Security industry pioneer Dave Aitel dishes on entrepreneurship, fostering a "one team, one parking lot" culture, how lessons from his time at the NSA still guides his decisions, and his approach to blunt, honest marketing. We also discuss a shared passion for Brazilian Jiu-Jitsu and his work supporting Project Grapple in Miami.

Links:

• Project Grapple, The Jiu-Jitsu Non Profit Changing Lives
• Aitel Foundation
• Infiltrate Conference
• Daily Dave (mailing list)

Former Chief Security Scientist at Bank of America, Sounil Yu, explains why he created the Cyber Defense Matrix framework and how organizations are using it to drive visibility and security decisions in multiple places. We discuss securing "cattle vs pets," the next era of security innovation, and the increasing security poverty line that hurts small- and medium-sized businesses.

Links:

• Cyber Defense Matrix — The Cyber Defense Matrix helps us understand what we need organized through a logical construct so that when we go into the security vendor marketplace, we can quickly discern what products solve what problems and be informed on what is the core function of a given product. In addition, the Cyber Defense Matrix provides a mechanism to ensure that we have capabilities across the entire spectrum of options to help secure our environments.
• Cyber Defense Matrix Reloaded — This is an update to the Cyber Defense Matrix briefing given at the 2019 RSA Conference. Cybersecurity practitioners can use this to organize vendors, find gaps in security portfolios, understand how to organize security measurements, prioritize investments, minimize business impact, visualize attack surfaces, align other existing frameworks, and gain a fuller understanding of the entire space of cybersecurity.

In an industry where 10-15% of staff are women, Akamai's security team is 40% women and growing. Chief security officer Andy Ellis joins the podcast to share lessons on practical things -- some subtle, some major -- that pushed real diversity on Akamai's security team.

Links:

• One company’s successful approach to gender balance
• Video: 20 Years In: Security’s Grand Challenges, Then and Now
• Andy Ellis: Humans are Awesome at Risk Management

Veteran malware hunter Costin Raiu talks about writing his own an anti-virus program as a teenager in Romania, his work tracking advanced threat actors globally, and why he assumes his computer is compromised by at least three APT groups.

Links:

• "Equation Group" ran the most advanced hacking operation ever uncovered
• The adventures of lab ED011 — One Romanian campus computer lab both pentested the world and eventually helped protect it
• Costin Raiu on Twitter
• The "Red October" Campaign

Flashpoint chief executive Josh Lefkowitz talks about how his previous work as a counter-terrorism analyst underscored the value of contextual threat-intelligence, his company's approach to gathering and analyzing data, and his mission to be an extension of a client's security team.

Links:

• Flashpoint - Library
• '7 Minutes' with Flashpoint CEO Josh Lefkowitz
• Video: Josh Lefkowitz on AlphaBay's demise

BlackBerry security response executive Christine Gadsby joins the podcast to talk about tough decisions around shipping secure software, the challenges of securing supply chain dependencies, BlackBerry's new ransomware recovery feature, and her upcoming Black Hat 2018 presentation.

Links:

• Black Hat 2018: Stop that Release There's a Vulnerability!
• Christine Gadsby on Twitter
• BlackBerry Enterprise Software - Security & Management for the Enterprise of Things
• Christine Gadsby on LinkedIn

Cybersecurity industry veteran Chad Loder talks about his time as co-founder of Rapid7, the decision to acquire Metasploit, lessons learned from moving to the CISO chair and why the industry still struggles with security awareness training.

Links:

• About Habitu8
• Chad Loder on Twitter
• Rapid7 Acquires Metasploit

Chris Castaldo, senior director of cybersecurity at 2U, Inc., joins Ryan on the podcast to talk about building a threat model for digitizing the education sector, his top priorities as a defender, new solutions that impress him, and why it's important to get independent third-party security assessments.

Links:

• Uptycs
• osquery | Easily ask questions about your Linux, Windows, and macOS infrastructure

Founder and CEO of Wire Security, Wim Remes, joins the podcast to discuss the intricacies of penetration testing, red-teaming, bug bounty programs, and calls for defenders to embrace continuous pen-testing.

Links:

• Wim Remes on GitHub
• Wim Remes on Twitter

Lacework Chief Security Architect Dan Hubbard joins the podcast to discuss his new research on container security, the challenges of securing cloud deployments, and why technological advancements have widened attack surfaces.

Links:

• Containers at risk (PDF direct download)
• Dan Hubbard on Twitter