The Security Strategist

The most dangerous cyber attacks today have one thing in common: they target humans rather than systems. Social engineering has been a prevalent tactic for years, with a known $51B in exposed losses over the last decade. Unfortunately, these numbers will continue to rise with the proliferation of AI, and your email inboxes are your most likely target.

Abnormal Security takes a different approach to email security, understanding human behavior to protect human vulnerabilities. By baselining known behavior, the platform can understand when anomalous activity occurs and block attacks—even when these threats are text-based emails with no traditional indicators of compromise.

In this episode of the EM360 Podcast, Chris Steffen VP of Research at EMA speaks to  Leach, Field CISO at Abnormal Security, to discuss:

• AI 
• Social Engineering 
• Human behavior 
• Security Culture

Hackers use AI tools like ChatGPT to enhance their operations and manipulate large language models. They infiltrate and attack GPT by manipulating the knowledge base through coordinated bot activity. 

These sophisticated cybercriminals are not just using AI tools, they are leveraging them to streamline their attacks. By exploiting the model's natural language processing capabilities, they can craft convincing phishing emails, generate fake news articles, and even create highly realistic deepfake videos. 

With the ability to mimic human speech patterns and convincingly generate text, these AI-enhanced attacks pose a significant and immediate challenge for cybersecurity professionals worldwide. As the arms race between hackers and defenders escalates, experts stress the urgent need for developing robust defences and staying vigilant against these evolving threats in the digital landscape. 

In this episode of the EM360 Podcast, Alejandro Leal, Analyst at KuppingerCole speaks to Arik Atar, Senior Threat Intelligence Researcher at Radware, to discuss: 

• Hacker infiltration 
• GPT Capabilities 
• Operational needs 
• Hacker skill development 

The trend of platformization in the Security Operations Centre (SOC) is a game-changer in the cybersecurity landscape. It offers a holistic approach to managing and mitigating security threats. By consolidating various security tools, processes, and data sources into a unified platform, organizations can streamline operations, reduce complexity, and significantly enhance overall security outcomes. 

Platformization, as demonstrated by solutions like Palo Alto's XDR platform, is a powerful tool for SOC teams. It enables them to efficiently correlate and analyse vast amounts of security data in real-time, leading to quicker detection and response to threats. With advanced analytics, machine learning, and automation seamlessly integrated, platforms like XDR empower SOC analysts to focus on higher-value tasks, such as proactive threat hunting and strategic decision-making. 

In this episode of the EM360 Podcast, Brad LaPorte, Advisor at Lionfish Tech Advisors, speaks to Dan Flaherty, Senior Product Marketing Manager at Palo Alto Networks, to discuss:

• Why security tool consolidation is happening now
• Platformization for the SOC
• How to approach onboarding a platform like Palo Alto Networks Cortex XDR'

Interested in learning more about XDR and Palo Alto Networks? You can find some additional resources below:

• Break free from legacy endpoint solutions
• A Comprehensive Guide to the 2023 MITRE Engenuity ATT&CK Evaluations
• Palo Alto Networks named a Leader by Gartner® for Cortex XDR.

• 00:00 - Introduction
• 01:39 - Defining Platformization and its Benefits
• 08:16 - Downsides of Implementing Multiple Tools
• 09:14 - Advantages of Platformization
• 29:27 - Platformization as a Solution for Security Challenges
• 31:24 - Conclusion

The alarming rate of violence against healthcare workers underscores the urgent need for comprehensive security measures within medical facilities. As incidents continue to rise, it's imperative that proactive strategies are employed to safeguard the well-being of patients, visitors and staff. 

In this episode of the EM360 Podcast, Paulina Rios Maya speaks to Sheila Cook, Chief Experience Officer at the University of Illinois Hospital & Health Science System and Clete Bourdeaux, Healthcare Business Development Director for HID’s workforce identity management unit, to discuss: 

• Workplace violence
• Evolution of security protocols within medical facilities
• Healthcare security

GenAI has revolutionized the landscape of information security. Once reserved for experts and Ph. D.s, it is now accessible to a broader spectrum of practitioners and engineers. Its applications span from summarising data to tailoring reports, amplifying incident response, and profiling user behaviours. 

By harnessing the power of generative AI, security professionals can navigate complex datasets with enhanced efficiency and precision. The importance of continuously updating AI models with fresh data cannot be overstated. It is this constant evolution that ensures the relevance and efficacy of GenAI in the face of ever-changing security challenges. As GenAI continues to advance, it holds the promise of redefining the future of security operations, ushering in an era of proactive defence and adaptive strategies against emerging threats.

In this episode of the EM360 Podcast, Chris Steffen VP of Research at EMA speaks to Jimmy Astle, Senior Director of Detection Enablement at Red Canary, to discuss: 

• GenAI 
• Uses of GenAI 
• Training of AI 
• Automation in security operations

GenAI has revolutionized the landscape of information security. Once reserved for experts and Ph. D.s, it is now accessible to a broader spectrum of practitioners and engineers. Its applications span from summarising data to tailoring reports, amplifying incident response, and profiling user behaviours. 

By harnessing the power of generative AI, security professionals can navigate complex datasets with enhanced efficiency and precision. The importance of continuously updating AI models with fresh data cannot be overstated. It is this constant evolution that ensures the relevance and efficacy of GenAI in the face of ever-changing security challenges. As GenAI continues to advance, it holds the promise of redefining the future of security operations, ushering in an era of proactive defence and adaptive strategies against emerging threats.

In this episode of the EM360 Podcast, Chris Steffen VP of Research at EMA speaks to Jimmy Astle, Senior Director of Detection Enablement at Red Canary, to discuss: 

• GenAI 
• Uses of GenAI 
• Training of AI 
• Automation in security operations

The sheer volume and diversity of data available to organisations today offer numerous opportunities for innovation, efficiency gains, and informed decision-making. However, this abundance of data also brings with it formidable challenges, particularly concerning privacy, security, and ethical considerations.

Data is often described as new oil, so safeguarding its integrity and protecting it from unauthorised access or misuse has become paramount. Data breaches and cyberattacks have become all too common, underscoring the critical need for robust security measures and vigilant oversight. Organisations can benefit from leveraging advanced cybersecurity solutions offered by platforms like Cyera to address these challenges. 

In this episode of the EM360 Podcast, Richard Stiennon, Chief Research Analyst at IT-Harvest, speaks to Emily Heath, General Partner of VC firm Cyberstarts and former CISO of United Airlines and DocuSign, to discuss:  

• Data security 
• CISOs and compliance
• Data classification practices 
• Data classification and AI 
• The future of data security with AI

Gone are the days of merely safeguarding school computers! Censornet, a rising star in the tech industry, has undergone a remarkable transformation. From its roots as an internet security provider for educators, it has emerged as a trailblazing force in digital risk management. 

Today, Censornet offers a comprehensive suite of tools designed to confront the dynamic challenges of the digital landscape, ensuring a safer and more secure online environment for all. This evolution stems from recognising that traditional threats are no longer the sole concern. With the proliferation of Shadow IT, unauthorised applications and devices, and the rise of insider threats, organisations face a complex array of risks. 

In this episode of the EM360 Podcast, Jonathan Care, Advisor at Lionfish Tech Advisors, speaks to Gareth Lockwood, VP of Product at Censornet, to discuss:

• Inspiration behind Censornet 
• Censornet’s Capabilities 
• Censornet’s Clients 
• Shadow-IT 
• Prevention of future vulnerabilities with AI and Censornet

Amid the ever-evolving landscape of cyber threats, organisations are constantly challenged to ensure security. Conventional security methods are failing to keep up with the escalating volume and sophistication of attacks. By implementing Managed Detection and Response (MDR) with automation, Security Operations Centers (SOCs) can optimise workflows, augment analyst capabilities, and significantly enhance the organisation's overall cybersecurity defences. 

Palo Alto Networks offers comprehensive MDR services, leveraging its threat intelligence and cutting-edge technology expertise. Unit 42, its esteemed threat intelligence team, is crucial in providing valuable insights into emerging threats and trends, empowering organisations to stay ahead of malicious actors. 

In this episode of the EM360 Podcast, Richard Stiennon, Chief Research Analyst at IT-Harvest, speaks to Ophir Karako, Software Engineer (Unit 42) at Palo Alto Networks, to discuss: 

• Palo Alto’s MDR Services 
• Operational Automation 
• Data Enrichment
• Threat Response 
• Job security for SOC Analysts 

Interested in learning more about XSOAR and Palo Alto Networks? You can find some additional resources below:

• Enloe Medical Center Strengthens Its Security Posture and Improves Efficiency With Unit 42 MDR
• Unit 42 Managed Detection and Response Service Datasheet
• A Practical Guide to Deploying SecOps Automation

00:00 - Introduction and Background

00:57 - MDR Services at Palo Alto Networks

03:20 - Automation in Operations

04:16  - Automating Data Enrichment

05:13  - Intellectual Property Playbooks and Scripts

05:41 - Customized Reports for Customers

06:10 - Automated Threat Response

07:08 - Insights and Lessons Learned from Automation

07:37 - Benefits of Automation for SOC Analysts

08:06 - Collaboration with Product Experts

09:04 - Treating Automation as a CI/CD Process

10:01 - The Future of Automation in Cybersecurity

12:51  - Automation and Job Security for SOC Analysts

14:20 - Cortex XSOAR: Security Orchestration, Automation, and Response Platform

15:46 - Unit 42 MDR Service

16:16 - Conclusion

The SolarWinds breach exposed vulnerabilities within DevSecOps practices, sending shockwaves through the tech world. 

The U.S. Securities and Exchange Commission (SEC) indictment against SolarWinds further emphasised the gravity of the situation, alleging the company misled investors by failing to disclose these vulnerabilities and the subsequent breach adequately. 

This lack of transparency raises crucial questions about accountability and risk management in the mobile app development landscape, pushing organisations to re-evaluate their DevSecOps practices and prioritise robust security measures throughout the entire development lifecycle.

In this episode of the EM360 Podcast, Head of Podcast Production Paulina Rios Maya speaks to Richard Stiennon, Chief Research Analyst at IT-Harvest, and Tom Tovar, CEO and Co-Creator of Appdome, to discuss: 

• The SolarWinds indictment 
• The U.S. SEC 4-day rule
• The impact on DevSecOps practices
• BYOD and VPN security 
• The evolving role of cybersecurity
• Building cyber resilience