Howdy, y'all!  Allan went down to Orlando, Florida and recorded three LIVE! shows at Zero Trust World, a conference sponsored by ThreatLocker.  This is the first of those three shows.

James Keeler of LMT Technology Solutions has a steady hand on the incident response wheel and a lot of experience under his belt as well.  After seeing James speak on a panel at Zero Trust World, Allan asked him to be on the show.

Join Allan as he asks James to walk us through his philosophy of incident response, the underpinnings, the steps and just about everything else about Incident Response as well.

This show is sponsored by our good friends at ThreatLocker - visit https://threatlocker.com and tell them you heard about them down here at the 'Ranch!

This week Allan is joined by Leigh Honeywell (CEO of Tall Poppy) Nathan Case (Federal CISO at Snyk), and Ryan Macababbad (Currently looking.  HIRE HER!), three cybersecurity professionals with broad backgrounds in cyber, and all three of whom are neurodivergent.

Allan in fact, has been recently diagnosed as being on the autism spectrum, albeit 'high functioning' (as the diagnosis indicates) or 'low support needed' (as the autism community prefers to call it).

With his recent diagnosis, Allan decided to reach out to friends in the neurodiverse community to discuss:

1. The positives of neurodivergence

Fun fact:  There are more vulnerabilities and exploits below the OS layer than above it!

CPUs, BIOS, Firmware, embedded Linux, FPGAs, UEFI, PXE...  The list goes on an on.  What are we supposed to do about that?

Allan asked Yuriy to come down to the 'Ranch to discuss this issue with him.  Yuriy is CEO at Eclypsium, member of the Forbes Technology Counsel, Founder of the open source CHIPSEC project, former head of Threat Research at McAfee, form Senior Principle Engineer at Intel…  He is uniquely qualified to discuss these issues.

Full DISCLAIMER: Allan is CISO at Eclypsium.  Note that he asked Yuriy to come on the show, not the other way around.  Nobody knows this space like Yuriy and his team.

Allan asks Yuriy about:

• The history of CPU exploits

It's an eye-opening show to say the least.

Y'all be good now!

In this episode, Allan flies solo, as he is finally willing to speak on an issue he has been mulling and fussing over for some time:  the two-fold CISO laments of:

• "We have all the accountability and none of the authority!"

Allan is refuting both of these claims.

Allan calls up examples such as project managers, contract lawyers, CFOs in his argument.

He also demonstrates that we have far more authority than we think, and also that we can earn even more.

As to advising the business, and the business owning the risk, we have here two contradictions to one of the show's mantras: "BE the business!"

You will hopefully come away from this show with some different perspectives on these two claims.

Y'all be good now! 

We declared a while back that 'not having a seat at the table' was a tired CISO topic.  So we decided to solution the complaint.

Hopefully we pulled it off.

Join Allan and Jim McConnell, Principal at Ask McConnell, LLC and former Fellow in Corporate Security Protection Operations at Verizon, as they take on the challenge of solving this common lament.

There is a fierce round of "answer pong" as they throw out suggestions on how to earn that seat, but they also cover:

• What does it mean to have a seat at the table?

And of course, the aforementioned game of Answer Pong as to how to earn that seat.

Y'all enjoy the show, and y'all be good now!

Pat Benoit, CISO at Brinks, returns to the 'Ranch to visit Allan and to chat about his newest achievement - Pat got a NACD Directorship Certification!

Allan has often thought about doing this as well, so he got Pat on the mic to talk about his whole experience:

1. Why did you do it?

As topics for shows go, this one is short and sweet.  But Pat, as always, spins a very human tale that will keep you engaged.

Y'all be good now!

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  Our guest is Ayman Elsawah, who, like Allan these days, is a fractional CISO and founder of his own security company.  He has done the fractional CISO thing many times.  He has also been a professor, a security consultant, and a cloud-specific security consultant.  His tenure includes eBay, NCC Group, Justworks and Masterclass.  Ayman and Allan are talking about how cybersecurity teams can integrate themselves with the rest of the business.

1. So we talk about the role of the CISO in business enablement all the time. Allan argues, based on the wise words of Scott McCool, a friend and mentor, that we are not here to enable the business.  Rather we are here to BE the business.  The distinction is that enablement still puts the CISO off to the side of the goings on.  Being the business means that the CISO is part of the process, in there with sleeves rolled up alongside CRO, CMO, CFO, CEO, COO, etc.  So let’s ask the question twice:

1. In a B2B context, what are three things a CISO can do to enable the business?

1. Presumably one of these involves being part of the sales cycle?

Y'all be good now!

This one was recorded LIVE! in Podcast Alley at the CyberMarketingCon 2023 put on by the Cybersecurity Marketing Society in Austin, Texas.

Marketing!?!!?  Say what!?!?

Yup!  Allan went down to Austin to catch up with industry players and to participate in the conference as a "creator", i.e., podcaster.

While there Allan ran into his friend Tom LeDuc, CMO at Semperis, and he got Tom to hop on the mic with him to discuss leadership challenges such as conflict, territorialism, jurisdictional disputes, startup mindset vs. bigger mindset...  The two of them cover quite a lot of territory.

Some of Tom's story is obviously CMO-specific, but Allan and Tom both universalize the topics and get to the heart of what matters for all leaders.

This show is not sponsored by Semperis, but Allan wants to clarify and be transparent about the fact that he is an advisor to Semperis.

Allan says: "Tom is just a great guy and is fun on the mic!"

Y'all be good now!

Howdy, y’all, and welcome to The Cyber Ranch Podcast! Our guest this week is John Checco, aka "Checco", who is overdue for being on the show we freely admit!  John is a presence on LinkedIn and in our industry.  He’s the author of “Zero Trust: From Aspirational to Overdue”.  He’s also involved, as you can imagine, in many other things – various advisory roles, ISSA roles, Infraguard roles…  He’s been resident CISO at Proofpoint, for example.  He’s also a fire instructor!  But we asked John to the show specifically to talk about what he calls “The Misfits of Zero Trust”.  John, thank you so much for coming on down to the ‘Ranch!

Questions Allan asks John:

1. Without revealing any secrets, what was your experience investigating the Zero Trust model for such a large organization?

Thank you, listeners, for dropping by the 'Ranch!  Y'all be good now!