5G and OT

Jason talks about 5G and the business opportunities it offers as well as the risks in the OT environment.

01:26   5G and how it relates to OT.

06:47   The OT lifecycle is long, especially compared with IT lifecycles.

10:49   The mobile market is saturated. 5G is looking to the enterprise market, the OT market, that machine-to-machine, for profit.

22:19   As well as bringing security problems, 5G also brings the opportunity to solve them because for the first time there will be a bandwidth sufficient to provide effective monitoring.

Jason Haward-Grau Interview Transcript, September 2019

Cybersecurity’s Watchdog

Jason offers an insight into the philosophy and work of NSS Labs. He discusses outdated dogma in cybersecurity, offers advice for vendors from large players to scrappy startups, and shares why he chose a career in cyber – he knew it was a domain that would never be mundane. 

04:23  Vendors cover a spectrum of intents and interests; unfortunately, they are not always ethical.

06:46  How do NSS Labs maintain independence and impartiality?

11:37   Defence in depth – plurality does not equal better security

14:20  Vendors have an obligation to ensure they’re delivering an updatable, secure, maintained product within the lifespan

16:26  In virtualizing existing workloads in cloud environments, we are lifting and shifting risk from a data center to the cloud.

19:19  NSS Labs have found they can use JavaScript to bypass protections in just about every next-generation firewall available.

23:11  Large vendors should extend their product’s protections beyond the workplace to wherever the enduser is.

Jason Brvenik Interview Transcript

Ransomware and Local Government

Lester talks ransomware in the government environment, cybersecurity insurance, and data privacy as a two-way street.

02:21 Government is known for being bad at cybersecurity and purchasing insurance. This makes it a perfect malware target.

05:47 Don’t rely on cybersecurity insurance; it’s not a cure all. Look at your overall security framework instead.

13:23 Privacy is an issue with duality. Citizen’s data privacy must be respected, but to provide enhanced services, you need access to personal data.

Lester Godsey Interview Transcript

Security in Hardware

Yuriy talks security in firmware and hardware, building a product people need, and the secret to entrepreneurial success.

02:04 How disaster can shape a career, a person.

06:24 Some hardware and firmware manufacturers are starting to pay much more attention to vulnerabilities and securing their products, but too many just don’t care.

11:12 Get repeatable processes in place to scale your product, your sales, but also your team and your culture, and make it successful.

11:58 Build a product people actually need. Serve a need, don’t just put more tech out there.

15:50 Security capabilities need to be properly configured – otherwise they can’t protect us. This is part of the basic hygiene we should be practicing as an industry.

Yuriy Bulygin Interview Transcript

Crowdsource in Cybersecurity

Rubric.

05:50 It is as important to learn from your failures as your successes. It shapes you as a leader.

08:23 A company must embody, as part of normal business practices, what it means to do the right thing, then it becomes company culture.

11:88 Quantum computing — the higher the bandwidth, the deeper the encryption has to go.

13:27 In handling large amounts of data, got to have security built into your technology from the beginning.

15:58 Two great ways to bridge the skills gap: train and nurture interns and embrace crowdsourcing.

Trish Dixon Interview Transcript

The Right to Know

Brian talks about the need for constant monitoring in security and argues that we should be able to ask the data collectors, like Google and the government, what they know about us.

05:09 The permissive culture the internet was built with is the reason we have so many security issues today

07:57 Blockchain is one potential way to improve the trust dynamic in cyberspace.

10:31 There is no mechanism for consumer to ask the data collectors —Google, Facebook, Carriers, the government — what they know about you, and there should be. Is it time for legislation?

16:25 You can buy security, but you can never stop monitoring.

Brian NeSmith Interview Transcript

Cloud Security is a Shared Responsibility

John talks about CSA’s main areas of focus, the challenge of staying up to date in an ever-evolving space, and the importance of participating in new learning.

01:50 CSA’s three areas of focus are helping people transition to cloud, enhance cloud security,and adopt new technologies delivered through cloud.

05:37 Cloud security needs to be based on a shared model.

10:52 How you build security culture within your organization?

15:00 Education and training is a constant. Read, absorb, download, but most of all, participate.

4

John Yeoh Interview Transcript

How to Plug the Skills Gap

Tammy talks about identity management, diversity, and the usefulness of mentoring and internships in helping to fill the skills gap.

04:19 Fill the skills gap by recruiting from universities. Encourage students into internships and then groom and mentor them.

08:03 Vendors — you need a relationship and a network to get a foot in the door.

11:09 Asset inventory continues to be a critical issue, but is ever harder to maintain in our transformative age.

12:38 Persona identity is very impactful.

Tammy Moskites Interview Transcript

A Digital Geneva Convention

Sergio talks about the cyberspace power vacuum, the challenge of ICS cybersecurity, and mental health issues in an incredibly pressured industry.

02:42 ICS cybersecurity is one of the most important and preeminent challenges we face because of the direct relationship to lives.

07:10 There are significant mental health issues in the cybersecurity community. We need to be more open in discussing this and helping each other.

13:27 We face a policy and power vacuum in cyberspace. We need a digital Geneva Convention.

20:43 Cyber professionals have to hold each other to account — we should be nice to each other personally but fight each other professionally to find the right answer.

Sergio Caltagirone Interview Transcript

Helen discusses the importance of ethics in security teams, vendor relationship goals, and the inherent goodness of the cybersecurity community.

03:17 Part of the CISO role is to translate the business need to the vendor and the vendor product value to the business.

03:49 Higher education cybersecurity risk profiles have a timeline.

07:55 How can vendors really learn how to provide value? Research and understand the CISO, their business environment, and their challenges. And once you’re in, listen.

14:11 Ethics should be a key driving value in the security team and in the vendor product.

Helen Patton Interview Transcript