The Security Strategist

In this podcast, Sascha Giese discusses the evolving role of AI in IT teams, addressing employee perceptions, the need for regulations, and the importance of collaboration between IT and AI teams. He emphasizes that while AI may replace some jobs, it will primarily transform existing roles. The discussion also highlights the necessity of observability in IT systems to optimize performance and ensure security.

Key Takeaways

• AI will replace some jobs, but transform most.
• AI needs to be supervised and trained.
• AI is more of an assistant than a replacement.
• There is a need for government regulation for AI.
• Tension exists between IT and AI teams due to communication breakdowns.
• AI can improve the efficiency of the whole IT organization.
• Tool consolidation is becoming more popular in IT.
• Losing business can happen in minutes without observability.

Chapters

00:00 Introduction to AI and IT Teams

06:10 Regulations and Guidelines for AI

11:52 The Importance of Collaboration in IT

17:46 Security and Observability in IT

The shift to cloud computing has transformed how businesses operate, offering unmatched flexibility, scalability, and cost efficiency. However, as organisations increasingly rely on the cloud, the attack surface for cyber threats has expanded significantly. 

Traditional security tools often struggle to keep up with the unique challenges of cloud environments, such as dynamic workloads, distributed systems, and multi-cloud configurations. This is where Cloud Detection and Response (CDR) becomes essential. CDR solutions are specifically designed to monitor cloud environments in real-time, identify potential threats, and provide swift responses to mitigate risks. 

The importance of CDR extends beyond just preventing breaches—it’s about safeguarding critical data, maintaining business continuity, and building trust with customers and stakeholders. With the rise of sophisticated attacks like ransomware and supply chain compromises targeting cloud infrastructure, having a comprehensive CDR strategy is no longer optional but a necessity.

In this episode, Aparna Sundararajan speaks to Mohit Bhasin, Senior Product Marketing Manager at Palo Alto Networks, about the importance of CDR and the need for a holistic approach to cybersecurity.

Key Takeaways: 

• Cloud security is essential for organisational success.
• Real-time protection is crucial to prevent attacks.
• Organisations need a unified approach to cloud security.
• Visibility and context are critical in security solutions.
• Proactive risk management is necessary in cloud environments.
• Security should be integrated into the development process.
• Automation can enhance security team efficiency.
• Security is an enabler of innovation, not a blocker.

Chapters: 

00:00 - Introduction to Cloud Detection and Response

02:55 - Understanding Cloud Detection and Response

05:46 - Real-Time Protection and Customer Insights

09:00 - The Future of Cloud Security

11:52 - Overrated and Underrated Aspects of CDR

14:46 - Final Thoughts on Cloud Security Strategy

Effective supply chain risk management is no longer optional—it is essential for long-term business success. Disruptions from natural disasters, geopolitical tensions, or unexpected global events like pandemics can ripple through even the most carefully planned supply chains. 

Companies that fail to anticipate and mitigate these risks can face costly delays, increased operational costs, and damaged reputations. By prioritising risk management, businesses can identify vulnerabilities, strengthen their supply chain resilience, and ensure that they can respond swiftly to unforeseen challenges.  

Proactively managing supply chain risk offers a competitive edge in an increasingly unpredictable marketplace. It allows businesses to build stronger relationships with suppliers, improve operational efficiency, and ensure continuity of service, even in times of crisis. Implementing strategies such as diversifying suppliers, leveraging technology for better visibility, and adopting flexible logistical models can help organisations stay agile and minimise potential disruptions. 

In this episode, Paulina Rios Maya, Head of Industry Relations, speaks to Haydn Brooks, CEO and Co-Founder of Risk Ledger, about third-party risk management and the best practices for organisations to enhance their security posture. 

Key Takeaways:

• Supply chains have become more interconnected, increasing exposure to cyber risks.
• Hackers target corporate supply chains for financial gain and geopolitical reasons.
• The attack surface has expanded significantly without corresponding security measures.
• Supply chain attacks can be untargeted or targeted, with different motivations.
• Developing security tools for supply chains is challenging due to complexity and the need for more visibility.
• Real-world examples like Target and SolarWinds illustrate the consequences of supply chain breaches.
• Neglecting third-party risk management can lead to reputational and operational impacts.
• Collaboration with suppliers is essential for a unified defence against cyber threats.

Chapters: 

00:00 - Introduction to Supply Chain Risk Management

01:51 - Understanding the Motivation Behind Supply Chain Attacks

04:39 - Challenges in Developing Security Tools for Supply Chains

06:37 - Real-World Consequences of Supply Chain Breaches

09:23 - The Importance of Third-Party Risk Management

11:18 - Best Practices for Enhancing Third-Party Risk Management

13:37 - The Role of Automation in Risk Management

15:04 - Creating a Unified Defense Strategy with Suppliers

Today, organisations face relentless cybersecurity threats, with phishing attacks and poor password management leading the charge. These vulnerabilities can result in data breaches, financial losses, and reputational damage, making them a top concern for businesses of all sizes. Despite technological advances, many organisations struggle to keep up with increasingly sophisticated phishing techniques and the risks of weak or reused passwords. 

Addressing these challenges requires more than cookie-cutter solutions—it demands a holistic approach to cybersecurity that encompasses technology, employee education, and robust policy enforcement.  

The stakes are exceptionally high for small and medium-sized enterprises (SMEs). Cybercriminals often target SMEs, perceiving them as less prepared to fend off attacks. Implementing effective cybersecurity measures doesn’t have to be overwhelming or costly, but it does require understanding the risks and taking proactive steps to mitigate them. 

In this episode, Paulina Rios Maya, Head of Industry Relations, speaks to Steven Furnell, IEEE senior member and professor of cybersecurity at the University of Nottingham. 

Key Takeaways: 

• Cybersecurity posture shows little improvement year over year.
• Phishing remains the most reported cybersecurity threat.
• Community support is vital for SMEs in cybersecurity.
• Transitioning to passwordless solutions is underway but not complete.
• Biometric data should be stored securely on user devices.
• Usability must be balanced with security in technology development.
• Deepfake technology presents new challenges for biometric systems.

Chapters: 

00:00 - Introduction to Cybersecurity Insights

01:27 - Current Cybersecurity Posture and Challenges

03:23 - Phishing and Common Cybersecurity Threats

07:09 - Supporting Small and Medium Enterprises

10:56 - Transitioning to a Passwordless Future

17:16 - Biometric Security and Its Challenges

Governments and institutions face unprecedented cyber threats challenging national infrastructure, sensitive data security, and public services. To stay ahead in emerging risks, organisations must adopt cutting-edge tools that enable proactive preparation and robust defence strategies against these risks.

Cyber ranges and digital twins are revolutionising cybersecurity by offering highly effective methods for simulating real-world attacks, testing security protocols, and providing predictive insights into potential vulnerabilities. These tools provide a safe, controlled environment for teams to practice and refine their response strategies, ensuring they can confidently tackle sophisticated cyber threats.

Cyber ranges create realistic virtual environments that mimic complex network infrastructures, enabling security teams to engage in hands-on training exercises and test their systems under simulated attack scenarios. Meanwhile, digital twins—virtual replicas of physical systems—allow for continuous monitoring and real-time analysis of critical infrastructure. 

In this episode, Paulina Rios Maya, Head of Industry Relations, speaks to Aare Reintam, COO of CybExer Technologies, about their NATO-award-winning cyber ranges. 

Key Takeaways: 

• Cyber ranges are essential for simulating real-world cyber attacks.
• Digital twins provide a safe environment for testing and learning.
• AI can enhance both offensive and defensive cybersecurity strategies.
• Regular participation in cyber ranges improves team readiness.
• Understanding interdependencies in critical infrastructure is vital.
• Proactive measures are necessary to address cybersecurity weaknesses.

Chapters: 

00:00 - Introduction to Cyber Ranges and Digital Twins

02:50 - The Role of Cyber Ranges in Cybersecurity Training

05:45 - Digital Twins: Enhancing Cybersecurity Simulations

09:06 - Adapting to Evolving Cyber Threats

12:01 - AI and Machine Learning in Cyber Ranges

14:57 - Long-term Implications of Cyber Ranges for Organizations

17:52 - Best Practices for Cyber Range Participation

21:04 - The Importance of Continuous Training for Governments

23:57 - Conclusion and Resources

Digital risk protection has become a cornerstone of organisational security. Proactive measures are essential to defend against cyber risks, from safeguarding sensitive data to mitigating external threats. Businesses must move beyond traditional cybersecurity approaches, embracing holistic digital risk strategies that protect their reputation, assets, and customers. Organisations can create resilient systems that adapt to today’s complexities by anticipating risks rather than merely reacting to them. 

However, adequate digital risk protection isn’t just about technology—it requires a cultural shift. Fostering a security-first mindset means embedding security practices into every level of an organisation, from executive leadership to front-line employees. This cultural evolution goes hand in hand with compliance, as businesses align their strategies with ever-changing regulations. 

In this episode, Paulina Rios Maya, Head of Industry Relations, speaks to Scott Walker, Cyber Security Incident Response Team manager at Orange Cyberdefense, about the continuous nature of cybersecurity efforts, highlighting the thrill and challenges of incident response.

Key Takeaways: 

• Digital risk protection is essential for organisations.
• Cultural shifts are necessary for effective cybersecurity compliance.
• Honesty in reporting incidents is crucial for effective response.
• Real-time metrics are vital for measuring cybersecurity effectiveness.
• Community support can help smaller businesses improve security.
• Incident response is a dynamic and exciting field.
• Understanding past threats helps in preparing for future ones.

Chapters:

00:00 - From Military to Cybersecurity: Scott Walker's Journey

01:24 - The Importance of Digital Risk Protection

05:41 - Cultural Shifts in Cybersecurity Compliance

09:00 - Building a Culture of Honesty in Cybersecurity

10:54 - The Role of Real-Time Metrics in Cyber Defense

13:41 - Community Support in Cybersecurity

15:34 - Emerging Threats: AI and Cybersecurity Resilience

19:35 - The Thrill of Incident Response

Understanding human behaviour is critical in creating secure environments, as human actions, decisions, and vulnerabilities often determine the effectiveness of security measures. By prioritising behavioural insights, organisations can anticipate potential threats and design systems that align with how people naturally act and interact. 

Discussing the psychological drivers behind employee behaviour helps uncover why individuals may unknowingly bypass security protocols, highlighting the importance of addressing root causes rather than merely enforcing rules.  

Security isn’t just about preventing incidents; it’s about cultivating a culture where individuals are empowered to make informed decisions. This involves fostering a "just culture," where employees feel safe reporting mistakes without fear of punishment, enabling continuous improvement. By focusing on trust, transparency, and education, organisations can instil a security-first mindset across their workforce. 

In this episode, Paulina Rios Maya, Head of Industry Relations, speaks to John Scott, Lead Cyber Security Researcher at CultureAI, about building trust and responsibility within security culture to mitigate cyber risks effectively.

Key Takeaways: 

• Understanding human behaviour is crucial for security.
• Human errors are inevitable; organisations must accept this.
• A ‘just culture’ is essential for a secure environment.
• Leadership must model security behaviours.
• Security should be seen as everyone's responsibility.
• Simplifying reporting processes encourages engagement.
• Fostering secure behaviour at home enhances workplace security.

Chapters: 

00:00 - Understanding Human Behavior in Security

05:15 - The Role of Psychological Drivers

10:55 - Fostering a Security-First Mindset

17:32 - Bridging the Generational Gap in Security Awareness

25:30 - Building Trust and Responsibility in Security Culture

Hackers today rely on sophisticated techniques to collect information about their targets, combining digital stealth, social engineering, and data mining to get ahead. From scouring social media profiles to exploiting publicly available data, attackers gather intelligence that helps them pinpoint vulnerabilities and personalise attacks. Every detail—personal photos, company affiliations, online connections—can provide valuable clues for hackers, helping them craft realistic phishing attempts, exploit system weaknesses, or impersonate trusted contacts. 

Understanding how hackers operate is the first line of defence in protecting your personal and business information. By exploring the methods hackers use, such as network reconnaissance, dark web monitoring, and social profiling, individuals and companies can recognise potential threats before they escalate. Awareness is power, and by knowing how hackers collect intelligence, you can adopt strategies to reduce your digital footprint, secure sensitive data, and stay one step ahead. 

In this episode, Alejandro Leal, Analyst at KuppingerCole speaks to Arik Atar, Senior Threat Intelligence Researcher at Radware, about the increasing sophistication of attacks, especially during the holiday season. 

Key Takeaways: 

• Threat actors are opportunists, targeting based on available information.
• Social media is a significant source of personal information for attackers.
• Holiday seasons see a spike in cyber attacks due to increased online activity.
• Using separate emails for different services can minimise risk.
• Regularly check privacy settings on social media and apps.
• Avoid saving passwords in web browsers for better security.
• Be cautious of seemingly legitimate offers that may involve stolen accounts.

Chapters: 

00:00 - Understanding Threat Actors' Motivations

02:27 - The Role of Social Media in Cybersecurity

05:44 - Evolution of Threat Actor Behavior

09:32 - Anticipating Holiday Season Cyber Threats

12:52 - Future-Proofing Your Digital Security

As Chinese electric vehicles (EVs) rapidly gain market share across Europe, cybersecurity has become a key focus for regulators, manufacturers, and consumers alike. These advanced vehicles, packed with digital features and data-driven capabilities, also bring new cybersecurity challenges. With sophisticated connectivity features, onboard software, and data collection systems, the risk of cyber vulnerabilities is heightened, raising questions about data privacy, vehicle security, and the integrity of critical infrastructure. 

The intersection of cybersecurity and the influx of Chinese EVs requires strict data protection standards, secure software protocols, and collaboration across the automotive and tech industries. European markets increasingly prioritise transparency and rigorous testing to ensure these vehicles meet robust cybersecurity standards. By addressing these challenges, Europe can continue to embrace the electric future with confidence, ensuring that cutting-edge technology goes hand-in-hand with safety and security for all.

In this episode, Paulina Rios Maya, Head of Industry Relations, speaks to Gianni Cuozzo, founder and CEO of Exein, about  the evolution of the automotive industry, the competitive landscape shaped by Chinese manufacturers, and the cybersecurity risks associated with connected technologies in EVs

Key Takeaways: 

• EVs are fundamentally IoT systems on wheels.
• The automotive industry has evolved from mechanical to digital to connected vehicles.
• Chinese EVs are reshaping the competitive landscape in Europe.
• The Cyber Resilience Act aims to enforce security standards for manufacturers.
• Firmware updates can introduce new vulnerabilities post-certification.
• The automotive supply chain must adhere to new security regulations.
• Innovation in EVs must be balanced with robust security measures.

Chapters: 

00:00 - Introduction to Cybersecurity and EVs

02:58 - The Evolution of the Automotive Industry

05:52 - Impact of Chinese EVs on European Market

09:06 - Cybersecurity Risks of Connected EVs

12:52 - The Cyber Resilience Act and Its Implications

17:03 - Navigating Innovation and Security in EVs

With cloud attacks rising, Cloud Detection and Response (CDR) is becoming a crucial focus in modern security operations. But what exactly is CDR, and how does it fit alongside other advanced security solutions like XDR? Just as Security Operations Centers (SOCs) defend the enterprise network, they now must extend their defences to the cloud, ensuring threats are detected and addressed in real time. 

However, many organisations still rely heavily on Posture Management and "Shift Left" strategies to secure their cloud. While effective, these approaches leave gaps in protection, especially against modern attack methods. There's often an assumption that cloud security is entirely handled by the Cloud Service Provider (CSP), which leads to critical oversights. 

Recent research reveals that traditional security measures often miss threats like runtime attacks and identity mismanagement. In this episode, Chris Steffen, EMA's Vice President of Research, speaks to Nathaniel "Q" Quist, Palo Alto's Cloud Threat Intelligence Manager, to discuss CDR and its benefits. 

Key Takeaways: 

• Understanding the shared responsibility model is crucial for organisations.
• Misconfigurations are a leading cause of cloud security breaches.
• Ransomware attacks in the cloud behave differently than on-premises.
• Identity access management is a primary target for attackers.
• Visibility and telemetry are essential to effective security operations.
• Hard-coded credentials pose significant risks in cloud environments.

Chapters

00:00 - Introduction to Cloud Detection and Response

02:56 - Understanding the Shared Responsibility Model

05:47 - Cloud Security Posture Management and Its Importance

09:07 - Real-World Scenarios in Cloud Security

11:53 - The Evolution of Cybersecurity Technologies

15:13 - Key Security Gaps in Cloud Environment