All links and images for this episode can be found on CISO Series (https://cisoseries.com/archaeologists-dig-up-the-remains-of-an-optimistic-ciso/)

It it believed that in ancient times cybersecurity was successfully fought with a glass half full approach. Today's pessimistic CISOs have yet to confirm the findings.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest is George Finney (@wellawaresecure), CISO, Southern Methodist University and author of "Well Aware: The Nine Cybersecurity Habits to Protect Your Future".

Thanks to our sponsor, Netskope.

The Netskope security cloud provides unrivaled visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. Only Netskope understands the cloud and takes a data-centric approach that empowers security teams with the right balance of protection and speed they need to secure their digital transformation journey.

On this week's episode

Vendors have questions our CISOs have answers

Neil Saltman of Anomali runs a CISO meetup group and he asks, "A common topic is CISOs going back to platform vendors versus best of breed because they are overwhelmed. When do you buy best of breed vs. just add it to the stack from Microsoft or other large vendors… When I worked at Bromium I had a CISO tell me 'I’ll buy your product when Microsoft buys you.'"

Mike Johnson leans more to best-of-breed or in some cases build it yourself. Can Mike sympathize with these other CISOs and what would his situation have to be to make a platform play?

What I learned from a CISO

One of the main tenets of George's new book, "Well Aware: The Nine Cybersecurity Habits to Protect Your Future" is that optimists outperform pessimists in productivity, wealth, and longevity. The "Department of No" cybersecurity people are just hurting themselves. You argue that the more positive attitude can be garnered by learning from people who have successfully protected their communities. What are examples of watching another's success, and what can you learn?

What's Worse?!

Both are going to cause problems. It's tough to say which one's worse.

It's time for "Ask a CISO"

We've got a request for career advice, from an anonymous listener. We'll call him Steve. Steve has been with his company 14 years and they were recently acquired and the new company was calling the shots. After the acquisition, the CISO and Steve were working on bringing the merged companies up to compliance standards and dealing with audits: SOC 2, Sarbanes-Oxley, PCI, etc. CISO was planning on leaving the company in 2021 and grooming Steve to replace him. Then COVID hit and the company gave the CISO a beautiful severance package leaving Steve with all the CISO's responsibilities, but not the title change or salary. Steve asked the CIO about plans to replace the CISO and the CIO said Steve could apply once the position was announced. That was 5 months ago. Steve likes his job and the people he's working with but he's frustrated with no clear vision of future plans. We offer up some advice for Steve.

What’s the best way to handle this

Can we opt-in to cybersecurity awareness? At one of our live shows I asked the audience, "Who has gone through security awareness training?" Every hand went up with a loud audible groan. Most of us would like to opt-out of this mandated training. What if our coworkers could be enticed to opt-in? It's the end of cybersecurity awareness month. What have you done or seen others do that's actually worked? And now the far trickier question, what has worked over a long time?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/can-a-robot-be-concerned-about-your-privacy/)

I want AI to be efficient, but I also want my space.

This week's episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest is Rebecca Weekly (@rebeccalipon), senior director of hyperscale strategy and execution, senior principal engineer, Intel.

Thanks to this week's podcast sponsor, Intel.

Intel’s new suite of security features in the upcoming Xeon Scalable platform improves data confidentiality and integrity in a world that increasingly relies on it. Features like Intel SGX further enable confidential computing scenarios — crucial for organizations in regulated industries to meet growing security requirements and protect sensitive data.

On this week's episode

Why is everybody talking about this now

"The lack of women in cybersecurity leaves the online world at greater risk," stated Naomi Schalit of The Conversation. Mollie Chard of Capgemini shared the article that generated a lot of conversation. Naomi hit many issues we've discussed before like diversity offers different viewpoints, which is critical for building a cybersecurity program.

I would like to focus on the dynamic of the security team. I've been in testosterone-fueled environments and things change dramatically when just one woman enters the room. And it changes even more when there are more women. What is that dynamic, why is it valuable, and what's the danger of the all-male environment?

Well that didn’t work out the way we expected

At the end of every show I ask our guests, "Are you hiring?" And prior to COVID, almost everyone said desperately, "YES, we're hiring." That has changed dramatically for the worse since COVID started. Emma Brighton has a story on InfoSecurity Magazine about the real shortage that's happening. Problems she points to are the need to secure more communications channels, security people being offloaded to do IT support, and the competition for skilled talent. What is COVID doing to our security environment and our staff?

What's Worse?!

Everyone in the loop or out of the loop?

Please, Enough. No, More.

Today's topic is security on the chipset. We have never talked about this on the show, but now we've got someone from Intel and it seemed appropriate now would be the time to do just that. What have we heard enough about chip-level security, and what would we like to hear a lot more?

Are we having communication issues

Will the fight to maintain privacy always be in conflict? The people who collect data always want more information so they can get greater insights. Outside of regulations, they have no incentive to maintain privacy. As we're collecting more and more information automatically and artificial intelligence systems are making decisions for us, can AI systems be made privacy aware while still being effective at gaining insights? What would that even look like?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/bonus-episode:-innovators-spotlight/)

What makes a security solution innovative? Where do you think security desperately needs innovation? And what do you look for in a security vendor's presentation?

On this very special bonus episode of CISO/Security Vendor Relationship Podcast, I invite two special guests, David Tyburski, CISO, Wynn Resorts and Matt Crouse (@mattcrouse), CISO, Taco Bell to answer that very question AND determine if any of the three competing security vendors during the Evanta 2020 Global CISO Virtual Executive Summit were in fact innovative.

Our three competitors (and also sponsors) were:

John Worrall (@jworrall), CEO, ZeroNorth

Nick Halsey (@nickhalsey), CEO, Okera

Demetrios Lazarikos, CEO and co-founder, Blue Lava

Thanks to these sponsors and Evanta for their support on this episode.

All links and images for this episode can be found on CISO Series (https://cisoseries.com/a-phish-so-insidious-you-cant-help-but-be-jealous/)

Wait, that's a phish even I'd fall for.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week is Matt Crouse, CISO, Taco Bell.

Huge thanks to our sponsor, CloudKnox.

CloudKnox Security is the market leader within Gartner’s newly defined Cloud Infrastructure Entitlement Management (CIEM) segment. CloudKnox transforms how organizations implement the principle of least privilege in the cloud and empowers security teams to proactively address accidental and malicious credential misuse by continuously detecting and mitigating insider risks.

On this week's episode

Here’s some surprising research

Here's a depressing statistic. Ninety four percent of security and business leaders say they've suffered "one or more business-impacting cyberattacks in the last year — that is, an attack resulting in a loss of customer, employee, or other confidential data; interruption of day-to-day operations; ransomware payout; financial loss or theft; and/or theft of intellectual property." This according to a Forrester Consulting study sponsored by Tenable. Do we accept the sobering fact that a business-impacting cyberattack is an annual inevitability? And if so, what percentage of a CISO's job is putting systems in place to minimize damage, and what are ways you do that?

If you're not paranoid yet here’s your chance

Get ready for a really nasty phishing attack. Craig Hays, bug bounty hunter particularly interested in phishing, tells a story of a wormable phish that after taking over one user's email account began to reply to legitimate email threads from that account. The phisher would actually read the thread and create a relevant response, but with a phishing link which would then compromise another user's email account in the same way. And the phisher would repeat the process from yet another account, causing this wormable phish to spread not just through the initially targeted company, but through their partners, suppliers, and their partners and suppliers.

At the time Craig's company didn't have multi-factor authentication (MFA) implemented to which Craig realizes that would stop such an attack. Yet, in the end he was very impressed with this type of attack because it has so many indicators of legitimacy. Have we experienced a similar attack and/or do we have a "favorite" phishing attack in terms of its effectiveness?

What's Worse?!

Audit season is about to begin.

What would you advise?

On the Cybersecurity subreddit, GenoSecurity asks, "What types of projects would look good on a resume since I have no work experience. I am also open to projects that might not look as good but are good for beginners since I’m currently working on my Net+ cert."

Close your eyes and visualize the perfect engagement

Last Friday we had an online after party using a new tool called Toucan which simulates a real party in a virtual setting. We've also used a platform called Icebreaker that allows for one-on-one random meetups. And last week I participated in a table top cyberthreat exercise with Bruce Potter of Expel and Shmoocon that ran like a Dungeons and Dragons role playing game. All were fun and had their value. Since the launch of the pandemic, how have we been able to socialize and stay connected in fun and unique ways?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/whether-its-vulnerabilities-or-children-we-like-to-pick-favorites/)

While you do have to claim all of your vulnerabilities and your children, you don't have to like all of them.

This episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest this week is Ben Sapiro, global CISO, Great-West LifeCo.

HUGE thanks to our sponsor, Kenna Security.

With Kenna Security, companies efficiently manage the right level of risk for their business. Our Modern Vulnerability Management model eliminates the friction between Security and IT teams about what to patch, providing clear prioritization based on real-time threat intelligence and guidance applied to each customer’s unique environment across infrastructure, applications and IoT.

On this week's episode

Why is everybody talking about this now

Do you have a clear overall picture of how you're protecting your environment? The Cyber Defense Matrix, an open source tool created by Sounil Yu, a former guest, offers a simple five-by-five grid with the x-axis being the five operational functions of the NIST Cybersecurity Framework and the Y-axis are the five asset classes cyber professionals are trying to secure (devices, applications, networks, data, users). The idea is you are supposed to fill in all 25 squares as best as possible to see where you might have gaps in your security program. Ross Young, CISO, Caterpillar Financial Services Corporation, and a recent guest on this show, has adapted the matrix, by changing the Y-axis to four risks of phishing, ransomware, web app attacks, third party risks.

So what's a better way of building out at your security program: by the assets that you're trying to protect or the risks that you're facing? What are the pros and cons of each method?

Can you change Mike's mind

On a previous show Mike said he is NOT a fan of security through obscurity. Utku Sen of HackerOne argues that security through obscurity is underrated. His argument was that adding "obscurity" is often costless and it adds another layer in your defense in depth program. It is far from bulletproof, but obscurity reduces the likelihood which lowers your overall risk. Examples he included were obfuscating your code in your program, and/or using random variables in the code.

Can we change Mike's mind? Is there a level of security through obscurity he has deployed and/or would consider?

What's Worse?!

What's better? Good and bad data or no data?

Please, enough! No, more.

Today's topic is vulnerability management, or specifically, vulnerability remediation. What have you heard enough of on vulnerability management, and what would you like to hear a lot more?

Question for the board

What misconceptions does the board have of the role of the CISO? On LinkedIn, Amar Singh of Cyber Management Alliance Limited, listed off what the CISO is and, isn't, and what inappropriate demands are made on them. He said the CISO is
-NOT a super-being or a magician
-NOT there to fix IT blunders
-NOT the only guardian of the realm
-Unable to STOP all cyber-attacks.
-NOT a scapegoat/sacrificial lamb
-NOT accountable but responsible

We often get the sense that CISOs do play these roles as they come in and out. What can be done to temper these beliefs? "