What Are the Questions We Should Be Asking?

Jake discusses the cybersecurity questions we should be asking: what legislators should be asking citizens; what boards should be asking CISOs; what companies should be asking during M&A processes; and what citizens should be asking themselves.

03:22 While it’s true that legislators lack technical knowledge, the best ones know how to ask the right questions.

04:49 Americans need to consider if they want Europe to be setting the privacy regulations and if not, they need to ask U.S. legislators to start doing so.

09:03 Boards and executives are on the hook for cybersecurity and finally understanding that it is a critical component to an overall risk management program.

13:54 The Marriott breach showed cybersecurity diligence during M&A is essential.

15:49 The goal for CISOs with any breach is to learn from it, develop the appropriate standard of care, and then show those learnings to the executive team.

Jake Olcott Interview Transcript

Trust is a Cultural Imperative

Phil talks about the erosion of trust in society, the increasing role of encryption in security, and the need for some privacy standards.

01:19 Privacy and security are two different things and not interchangeable.

02:06 How much access should governments have to their citizens’ data?

04:22 The value of the information shared should determine the level of encryption in IoT devices.

06:04 Encryption will play an ever-increasing role in security

08:17 Digital transformation and security in design – can’t bolt it on after.

12:04 Trust has been eroded in every area of society

14:06 Is cybersecurity attracting workers motivated by money rather than a desire to do good?

16:50 The U.S. needs a privacy minister. People should stop assuming business will be ethical in its use of customer data.

18:32 As long as we say the ends justify the means, we will fail.

Phil Dunkelberger Interview Transcript

Encryption, Business’s Moral Dilemma, and Diversity

Rubric: Jon Callas talks about his long and illustrious career, offers unusual advice on how to address the diversity and the skills gap, discusses the advantages of encryption, and is positive about the protection of privacy, believing the future lies in proper policy, regulation, legislation, and consumer activism.

01:09 Jon’s long and illustrious career in four minutes.

06:44 Privacy isn’t doomed. The future lies in proper policy, regulation, legislation, and consumer activism.

09:44 We are seeing consumers take action to safeguard their data, and Apple made a good start on that with transparency, consent, and control in iOS.

11:14 We need tools we can set in our devices to monitor our usage and therefore gauge our dependency

13:35 We are moving to a world where SSL and encryption will be the default but this poses moral questions for business.

15:10 Encryption makes it easy to dispose of digital waste. Encryption enables recycling

19:05 Companies need to set their own moral compass or outside influences will do it for them.

23:28 Tech was an incredibly diverse field, it can be again, if companies stop looking for staff in the obvious places.

Jon Callas Interview Transcript

Trust as a Product

Eric discusses his process of customer development, the concept of trust as a

product, and the dollar cost of the loss of customer trust.

01:08 Customer development is about starting with the problem first.

03:26 Collect a Dirty Dozen. Gather 12 customers in the space that you care about and interview them. Ask open-ended questions and ask about their problems.

10:39 Trust as a product

11:37 Breaches and loss of trust is translating to real dollars: 2.5 billion dollars globally.

13:12 Loss of privacy is the cost of social media.

14:06 When companies invest in security, they are focused on minimizing their own risk and liability not protecting their customers.

15:22 Perhaps it’s time for a trust report – just like a credit report

16:22 If enterprises demonstrate that they really care about trust and their customers, that will be the differentiator.

17:04 Ongoing customer engagement is necessary for business and product success.

Eric Olden Interview Transcript

The Future of Cyber

Emily discusses Deloitte’s survey on The Future of Cyber and offers her opinion on the risk in IoT, consumer identity management, and the best way to increase diversity in cyber.

03:04 The discrepancy between digital spending and digital transformation.

05:32 Organizations are creating additional risk as they go through digital transformation.

07:05 IoT brings increased risk and broader, more sophisticated attack surfaces.

08:36 We’re going to need people as well as automation to cope with the security scope of IoT.

10:28 Highly regulated industries are further ahead on the risk curve.

10:41 How should companies choose what to outsource and what to keep inhouse?

13:21 Consumer identity management

17:10 People self-select into industries they are passionate about. With cyber everywhere we have an opportunity to increase passion for cyber in women.

20:16 Conferences like RSA are all about conversation and relationships.

Emily Mossburg Interview Transcript

Understanding Risk in Cybersecurity

Andrea explains her role as a translator of digital topics into business language to help decision makers better understand strategic risk. She goes on to explore why leadership and culture are crucial in managing risk, the monetization of data and our tech addiction, and the need for the different stakeholders in society to help formulate the right regulatory solutions.

04:01 Cyber has grown so fast that boards and executive teams often lack the experience and knowledge to understand the risk.

08:11 Leadership and culture are crucial in managing risk. Ethical leadership provides the opportunity to create products and services that build risk and security into the design.

12:38 The data breaches and privacy mishaps will lead to ever greater government regulation.

13:41 The consumer has been sold out. Our data is sold without our knowledge, but worse than that, with our permission because we don’t read the T&Cs we sign.

15:15 The danger is that laws on regulation will be made by people who do not understand the cybersecurity industry nor the issues it faces, so business must engage constructively and help craft them.

17:52 Knowing your risks affords you the opportunity to create value.

20:38 The four most important strategic risks fall under four main categories: environment, social, governance, and technology.

23:51 The path to a career in cybersecurity doesn’t have to be STEM. The development of this industry requires people with different perspectives and expertise, and they need to reflect the stakeholders in the customer base that organizations have.

Andrea Bonime-Blanc Interview Transcript

Federal policy, data protection, and identity fraud

Joseph talks about data protection and breaches, points out the opportunity regulation offers vendors, and welcomes the possibility of federal government sharing identity attributes to help fight synthetic identity fraud.

03:03 The different silos of data are meaningless to the end user. They just want their data to be where it should be and protected.

06:27 Data breaches will happen; it’s how a company handles them that matters. Clear and transparent communication will win customer trust.

12:04 The way we’ve historically treated data sharing, collaborative and risky versus closed and secure, isn’t good enough anymore. 

14:50 You can’t buy your way into compliance. The vendor community needs to take the regulations and work out how to make it easy for companies to be compliant.

20:19 Encryption is not a cure all, but it is a really important piece of the puzzle.

24:55 Could opening federal identity attributes for private sector identity providers and identity solution providers help fight synthetic identity fraud?

Joseph Stuntz Interview Transcript

Identity, Diversity and Inclusion

Jackson talks about security in identity management, emphasizes the importance of user experience, and describes the IoT industry as the Wild West.

02:23 In the world of identity, foundational technology is still relevant. The dissonance comes with cloud.

04:49 IM should be a business enabler not just an IT efficiency thing.

05:20 Security need to consider user experience in IM.

07:10 Too many people think of UX as an afterthought. It should be part of the development lifecycle.

11:09 Combining good features, good backend, APIs and wrapping it all with good UX is an unbeatable combination.

12:46 The industry needs to do more to close the gender gap in cyber and encourage diversity.

14:38 The correlation between identity and human population has broken.

15:11 The problem with IoT is that there are no actual standards on identity and security.

16:18 The IoT environment is literally the Wild West. How do we secure IoT devices and protect them from penetration?

18:49 It’s a truism in the identity and business world that if something makes business sense, security then becomes a secondary issue.

19:13 Diversity and inclusion: fluidity has to increase, not just with genders but industries too.

Jackson Shaw Transcript

Working with Data While Respecting Privacy

Emrah discusses the best way to store data, the privacy paradox, and cautions against overregulation.

00:55 Chooch AI’s mission is to emulate human intuition.

06:00 There is a privacy paradox and the best way to address it is to score the benefits and disadvantages of having your privacy revealed.

08:19 The Western World is very privacy driven and it is creating tension in the tech world

13:18 Don’t keep raw data. Use neural networks to hash it.

14:13 Governments do need to regulate, but they should be cautious. Overregulation stunts innovation.

18:34 People overemphasize data. What is actually important is how your models and platforms interact.

19:45 Ashwin Krishnan: if you could create a closed-loop pipeline of data collection, model training, and prediction, you would be able to discard the data that isn’t adding value.

21:56 Use public data, don’t collect private data to train your models. That will solve the privacy problem.

Emrah Gultekin Interview Transcript

The Human Element in Cybersecurity

Caroline talks about how the skills shortage impacts the industry and the very real problem of burnout in skilled, experienced security professionals. She shares her thoughts on AI and automation and underlines that the human element is still necessary to effectively detect, defend against, and respond to cybersecurity attacks.

02:06 Human Resources has rebranded as People, but the skills shortage problems remain.

05:31 The skills shortage challenge: Hunt. Poach. Repeat.

07:39 The trouble with working with consulting firms.

08:15 Influencing the culture at Cobalt.io

13:26 Security can’t be bolted on. It must be built into design and development and then maintained.

15:15 Security must be embedded into an organization’s culture.

16:32 Where does AI and automation work best?

18:44 The human element is still necessary to effectively detect, defend against, and respond to cybersecurity attacks.

21:34 Burnout for cyber professionals is a huge problem, but it’s finally being

addressed.

Caroline Wong Interview Transcript