and which are malicious--or at least deserve greater scrutiny. For the most part, it's not that it is exceptionally complex or difficult work. The issue is mostly a matter of scale. The sheer volume of security events generated makes the initial triage to flag the ones that need more attention and collect the peripheral information to provide the context necessary for effective investigation is a Sisyphean task.

It is an ideal scenario for employing AI. Machine Learning and Artificial Intelligence have been used for years to automate and streamline these sorts of tasks. Now, generative AI built on LLMs (Large Language Models) is transforming cybersecurity analysis. Anything that is routine and repeatable and can be clearly-defined should be automated with AI.

Adobe Security has developed a set of tools dubbed "Project Sherlock" to do just that. Tiberiu Boros and Radu Chivereanu, machine language engineers with Adobe Security, join the podcast to talk about 'Project Sherlock'--an internal Adobe project utilizing generative AI to streamline cyber threat analysis and incident response.

Check out the full episode for more on Adobe's "Project Sherlock." We also discuss the challenges facing organizations and developers around the volume and relevance of the data sets used to train large language models, and some of the issues with AI hallucination and the need to validate the responses provided from generative AI models.

The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 121

 

SBOMs (Software Bill of Materials) have gotten a lot of attention in the past year. Think of SBOMs as the ingredient list of software – a detailed catalog of every component, library, and module that constitutes a software product. This concept isn't just a fancy tech term; it's necessary in today's world, where software complexity resembles a vast, interconnected jigsaw puzzle. SBOMs bring transparency and clarity to this complex digital environment, much like how an architect relies on a detailed list of materials for constructing a building.

The need for SBOMs is more critical than ever, especially with the surge in open-source software usage. Vivek Bhandari, VP of Product Marketing for Tanium, joins this episode of the TechSpective podcast to emphasize this point. Vivek highlights how open-source components have revolutionized software development, allowing developers to pick and assemble code like ingredients in a recipe. However, he notes that this innovation also brings a heightened risk of vulnerabilities entering the software supply chain. Knowing the 'ingredients' of your applications isn't just useful; it's a vital aspect of cybersecurity, enabling quick identification and response to vulnerabilities.

Surprisingly, the adoption of SBOMs is still not widespread. Vivek points out that less than 20% of software-producing organizations in the United States currently create an SBOM. This statistic underscores the urgency for the tech community to embrace SBOMs as a standard practice.

Our discussion also covers the importance of real-time visibility in SBOMs. Unlike static lists, software components are dynamic; they change and update regularly. Therefore, an SBOM should be more like a live GPS than a static map, continuously monitoring and updating to provide real-time oversight. This aspect is crucial for maintaining cybersecurity resilience.

Whether you're just starting to explore the world of SBOMs or looking to deepen your understanding, this episode is for you. Stay tuned as we unravel the complexities of SBOMs with Vivek Bhandari and learn how to harness them for better cybersecurity resilience. Let's dive in!

Check out the full episode for more on SBOMs and how automation, context, and compliance play pivotal roles in this process, ensuring not just security but also adherence to industry standards and regulatory requirements.:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 120

 

Ads and commercials are a sort of "necessary evil." Aside from the NFL Super Bowl, I don't think anyone is ever anxious to see commercials--and even that has been trending toward more mundane and underwhelming ads for the last few years, in my opinion. Nobody really wants to see the ads, but the ads are what pays the bills and enables the content--which the audience does want--to be offered for free, or at least a lower cost, subsidized by the ad revenue.

The way society consumes media has also shifted dramatically, making traditional commercials and advertising less effective in many cases. In the "before times," TV shows aired serially on a given day and time, and there wasn't really any option to bypass the commercials. Of course, you could still skip them by using that time for a bathroom break or to grab a snack from the kitchen. Starting with the ability to record shows and watch them later--and simply fast forward through commercials or any other part you didn't care to watch--and evolving to streaming services like Netflix that empower the audience to binge watch entire seasons commercial-free in a single weekend, and content consumed via social media platforms like Tik Tok, the game has changed.

Omar Tawakol, CEO of Rembrand, joins this episode of the TechSpective Podcast to talk about trends in marketing and the concept of "Physics-Informed Generative AI," pioneered by Rembrand. Omar was previously CEO of Voicea--which was acquired by Cisco--and CEO of BlueKai--which was acquired by Oracle Data Cloud.

More specifically, we chat about how Rembrand is harnessing artificial intelligence (AI) to revolutionize the concept of product placement ads. Rembrand is able to leverage AI to virtually embed product placement in content after the fact. Not only does it streamline the production process, but it also enables a variety of possibilities that simply don't exist--or at least are highly impractical--with traditional advertising tools and processes.

Omar shared some links to clips that demonstrate the way Rembrand ads work within content:

BotezLive, Chess video with hot moments animation (L'Oreal)

Zane & Heath, Podcast (Virgin Galactic)

Digital Social Hour, Podcast (AWS)

Check out the full episode for more on trends in marketing and advertising, and the innovative ways that Rembrand is reshaping the process. The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer. The video is particularly useful for this episode of the podcast, because Omar shares some video clips to illustrate how Rembrand works and looks compared with traditional advertising methods:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 119

 

If you want to prevent threat actors from infiltrating or compromising your environment, it helps to see things from the threat actor perspective. This concept has been fundamental to cybersecurity for many years--whether it is penetration testing, red teaming, ethical hacking, or other angles. Whatever you call it, the notion is simple enough.

Bugcrowd more or less pioneered the idea of harnessing the collective power of ethical hackers to provide crowdsourced security-as-a-service for companies. Dave Gerry, CEO of Bugcrowd, and Casey Ellis, founder, chairman, and CTO of Bugcrowd, join the TechSpective Podcast to talk about trends in ethical hacking and crowdsourced security and key takeaways from their "Inside the Mind of a Hacker 2023" report.

Check out the full episode for more on ethical hacking and crowdsourced security. We also discuss the challenges of developing secure code, the cognitive bias of trying to analyze or review your own code, and why it's important to have third-parties take a look to find unique angles or holes you haven't--and to some extent simply can't--see. The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 118

 

"You can't protect what you can't see."

The first time someone said that, I am sure it was very profound. It is an obvious statement, but also very powerful in the context of cybersecurity. If you aren't even aware of the hardware assets connected to your network, or the software applications they are running, how can you possibly be aware of any vulnerabilities or weaknesses they may contain, and how could you take meaningful steps to reduce your exposure to risk?

Short answer: You can't.

That is why the mantra "You can't protect what you can't see" remains powerful despite being obvious, and even as it has attained buzzword hype status for cybersecurity vendors. Everyone claims to provide "complete" or "comprehensive" visibility at this point. However, there is another piece of the puzzle that is essential: context.

The founder and CEO of JupiterOne, Erkang Zheng, shares his thoughts on the importance of context. Visibility is important, but what is equally--or more--crucial is having context to go with the visibility. Knowing all of the hardware and software assets connected to your network--or even that your hardware and software interacts with beyond your network--is not very helpful if you don't also understand what those assets are doing and why, and how a compromise of those assets could impact your organization.

Check out the full episode for more on visibility and context for cybersecurity. Zheng and I also talk about the unique and innovative "Data Heist" events JupiterOne has been hosting around the country. The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 117

 

Cybersecurity used to be more of a mystical dark art, but over time, businesses and individuals have come to understand just how critical cybersecurity is, and cybersecurity professionals and vendors have recognized that they need to integrate with and facilitate business productivity rather than pushing security for the sake of security and creating unnecessary roadblocks for everyone. Thankfully, security culture is improving for many organizations.

Mike Halstead, Cybersecurity Sector Lead at Launch Consulting Group, joins me one this episode of the TechSpective Podcast to talk about cybersecurity trends and best practices. We also talk about the importance of security culture, and creating an environment where individuals understand that security is a business problem that applies to everyone, not just an IT issue.

Check out the full episode for more on current trends in security culture and cybersecurity, how to help C-suite executives recognize and avoid social engineering attacks, and more. The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.

TechSpective Podcast Episode 116

 

Getting hacked sucks in all scenarios. In most cases, though, getting hacked is an inconvenience. In some cases, it is deadly. Having your data stolen, or getting your computer bricked by ransomware is annoying. Getting a medical device like an insulin pump hacked might kill you.

Christopher Gates, Director of Product Security at Velentium, joins me on this episode to talk about medical device security and the differences between cybersecurity in general and securing medical devices or OT equipment in general. Chris notes, "Anything that is an operational technology--OT--means it has a real-world consequence to it. It's not a virtualized, 'They stole my identity,' 'They stole my money,' 'They prevented me from doing my business'--it has real-world consequences to it."

He would know, too. Christopher has built his career promoting the concepts of a security total product lifecycle--an approach designed to ease the burden on developers and ensure high-quality products that work as intended to save and improve lives without putting patients at risk. He co-authored "Medical Device Cybersecurity for Engineers and Manufacturers," and he has developed a student-paced certificate training program to instruct medical device engineers with the goal of elevating them to be experts in all aspects of medical device cybersecurity.

Check out the full episode for more on the security product lifecycle and the importance of baking security into embedded systems, OT equipment, and--crucially--medical devices. The podcast itself is audio-only, but the video of our conversation is also available on YouTube if you prefer:

Please ask questions and share your thoughts on the topic in the comments below. Also, please subscribe to the TechSpective Podcast through your favorite podcast platform and share the podcast with your peers and friends.

If you enjoy the podcast, I would also be grateful if you could take 2 minutes to rate and review the podcast on iTunes or wherever you listen.