teissPodcast - Cracking Cyber Security

On this week’s teiss Security Leaders Roundtable Podcast - Thom Langford, Founder of (TL)2 Security Ltd and Javvad Malik, Security Awareness Advocate at KnowBe4, discuss cyber security news stories such as organisations failing to maximize use of Microsoft 365 security, the “people” element in a cyber security strategy, and fake voicemail alerts in suspected whaling campaigns.

I hope you enjoy the themes and the all-round bantz.
Music: Light the Fuze, Audio Network and Natural Duality, Joseph McDade

This week we are exploring the weird world of deepfakes - one of the latest ways cybercriminals are exploiting people and making money. Put simplistically, the term “deepfake” refers to an image, video, or audio clip that is manipulated using artificial intelligence and deep learning to depict something that did not really happen. 

On this week’s episode, we have two experts tackling the topic, first from a tech perspective - Andrzej Kawalec, Director of strategy and technology at Optiv, who explains how criminals are using deepfakes to their advantage, how companies should start to think about them, and what tech is developing in the arena to combat the threat. My second guest is Tamara Quinn a non-contentious IP and Data Privacy Partner at Osborne Clarke, who shares a legal perspective on the topic. 

According to the National Crime Agency more than 2,500 arrests were made last year in the UK, after Facebook reported offenders for trying to entice children into sharing indecent images or meeting in real life.

Today’s children and teenagers have grown up in the online world, and with all its benefits, these arrests are proof of the darker side of the digital space. So how can we better our children and teenagers online?

On this week’s teissPodcast I had the honour of speaking with Lorin LaFave, the mother of Breck Bednar, who was murdered in 2014 after being groomed online. Two weeks after her son’s murder, Lorin set up the Breck Foundation to educate young people and their parents about online grooming and internet safety.

In the interview, Lorin talks about the misconceptions about online grooming, what measures she would like to see put in place when it comes to security by design for products and games and what she feels the cyber security industry could be doing to improve internet safety.

Do watch Breck’s Last Game; it's a tragic, powerful and important story. Details about the Breck Foundation Ball can be found here.

Apparently there’s an election on December 12th, so on this teissPodcast we’re exploring which cyber threats are going to impact the upcoming UK election.

Our expert guest this week is Priscilla Moriuchi, director of strategic threat intelligence at Recorded Future, who’s researched the security threats facing elections globally, with a large focus on disinformation campaigns.  

On the podcast Priscilla discusses the tactics hackers are using to target elections, whether political micro-targeting can really impact election results and what the security world can learn from election campaigns.  

Red teaming is one of the most fascinating activities an ethical hacker can be involved in. The practice usually involves an independent group that assumes the role of a hacker to show organisations what vulnerabilities or backdoors pose a threat to their cyber security. Sounds like every organisation should employ one…but is it always necessary? And if so, how do you know if your organisation is ready for red teaming? 

On this episode of the teissPodcast I speak with Ed Williams, EMEA director at SpiderLabs, Trustwave, about red teaming and deciding when is the right time for an organisation to engage a red team. Ed, a patriotic Welshman and ardent rugby enthusiast, explains some common tactics hackers use to manipulate people, where red teaming should sit in the overall cyber security strategy and how can cyber maturity be achieved through red teaming.

We are told that the expected cyber skills shortage is estimated to be 1.8 million by 2022 and yet just 12% of the cybersecurity workforce is under the age of 35.

This week I speak with Mark Walmsley, CISO, Freshfields, about finding, nurturing and growing the next generation of cyber talent. 

Mark has a wealth of knowledge and experience in sourcing and recruiting talent – particularly in the more untraditional places – so I asked him about where and from what age the search should begin, what it takes to motivate young people, and what the industry should be doing to increase its talent pipeline.

Mark will be speaking at Cyber Security Connect UK.

There’s a saying that culture trumps strategy every time, but how do you build a strong, positive culture in the first place?

I caught up with Steve Moore, VP and Chief Security Strategist at Exabeam. Steve’s been on the podcast before and it’s always inspiring to hear his thoughts on leadership, nurturing talent and creating a culture which allows people to grow and thrive in their roles. 

Easy right? Steve highlights some approaches which can help. He also mentions Exambeam’s recent Cybersecurity Salary Survey which is worth a read.

Check out Steve’s podcast The New CISO!

Interview recorded at the Exabeam user conference, San Francisco, earlier this year. 

Welcome to the Security Leaders’ Roundtable Podcast, where I am joined by two exceptionally talented CISOs, Brian Brackenborough, CISO of a major broadcaster and Nick Nagle, CISO of the Publishing House, Conde Nast International. 

On this podcast, recorded in July 2019, I asked them to bring two cyber security news stories to the table, as well as a “grudging respect” – a story/hack/response to a breach which deserves a tip of the hat. 

Brian selected the story about the ICO intending to fine British Airways £183.39M for breaches of data protection law. Nick chose one on the anonymous hacker who was arrested after dropping a USB stick while throwing a Molotov cocktail, as you do.

Brian’s “grudging respect” (though not so much grudging, but more pure respect) was for the digital bank Monzo and how they responded to the Ticketmaster and BA breaches. 

Nick’s contribution was about a fake French minister in a silicone mask who stole millions. True story.

Hope you enjoy the discussion.

Whether it’s external threats to an organisation or bracing personal challenges, how do you respond to the unknown unknowns? Well fortunately our guest this week, Colin Anderson, CISO at Levi Strauss & Co, has had much experience in this realm.

I had the opportunity to speak with him at the Exabeam user conference in San Francisco last week where we spoke about his leadership style, how he forms partnerships and support from within the board and whether cyber security can be measured in numbers alone.

And…yes, he only wears Levi’s.

What can we learn from the way cybercriminals recruit and train people in their networks to help us with our own cyber security skills shortage? 

On this podcast we are visiting the dark side of the moon with teissPodcast friend and regular, Joe Carson, Chief Security Scientist & Advisory CISO at Thycotic. We explore how criminals recruit and train people in their network and how quickly can they take someone with no experience and coach them to be a functional member of their team. Essentially, with ethics in mind, what could we learn and even copy from them?