In this podcast, Malcolm Harkins, Chief Security and Trust Officer at Cymatic, Simone Petrella, CEO and Founder of CyberVista, Chris Pierson, CEO and Founder of BlackCloak, and Hank Thomas, CEO of Strategic Cyber Ventures join our host Ashwin Krishnan to unpack RSAC 2020.

They all agreed that RSA has become a vendor’s conference and none of them attended as many sessions as they’d intended, if at all. Which raises the important question — is RSAC still relevant? Their answer is an emphatic yes.  The real power of RSAC is not in the expo hall or even in the keynotes, it’s in the audience. The value lies in the network it convenes, the meetings held, the connections renewed year after year, and the new people met.

05:18 — “I have always expected at RSA a level of marketing manipulation and storytelling to perpetuate the industry’s profit motives and profiting from the pain.” Malcolm Harkins

17:11 — “Increasingly, the sessions, the events that are held on the outskirts, in the hotels and the suites, that’s where I get real one-on-one time.” Chris Pierson

22:13 — “I really think that the real value of RSA is that it has the convening power to bring together professionals in the space that have been working on a number of these issues over the last 15-20 years … those relationships and connections have remained constant.” Simone Petrella

24:32 — “No matter how much consolidation takes place in cybersecurity there’s always going to be new innovation required because we have a global network of adversaries constantly working to defeat us.” Hank Thomas

Look out for more of our interviews from RSAC 2020 as they are published over the next week.

Highlights from RSA 2019 include our conversations with Brian Vecci of Varonis, Jon Callas of ACLU, and Eric Olden of Oracle.

To mark International Women’s Day 2020 and highlight the amazing women making a difference in cybersecurity, we invited 13 of our previous guests to answer a single question. Their responses are collated into this podcast: a snapshot of the industry from the women who are leading it.

Diana Kelley, Field CTO at Microsoft, on digital privacy best practices.

Fiona McEvoy, Tech Ethics Writer and Researcher, on digital regulation.

Laura Noren, VP of Privacy and Trust at Obsidian Security, on cybersecurity skill sets.

Jessica Groopman, Industry Analyst and Founding Partner at Kaleido Insights, on how to attract ethically minded tech employees.

Vasu Jakkal, EVP & CMO at FireEye, on the future of the CMO in technology.

Simone Petrella, CEO & Founder of Cyber Vista, on the cyber skills gap challenge.

Dr. Andrea Little Limbago, Chief Social Scientist at Virtru, on government intervention in encryption.

Kavya Pearlman, Cybersecurity Strategist, on the conflicting demands on the CISO role.

Renuka Nadkarni, Security CTO at F5, on managing privacy from a B2B perspective.

Kristina Podnar, Digital Policy Consultant and Author, on how marketers can create personalized experiences without stalking customers.

Hema Lakkaraju, CEO & Founder of Hayag Corporation, on compliance in healthcare

Dr. Char Sample, Chief Research Scientist at Idaho National Labs, on which approach works best in cybersecurity — individualism or collectivism .

Meeri Haataja, CEO & Co-Founder at Saidot, on AI governance and ethics.

You can find more podcasts from these amazing women in our podcast library.

Dr. Paul Vixie, CEO of Farsight Security and Internet Hall of Famer, joins Ashwin at RSA’s Broadcast Alley to talk about ethical data aggregation. He explains the cybercrime fighting mission behind SIE Europe, the nonprofit he co-founded with Christoph Fishcher and Peter Kruse, saying, “So far, everyone’s giving us high marks for both transparency and the usefulness.”

He feels hopeful for the generation that has had to learn about data privacy the hard way and enjoys seeing them choose to work for companies with a mission they can believe in. Paul is particularly proud to offer those opportunities at Farsight explaining, “I like making it clear that if you help us succeed you will not create a world that you’re going to hate living in.”

01:29 — SIE Europe: sharing data to fight cybercrime.

03:34 — Privacy regulations are positive and will result in a stronger economy.

06:24 — Constructive vulnerability is impossible to achieve at scale.

08:37 — Farsight is proud to offer career opportunities that respect privacy.

To hear more from Paul Vixie, listen to our first podcast with him. For more from RSA 2020, watch our interview with Microsoft’s Diana Kelley and INL’s Dr. Char Sample.

Demystifying Artificial Intelligence and Machine Learning.

Diana Kelley, Cybersecurity Field CTO for Microsoft, and Dr. Char. Sample, Cybersecurity Research Fellow at Idaho National Laboratories, join Ashwin on RSA’s Broadcast Alley to discuss their “All that Glitters” talk debunking artificial intelligence and machine learning marketing. In an industry with so many buzzwords and too little understanding, Diana would like to see marketers focus on the customer experience. She reveals, “Really creative CMOs can clarify and come up with these very succinct messages that resonate without resorting to pure buzzwording.”

They discuss the importance of diversity when creating data sets and the lack of understanding between human and artificial intelligence. Dr. Char sees this as an area ripe for study. She explains, “We need to work more with the cognitive neural scientists, the psychologists, the people who actually understand how we think and where we are building these biases in.” As Diana points out, “the thing about unconscious bias is it’s unconscious.”

Privacy is a topic at the top of everyone’s mind at RSAC 2020. While regulation is important, both Diana and Dr. Char feel that privacy must be part of corporate culture and not a compliance check box.  Diana explains, “privacy is a human right and it’s the responsibility of the organization to deliver that for people.” Something Microsoft wholeheartedly embrace.

03:26 — Marketers, please ditch the buzzword bingo.

05:11 — Marketing best practices — focus on the experience and create unique, resonant messages.

07:00 — The cybersecurity industry is really bad at listening. Stop tailoring my problem to your solution.

08:02 — We need to understand the difference between how human intelligence works and how artificial intelligence works.

08:38 — To avoid bias in data sets you must have a neuro-diverse team.

10:52 — Privacy needs to be in a company’s DNA not just a regulatory check box.

If you’d like to hear more from Diana Kelley, you can listen to her previous podcast with us.

Community is Key

In this podcast, Chris Jacquet, CISO of Hitachi Vantara, discusses the benefits of the CISO community. More than just fellowship, the CISO community is a coalition of skills and knowledge shared to help fight an increasingly agile adversary. Chris explains, “If we don’t group ourselves and help ourselves, we won’t be successful at fighting the bad guys.”

While the cyber skills gap is a constant challenge, Chris suggests we could close it by being more open-minded. A focus on very narrow job descriptions is part of the problem. Chris believes cybersecurity needs curious minds; they don’t have to have come from technical backgrounds. He is only half joking when he says, “The Russian hacker that is attacking us at the moment, does he have the CISSP, does he have 15 years of experience? Maybe not.”  Chris suggests the industry could also help itself by collaborating with educational institutions to develop curricula with marketplace value.

04:42 — The Tech Challenge: Inspiring and encouraging children to explore STEM.

09:31 — The CISO community is crucial in a lonely and isolating job.

14:32 — Attacks will happen, prepare and defend, but know detection is key. 

17:10 — Cybersecurity hiring needs to be more open to people from different backgrounds.

23:27 — Predictions for 2020 – adversaries benefit from emerging technologies just as we do; IoT is a huge challenge; the ethics of data privacy.

For more on data privacy ethics, listen to our podcast with Stan Lowe, CISO of ZScaler. To hear more about the CISO community, try our podcast with Peter Liebert, Career CISO and Founder of Liebert Security.

Four things no one is telling you about data privacy

Industry analyst, Jessica Groopman, joins Ashwin on the podcast to discuss her recent article, “Four Reasons for Optimism on International Privacy & Protection Day.” In sharing her motivation for writing the article she explains, privacy professionals “are confronted with these revelations of data malpractice and misuse and abuse every day.” Jessica couldn’t help wondering if there were room for a different perspective on data privacy.

In their conversation, Jessica delves into each of the four reasons for optimism: awareness is growing; market forces are filling the data protection vacuum; new techniques, tools and designs; and the shift from a reactive to proactive approach. Each of her insights is filtered through her unique anthropologist’s perspective of emerging tech. Her optimism is inspiring, but as she explains, “privacy is a societal thing,” and it’ll take a village to fix this.

02:04 — Studying emerging technology from an anthropologist’s and archaeologist’s perspective.

05:49 — Jessica’s four reasons for optimism in data privacy.

07:33 — Awareness of data privacy is accelerating and widening.

11:22 — Market forces are filling the data privacy vacuum.

14:07 — The rise of new tools, techniques and designs.

18:59 — Shifting from reactive to proactive approaches.

23:06 — Privacy is actually a societal thing.

Digital Policy Consultant, Kristina Podnar, joins the podcast to share her thoughts on privacy regulation. CCPA has forced many companies to share their data privacy practices and policies with customers. User experience (UX) is important and as Kristina points out, “they can check the box that they’re complying with something, but it doesn’t mean that it’s a good user experience for folks like you or for me.”

Kristina argues that regulatory compliance is not just a matter for the lawyers but should include everyone from IT to Marketing to HR. It should be less about checking a box and more about creating a relationship of trust and respect with the customer. She recommends CEOs place that relationship at the heart of the business and make protecting customer privacy the responsibility of the entire C-Suite.  

05:35 — Regulation compliance doesn’t always equal a good user experience (UX).

6:52 — It isn’t just the legal team that is responsible for regulation compliance. Everyone from IT to Marketing to HR should be involved.

09:36 — Privacy policies are not written to be understood. Make it clear and simple.

12:26 — Respecting privacy and customer data starts at the top. Bake it into company culture.

14:40 — CEOs need to make privacy a C-Suite responsibility.

For more on the plea to make privacy policies user-friendly listen to our podcast with Malcolm Harkins and Chris Pierson.

 

Help Others, Build Value, Have Fun

Will Lin, Partner and Co-Founder of ForgePoint Capital joins the podcast to talk about cybersecurity from the VC perspective. He explains why the entrepreneur-VC relationship is about more than just capital and describes an ecosystem based on mentoring, networking and aligned values. He points out, “When you, as a CEO and entrepreneur, are selecting a firm to work with, you’re doing that because you want to be surrounded by an ecosystem that aligns well with your own current system.”

He describes the beginnings and purpose of the Tinker Tribe. Tired of conferences and being surrounded by vendor noise, the Tinker Tribe was created to find unique ways to tackle cybersecurity, be a support network, and have some fun. While vendors remain more competitive in nature, Will has seen a similar collaborative move towards building an entrepreneurial community. He says, “I think seeing entrepreneurs band together and help each other is just more continual proof that we’re all doing this for the right reasons.”

Looking forward, Will believes 2020 will bring clarity for the CISO role and a focus on back to basics. He explains, “There’s been multiple years of innovation, experimenting, new ideas, new ways of solving problems … now we have a much clearer idea of what problems need to be solved.”

01:38 — Being a VC is about more than just money, it’s about mentoring entrepreneurs.

05:23 — The history and purpose of #TinkerTribe.

10:57 — CISOs have particular personality traits — they want to protect, they want to help, and that drives their community mentality.

12:55 — Vendors are starting to collaborate – but it’s more of an entrepreneurial community.

15:16 — Cognitive diversity is the most valuable kind of diversity.

19:19 — Trends for 2020: Back to basics and the continued evolution of the CISO role. 

For more on leveraging your network listen to our podcast with Tammy Moskites and to hear more on diversity listen to our podcast with Varun Badhwar.

Business Logic Attacks

In this podcast, Renuka Nadkarni, CTO for Security at F5 Networks, discusses her new focus on business logic attacks. In combating these attacks, she describes a partnership where security benefits the business rather than being seen as an obstructive force.

She goes on to talk about the evolving environment for women in technology and confides that she spent the first 10-15 years of her career simply trying to fit in. Her advice to women in this space now is, “you can never be something you’re not. And the sooner you get very comfortable with that … and you are willing to put your originality into the conversation and be who you are, the faster you actually get to the transition.”

02:12 — What is a business logic attack?

04:47 — Security causes friction. Is there a better way than MFA?

07:52 — Moving to cloud opens new attack vectors but you bring the old ones with you too.

09:43 — Attackers have to show ROI too.

16:53 — The evolving environment for women in technology – and some important life lessons.

For more on the relationship between business and security listen to our podcasts with Nina Wyatt and Gary Hayslip.

Weaponizing the Internet

In this episode Stan Lowe, CISO at Zscaler, sits down with our host Ashwin Krishnan to discuss weaponizing the internet, zero trust, digital privacy and much more besides. They begin by talking about the evolution of zero trust and how it supports the business environment security professionals are in today. 

That environment has changed and so too has the CISO role — it’s become harder. CISOs must be business and privacy experts as well as technical experts. Network boundaries have disappeared as employees can and do work from anywhere. Adversaries are weaponizing the internet by capitalizing on digital personas to sophisticate their attacks. And then, there’s the skills shortage. As Stan points out, “this is the only gig where you have to get up and apologize for being the victim of a crime.”

He believes we will see an increase in those crimes. Adversaries, both criminal and state actors, have started taking a combined arms approach. The breaches are cheap, trigger media attention, affect share prices, and place a spotlight on the attacker’s political aims.

They end the podcast by discussing digital privacy. Stan would like to see the digital representation of the consumer better protected by the companies gleaning that information, by the social media companies sharing and selling it, and by the consumers themselves. As Stan says, “we the people own that data.”

01:48 — What zero trust means today.

05:07 — The CISO role has evolved from technology expert to business expert.

06:32 — The adversaries are weaponizing the internet.

09:29 — We will see more attacks on private corporations by state actors. 

11:48 — We brought the skills shortage on ourselves. We need to change our thinking and widen the talent pool. Not only that – experienced professionals need to reskill.

16:12 — If you are a CISO without a Chief Privacy Officer, guess what? You’re both.

17:47 — Data privacy – the onus is on the corporation to protect customer’s data and only use it in an ethical way. 

For more on data privacy listen to our podcast with Brian NeSmith and for more on Zero Trust listen our podcasts with Joe Stuntz and Aaron Turner.