The Well Aware Security Show

Everyone talks about Cybersecurity Culture, but if you asked 100 people for a definition, you'd probably get 200 answers. Which is why this week we're talking to Dr. Keri Pearlson, Executive Director of the research group Cybersecurity at MIT Sloan (CAMS) who has focused her research around cybersecurity culture at organizations across the globe. 

Want to know how to get started in your cybersecurity career? Want to hire some of those people getting started in cybersecurity? We asked our guest this week, Zach Vinduska US CISO for Credera, what we can do differently about recruiting the next generation of security talent and how we can sustain their careers for the next 30 years.

You may have heard of the MITRE ATT&CK framework, which helps network defenders understand the methods attackers use to penetrate networks. But have you heard of ENGAGE? This week, we welcome back MITRE's chief mad scientist for deception, Dr. Stanley Barr, who talks about how MITRE is engaging the community to create a framework help defenders disrupt adversaries.

"No security person really works in security,” says Andy Bennett, VP of Technology and CISO for the Apollo Information Systems. There's a reason we say People, Process, and Technology - people always come first. We build cars, we are bankers, we are educators...and being secure means knowing the business and building relationships with the other humans we work with. 

ISC2 last year reported that almost 70% of workers surveyed in the US and UK wouldn't want to work in security. This week, we discuss whether we have a cybersecurity skills shortage or whether what we actually have is a cybersecurity leadership shortage.  My guest this week is Brian Mork, CISO for Westinghouse, advocate for Hacking Is Not A Crime (#HINAC), and Co-Founder of Team Cryptolingus. Brian has some interesting thoughts you will not want to miss!

The cybersecurity habit of the week is Community.  Lots of conferences bill themselves as being "For CISOs, by CISOs" but many don't actually live up to the billing of being run or created by CISOs. Randy, Jamin, and Cecil are hoping to change that when it comes to cybersecurity conferences. And along the way, they're hoping to improve their community for the better as well by donating a portion of their proceeds to charity.

How do you know when you're in the Goldilocks zone when it comes to security? Not too much or not too little? We think it's by making sure security is aligned with the business. Our guest this week is Jason Fruge. Jason is the CISO for Rent-A-Center, and this is his 4th CISO role. Jason has held CISO roles at retail and healthcare technology companies and was a Global Group Information Security Officer at Citibank as well.

There are millions of unfilled jobs in the cybersecurity industry today...what do we need to bridge that gap? Our guest this week is Val Mukherjee, Chairman and Founder of the Cyber Future Foundation. This week, CFF announced a partnership with Cybrary and Safal Partners to provide free training within Cybrary's platform. This partnership will enhance CFF and Safal's cybersecurity apprenticeship program with the US Department of Labor. We all need to work together to secure our future!

We know that there's a huge talent shortage in cybersecurity, which leads to high turnover. This makes succession planning even more important because we know that we have to manage the "churn" on top of everything else. Veteran CISO and Cyber Luminary Malcolm Harkins joins the show to talk about how important succession planning really is, how to do it really well, what to do when you mess up. As Malcolm says, "You can't talk you way out of something you behaved yourself into."

The biggest complaint I hear from people about security training is that it’s a waste of their time. And if you’re doing a 5 minute awareness video once a year to check a compliance box, you probably are wasting your employee’s time. Our guest this week, Ashley Rose, is the CEO of Living Security and her philosophy is to empower people to change their behaviors...and along the way make it fun and engaging as well.