UberKnowledge

In the first of our new shorter podcasts focused on helping our community navigate our new normal, Helen Patton, CISO at Ohio State University discusses managing cybersecurity in higher education during an era of remote working and learning.

01:17 — Moving teaching online is going to be a process for universities.

03:49 — Privacy and security remain important. Staff and students connecting remotely need to take responsibility for the final mile.

06:33 — Due to cloud and mobile, we’ve been preparing for remote working for some time. It’s just accelerated now.

08:42 — If vendors don’t have an existing relationship with a business, now is not the time to start.

Helen is a repeat guest on our podcast. You can find her previous podcast with us here.

Unhooding the Hackers

In this podcast, Brook Chelmo, Senior Product Marketing and Product Manager at SonicWall, shares insights from his conversations with a Russian ransomware cell. Retweeted by the hackers he referenced, Brook decided to engage. Through secure communication channels, he worked to find out what kind of people they were and what motivated them. He discovered the human behind the hoody and a desire for recognition. It turns out, ransomware hackers want to be known as well as get paid, as notoriety brings not only success but also kudos within their own community.

In an unusual twist, the hacker was willing to talk about the loopholes he exploited: use stronger passwords, code in proper languages, and know misconfigured firewalls are a hackers best friend. Brook points out that these intelligent and technically skilled people with security insights are exactly the kind we ought to be hiring. This points to entirely different kind of diversity debate: How do we hire people we culturally don’t trust?

01:36 — What do you do when a Russian hacker retweets you?

03:07 — Ransomware hackers want to be known.

06:03 — Notoriety often comes with an FBI flag.

08:05 — Security advice from a hacker.

12:13 — Democratizing diversity.

You can find more on ransomware in our podcasts with Jadee Hanson of Code42 and local government CISO Lester Godsey.

Phil Dunkelberger, CEO of Nok Nok Labs, joins Ashwin on our podcast for a second time. He discusses his work on authentication and the FIDO Alliance pointing out that passwords and usernames are ineffective as security tools. Increasing consumer frustration and regulation like CCPA and GDPR have brought the privacy debate to the fore, but Phil explains that the privacy debate is not new; he’s been involved in it for over 20 years.

Phil goes on to talk about the need for brands to build a trust relationship with their customers, and that includes a decipherable EULA. He also suggests that the cyber skills gap could be broached by teaching cybersecurity in schools and colleges. This would open the field to a broader range of people. In Phil’s opinion, “diversity is a huge advantage in security.”

03:02 — Passwords are a liability. FIDO is the future for authentication.

05:17 — We need to consider the customer journey and make things easier not harder.

11:01 — Best way to tackle increased diversity? Teach cybersecurity in schools and colleges.

13:02 — We can innovate together in this industry.

You can find our previous podcast with Phil Dunkelberger here.

Don’t Pay up, Back up

In this podcast, Jadee Hanson, CISO at Code42, discusses the perils of breach fatigue and ransomware. She points out fatigue often means we give up, and that is not a lapse we can afford in the cybersecurity space. When asked about ransomware, Jadee’s advice is don’t pay up, back up. Her rationale is that “when you think about paying the ransom, you’re essentially funding the bad people to do it again.”

Jadee also talks about the CISO skillset, sharing her view that the role has become increasingly strategic with a focus on leadership. When it comes to women in cybersecurity, she believes the more women see women in cyber roles, the more empowered they will become. “Women just need to know they have a seat at the table,” she explains. To help promote women in this space, Code42 will be hosting their first networking event for female CISOs this fall.

03:27 — There is no official training to become a CISO.

05:41 — Women need to know they have a seat at the cybersecurity table.

09:17 — Breach fatigue is scary. We can’t afford to give up.

12:01 — Ransomware – don’t pay up, back up.

13:53 — There is no privacy without security.

To listen to more about women in cybersecurity check out our podcast with Arctic Wolf’s Dinah Davis.

Giovanni Vigna, CTO at Lastline, joins Ashwin on the podcast for a second time. He expands on his previous analogy of CISOs being like goalkeepers – never praised for goals saved, only criticized for goals scored – and jokes that now they need binoculars to be able to foresee incoming threats. Fortunately for CISOs and their teams, the security community has built up a bank of resources where enterprises can test and learn. In fact, Giovanni believes those resources are so empowering that “the enterprise can take control of its protection and make the vendors accountable.”

01:58 — CISOs are goalies, but now they need binoculars.

05:29 — The security community has built incredible resources to help enterprises understand what they might need.

07:29 — Thinking like a hacker frees you from your own assumptions.

10:18 — AI is a tool — good at finding patterns, bad at logic.

13:13 — Why machine learning will replicate mistakes over and over again.

14:12— Enterprises can’t rely on just one vendor, we need the resources of the entire community.

For more from Giovanni listen to his previous podcast with us.

In this episode, Jason Brvenik, CEO of NSS Labs, joins the podcast for a second time. He and Ashwin discuss what makes a successful security program and the paradox of achieving that success for CISOs. Amidst all the marketing noise, Jason believes the continuous assessment of vendors remains crucial in helping enterprises make informed security product choices.

Jason shares what NSS Labs hopes to achieve with its new nonprofit, namely inform the market and provide better cybersecurity for all. It’s an important initiative because, as Brian explains, “there’s no organization representing the consumers of security products.”

02:47 — NSS Labs nonprofit aims to inform the market.

04:50 — Cyber is a complicated space and not every marketer understands the tech they promote.

08:04 — Cloud is the future, but it is still evolving. It doesn’t fit the traditional business model, so adoption can be challenging.

12:16 — The continuous monitoring and assessment of vendors and technologies remains crucial.

14:13 — Access control is not security.

You can find Jason’s previous podcast with us here.

In this podcast Emily Mossburg, Global Cyber Leader at Deloitte & Touche joins Ashwin to discuss the broadening of cybersecurity across the enterprise, women in tech, and Deloitte’s global cyber strategy for 2020. 

Emily would like to see more skill diversity in cybersecurity. She explains, “It is critically important that we focus in on some of the softer skills required for the CISO in order to make sure that the broader organization is bought in and understands the risk.” This is something we hear often on this podcast: CISOs need to be able to talk more than just tech and communication skills are key.

02:41 — Educate executives and the board on the evolution of cybersecurity and make sure they understand this is a moving goal line.

04:29 — Cybersecurity is not just the CISO’s responsibility. This is about arming the entire enterprise.

08:04 — We need to focus on the softer skills in the CISO role.

09:19 — How can we make cyber an inviting field for women? 

12:41 — Deloitte’s global cyber goals for 2020.

You can find our previous podcast with Emily here.

Cybersecurity ROI

Brian Contos, CISO & VP of Technology Innovation at Verodin, sat down with our host, Ashwin Krishnan, at RSAC 2020. In their conversation, Brian points out that it’s not enough that CISOs talk business as well as tech to the board. These days they also need to show cybersecurity ROI in terms of dollars not just risk. He asks, “Can you prove that the security tools you have in place are actually providing value and working?”

In Brian’s experience, one effective way of bridging the skills gap is to cast the recruitment net wider and then conduct onsite tests as part of the recruitment process. Companies have found this ensures a good fit pre-hire, while the continued practice of testing keeps everyone’s skills sharp.

He also discusses the importance of honesty and transparency in that tricky vendor-CISO relationship. Communication here is key: vendors must be honest about the value they bring and CISOs must be transparent about what they actually need.

02:02 — CISOs are increasingly being asked to show ROI in dollars and cents.

05:52 — CISOs have to talk business not just tech.

10:16 — Cast the recruitment net wider to manage the skills gap.

12:34 — Vendor-CISO relationship is all about honest communication.

17:01 — The triumverate of product, threat intelligence and service is the way forward for vendors.

You can find more on managing the skills gap in our recent podcasts with Laura Noren and Chris Jacquet.

In this podcast Laura Noren, VP of Privacy and Trust at Obsidian Security, discusses the impact of CCPA on privacy and is disappointed that it’s very name, California Consumer Privacy Act, “assumes that everyone’s most important status in the world is as a consumer.” The challenge of managing consumer requests to see data held or request full deletion has cost implications for most enterprises. Laura has long believed the best way for companies to handle this is to design data sets to decay. Interestingly, this would not only save businesses money but also improve privacy for consumers.

01:12 — CCPA – identity validation is proving an extra headache when requesting information.

04:37 — Data deletion as a service

06:37 — Decay by design. A business cost saving that could actually enhance consumer privacy.

08:57 — Academia is leading the way in helping citizens choose what data they share. 

13:49 — Diversity in computer science remains a problem.

16:30 — A human-in-the-loop algorithmic approach to combating bias.

If you’d like to hear more from Laura, you can find her previous podcast with us here.

Jake Kouns, CEO & CISO of Risk Based Security, met with our host, Ashwin Krishnan, at RSAC 2020. They discuss the intelligence gap in cybersecurity and the overwhelming effect of Patch Tuesday. Jake explains, “People need to focus on not just security, but the right security, and in order to do that we need to have data to better understand what’s going on.”

Cyberinsurance is coming whether we like it or not. Jake believes that this could actually be beneficial to the industry as a whole and SMEs in particular. While larger enterprises may have incident response teams and plans in place, often SMEs do not and could benefit from a partner. 

Jake also offers his advice on managing regulations and compliance. As important and useful as they are, the common mistake companies make is to begin with the first control in the list and work down. A far better approach is to focus first on those controls most relevant to the business, its customers and the data collected.

03:15 — Cyberinsurance is coming whether we like it or not.

04:53 — Compliance doesn’t equal security.

07:44 — Attribution remains an important area that needs research.

11:58 — Patch Tuesday is overwhelming for enterprises.

12:57 — RSAC is all about maintaining customer relationships.

Want to hear more of our conversations from RSAC 2020? Check out our post-conference analysis in “RSAC, Still Relevant?” and our interviews with Microsoft’s Diana Kelley and Farsight Security’s Paul Vixie.