Africa-focused technology, digital and innovation ecosystem insight and commentary.
…
continue reading
Player FM - Internet Radio Done Right
Checked 2M ago
추가했습니다 two 년 전
Adopting Zero Trust에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Adopting Zero Trust 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Adopting Zero Trust와 비슷한 콘텐츠
Show notes are at https://stevelitchfield.com/sshow/chat.html
…
continue reading
T
The Talk Show With John Gruber
1
The Talk Show With John Gruber
Daring Fireball / John Gruber
2k
343
The director’s commentary track for Daring Fireball. Long digressions on Apple, technology, design, movies, and more.
…
continue reading
The power of Data is undeniable. And unharnessed - it’s nothing but chaos. Making data your ally. Using it to lead with confidence and clarity. Host Jess Carter is solving problems in real-time to reveal what’s possible. Helping communities and people thrive. This is Data Driven Leadership, a show brought to you by Resultant.
…
continue reading
Download This Show is your weekly guide to the world of media, culture, and technology. From social media to gadgets, streaming services to privacy issues. Each week Rae Johnston and guests take a fun, deep dive into how technology is reshaping our lives.
…
continue reading
Android Backstage, a podcast by and for Android developers. Hosted by developers from the Android engineering team, this show covers topics of interest to Android programmers, with in-depth discussions and interviews with engineers on the Android team at Google. Subscribe to Android Developers YouTube → https://goo.gle/AndroidDevs
…
continue reading
We help founders make something people want.
…
continue reading
This is the audio podcast version of Troy Hunt's weekly update video published here: https://www.troyhunt.com/tag/weekly-update/
…
continue reading
R
Redefining AI - Artificial Intelligence with Squirro
1
Redefining AI - Artificial Intelligence with Squirro
Squirro
12k120
Redefining AI is the 2024 New York Digital Award winning tech podcast! Discover a whole new take on Artificial Intelligence in joining host Lauren Hawker Zafer, a top voice in Artificial Intelligence on LinkedIn, for insightful chats that unravel the fascinating world of tech innovation, use case exploration and AI knowledge. Dive into candid discussions with accomplished industry experts and established academics. With each episode, you'll expand your grasp of cutting-edge technologies and ...
…
continue reading
A podcast about web design and development.
…
continue reading
Player FM -팟 캐스트 앱
Player FM 앱으로 오프라인으로 전환하세요!
Player FM 앱으로 오프라인으로 전환하세요!
))
들어볼 가치가 있는 팟캐스트
스폰서 후원
L
Lost Cultures: Living Legacies
On the Season 2 debut of Lost Cultures: Living Legacies , we travel to Bermuda, an Atlantic island whose history spans centuries and continents. Once uninhabited, Bermuda became a vital stop in transatlantic trade, a maritime stronghold, and a cultural crossroads shaped by African, European, Caribbean, and Native American influences. Guests Dr. Kristy Warren and Dr. Edward Harris trace its transformation from an uninhabited island to a strategic outpost shaped by shipwrecks, colonization, the transatlantic slave trade, and the rise and fall of empires. Plus, former Director of Tourism Gary Phillips shares the story of the Gombey tradition, a vibrant performance art rooted in resistance, migration, and cultural fusion. Together, they reveal how Bermuda’s layered past continues to shape its people, culture, and identity today. You can also find us online at travelandleisure.com/lostcultures Learn more about your ad choices. Visit podcastchoices.com/adchoices…
Hacker Valley Dishes on Breaking Into Cybersecurity
Manage episode 396087753 series 3462572
Adopting Zero Trust에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Adopting Zero Trust 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
To start the new season, we are joined by Hacker Valley Media’s Ron Eddings and Chris Cochran, who discuss breaking into cybersecurity and the role storytelling plays.
A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people.
People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny.
And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills.
Read more at adoptingzerotrust.com
56 에피소드
공유Manage episode 396087753 series 3462572
Adopting Zero Trust에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Adopting Zero Trust 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
To start the new season, we are joined by Hacker Valley Media’s Ron Eddings and Chris Cochran, who discuss breaking into cybersecurity and the role storytelling plays.
A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people.
People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny.
And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills.
Read more at adoptingzerotrust.com
56 에피소드
Усі епізоди
×
A
Adopting Zero Trust
1 How Critical Infrastructure Leaders Are Rethinking Cybersecurity 44:32
44:32 
나중에 재생 
나중에 재생 
리스트 
좋아요 
좋아요44:32
나중에 재생 나중에 재생 리스트 좋아요 좋아요In this episode of Adopting Zero Trust, hosts Elliot Volkman and Neal Dennis discuss critical infrastructure security with expert guest Ian Branson, Vice President of Global Industrial Cybersecurity at Black and Veatch. The discussion centers around the philosophical and strategic approaches to handling incidents and breaches, especially in the operational technology (OT) realm. Branson highlights the importance of understanding what needs protection, the integration of IT and OT security, and the crucial role of threat intelligence. They also explore the evolving need for converging physical and digital security data to manage risks effectively. 01:37 Starting Point for Protecting Critical Infrastructure 04:52 Funding and Resource Allocation for Cybersecurity 10:57 Threat Intelligence and Incident Response 16:25 IT and OT Convergence 23:47 Discussing Employee and Equipment Management 26:19 Integrating Physical and Cyber Security 34:39 Proactive Security Measures in New Constructions 40:46 Balancing Rapid Response and Availability…
A
Adopting Zero Trust
In this episode of Adoption Zero Trust (AZT), host Neal Dennis and producer Elliot Volkman sit down with Bradon Rogers, Chief Customer Officer at Island, to discuss how AI is compounding the already existing problems tied to shadow IT. The conversation explores how modern enterprises handle the growing complexities of unregulated software use, the role of enterprise browsers in mitigating risks, and the dynamic between user experience and cybersecurity. 01:16 Shadows within shadows 04:15 AI in Approved Solutions 09:14 Enterprise Browser and Security 14:25 Transition to Browser-Based Applications 16:23 Enterprise Browser Capabilities 18:45 Data Protection and Shadow IT 24:39 Shepherding Data in the Enterprise Browser 25:17 Policy Perspectives on AI and Data Flow 28:16 Exploring SBOM and AI Integration 35:39 Browser Security and Application Boundaries 41:40 BYOD and Privacy Concerns 44:48 Third-Party Scenarios and Onboarding…
A
Adopting Zero Trust
1 Live at ZTW2025: Cyberwire Daily’s Dave Bittner + Dr. Zero Trust 32:50
32:50 나중에 재생 나중에 재생 리스트 좋아요 좋아요32:50
나중에 재생 나중에 재생 리스트 좋아요 좋아요Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Live from ThreatLocker’s Zero Trust World (ZTW), cybersecurity heavyweights Dave Bittner , host of CyberWire Daily and Dr. Chase Cunningham AKA Dr. Zero Trust shared their unfiltered thoughts on the state of cybersecurity, AI, and government regulations. From the shifting landscape of compliance enforcement to the role of hitting critical mass of AI in both defense and cybercrime, we can expect an extraordinary level of change in the years ahead. 01:37 Cybersecurity Landscape Overview 01:58 Government and Cybersecurity 02:39 Leadership and Appointments in Cybersecurity 03:47 Future of CISA and Compliance 06:41 Managing Cybersecurity News 14:54 The Role of LLMs in Cybersecurity 16:22 Global Perspective on AI and LLMs 18:47 Reflecting on Past Technological Predictions 20:18 The Double-Edged Sword of AI and Surveillance 24:21 The Dark Side of Technological Advancements 26:17 Debating the Term 'AI' and Its Implications 28:43 Historical Anecdotes and Unanswered Questions…
A
Adopting Zero Trust
1 Rapid fire update: Silk Typhoon and DOJ's indictment of twelve Chinese nationals 3:20
3:20 나중에 재생 나중에 재생 리스트 좋아요 좋아요3:20
나중에 재생 나중에 재생 리스트 좋아요 좋아요New intelligence: Silk Typhoon, formerly tracked as HAFNIUM, is a China-based threat actor most recently observed targeting IT supply chains in the US. Today, we released a new report in conjunction with the Department of Justice's action against twelve Chinese nationals that includes mercenary hackers, law enforcement officers, and employees of a private hacking company. This group has been charged in connection with global cyberespionage campaigns. Dive into our latest blog for all the details.…
A
Adopting Zero Trust
1 Predicting the year of cybersecurity ahead (minus regulations) 1:02:52
1:02:52 나중에 재생 나중에 재생 리스트 좋아요 좋아요1:02:52
나중에 재생 나중에 재생 리스트 좋아요 좋아요It’s mid-February, but somehow, we’ve already been through what feels like a year's worth of change in the cybersecurity and regulation world. Beyond the standard incidents, outages, and attacks… there have been obvious impacts that have downstream effects. Regardless of regulatory changes, which we’ll cover as those impact our space, AZT brought together a few minds who have thoughts on the year ahead. To properly kick off season four, we have the privilege of chatting with two wonderful guests: Lawrence Pingree , VP of Technical Marketing at Dispersive, but you are more likely to know his name from his time at Gartner. However, he has a varied background ranging from CTO to security engineer, so don’t let that marketing line in his title fool you. Oliver Plante , VP of Support at ThreatLocker, has around 15-20 years of IT under his belt. He also has seen a thing or two when it comes to implementing new cybersecurity strategies 03:21 Predictions for the Year Ahead 04:06 Zero Trust and Least Privilege 05:40 The Future of Cyber Defense 07:21 AI and Cybersecurity 08:41 Threat Intelligence and Preemptive Defense 09:50 Challenges and Innovations in Cybersecurity 14:23 The Role of AI in Cyber Attacks 26:18 Quantum Computing: Threat or Savior? 29:31 Passwordless Security: The Future 30:57 Challenges of Deepfake Technology and Passwordless Security 33:03 Blockchain and Its Applications in Security 35:33 Debate on Password Management Practices 38:03 User Responsibility and Security Automation 47:50 Government's Role in Cybersecurity 57:14 Future of Cybersecurity and Zero Trust…
A
Adopting Zero Trust
Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Neal and I are excited to welcome you back to AZT as we kick off our fourth season. After four years of trying out different formats and episodes, including at least an entire season terrorizing vendors for slapping Zero Trust on their box as if it were something you could buy, we’re ready to narrow our focus a bit.…
A
Adopting Zero Trust
1 The key to growing a cybersecurity career are soft skills 50:38
50:38 나중에 재생 나중에 재생 리스트 좋아요 좋아요50:38
나중에 재생 나중에 재생 리스트 좋아요 좋아요In this episode of 'Adopting Zero Trust (AZT)', host Neal Dennis and producer Elliot Volkman delve into the often-overlooked realm of soft or 'non-tech' skills in cybersecurity. This week, we chat with Courtney Hans , VP of Cyber Services at AmTrust Financial Services, and Evgeniy Kharam , author of Architecting Success: The Art of Soft Skills, who help us explore how non-technical skills are vital in shaping the careers of cybersecurity professionals. Our guests share the importance of effective communication, emotional intelligence, and adaptability. The hosts and guests share personal anecdotes, training tips, and the necessity of bridging technical prowess with essential soft skills to improve stakeholder engagement and career advancement. The episode emphasizes the value of being comfortable with discomfort and soliciting feedback to enhance one’s professional journey in cybersecurity.…
A
Adopting Zero Trust
1 Behind the scenes of cybersecurity media and reporting 1:04:53
1:04:53 나중에 재생 나중에 재생 리스트 좋아요 좋아요1:04:53
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 15: We gather a panel of journalists, communications, and a researcher to discuss how cybersecurity news and incidents are reported. You can read the show notes here . In the world of cybersecurity journalism, you can broadly divide it into four competing forces: reporters, communications teams, researchers, and readers. Each requires the other to accomplish its goals, but they all have very different priorities and goals. Journalists have a duty to inform the public about security-related events. Communication teams have a duty to inform the public about related incidents and research, but in a controlled setting. Researchers help provide answers to communication teams and journalists. Readers want to be informed of information that impact them, and their habits shape what kind of reporting is invested in the most. This week we explore some of these dynamics by bringing together a panel representing comms, journalism, and research to discuss the game of tug-of-war during incident response and incident reporting. Danny Palmer was a long-standing cybersecurity reporter at ZDNet prior to recently joining DarkTrace, Josh Swarz is the Senior Communications Manager at Microsoft focusing on threat intelligence, our host Neal Dennis is former NSA and has lived many lives around either keeping secrets or uncovering them, and producer Elliot Volkman has been a reporter for two decades and works with Josh on elevating research at Microsoft Threat Intelligence.…
A
Adopting Zero Trust
1 GRC tool or spreadsheets, that is the question | GRC Uncensored Preview 43:13
43:13 나중에 재생 나중에 재생 리스트 좋아요 좋아요43:13
나중에 재생 나중에 재생 리스트 좋아요 좋아요In our final preview episode of GRC Uncensored, we explore a particularly bipolar debate: do you need a GRC tool to manage compliance, or will spreadsheets suffice? After this, we will be back to our regularly produced AZT episodes. The last episodes of our pilot for GRC Uncensored can be found on your favorite podcast app or newsletter on Substack.…
A
Adopting Zero Trust
1 Podcast Preview: GRC Uncensored and the commoditization of compliance 41:30
41:30 나중에 재생 나중에 재생 리스트 좋아요 좋아요41:30
나중에 재생 나중에 재생 리스트 좋아요 좋아요We are interrupting our regularly scheduled podcast series to introduce you to a new series we developed: GRC Uncensored. This pilot season will elevate conversations about GRC that are often buried under millions of dollars in marketing spend. No boring talks about controls or frameworks, just unfiltered discussions with auditors and practitioners in the GRC space. We'll be back to our regular AZT episodes in a couple of weeks. ----- In the first episode of 'GRC Uncensored,' hosts Troy Fine, dubbed the 'GRC Meme King,' and Elliot Volkman, alongside guest Kendra Cooley dive into the complexities of Governance, Risk, and Compliance (GRC) in cybersecurity. The discussion unravels the 'love-hate' relationship many security professionals have with compliance frameworks like SOC 2, exploring how they have become commoditized and possibly devalued over time. The conversation touches upon the challenges security practitioners face in conveying the true value of GRC to businesses, the potential pitfalls of 'SOC in a box' offerings, and the broader implications of compliance becoming a 'check the box' exercise. Moreover, the episode delves into the broader regulatory landscape and the ongoing debates about the role of government regulations in cybersecurity compliance. This candid dialogue sets the stage for future episodes that promise further to dissect the nuances of cybersecurity audits and standards. 00:00 Welcome to GRC Uncensored 01:34 Introducing Kendra Cooley 02:05 Love-Hate Relationship with GRC 03:16 The SOC 2 Debate 04:33 Challenges with SOC 2 Audits 09:10 The Value of SOC 2 in the Industry 12:04 The Evolution of Compliance Frameworks 20:39 False Sense of Security in Compliance 24:46 The Buzz Around AI and Quantum 25:10 Staying Updated as a Security Professional 26:45 Challenges in Penetration Testing and Vendor Assessments 27:37 Compliance and Its Impact on Security 30:10 Government Regulations and Their Effectiveness 32:23 The Complexity of Privacy Laws 38:29 The Role of GRC Teams in Risk Management 42:30 Concluding Thoughts and Future Episodes…
A
Adopting Zero Trust
Welcome back to Adopting Zero Trust! In this episode, hosts Elliot Volkman and Neal Dennis are joined by Rob Allen, Chief Product Officer of ThreatLocker, to dive deep into the operationalization of Zero Trust. Despite covering various aspects over three seasons, this crucial topic is addressed thoroughly. They explore pre-adoption preparation, aligning organizational actions, and the importance of education in security. Additionally, the conversation highlights the 'assume breach' perspective and how concepts like default deny and least privilege are essential. With real-world examples and anecdotes, they provide actionable insights on implementing Zero Trust strategies effectively. Tune in to learn about the foundational steps necessary to transition into a Zero Trust environment. This is the first of a three-part mini-series, so stay tuned as we explore more aspects of how to prepare your organization for adopting a Zero Trust strategy.…
A
Adopting Zero Trust
Season 3, Episode 13: Cato Network’s Etay Maor provides fresh research on the abuse of unpatched log4j libraries. Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . This week on Adopting Zero Trust (AZT), we highlight a significant cybersecurity risk focused on the notorious Log4j vulnerability and the growing concern around shadow IT. Featuring expert insights from Etay Maor, the Chief Cybersecurity Strategist at Cato Networks, the conversation initially looks into the persistent exploitation methods, the importance of knowing one’s cybersecurity environment, and strategic approaches to mitigating risks.…
A
Adopting Zero Trust
1 Overturning of Chevron Deference’s Impact on Cybersecurity Regulation 51:44
51:44 나중에 재생 나중에 재생 리스트 좋아요 좋아요51:44
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 12: Could the overturning of Chevron Deference impact cybersecurity and privacy regulations? Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Welcome back to Adopting Zero Trust or AZT. In our latest episode, we assembled a distinguished panel to dig into a timely topic affecting the cybersecurity landscape but has the fog of war wrapped around it. Today’s conversation centered around the recent developments in cybersecurity regulations and their potential impacts, ignited by the Supreme Court overturning Chevron Deference. This, of course, has other potential impacts on all regulation types enforced and shaped by federal agencies, but our focus is, of course, on cybersecurity, privacy, and AI. The Panel We welcome back Ilona Cohen, Chief Legal and Policy Officer at HackerOne, who joined us last year to discuss the National Cybersecurity Strategy . Ilona is also the former General Counsel for OMB. We are also joined by the GRC meme king, Troy Fine, the Director of SOC and ISO Assurance Services at Gills Norton. Beyond the memes, Troy takes a practical perspective on regulations and acts as our voice for those who may be most immediately impacted. Key Takeaways Chevron Deference overturned: The Supreme Court's decision removes the requirement for courts to defer to federal agencies' interpretations of ambiguous statutes and now relies on the courts. Increased regulatory uncertainty: This ruling may lead to more challenges to existing and future regulations, potentially affecting cybersecurity and AI policies. State vs. Federal regulation: The uncertainty at the federal level might prompt states to act more quickly on issues like AI and cybersecurity, potentially creating a patchwork of regulations. Impact on AI regulation: With about 40 federal bills addressing AI in the pipeline, the ruling could complicate the process of creating comprehensive federal AI regulations. Cybersecurity implications: Existing and proposed cybersecurity regulations, such as the Cyber Incident Reporting for Critical Infrastructure Act, may face new challenges. Business concerns: While some business organizations applauded the ruling, the resulting regulatory uncertainty could be problematic for companies trying to plan and comply with regulations. Expertise concerns: There are worries that courts may lack the technical expertise to make decisions on complex technological issues like AI without deferring to agency experts. Potential for innovation: The regulatory uncertainty might create a wild west period for AI, potentially fostering innovation before more stringent regulations are imposed. Self-regulation importance: In the absence of clear federal regulations, industry self-regulation initiatives may become more significant, especially in rapidly evolving fields like AI.…
A
Adopting Zero Trust
Season 3, Episode 11: Vulnerability management is critical to any Zero Trust strategy, but you probably already know that. Fortra’s Tyler Reguly breaks down severity vs. risk. Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Every organization relies on some form of technology to run, and each tool you add increases the risk of vulnerabilities causing problems. If you don’t stay on top of patching, you increase the odds of a bad actor finding their way more easily within your network. This week, we chat with Tyler Reguly, a senior manager of security research at Fortra, who shares insights from his 18 years in vulnerability management. Tyler discusses the importance of staying on top of patching to maintain a Zero Trust strategy, the differences between vulnerability and patch management, and emphasizes that the Common Vulnerability Scoring System (CVSS) measures severity, not risk. We also briefly nerd out about the significance of groups like the Canadian Cyber Threat Exchange (CCTX) for knowledge sharing and collaboration in cybersecurity. And then, we wrap things up by exploring the efficacy of existing security policies and benchmarks, such as CIS and DISA STIGs, and the role of vendor relationships in maintaining effective security practices.…
A
Adopting Zero Trust
1 The Unstoppable Phish: A Discussion with Vivek Ramachandran 26:31
26:31 나중에 재생 나중에 재생 리스트 좋아요 좋아요26:31
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 10: Elliot chat’s with Vivek Ramachandran of SquareX about his approach to tackling the impossible: Social engineering. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . For nearly three decades, social engineering, particularly phishing, has been one of the most impactful and financially draining cyber threats. Between security awareness training, email security gateways, generative AI, enterprise browsers, and a slew of other tech like EDRs and XDRs, social engineering has yet to be thoroughly thwarted. The reason for that is straightforward enough: social engineering is a psychological threat, not just a technological one. In our last round of interviews from RSA, we chatted with Vivek Ramachandran, the founder of SquareX, who is attempting to tackle the challenge. Vivek also walks us through a more realistic perspective of how threat actors use generative AI today, which goes beyond the more unique what-if scenarios we’ve seen in headlines in the past two years. Key Takeaways Social engineering and phishing attacks remain a significant threat, and everyone can be a target. The sophistication of these attacks has increased due to advances in AI. AI can craft messages that sound remarkably like someone the recipient knows, enabling rapid scalability. Social media platforms are becoming common channels for launching phishing attacks. Attackers exploit the trust that users place in these platforms and their contacts. Vivek Ramachandran's company, SquareX, deploys a browser extension that can attribute attacks and detect and block them in real-time, providing valuable information to the enterprise. Traditional technologies like Secure Web Gateways (SWG) have matured, and attackers can easily bypass them. Enterprise browsers solve the problem for a small niche group of websites but have adoption friction due to the inconvenience of having a dedicated browser.…
A
Adopting Zero Trust
1 Breaking Down the SMB Threat Landscape and The Value of MSPs with SonicWall 46:22
46:22 나중에 재생 나중에 재생 리스트 좋아요 좋아요46:22
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 9: We chat with SonicWall’s Doug McKee about the top 5 threats targeting SMBs based on recent research. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Cybersecurity challenges come in many different flavors regardless of how old your company is or how many employees it houses. Larger companies have to deal with layers upon layers of technology, processes, and the people who support it. Smaller organizations are resource-constrained, often lack the experience or expertise to build a proper program, and typically rely on external support systems. While larger companies may not be nimble, typically, they employ and understand the value of threat intelligence to hone in on risks that could impact the business. They also have larger targets on their back because they are seen as more valuable targets for data, financial drain, and other nefarious purposes. In the same, smaller organizations may not be as valuable as a direct target, but they can be seen as a doorway into these larger companies. It’s for these reasons that supply chain attacks, even older ones, are among the top threats targeting small businesses and startups. This week on AZT, we examine the top five threats targeting startups and small businesses and chat with SonicWall’s Executive Director of Threat Research about the WHY behind them. As a researcher and educator through SANS, Doug McKee shares his perspective on why smaller shops need to consider threat intelligence as part of their cybersecurity program and how MSPs can help fulfill that capability. Top 5 threats to SMBs (According to SonicWall) Log4j (2021) more than 43% of organizations were under attack Fortinet SSL VPN CVE-2018-13379 - 35% of orgs were under attack Heartbleed (2012) - 35% of organizations Atlassian CVE-2021- 26085 - 32 % Vmware CVE-2021 - 21975 - 28% of orgs The Guest: Douglas McKee Doug is an experienced information security professional who possesses extensive technical expertise acquired through involvement in application and system security testing, hardware and software vulnerability research, malware analysis, forensics, penetration testing, red team exercises, protocol analysis, application development, and risk mitigation activities. These technical proficiencies are complemented by adept leadership and communication skills, honed through the leadership of teams and projects, collaboration within both large and small teams, and the composition of technical reports for clients. Doug is recognized for discovering numerous CVEs and regularly speaks at prominent security conferences such as Blackhat, DEFCON, RSA, Hardware.io , and Ekoparty. Additionally, Douglas's research is frequently featured in publications with a wide readership, including Wired, Politico, Bleeping Computer, Security Boulevard, Venture Beat, CSO, Politico Morning eHealth, Tech Republic, and Axios. Key Takeaways None of these vulnerabilities in SonicWall’s research were found or disclosed between 2022-2024, and yet we’re still dealing with them Old vulnerabilities remain a significant threat The most widespread attacks for SMBs include Heartbleed and Log4j vulnerabilities Many widespread vulnerabilities are supply chain vulnerabilities These vulnerabilities are embedded in multiple products and systems Patching vulnerabilities can be complex and costly Compliance and regulatory standards can complicate the process Attackers are becoming increasingly nuanced in their approaches…
A
Adopting Zero Trust
1 Decoding Emerging Threats: MITRE, OWASP, and Threat Intel 25:00
25:00 나중에 재생 나중에 재생 리스트 좋아요 좋아요25:00
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 8: AZT and Dr. Zero Trust have a crossover episode where we chat with reps from MITRE and OWASP about challenges associated with emerging threats. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Every few weeks, and occasionally every few days, we hear report of a new novel technique or zero day. Those headlines often create an unnecessary level of fear for organizations, but battle-worn cybersecurity professionals know just because it’s on a headline doesn’t necessarily mean it will impact their environment. That is because emerging threats are just that, new and novel. While zero day threats can be interesting and something to be aware of, most threat actors stick to tried and true methods. But how do we identify what is most impactful to our security posture, attack surface, or insert your other buzzy term? Threat intelligence and the collective defense. And for that, it’s time to introduce our two very equipped guests to navigate this conversation and our guest moderator: This week on AZT, we have representatives from OWASP and MITRE, with Dr Zero Trust leading the charge. The Guests Special Guest Moderator Dr. Chase Cunningham - Dr. Zero Trust and Vice President of Security Market Research for G2 Avi Douglen - Chair of the Global Board of Directors for the OWASP Foundation and Founder and CEO of Bounce Security. Avi is a security architect and software developer, leading development teams in building secure products for over 20 years. As a systems developer and security consultant, over the years Avi has amassed much technical knowledge and understanding of the enterprise security needs at the business level. Avi currently serves on the OWASP Global Board of Directors, and leads the Israel chapter. He is the founder and leader of the the popular AppSecIL security conference, the OWASP Threat Modeling Project, and co-authored the Threat Modeling Manifesto . He is a community moderator on Security StackExchange , and a frequent speaker at industry conferences, recent ones can be seen here . Stanley Barr - Senior Principcal Cyber Researcher for MITRE Dr. Stanley Barr is a three time graduate of University of Massachusetts Lowell. He has a BS in Information Sciences, an MS in Mathematics, and a PhD in Computer Science. He has coauthored published papers in malware analysis, barrier coverage problems, expert systems for network security, and robotic manufacturing. He has spoken at MILCOM, RSA, Bsides Boston, and Defcon. He has been a panelist for conferences. Panels topics have included fighting through real world computer network attacks from both external and internal threats. Currently, he is a Senior Principal Scientist at The MITRE Corporation, a not-for-profit corporation that manages six federally funded research and development centers (FFRDCs). Key Takeaways Emerging threats are interesting, but threat modeling and understanding how systems work to identify potential issues is more impactful AI can pose a threat due to its ability to remember and tailor information, as well as its scalability. The panel emphasized that basic security hygiene is often overlooked, such as enabling 2FA on all accounts. The OWASP Top 10 most common attack vectors are still a significant concern, but they should not be the only focus. The panel argued that responsibility for security breaches should extend beyond the CISO to the entire board and engineering organization. Cybersecurity is a people-centric challenge, and relying on people not to make mistakes is not a sustainable strategy. There is value in investing in proper security measures, as it can save organizations money in the long run.…
A
Adopting Zero Trust
1 Navigating the Ever-Changing Landscape of Cybersecurity Regulations With Lacework and Drata 30:10
30:10 나중에 재생 나중에 재생 리스트 좋아요 좋아요30:10
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 7: Though regulation impacting cybersecurity moves slow, when new laws are introduced it often puts significant strain on companies. Lacework’s Tim Chase and Drata’s Matt HIllary discuss navigating the latest broad-sweeping regulations. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . The time between a law being proposed and going into effect may feel like a snails pace, but for cybersecurity and GRC professionals, it may feel like the DNA of an organization may need to change. This week we chat with cybersecurity leaders Tim Chase from Laceworks and Matt Hillary of Drata who delve deep into the ever-evolving landscape of cybersecurity regulations. They explore topics such as the challenges of rapid incident reporting, the role of collaboration in the industry, and the emerging onslaught of AI-related laws and proposed bills. This Week’s Guests Tim Chase, Lacework’s Global Field CISO With over 15 years of experience in the cybersecurity industry, Tim is a Global Field CISO at Lacework, a leading cloud security platform. Tim holds CCSK, CISSP, and GCCC certifications and has a deep understanding of product security, DevSecOps, application security, and the current and emerging threats in the cybersecurity landscape. Matt Hillary, Drata’s CISO Matt Hillary currently serves as VP, Security and Chief Information Security Officer at Drata. With more than 15 years of security experience, Matt has a track record of building exceptional security programs. He most recently served as SVP, Systems and Security and CISO at Lumio, and he’s also held CISO and lead security roles at Weave and Workfront, Instructure, Adobe, MX, and Amazon Web Services. He is also a closet raver. Like really, actually is. TL;DR The landscape of cybersecurity regulations is ever-changing, with new bills and regulations continually emerging which impact businesses of various sizes. The recent rules released by the SEC regarding the time frame for announcing a breach or incident have significantly impacted organizations. The term "material" is a key aspect of these rules, leading to discussions around what constitutes a material cybersecurity incident. The role of a CISO is challenging due to the potential for breaches and incidents despite implementing comprehensive security measures. The additional regulations add further complexity to the role. Transparency and honesty are vital in the event of a breach. Companies that are open about incidents and their impact are viewed more favorably than those that attempt to cover things up. The concept of 'carrot and stick' in regulation is discussed. There are mixed feelings about this approach, with some preferring collaboration and industry-led standards over punitive measures such as fines. However, there is recognition that both incentives (the carrot) and punitive measures (the stick) can drive companies to improve their cybersecurity measures. AI is a hot topic in the cybersecurity field, with potential to assist in quickly sorting through data and reducing false positives. However, the implementation of AI also brings its own set of regulations and challenges.…
Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not? Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal answer, but how often does life throw us simplicity? Rarely. This week on Adopting Zero Trust, we continue our conversation that looked at the role cyber insurance plays in organizations and drill into one of the most challenging topics associated with it: Ransomware. And, because this is a heavy subject, we brought in two heavy hitters from past episodes to share their perspectives, Kris Lovejoy and Brian Willett TL;DR Paying ransomware ransoms is a complex decision that depends on various factors, such as the potential impact on the organization's services or employees. Having robust and tested backups is crucial in a ransomware situation, but organizations must be prepared for scenarios where ransomware affects backups. Cyber insurance can help mitigate the financial impact of ransomware attacks, but organizations should be cautious and consider all the potential outcomes. Avoiding ransomware attacks requires a proactive approach, which includes implementing hardening standards, good practices around vulnerability management, enforcing compliance on systems, and having good identity protection. AI holds promise in the cybersecurity sector, but its role in ransomware attacks is still in its infancy.…
A
Adopting Zero Trust
Season 3, Episode 5: Cyber Insurance may not be the sexiest topic, but it’s an important piece of any mature cyber program. We chatted with a lawyer and a VC who share their perspective. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . There are many aspects of cybersecurity that are not classified as cool or sexy, but every component plays a role in securing people, data, and businesses. One particular aspect that is often seen as a necessary evil, even more so than policies and documentation, is cyber insurance. On one hand, you have a system that forces backstops to protect the organization in the event of an incident; on the other, requirements to not only remain insured but reduce premiums encourage businesses to invest more in securing the business. This week, we chatted with Karl Sharman of Forgepoint Capital and Andy Moss of Reed Smith to better understand the role cyber insurance plays today.…
A
Adopting Zero Trust
1 The Current and Future State of Zero Trust With Forrester’s David Holmes 54:05
54:05 나중에 재생 나중에 재생 리스트 좋아요 좋아요54:05
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season 3, Episode 4: Forrester Principal Research Analyst on Zero Trust, David Holmes, shares his perspective on the current and future state of Zero Trust. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Zero Trust is a concept, a strategy, a philosophy, and, for some poor souls, a solution you can buy ( it’s not ). Through our three seasons, we have heard about MVPs , learned from the godfather of Zero Trust , been aided by Dr Zero Trust , and even heard from current and former federal officials about their stance on the concept. However, we have yet to touch on the current an future state of Zero Trust, and for that, we look to Forrester Principal Research Analyst on Zero Trust, David Holmes. Prior to joining Forrester, David spent a decade researching, writing, and speaking about cybersecurity topics for network and application security vendors. Before entering the cybersecurity space, he was a C/C++ software developer specializing in authentication and authorization, network protocols, and cryptography. So you could say he knows a thing or two about the subject at hand. TL;DR Holmes explains that Zero Trust's core principles remain unchanged: all networks are untrusted, least privilege access is enforced, and everything is inspected and monitored. The COVID-19 pandemic has accelerated the adoption of Zero Trust as organizations were forced to work remotely and faced VPN overloads. David shares his perspective on the current and future state of Zero Trust, as well as areas he would like to see the vendor market seek to solve. The biggest example of successful Zero Trust implementation is Google. Since implementing Zero Trust, no major breaches have been reported. In addition to Google, there is a smaller organization that successfully implemented Zero Trust using existing tools, indicating that Zero Trust can be achieved without significant financial investment. However, achieving full Zero Trust is a journey rather than a destination, similar to cybersecurity itself. It's an ongoing process of adaptation and improvement.…
A
Adopting Zero Trust
Season 3, Episode 3: Canva’s Head of Enterprise Security, Kane Narraway, discusses how to deploy a Zero Trust strategy in under a year. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . This week on Adopting Zero Trust (AZT) we chat with Kane Narraway , the head of Head of Enterprise Security at Canva. Prior to his current role. Kane has been adopting Zero Trust for around a decade, starting with the UK government, and later to organizations like Shopify, Atlassian, and BT. You could say he’s seen a thing or two, and has absolutely been part of the evolutions occurring within cybersecurity and Zero Trust. Kane walks, crawls, and runs us through how he has built out Zero Trust strategies and recommends where organizations get started.…
Season 3, Episode 2: In our conversation with Energy Solution’s CIO David Weisong we chat about how new processes, technology, and budgets are formed. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . It’s a mystery as old as time: the cybersecurity and technology budget and acquisition strategy. How are they formed? How are these projects prioritized? How are internal teams proposing changes and asking for new dollars (and likely not getting them)? This week, we chat with someone at the heart of the matter for their business who walks us through how they build their security and information roadmap, or in what I lovingly call: quit bugging the C-suite. David Weisong is the CIO for Energy Solutions and has a background in software development, DevOps, and managing IT functions, which makes him the perfect candidate to properly discuss the ins and outs of cybersecurity and IT roadmaps.…
A
Adopting Zero Trust
To start the new season, we are joined by Hacker Valley Media’s Ron Eddings and Chris Cochran, who discuss breaking into cybersecurity and the role storytelling plays. A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people. People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny. And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills. Read more at adoptingzerotrust.com…
A
Adopting Zero Trust
1 From Hacktivist to White Hat Hacker. A Chat with LulzSec’s Sabu. 56:18
56:18 나중에 재생 나중에 재생 리스트 좋아요 좋아요56:18
나중에 재생 나중에 재생 리스트 좋아요 좋아요Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . PS, we're giving away a Flipper Zero on our site as a little season finale gift. Check out details on our site. You know what they say, you save the best for last. As we wrap season two of Adopting Zero Trust, we take a shift from our standard conversations about modern cybersecurity strategies and look back at some of the history that got us to where we are today. This week we chat with Hector Monsegur , Co-Founder of LulzSec , and current Director of Research for Alacrinet, who discusses his journey from hacktivism to white hat pen testing. In May of 2011, a series of cyber attacks swept the globe. Starting with Fox News, after a broadcaster called rapper Common ‘vile’, then an attack on X Factor (yes, the show Joe Rogan used to host) leaking contestant data, and through to taking down the Sony Playstation network. A, at the time, black hat hacking group was founded and picked off targets for laughs (lulz) rather than financial gain. Among the group was co-founder Hector Monsegur, better known by his alias Sabu, who shaped the movement into cause-based cyber attacks or hacktivism. But the story starts well before the formation of Lulzsec, and before the FBI knocked on Hector’s door. It stretches back to a time when there weren’t resources for people to learn how to hack, pen test, and become cybersecurity practitioners didn’t exist, unlike the endless amount of certs and higher education programs that exist today. Key Takeaways The evolution of one's ethical stance: Hector's journey highlights the importance of questioning and reassessing one's actions and beliefs. Collaboration and collective impact: Working together can amplify efforts and create positive change, even in the realm of cybersecurity. Balancing curiosity and responsibility: Exploring technology and hacking skills should be accompanied by a sense of responsibility and ethical considerations. Editor’s Note The season finale of AZT is here, and we couldn’t have found a more interesting way to wrap things up. Hector has such a unique and storied past, and we can’t recommend his own series enough. The very agent who knocked on his door joins him as the cohost on Hacker and the Fed . We also can’t thank you, our listeners, enough for another year of the show. Neal and I do this as a passion project first and foremost, but as we seek to attract harder-to-reach guests, we are also building in some ad opportunities. We are ensuring that doesn't impact how we highlight the practitioner's perspective on modern cybersecurity strategies, too. Speaking of growing, that other podcast I mentioned last episode? Mastering the Art of Failing can now be found at failingpod.com or on your favorite podcast app. The pilot series will highlight people who have found success in their lives, but not without some challenges along the way. Our first guest, Glen Hellman, was part of several successful exits… and quite a few not-so-successful flops. As the series progresses we’ll expand beyond just career-oriented stories and dig into physical, mental, and other states of pushing boundaries and levels of success.…
A
Adopting Zero Trust
Season two, episode 18: Evgeniy Kharam, a founder, CISO, architect, and podcast producer discusses the rise of Enterprise (Secure) browsers. You can read the show notes here and subscribe to updates. In the latest episode of AZT, Evgeniy Kharam, a founder, CISO, architect, and podcast producer, joins the discussion to talk about the rise of Enterprise (Secure) browsers. The conversation explores the importance of browser security and its relevance to the Zero Trust framework. Key Takeaways The birth of the enterprise browser - Remote Browser Isolation: Evgeniy explains the concept of remote browser isolation, which creates a layer of separation between users and potentially harmful websites. By browsing through a remote browser, users can mitigate the risks associated with malware and other online threats. Customized Browser Profiles: The conversation delves into the idea of using customized browser profiles to enhance security and control access. By providing contractors or temporary workers with specific browser profiles, organizations can ensure that only authorized individuals can access certain applications or data. Managed Device and Compliance: The discussion highlights the trend of using managed devices and the impact on compliance requirements. With the ability to enforce the use of specific browsers through Mobile Device Management (MDM), organizations can strengthen security measures and simplify compliance audits.…
A
Adopting Zero Trust
1 Beyond the Buzzword: Applicable use of AI in Cybersecurity 56:37
56:37 나중에 재생 나중에 재생 리스트 좋아요 좋아요56:37
나중에 재생 나중에 재생 리스트 좋아요 좋아요Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . The word AI, much like Zero Trust, has come with a lot of baggage in the past few years. It’s a term that’s been misused, slapped on the front of startups’ overpriced booths at RSA and Black Hat, and it feels like every cybersecurity product under the sun now supports it in some flavor or fashion. It's the same cycle we’ve been in the past, but this time everyone is jumping in. This week we are getting in front of the bandwagon and chat with a pioneer in the cybersec AI space who has seen how the technology has been evolving over the past decade, Oliver Tavakoli, the CTO of Vectra AI. “My contemporaneous definition of AI at any given moment in time is there's got to be enough pixie dust in it for people to view it as somewhat magical; so that's my incredibly technical definition. I'd say over the past 10-15 years, that is typically meant neural nets-that has those have been a stand in-and and obviously, neural nets can be used for discrimination [As opposed to a generative AI model] . Again, the example of cat (You search “Cat” on Google images, and it returns results that show images, in theory, of only cats) is an example of how they can be used in a generative sense, which is really the latest revolution that you see. And then the other thing is how broadly applicable they are and how well read they are. Tavakoli’s definition of AI provides the context for how AI is primarily applicable today in cybersecurity. But, in the past, typically these concepts were held back by technology. There is also a stark difference between what has been referred to as AI, or a discriminative AI model, and what is most popular today, or generative AI. It turns out in these large language models, as you make them bigger, there was always kind of the question of if you make them big enough. Will they just plateau or will they take off? It really wasn't a foregone conclusion that if you made them big enough they would take off, but it was a bet that was placed and a bet that turned out to have some merit to it. And that is the crux of today’s interview: what was and will be the past and future impact of AI on cybersecurity? Key Takeaways AI plays a significant role in both offensive and defensive cybersecurity strategies. Threat actors use AI to enhance their attacks, making them more believable and harder to detect. Defensive uses of AI include improving workflow and making SOCs more productive. Organizations must always assume that compromise is possible and focus on minimizing the impact of breaches.…
A
Adopting Zero Trust
1 AZT: Zack Butcher on Building Zero Trust Standards and Securing Microservices 54:57
54:57 나중에 재생 나중에 재생 리스트 좋아요 좋아요54:57
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season two, episode 16: Zack Butcher discusses building upon NIST’s Zero Trust policies and standards, and ZT’s influence on a service mesh as it relates to microservices. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . There are several guiding concepts that make it easier for organizations to build a Zero Trust strategy. The first that typically come to mind come from CISA and NIST. These core elements, ranging from the five pillars through to building a ZT architecture, offer a vendor-neutral path towards removing implicit trust. Organizations like CSA also do a great job of expanding upon this knowledge with more contributions from technology and service providers. This week, we take our first step towards understanding what goes on behind these policies, standards, and recommendations, and for that we have a well-equipped guest to walk us through it. Zack Butcher is one of the founding engineers over at Tetrate, a vendor that provides a consistent way to connect and protect thousands of individual microservices and deliver Zero Trust security operations across any environment. They also have their roots stemming from a team that worked at Google, which many of you are likely familiar with their connection to Zero Trust through BeyondCorp. However, he is also the co-author on NIST special publication 800-207A . If that looks familiar, it’s because it’s an expansion of the earlier mentioned core NIST resource, 800-207 . NIST SP 800-207A builds upon that core architecture piece and hones in on access controls in cloud-native applications in multi-cloud environments. That is a bit of a mouthful, so here is Zack on what you need to know. When we talk about Zero Trust at runtime, there's a lot of FUD and a frustrating amount of FUD in the in the marketplace and a lot of vendors claiming certain things are Zero Trust and not. And you know, in that landscape, I wanted to really kind of push for people to have a very clear definition of Zero Trust at runtime, and it's a minimum definition. Let me be clear. You can do a whole lot more than what we talk about in the SP, but I try and give a very, very simple minimum definition. And that is five policy checks at runtime, and we call that identity based segmentation. Butcher also co-authored NIST SP 800-204A that focuses on building secure microservices-based applications using service-mesh architecture. So this week, Neal and Butcher ran down the rabbit hole of expanding upon these core Zero Trust resources, implications of a more secure environment at runtime, and identity-based segmentation.…
A
Adopting Zero Trust
1 AZT: API Security with John Kindervag, Chase Cunningham, and Richard Bird 38:12
38:12 나중에 재생 나중에 재생 리스트 좋아요 좋아요38:12
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season two, episode 15: We talk ZT History and API security with the godfather of Zero Trust, Dr Zero Trust, and Richard Bird. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . In the past few years, supply chain attacks and their impacts have or will soon overtake that of the damage done by ransomware. It’s of no surprise then that APIs are a critical attack vector that threat actors like to exploit, yet many organizations do not have a good understanding of how many doors they have running into their data. This week we chat with the godfather of Zero Trust, Dr. Zero Trust, and a chief security officer about the current state of API security maturity. Considering our guests, we, of course, also took the opportunity to chat a bit about Zero Trust's history. This week we have three very special guests: John Kindervag, the creator (godfather) of Zero Trust Chase Cunningham, AKA Dr Zero Trust, and the now VP of Market Research for G2 Richard Bird, Traceable AI’s Chief Security Officer Key Takeaways Like any other cybersecurity concept, APIs must have an asset inventory There is enough margin of error tied to the intended use of APIs that require continuous monitoring/verification There is a current maturity gap associated with securing the use of APIs in the name of speed and innovation, and often there is not a well-established owner Editors Note We will be taking a publishing break for the month of September as my daughter has arrived, and I will need to catch up on all the sleep I can get. We should be back in October and run through until the holiday break before we wrap season two. I’m also working on a few experimental podcast series during my parental leave, so stay tuned. At least one in particular should be of interest to our audience here. Also, if you work for a cybersecurity org and are interested in launching a podcast, slide into my inbox if you need a hand.…
A
Adopting Zero Trust
The illusion of going passwordless with Derek Hanson, Vice President Solutions Architecture and Alliances at Yubico. You can read the show notes here . True or False: The concept of passwordless is new. False. This is shocking, we know. Considering the amount of hype around the concept, it certainly can feel like a new concept since the masses are becoming more familiar with it; however, the message is a bit jumbled. For ages, we’ve used things like biometrics (fingerprints or iris scans) and even a PIN to access money on a debit card, but more recently, there has been an increase in misrepresentations about how secure passwordless technology is, simply because there is not a password involved. As cybersecurity practitioners, we know that the simple removal of passwords alone won’t prevent a successful phishing attack, which means multifactor authentication needs to play a role in getting us closer to the Zero Trust concept. Fortunately, we have a guest this week who is well-equipped to help us navigate the ins and outs of passwordless concepts, passkeys, and the split between identification and authentication. Derek Hanson is the Vice President of Solutions Architecture and Alliances at Yubico, who has spent the last 8 years contributing to the shaping of a physical piece of hardware, Yubikeys, designed to improve authentication. Prior to that, he worked at Costco, focusing on identification and IAM. But first, let’s improve your personal security stack… Giveaway - Yubikeys! If you already have a Yubikey, you already know there is always an opportunity for one more in your stack. If you’re new to Yubico’s offering, this is the perfect time for you to grab your very own YubiKey 5C NFC and gain phishing-resistant MFA. It even works with most password managers, too. To enter, we’ve given you a bunch of options on how you can increase your odds of winning one of two keys. You must be based in the US, though. [**Enter the giveaway here]( https://www.rafflecopter.com/rafl/display/c9435e741/?).** We’ll close the giveaway in about two weeks and announce it in our next episode.…
A
Adopting Zero Trust
1 Adopting Zero Trust: Philosophy of Prevention with iHeartMedia’s Janet Heins 44:02
44:02 나중에 재생 나중에 재생 리스트 좋아요 좋아요44:02
나중에 재생 나중에 재생 리스트 좋아요 좋아요Season two, episode 13: Cybersecurity prevention on a global scale with Janey Heins, Global CISO for iHeartMedia. At the heart of Zero Trust is the idea of prevention. If you don’t trust anything or any person, you are playing in the same pool as risk avoidance. While total risk avoidance isn’t feasible, Zero Trust gets us closer to reality. Now, map this up to an organization with a global footprint, with significant infrastructure sprawl, and you’ve got one very complex scenario on your hands. This brings us to this week’s guest, Janet Heins, iHeartMedia's Global CISO, who will help us navigate the philosophy of cybersecurity prevention on a global scale. Putting The Conversation Into Context With more than a decade behind her as a CISO, Heins’ experience stems from working with some massive brands. As a leader, she’s particularly passionate about translating business needs into technology processes or solutions, while at the same time bridging the language barriers that often stem between IT, cybersecurity, and the other adjacent areas. iHeartMedia has over 11,000 employees and a vast physical and digital footprint. With 860 radio stations across the US and 20,000 events annually, the company is part of the emergency broadcast system and has to be ready to respond to threats quickly. At a global level, Heins makes it clear that strong detection and response capabilities, as well as prevention measures, are critical elements of prevention. And while prevention can take many forms, in the context of today’s episode, we dig into security tools, hiring security professionals, and the basics, such as providing security awareness training to employees. One challenge of securing a large organization like iHeartMedia is consolidating the tech stack. iHeartMedia has a blended architecture of OT and IT, with legacy hardware and systems that need to be secured. Heins stresses the importance of communication and collaboration between the IT and OT teams, as well as being open to new tools and automation.…
A
Adopting Zero Trust
Over the past two years, we’ve explored the ins and outs of Zero Trust, ranging from the concept as a strategy down to the more technical components, such as how it impacts the physical world as found in IoT devices. However, what is often missed in these conversations, is at what point an organization can actually build trust. Not just crawling up from the baseline of zero but achieving continuous trust. The short answer? Defense in depth, building security in layers, and ensuring every 1 and 0 is secure at the offset while continuously monitored through automation. And this is where we get to introduce this week’s guests, who were kind enough to be pulled away from a busy conference. This is also a special episode for us, too, as it’s the first in-person interview we’ve done since launching this series. Live (June 22, 2023) from Drataverse, we have Daniel Marashlian, the co-founder and CTO of Drata, Ty Sbano, the CISO for Vercel and an angel investor at Silicon Valley CISO Investment Group (SVCI), and Matt Hilary, the Vice President of Security and CISO at Drata. You can read the show notes here .…
A
Adopting Zero Trust
Last episode, we brought to you a wild story of a victim who was SIM-swapped four times, and this week we’re back to basics with some fresh research and a closer look at a critical piece of Zero Trust: Non-federated applications. Cerby’s Chief Trust Officer, Matt Chiodi, was kind enough to add a bit of color to a research report they released at RSA that helps validate what they’ve been building the past 3 years. Before we get to that, it’s worthwhile to define what nonfederated applications are, as, like many cybersecurity concepts, it’s going through an identity crisis. Nonfederated applications are essentially the opposite of how organizations should be inventorying, tracking, and providing access to applications (SaaS platforms are a good example). To align with Zero Trust, or really any modern cybersecurity strategy, SSO, SAML, and other solutions designed to scale are necessary so IT and security teams can properly manage access. However, there are always outliers, which the business still needs access to, such as managing admin access to a social media profile. This brings us back to Matt and the Ponemon Institute, who produced the recent research report: The Hidden Cybersecurity Threat in Organizations: Nonfederated Applications .…
Taking a break from our usual format, this week we chat with a victim-turned-CEO who was hit by SIM-swapping attacks. However, not all harsh starts have to end that way, and Haseeb Awan made the best of a bad situation. After being compromised not once… nor twice, but four times, Haseeb eventually took matters into his own hands and developed a new solution and company, Efani . Haseeb was kind enough to share his personal experience of being SIM swapped where he describes the fear and anxiety felt as a result of the attacks and explained how easy it is to compromise a phone number.…
A
Adopting Zero Trust
Season two, episode nine: Featuring Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . What does implementing a Zero Trust strategy actually look like in an organization? Nearly a year into our podcast’s journey covering how practitioners view, define, and apply zero trust, it’s time to look under the hood at how a notable organization put its strategy into motion. This week we chat with Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon , about how they transformed their security organization with Zero Trust. Most interestingly though, while many organizations are just now exploring how they will start their zero trust journey, Bloomberg was ahead of the curve even before covid thrust the concept into the limelight. “I will always say it is continuing to be a journey. It's not a destination,” said Vachon. Key Takeaways Zero Trust Principles Zero trust is not a new concept but has been repackaged and branded as a solid ideology. Zero trust involves three principles: trust but verify, assume compromise, and strong posture. Zero Trust Journey Zero trust is a continuing journey, not a destination. Zero trust requires a good mindset about how to implement controls and how to reason about security architecture. Zero trust is not just about securing the corporate IT estate but also about securing the data center estate and the communications between components. Challenges in Implementing Zero Trust Balancing security with usability is a challenge that must be addressed to enable a high-collaboration, low-friction workflow. Bloomberg leverages many SaaS services for collaboration, but they also have their own core services that are still on-premises. They focus heavily on their offerings on-premises and have a big drink-your-own champagne culture around them.…
A
Adopting Zero Trust
There’s no avoiding it, the headlines have not been kind to the ways we access systems today. Users are still using 1234, password , and even their dog's name. Not just using these weak passwords but also reusing them across multiple platforms, making it incredibly easy to breach someone once they’ve been caught up in a previous breach. On the vendor side, well we all know what’s happened there in the past 12 months, and now more than ever, password management platforms have growing targets on their back as high-value assets. But we are not here to throw rocks in the glass house nor try to dissect what goes well or goes wrong in these situations; however, we should all focus on what we can take away from them and ensure they are not repeated. This concept aligns well with Zero Trust, where we should assume systems are already breached, that your users - be it intentionally to shitpost in a discord channel or accidentally fall for a phishing lure- and we should remove as much implicit, unchecked trust as possible. At least until Skynet takes us all out, but we have a few good years ahead. Jokes aside, we have a great episode for you and appreciate Bitwarden lending us two of their C-suite members who cover a range of topics, including how they navigate these challenges. This week we chat with Bitwarden’s CEO Michael Crandell and Chief Customer Officer Gary Orenstein. Bitwarden offers an integrated open-source password management solution for individuals, teams, and business organizations. It also offers a self-hosted solution, which appeals to those who want greater control over their secrets. Key Takeaways The use of a Zero Knowledge architecture means that the company, whether cloud-hosted or self-hosted, should not be able to access sensitive information without the user's permission. Open-sourced solutions offer additional layers of trust as there are more eyes are on the product and can vet it for security Passwordless authentication is the future…
A
Adopting Zero Trust
1 Adopting Zero Trust: Empathetic Leadership with Kyndryl’s Kris Lovejoy 57:45
57:45 나중에 재생 나중에 재생 리스트 좋아요 좋아요57:45
나중에 재생 나중에 재생 리스트 좋아요 좋아요For many, cybersecurity is seen as a cost center that reduces risk to the business. This can be oversimplified to something akin to how HR reduces people-related risks but comes with layer on top of layer of complexities ranging from technology to physical buildings and, of course, people. Regardless of organizational size, cybersecurity leadership requires a top-down approach, leaving room for discussion at the board level and aligning it with business goals. This week on AZT, Neal and I chat with Kris Lovejoy , Kyndryl’s (IBM spinoff) Global Security and Resilience Leader, former CEO of Virginia-based BluVector, and a former IBM CISO prior to being made GM of their security division. Having danced the line between startups and mega-enterprise organizations, there are few others who could so adequately discuss the role of cybersecurity leadership within modern organizations and why having a competent person at the helm is critical to the business (not just to reduce risk). We also play a bit of RSA buzzword bingo.…
A
Adopting Zero Trust
1 Adopting Zero Trust: Cybersecurity Innovation with Stanford Fellow AJ Grotto 39:14
39:14 나중에 재생 나중에 재생 리스트 좋아요 좋아요39:14
나중에 재생 나중에 재생 리스트 좋아요 좋아요For more than a decade, Zero Trust as a concept has moved from a philosophy and now into a practical architecture and strategy that organizations can adopt. While Zero Trust encapsulates much of what has gone well in cybersecurity for the past 30 years or so, does it truly offer an innovative approach or just iterative change? Is the concept positioned well so others can adapt it to their needs and prevent greater cyber-related risks? While we know it’s certainly not a silver bullet, and use cases are still reasonably immature, there is a firm argument for it helping to drive cybersecurity innovation forward. This week on AZT, Neal and I chat with Andrew “AJ” Grotto, current Stanford University Fellow and Director of Security at Turtle Rock Studios (makers of Back 4 Blood and other popular video games). Prior to his current roles, AJ was an advisor at NIST and was the Senior Director for Cybersecurity Policy for The White House National Security Council. As a practitioner and academic who danced the line between public and private sectors, AJ is well suited to help us navigate the question of what drives innovation around cybersecurity if the federal government is behind the curve or creates chain reactions, and where policy comes into play.…
A
Adopting Zero Trust
This week on AZT, we chat about something timely and impactful to everyone in the cybersecurity and users impacted by related decisions: the new National Cybersecurity Strategy ( full strategy here ). Our guests this week are Tony Scott and Ilona Cohen, both industry powerhouses and experts well-equipped to navigate this complex document. Ilona Cohen is the former General Counsel at Office of Management and Budget (OMB), was an Associate White House Counsel and Special Assistant to the President during the Obama administration, and is currently the Chief Legal Officer, Chief Policy Officer, and Corporate Secretary at HackerOne. Tony Scott is the former U.S. Federal CIO during the Obama administration, has worked for brands such as Disney and GM, and is currently the President and CEO of Intrusion. Together, they both experienced the Office of Personnel Management (OPM) breach of 2015, and have been involved with the ever-shifting threat landscape that impacts and leads to new initiatives like the latest National Cybersecurity Strategy. In particular, it resulted in the Cybersecurity National Action Plan , which resulted in the first bug bounty program.…
This week Neal and I continue with our exploration of new formats, and this time we go one-on-one with the Founder and CEO of Netfoundry, Galeal Zino . Prior to Netfoundry , Zino spent much of his career traversing R&D, and later moving into a key role for Tata Communications. Though Netfoundry’s bread and butter is a Zero Trust Network Access (ZTNA) solution that can be built into other technology via API and even supports IoT systems, and they also manage OpenZiti. OpenZiti is an open-source self-hosted solution of a similar nature with input and contributions from Zero Trust and developer communities. Rather than honing too deep into the technology aspect, Zino and Neal go down the rabbit hole of open source tools and communities and why they are so critical to much of today’s existing security infrastructure.…
A
Adopting Zero Trust
1 Adopting Zero Trust with Author George Finney: Approachable 50:43
50:43 나중에 재생 나중에 재생 리스트 좋아요 좋아요50:43
나중에 재생 나중에 재생 리스트 좋아요 좋아요Zero Trust as a concept or strategy on the surface appears simple in nature. Heck, it’s only two words. However, when push comes to shove, and it’s time for organizational adoption, Zero Trust impacts every aspect of a business in the form of a digital transformation. Fortunately, for every complexity and question, there is an answer and solution, which is where our latest guest comes into play. This week on Adopting Zero Trust (AZT), we chat with infosec author, practitioner, and educator George Finney about ways to make ZT more approachable. Finney is the best-selling author of Project Zero Trust, which currently offers the most approachable way to understand John Kindervag's 5-Step methodology for implementing Zero Trust, the four Zero Trust design principles, and how to limit the impact of a breach.…
A
Adopting Zero Trust
This week we have a two-for-one special and feature our newest panel-style format. On the practitioner side, we have crowd favorite Andrew Abel, who currently works with a financial institution, but has worked across multiple other industries in the past. On the Zero Trust technology side, we have Michael Loewy, Co-Founder of Tide Foundation . Tide Foundation lives between authentication and micro-segmentation, or if we look at CISA’s Foundation of Zero Trust principles : identity, network/environment, and data. The solution also impacts devices and application workloads, which means they fully align with the philosophy behind Zero Trust. On today’s episode, we ground Zero Trust back to reality with how much implicit trust can truly be removed, dig into the concept of Zero-Knowledge Authority and how it chips away at ZT gaps of today, and follow up with Abel on how ZT has changed over the past 6 months.…
A
Adopting Zero Trust
This week we chat with Ismael Valenzuela , VP of Threat Intel at Blackberry, a 13-year SANS instructor, and has balanced his time between educator and practitioner for decades. Before peppering Ismael with our usual questions and falling down the rabbit hole, we dug a bit deeper into his background and what drives him to split his time between educating peers and working for some of the biggest names in tech. On the docket for this week is Zero Trust as a philosophy, why Less Trust is a more applicable term, and the need for a threat model to narrow down your protect surface. As a side note, Ismael also just published a new post highlighting findings from BlackBerry’s new global threat intel report. The team will also discuss these findings today (Jan 26) on LinkedIn live .…
A
Adopting Zero Trust
Welcome to the last episode of season one, where Neal and I go on a rambling adventure and look back on some of the interesting and eye-opening conversations we’ve had over the past few months. To wrap things up, and what was supposed to be a 20-minute conversation, we felt it was time to better introduce ourselves to our listeners, discuss some plans for season two, highlight perhaps some aspirations of bringing AZT into the real world at a conference or two in 2023, and that we will finally open the doors to Zero Trust technology vendors. Since this is our season one wrap episode, and much of what we cover is a stream of consciousness, there are no key takeaways. Swing back around in January as we kick off the next season with another group of amazing guests. We have plenty of surprises in the works, too! We hope your year winds down well, and we will cross our fingers for no X-mas cyber incidents.…
A
Adopting Zero Trust
1 Adopting Zero Trust with Chase Cunningham: The Doctor is in 56:17
56:17 나중에 재생 나중에 재생 리스트 좋아요 좋아요56:17
나중에 재생 나중에 재생 리스트 좋아요 좋아요This week we chat with Chase Cunningham , Doctor Zero Trust himself, about the decade-overnight success of Zero Trust, how he got involved with the concept, and methods for navigating vendors wanting to shape the concept. For those initiated into the world of Zero Trust, you are no doubt familiar with his podcast, regular LinkedIn musings, and history as a Forrester analyst. Beyond the podcast, Chase is the CSO for Ericom Software, has a long history in threat intel, and built a significant track record while at the NSA as a chief cryptologic technician.…
플레이어 FM에 오신것을 환영합니다!
플레이어 FM은 웹에서 고품질 팟캐스트를 검색하여 지금 바로 즐길 수 있도록 합니다. 최고의 팟캐스트 앱이며 Android, iPhone 및 웹에서도 작동합니다. 장치 간 구독 동기화를 위해 가입하세요.
Daily Deals
Daily Deals
Adopting Zero Trust와 비슷한 콘텐츠
Africa-focused technology, digital and innovation ecosystem insight and commentary.
…
continue reading
Show notes are at https://stevelitchfield.com/sshow/chat.html
…
continue reading
T
The Talk Show With John Gruber
1
The Talk Show With John Gruber
Daring Fireball / John Gruber
2k343
The director’s commentary track for Daring Fireball. Long digressions on Apple, technology, design, movies, and more.
…
continue reading
The power of Data is undeniable. And unharnessed - it’s nothing but chaos. Making data your ally. Using it to lead with confidence and clarity. Host Jess Carter is solving problems in real-time to reveal what’s possible. Helping communities and people thrive. This is Data Driven Leadership, a show brought to you by Resultant.
…
continue reading
Download This Show is your weekly guide to the world of media, culture, and technology. From social media to gadgets, streaming services to privacy issues. Each week Rae Johnston and guests take a fun, deep dive into how technology is reshaping our lives.
…
continue reading
Android Backstage, a podcast by and for Android developers. Hosted by developers from the Android engineering team, this show covers topics of interest to Android programmers, with in-depth discussions and interviews with engineers on the Android team at Google. Subscribe to Android Developers YouTube → https://goo.gle/AndroidDevs
…
continue reading
We help founders make something people want.
…
continue reading
This is the audio podcast version of Troy Hunt's weekly update video published here: https://www.troyhunt.com/tag/weekly-update/
…
continue reading
R
Redefining AI - Artificial Intelligence with Squirro
1
Redefining AI - Artificial Intelligence with Squirro
Squirro
12k120
Redefining AI is the 2024 New York Digital Award winning tech podcast! Discover a whole new take on Artificial Intelligence in joining host Lauren Hawker Zafer, a top voice in Artificial Intelligence on LinkedIn, for insightful chats that unravel the fascinating world of tech innovation, use case exploration and AI knowledge. Dive into candid discussions with accomplished industry experts and established academics. With each episode, you'll expand your grasp of cutting-edge technologies and ...
…
continue reading
A podcast about web design and development.
…
continue reading
Player FM -팟 캐스트 앱
Player FM 앱으로 오프라인으로 전환하세요!
Player FM 앱으로 오프라인으로 전환하세요!
))
