Cybersecurity Technology: Yesterday, Today, and Tomorrow

Malcolm Harkins, Chief Security and Trust Officer of Cymatic, and Peter Liebert, Commander of Cyber Operations at the California State Guard, join the podcast to discuss the past, present, and future of cybersecurity technology and offer their predictions for 2020.

They talk about the products and practices from the past that have lost relevance as technology has changed. Acknowledging the difficulty of turning off any security product, they offer ways to evaluate ongoing value. 

Malcolm sees CISOs as the CEOs of Security, and just like any CEO and business, they must grow, evolve, and transform. In managing that transformation, Peter believes legacy thinking is as much a hindrance as legacy products and recommends regular education for employees. 

In offering predictions for the future, Malcolm would like to see the government and customers hold the security industry to account. While Peter cautions that the government lags ten years behind everyone else and would like to see them follow procurement reform and adopt technologies faster. They both see AI and ML as beneficial to the future of cybersecurity but worry that it could help the bad guys before it helps the good guys.

02:12 — Cybersecurity products – how old is too old; can they stay relevant as technology evolves? 

05:42 — Should we turn older products off? How can CISOs evaluate those products’ value?

08:46 — Just like the real business, CISOs and security have to grow, evolve and transform.

09:53 — People are an often-neglected component. Employees must be educated as technology and solutions evolve.

11:01 — New communication tools means CISOs need to stay on top of data security, compliance, and privacy for those products.

15:48 — Is the future AI and ML? Who will benefit more the adversary or the practitioners?

17:05 — The Government always lags behind by ten years.

If you’d like to hear more, check out Malcolm’s podcast on the weakest link in cyber and Peter’s podcast on windfall budget.

People, Culture and Customer Empathy – an Entrepreneur’s Journey

In this episode of the podcast Varun Badhwar, SVP of Prisma Cloud at Palo Alto Networks, discusses growing a cloud security company and RedLock’s journey from startup to acquisition. At inception, a crowded market necessitated an innovative approach to sales and marketing which RedLock achieved by using high-quality cloud research to attract and educate customers.

Equally important to Varun was the development of corporate culture; he points out that “your first five employees define the culture of the next 50.” He found that collecting a group of professionals with diversity of experience was key to ensuring a nimble, keen-learning team. That culture and innovative mentality have moved with Varun and his team to Palo Alto Networks.

In looking at the market, Varun sees many vendors working to solve the most complex problems, while customers are still trying to achieve basic hygiene and visibility. He believes that keeping customers informed from day zero of the development process is critical in ensuring “you’re solving the right problems, not necessarily the hardest problems.”

02:23 — Market/product fit is an evolving journey. No-one can rest on their laurels.

04:50 — Company culture is defined by your first five employees.

08:46 — A crowded market means finding a new and engaging approach. 

11:52 — Redlock’s approach of offering high-quality research equaled a fast time to value.

13:32 — The cloud security speedboat. 

16:03 — Multi-cloud has become more prevalent than predicted.

16:39 — For enterprises, basic hygiene and security are the main concern. Ensure your product is working to solve the right problems not the most complex problems.

If you enjoyed this podcast and want to hear more about cloud security listen to our podcasts with John Yeoh and Jim Reavis of the Cloud Security Alliance.

Ancient Tactic, Modern World

Carolyn Crandall, Chief Deception Officer at Attivo Networks, joins the podcast to talk about deception technology, vulnerability during mergers and acquisitions, and the importance of crafting a unique marketing message.

02:56 — Perimeter attacks – your technology may be able to deflect them but what do you learn about the attacker?

07:02 — Attackers are well equipped. They can buy everything they need on the dark web.

10:22 — During M&A both companies become targets.

12:12 — Marketing cybersecurity – thousands of products and everyone is using the same words. How do you craft a unique message?

15:57 — Deception can help you use the security tools and products you already have more effectively

19:31 — We start too late in educating cybersecurity.

If you want to hear more about cybersecurity in M&A and network attacks listen to our podcasts with Jake Olcott and Ajit Sancheti.

CISO budget windfall and how to spend it.

In this episode of the podcast, we welcome industry stalwart Peter Liebert to the Cyber360+ community. Peter talks about the tragi-comedy of the CISO budget pre- and post-incident and offers recommendations for how to spend that windfall should you receive it. 

In discussing the onslaught of vendor attention after a breach, Peter recommends a careful assessing approach.  Sorting the good from the less good in the aftermath is near impossible. It’s best to clean up first and then compare them all. Importantly, CISOs should use that post-breach time to assess the vendors: how they act, how they respond, are they really partners? 

This is where the strong, tight-knit CISO community really comes in to its own. Allowing the practitioners to offer each other advice and the benefit of their experience. Because they are in competition with each other, vendors don’t have an equivalent community and they suffer for it.

02:30 — Windfall budget typically comes after an incident, how should CISOs manage it?

04:13 — First, get the lay of the land and craft your strategy from that.

06:44 — Don’t be the CISO of “I told you so.”

07:24 — Can you win more budget without a major incident? Yes, use a tabletop exercise.

10:18 — Vendor noise is deafening post-breach. How can you tell who to listen to?

13:45 — CISOs have a strong, tight-knit community. Vendors don’t and they suffer for that.

If you want to hear more about managing CISO budgets and breaches listen to our podcasts with Tom McAndrew of Coalfire and Archis Gore at Polyverse.

Each year Helen Patton, CISO at Ohio State University, poses the same question: which generation is most cyber-risk tolerant? In this podcast she discusses the answers she receives. Are tech-ignorant baby boomers the biggest risk or is it the carefree Gen Zs? Regardless, generalizing about groups isn’t helping CISOs secure organizations, so we’ll see a more individualized approach to security moving forward. But this will need, yes, you guessed it, more data. Helen goes on to discuss how that data could be collected and the necessity for a very transparent approach in the public sector. 

In the future, Helen sees the CISO role moving increasingly towards a focus on the digital experience. She discusses collaboration within the CISO community. Even in traditionally secretive organizations, CISOs are beginning to share knowledge pertinent to their industry and this is good news because we can only win this fight together.

02:21 — Which generation is most risk tolerant?

06:11 — Generalizing isn’t helping us manage security, we need a more individualized approach and UEBA will play a role.

09:22 — Individual risk tolerance versus the institution’s risk tolerance. 

11:24 — Yes, CISOs should be sharing their knowledge and encouraging companies to build security into product design.

12:34 — The CISO role will move towards a focus on digital experience.

14:23 — CISO collaboration on individual industry challenges will help win the cyber fight.

To hear more on risk listen to our podcasts with Andrea Bonime-Blanc and Gary Hayslip.

On this edition of the Cyber360+ podcast, Digital Policy Consultant Kristina Podnar and Ashwin Krishnan talk about the lack of focus on security in marketing. In her consulting work, Kristina sees that most marketers don’t understand the issues surrounding security and those that do are afraid to face them. A good step forward would be for CMOs to step in and partner with CIOs to ensure that amidst all the clever analytics software, customers’ data is protected.

The subject of customer data also cropped up when Kristina and Ashwin discussed Zappo’s recent attempt attempt at reengaging customers seven years after their data breach. They both underline the importance of trust in the customer relationship. It is this that marketers should be focused on post-breach. As Kristina says, “privacy and trust are a competitive advantage.”

01:34 — Security issues are scary to marketers. The engagement needs to be mandated from the top down.

06:24 — Marketers don’t know security so CMOs need to partner with the CIO and vendors to safeguard the organization.

09:40 — Marketers must think very carefully about how to win back customers after a breach. Zappos, we’re looking at you.

11:47 — To regain customer trust you have to do a mea culpa — there must be accountability.

14:32 — Sales and marketing are all about trust relationships.

To hear more about marketing in cybersecurity listen to our podcasts with Vasu Jakkal of FireEye and Larry Lunetta of Aruba.

02:40 — The first 90 days for a CISO are all about assessment.

04:42 — The similarities between a transition in security leadership and a breach. 

07:22 — Vendors – it’s about partnership, trust and a relationship. They don’t often offer that.

08:52 — Public sector procurement is slow and very defined.

10:20 — Starting in a new role is all about communication and consistency.

14:39 — A CISO’s job is to support the organization’s mission and vision.

Newly appointed CISO of Maricopa County, Lester Godsey returns to the podcast to discuss how CISOs transition between jobs. He shares his plan for his first 90 days as CISO of Maricopa County describing careful assessment and good communication.  

When asked about vendor relationships, Lester explains that the best vendors offer a partnership and recognize that it’s about securing the organization — even if that’s not with their product.

You can listen to more about public sector cybersecurity and vendor partnerships in our podcasts with Helen Patton and Taylor Lehmann.

03:11 — Humor as a tool to offer advice on best practices for selling to a CISO

05:43 — The best security salesperson is an ex-practitioner.

07:59 — Stop cold calling. 

09:56 — The characteristics of a great salesperson: engagement, knowledge, network.

13:49 — What makes a company a great place to work for a CISO?

Tired of the same intrusive sales tactics, Taylor Lehmann, CISO of Athenahealth, put together a tongue-in-cheek flowchart to try to educate vendors. In this podcast he discusses that flowchart and the best – and worst – practices for selling security.

Like many of our previous guests, Taylor reminds vendors that CISOs are looking for a partnership and that the relationship matters. In his opinion, the best salespeople exhibit and understand the same three characteristics – engagement, knowledge, network.

You can find Taylor’s flowchart here.

If you’d like to hear more on vendor advice and selling security listen to our podcasts with Tammy Moskites and Tom McAndrew.

ESG+T

01:39 — ESG+T. Why we must add Tech to Environmental, Social, and Corporate Governance.

04:33 — It all begins with leadership — if corporate leaders think ESG+T is important it will trickle into corporate culture. 

05:10 — Examples of the good governance ( Microsoft) and bad governance (Facebook).

07:21 — Managing ESG+T for traditional non-tech companies.

10:06 — These are difficult times but people can drive the necessary change.

In this podcast, regular Cyber360+ guest Andrea Bonime-Blanc talks about her new book “Gloom to Boom: How Leaders Transform Risk into Resilience and Value” and how it sets out why we must add tech to environmental, social, and corporate governance. She believes tech is an essential component as it is influential in every component of our lives. 

Andrea says the implementation of these practices begins with the leadership of a company and that they can be the differentiator in determining whether a company thrives or founders. In addition, she offers her own thoughts on — as well as examples of — what good and bad leadership looks like.

Listen to more about governance and ethics in business in our previous podcast with Andrea and our podcast with Shalini Trefzer.

A Data-centric Approach

Naresh talks data protection, risk awareness, and data-centric security.

02:50 — Protecting intellectual property and trade secrets.

05:51 — Data protection is multifaceted: on-prem, cloud storage, cloud sharing, telecom transit, portable devices.

10:45 — Data-centric security is essential. Educate employees on more than just phishing threats.

16:28 — GDPR is a live example of risk and compliance as two sides of the same coin.

21:01 — Build a risk-aware culture in your organization from the top down. 

In this podcast Naresh Podila, CISO of Pall Corporation, discusses the many facets to data protection in a large organization. He talks about rising to the challenge set by GDPR and what it taught him about a data-centric approach to security. 

Naresh shares his strategy for making an organization risk aware. He takes a top down approach and educates both the leadership and the grass roots of the enterprise. This approach is crucial in protecting Pall’s most important data, its intellectual property, and that is not governed by any kind of regulation but driven by economic survival.

Listen to more about data protection and regulation in our podcasts with Joseph Stuntz and Jake Olcott.