App Store

Google Play

SE - Details page - Device banner - 894x1036

Kliv in i en oändlig värld av stories

Lyssna när som helst, var som helst

David Spark

Geoff Belknap

Steve Zalewski

Defense in Depth promises clear talk on cybersecurity’s most controversial and confusing debates. Once a week we choose one controversial and popular cybersecurity debate and use the InfoSec community’s insights to lead our discussion.

Defense in Depth

All links and images for this episode can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Itai Tevet, CEO, Intezer.
 
In this episode:
 
 • Build for what you can handle
 • Rethinking alerts
 • Building trust into your system
 • Seeing the bigger picture
 
Thanks to our podcast sponsor, Intezer
 

 
 Intezer’s AI-driven solution automates alert triage and investigations, cutting through the noise to highlight serious threats. By integrating with your security tools, it escalates only 4% of alerts for fast remediation, helping SOC teams focus on what matters. Learn more at intezer.com today!

How Can We Fix Alert Fatigue?

Just a quick welcome message to this weekly show covering controversial and confusing topics in cybersecurity.

Welcome to Defense in Depth

Defense in Depth is part of the CISO Series network which can be found at CISOSeries.com.
 
What are the most important metrics to measure when building out your security program? One thing we learned on this episode is those metrics change, as your security program matures.
 
This episode of Defense in Depth is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest is my co-host of the other show, Mike Johnson, CISO of Lyft.
 

 Fluency's correlation and risk scoring technology combined with their approach of using pseudonyms in place of certain PII data greatly facilitates your organization's path towards compliance. Over time, machine learning and artificial intelligence algorithms detect anomalies at an impressive level of scalability. Run Fluency as a standalone or integrate it into your existing SIEM. Learn more by visiting us at booth #4529 at the RSA® Conference 2019. On this episode of Defense in Depth, you'll learn: • There is no golden set of security metrics.
 • Metrics you use to measure your security program this year won't necessarily be the same ones you use next year.
 • Use the NIST model to determine your security program maturity.
 • Unlike B2C, B2B companies can use metrics to build a closer tie between security and the business.
 • Regulations and certifications is one easy way to align security with the business.

Security Metrics

Will the privacy outcry and new regulations limit companies’ abilities to do business, or will it span a whole new industry? We discuss building a business in the new age of privacy regulations on this week’s Defense in Depth.
 

 
Chris Jordan, CEO, Fluency Security
 
This episode of Defense in Depth is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our sponsored guest is Chris Jordan, CEO of Fluency Security.
 Thanks to this week’s podcast sponsor, Fluency Security: Fluency’s correlation and risk scoring technology combined with their approach of using pseudonyms in place of certain PII data greatly facilitates your organization’s path towards compliance. Over time, machine learning and artificial intelligence algorithms detect anomalies at an impressive level of scalability. Run Fluency as a standalone or integrate it into your existing SIEM. Learn more by visiting us at booth #4529 at the RSA® Conference 2019. On this episode of Defense in Depth, you’ll learn: • While new privacy regulations may hamper a company’s ability to collect and sell any data they want, they don’t necessarily stifle the economy. For example, the introduction of HIPAA regulations spawned a growing industry.
 • DuckDuckGo is a search engine that doesn’t collect your browsing history to determine your search results.
 • Even if you are very protective of your data, the people around you probably aren’t. Through relationships and triangulation a profile of you, sans your personal data, can still be created.
 • Because of this ability to triangulate data, your employees’ personal data, outside of work can become a risk to your company.

Privacy

Defense in Depth is part of the CISO Series network, which can be found at CISOseries.com.
 
Security for the business affects everyone and all departments. On this episode of Defense in Depth we discuss the values and difficulties of building an information security council. 
 

 
 Check out this post and discussion for the basis of our conversation on this week's episode which is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest is Nick Espinosa (@NickAEsp), host of nationally syndicated show The Deep Dive with Nick Espinosa, and his daily podcast is called Nick's Nerd News Daily. Find Nick on Facebook, YouTube, and his articles on Forbes.
 
 
 Thanks to this week’s podcast sponsor, Fluency Security: 

 Fluency's correlation and risk scoring technology combined with their approach of using pseudonyms in place of certain PII data greatly facilitates your organization’s path towards compliance. Over time, machine learning and artificial intelligence algorithms detect anomalies at an impressive level of scalability. Run Fluency as a standalone or integrate it into your existing SIEM. Learn more by visiting us at booth #4529 at the RSA® Conference 2019. On this episode of Defense in Depth, you’ll learn: • A good starting point for building an information security council is to develop a business continuity and disaster recovery plan with all departments and stakeholders.
 • Understand the risk tolerance of each division.
 • A well-informed information security council can often benefit from less security training.
 • The number one battle to develop an InfoSec council is never technical. It is always cultural.
 • Need to create a culture of not shaming people for making mistakes that compromise security. You want employees to feel free to speak up if they do make a mistake.

Building an Information Security Council

Defense in Depth is available at CISOSeries.com.
 
Is your own staff the greatest threat to the security of your company? On this episode of Defense in Depth we discuss protecting your business from itself.
 
 Check out this post and discussion for the basis of our conversation on this week's episode which is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest is Vijay Bolina (@_jamesbaud_), CISO, Blackhawk Network.
 Thanks to this week’s podcast sponsor, Fluency Security: 

 
Fluency’s correlation and risk scoring technology combined with their approach of using pseudonyms in place of certain PII data greatly facilitates your organization’s path towards compliance. Over time, machine learning and artificial intelligence algorithms detect anomalies at an impressive level of scalability. Run Fluency as a standalone or integrate it into your existing SIEM. Learn more by visiting us at booth #4529 at the RSA® Conference 2019.
 On this episode of Defense in Depth, you’ll learn: • Nearly 1 in 5 people would sell their health record for $500. (
source • )
 • Insider threat mistakes can take many forms. It could be someone carelessly leaving a USB key somewhere or it could be a developer simply not securing their code.
 • Security people make mistakes just like non-security people. Difference is when a security person makes a mistake, chances are the gravity of the damage will be much higher.
 • A breach doesn’t necessarily have to damage the company. A breach simply means data left your protected area of the business. And that is still bad even if there was no actual damage.

Insider Threats

Defense in Depth is available at CISOSeries.com.
 
Is the "free to use" Secure Controls Framework the one meta-framework to rule them all?
 
 Check out this post and discussion for the basis of our conversation on this week's episode which is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest is Tom Cornelius, founder and contributor of the Secure Controls Framework (SCF) (@scf_support).
 
Thanks to this week’s podcast sponsor, SpyCloud
 
 
 Learn more about how you can protect employees and customers from account takeover with SpyCloud.
 

 
On this episode of Defense in Depth, you’ll learn:
 
 • Purpose of the Secure Controls Framework is to have a single framework to address multiple requirements. It's a meta framework that takes into consideration the controls of all other frameworks.
 • You only need to use the security controls that are important and relevant to you. For that reason, don't be daunted by the number of controls on SCF (currently 750).
 • You can have security without privacy, but you can't have privacy without security. Integrating privacy and security is critical to SCF.

Secure Controls Framework

Do companies who deliver "threat intelligence" deliver on that promise, or is there more the customer needs to bring to the table to be able to take action?
 
 Check out this post and discussion for the basis of our conversation on this week's episode which is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our sponsored guest for this episode is Eric Murphy (@_EricMurphy), VP, security research, SpyCloud.
 
 
 
Thanks to this week’s podcast sponsor, SpyCloud
 
 

 
 Learn more about how you can protect employees and customers from account takeover with SpyCloud.
 On this episode of Defense in Depth, you’ll learn: • Threat intelligence is about telling a story. And that story is broken up into three parts: strategic, operational, and tactical intelligence. Threat intelligence today really isn’t about creating that story. Most of the cases are about correlating data points.
 • Threat intelligence becomes stale when you are reactionary vs. being proactive.
 • Threat intelligence fails when you don’t mix multiple intelligence points to form a more complete full story of your adversaries.
 • Feeds are not valuable by themselves. When you combine it with your internal data, that’s when you could actually come up with something actionable.
 • If you’re not ingesting and onboarding your data appropriately into your internal threat intelligence team, why do you even have it?
 Find more at CISOSeries.com

Threat Intelligence

If a company's brand and value is built on trust, then your security department is critical to building the value of the company.
 
 Check out this post and discussion for the basis of our conversation on this week's episode which is co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest for this episode is Scott McCool (@McCoolScott), former CIO of Polycomm.
 
Thanks to this week’s podcast sponsor, SpyCloud
 
 
 
 Learn more about how you can protect employees and customers from account takeover with SpyCloud.
 

 On this episode of Defense in Depth, you’ll learn: 
 
 
 • When a business becomes an idea, the only thing that matters is the perceived value by the owners.
 • If you deem security 
is • the business, then it no longer can take a consultative role. It must take the role of brand and value building.
 • Explicit value is generating or saving money. Implicit value is what drives those two opposite ends of the spectrum.
 • A security department shouldn't be focused on trying to get more budget for themselves. They should see where they are in the value chain and at any given point in time they must fully understand the business and see which department could generate the most business value.
 • If you only lobby for the security department in terms of its importance for getting budget, and not lobby for the overall business then you will lose credibility with your partners within the business.

Security IS the Business

Is the RSA Conference a must attend for security professionals? Or is it enough to "just be in San Francisco that week"?
 
 Check out this post and discussion for the basis of our conversation on this week's episode co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX), CISO at Mitel. Our guest for this episode is Tyson Martin, CISO for Lumber Liquidators.
 

 
David Spark, producer of CISO Series, Tyson Martin, CISO, Lumber Liquidators, and Allan Alford, CISO, Mitel.
 
Thanks to this week's sponsor, Praetorian.
 
 
 
As a professional services company, Praetorian helps enterprise customers solve complex cybersecurity problems. We are the security experts.
 
On this episode of Defense in Depth, you'll learn:
 

 
 
 
 • Is RSAC for education or connecting? Does the value happen in the conference center or outside? This was the initial part of our debate and one argument is you need to graduate from RSAC to make it more of a "connecting outside of the event" type of event.
 • The show floor is overwhelming. As David Gorton of OverwatchID noted, "The circus hides the serious of what we're trying to do."
 • There were a lot of comments about people not having fear of missing out (FOMO), but you can't argue that RSAC has a gravitational force that brings tons of security-minded people to San Francisco for one week every year. There is enormous value in that.
 • The marketing model for vendors during and after the show is starting to grate on practitioners. They're not enjoying the endless cold calls the following week.
 • The expo hall is focused on leads and given that so many of these products are high ticket items, if just a few sales comes through, then the event pays for itself.
 • It's impossible for small booths to compete for visibility with huge booths at the conference.

RSA 2019: Success or Failure?

All links and images for this episode can be found on CISO Series.
 
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Richard Ford, CTO, Praetorian.
 
In this episode:
 
 • 

When did we all agree that red teaming was about validating security?
 • 
 • 

Does it seem like increasingly red teaming is a catch all term for a whole lot of testing that isn't clearly defined?
 • 
 • 

Is this making it hard to see its value?
 • 
 • 

Can moving red teaming upstream be more valuable to your organization?
 • 
 
Thanks to our podcast sponsor, Praetorian
 

 
Praetorian helps companies adopt a prevention-first cybersecurity strategy by actively uncovering vulnerabilities and minimizing potential weaknesses before attackers can exploit them.

Use Red Teaming To Build, Not Validate, Your Security Program

Use Red Teaming To Build, Not Validate, Your Security Program

Lyssna när som helst, var som helst

Andra podcasts som du kanske gillar...