エピソード
-
Accelerating into the cloud without caution often brings complexities that can cause more harm than good. Gartner has noted that cloud configuration errors cause 95% of cybersecurity breaches. With the rapid pace of cloud adoption, less time is spent ensuring systems are built and operated effectively with proper cyber hygiene. In this episode, Dale Hoak, Director of Information Security at RegScale, joins me in discussing cloud compliance-related challenges and best practices. Here are some terrific Dale Hoak one-liners:
"Compliance is essentially where fun went to die."
"Nobody steals your work. So, we need to use automation to do the work."
"Compliance is a key driver of trust in our world."
Action Items and Discussion Highlights
Invest in automation to gather and maintain compliance evidence.Implement "compliance as code" to bake compliance into the software development lifecycle.Automate change management processes to speed up compliance reviews.Establish a single pane of glass to prioritize and manage compliance issues.Conduct regular manual reviews to validate automated compliance processes and findings.Ensure prompt action on compliance alerts and issues to avoid consequences.Time Stamps
00:02 -- Introduction
03:12 -- Dale Hoak's professional highlights
05:34 -- Given your experience in the Navy and then with the NYPD and now you're in the corporate world, what are the similarities or differences in how security practices happen?
08:46 -- Commitment-Preparedness-Discipline Framework and Creating a High-Performance Information Security Culture
11:12 -- Building a culture of compliance
13:26 -- Why do organizations tend to be lax with compliance requirements and take the superficial check-the-box approach?
16:19 -- Key problems with the ATO (authority-to-operate) compliance process
19:15 -- Practical recommendations
23:05 -- If we go the automation route, what kinds of checks and balances should be in place where there is periodical and prompt human intervention to ensure you can pick up on errors or glitches?
26:17 -- Prompt processing of threat intelligence
27:06 -- Narrating an incident of non-securely migrating to the cloud
29:33 -- American Cancer Society's migration to the cloud.
31:51 -- Closing Thoughts
Memorable Dale Hoak Quotes/Statements
"Compliance is essentially where fun went to die, and it became very complex. It was very subjective, and it was the enemy of innovation."
"Today, as the cloud expands, particularly with AI, we're seeing that innovation is outpacing compliance."
"Regulatory compliance is becoming more challenging, but also more central in a cloud-first world."
"We've got to put compliance up there in front, and we've got to bake it in instead of bolt it on."
"Folks just tend to recycle and use compliance as the checklist."
"Compliance becomes highly interpretive and subjective, depending on your auditor -- if you bring in an experienced auditor versus a less experienced auditor."
"To be honest, compliance can be subjective, and compliance does not equal security. Just because you meet the guidelines and pass an audit does not make you secure."
"If you give a company an opportunity to save money by slacking on security, they're going to."
"Small companies just don't have the funds it takes to build a reliable security platform in a timely manner."
"Often regulatory compliance guidelines are outdated. They can't keep up with the speed of innovation out there."
"So, how do we make...
-
In this episode, Mike Manrod, the Chief Information Security Officer (CISO) of Grand Canyon Education, and Ori Eisen, the Founder and CEO of Trusona, joined me to discuss how best to reduce the risks of social engineering attacks on IT support and help desk personnel. This episode was motivated by the major cyber attack that brought MGM Resorts International's operations to a screeching halt. It was a social engineering attack where the attackers gained super administrator privileges by providing the MGM Help Desk with basic employee information.
Action Items and Discussion Highlights
"Bypassing the human verification is something super critical we need to address. It's something we can't afford to wait on, and it's low-hanging fruit."Implement a driver's license validation solution to authenticate callers to the IT help desk.Explore expanding the use of identity verification technologies beyond the IT help desk, such as for wire transfers and other high-risk financial transactions.Adopt a layered approach to establishing a robust defense. "You need a good tech stack, user entity behavior analytics, conditional access policies, MFA, and security awareness training." Educate IT support staff on identifying potential social engineering attempts, even when the caller appears to be using advanced techniques like voice cloning.Implement a policy instructing employees to hang up and call back when they receive requests for sensitive information or transactions.Stay vigilant and continue to explore new solutions to combat the evolving threat of social engineering attacks.
Time Stamps
00:02 -- Introduction
02:45 -- Mike Manrod's professional highlights
03:38 -- Ori Eisen's professional highlights
06:36 -- Why is Mike Manrod so passionate about this discussion topic?
08:45 -- Breaching MFA
13:25 -- Securing the Organization from Human Vulnerabilities
17:57 -- Defense-in-Depth and People-Process-Technology
19:44 -- Technology underlying authentication
22:40 -- Seamless adoption of authentication technology
26:15 -- Evolution of authentication technologies
30:02 -- What advice would you have for practitioners like you who are on the fence about investing in such technologies?
31:10 -- Closing Thoughts
Memorable Mike Manrod Quotes/Statements
"Multifactor authentication (MFA) carried us a long way, but now that it's everywhere, it naturally creates a cyber evolutionary force, driving adversaries to have to solve it."
"I think the future is that of a layered approach. No one solution solves the whole problem. You need a good tech stack; You need user entity behavior analytics; You need conditional access policies; You need MFA; You need security awareness training."
"You can't simply rely on five verification questions that anybody could guess."
"We were really excited about the driver's license validation aspect, you know, let's take a trusted authority like a driver's license bureau. Let's take a trusted identification with multiple attributes that can be verified and then put it on a clock so that if somebody somehow tries to socially engineer those chains, we detect and report on that too."
"Bypassing the human verification is something super critical we need to get on top of, and it's something we can't afford to wait on, and it's low-hanging fruit."
Memorable Ori...
-
エピソードを見逃しましたか？
-
In this episode, Laurie Salvail, Ph.D., Executive Director of CYBER.ORG, joins me to discuss the importance of cybersecurity education for K-12 students. Primarily funded by the Cybersecurity and Infrastructure Security Agency (CISA), CYBER.ORG is a powerful and free resource available to K-12 students and educators in the United States. CYBER.ORG’s Range, a cloud-based virtual environment, empowers K-12 students with real-world cybersecurity skills in a secure platform.
Action Items and Discussion Highlights
To inquire about professional development opportunities and resources for your school, contact CYBER.ORG at [email protected] or through the website.Cybersecurity and Infrastructure Security Agency (CISA) is one of the main funders of CYBER.ORG.CYBER.ORG offers no-cost professional development for teachers and caregivers across the US.Currently, over 35,000 teachers have access to CYBER.ORG content and other resources.Resources at Cyber.Org are available to all schools -- public, private, and homeschools.If a child is old enough to receive some type of technology, then they are old enough to learn how to use it.For cybersecurity education and training to be effective, they should be delivered in a fun, interactive, and immersive manner.Encourage industry professionals in your network to volunteer at local schools, speak to students about their cybersecurity-related careers, and help promote awareness about the field.Time Stamps
00:02 -- Introduction
00:49 -- Guest's Professional Highlights
02:41 -- About Cyber.Org
06:08 -- Vulnerability of youth to different forms of cyber attacks
07:22 -- Gaining access to Cyber.Org resources
08:34 -- Gaps in cyber education from K-12
13:36 -- How early should kids be exposed to cybersecurity awareness programs?
15:21 -- Cybersecurity is everyone's business
17:13 -- Should cybersecurity education be part of the K-12 core curriculum as early as possible?
22:35 -- Many schools have their own cybersecurity curriculum and cybersecurity program. So, where do cyber.org resources fit in for these schools?
28:26 -- How can listeners, as well as their organizations, help the cause of K-12 cybersecurity education?
Memorable Laurie Salvail Quotes/Statements
"A big part of who we are, though, is that we do grant writing to make our resources available completely free of charge for any school district teacher; we will never charge the user for anything at all."
"We are very thankful to receive funding from the Cybersecurity and Infrastructure Security Agency (CISA). They're one of our main funders right now, allowing us to create these resources for students across the US.
"We are able to offer no-cost professional development for our teachers and caregivers across the US."
"If you want to teach a student about cybersecurity, come to cyber.org, and we've got free resources for you to dive into and learn how to have those conversations where we're exciting our children."
"We have over 35,000 teachers right now that have access to our content."
"Cybersecurity is an important topic for all students at all grade levels. There's an age-appropriate way to do it at those levels, and we're here to help, so spreading that message is really important."
"Resources at Cyber.Org are available to all schools, public, private, and homeschool families."
"Every school is unique, and every school is different, and we hop on a call with each school to say, what will work in your building, what do your students
-
As machine learning algorithms continue to evolve, Large Language Models (LLMs) like GPT-4 are gaining popularity. While these models hold great promise in revolutionizing various functions and industries—ranging from content generation and customer service to research and development—they also come with their own set of risks and ethical concerns. In this episode, Rohan Sathe, Co-founder & CTO/Head of R&D at Nightfall.ai, and I review the LLM-related risks and how best to mitigate them.
Action Items and Discussion Highlights
Large Language Models (LLMs) are built on specialized machine learning models and architectures called transformer-based architectures, and they are leveraged in Natural Language Processing (NLP) contexts.There's been a lot of ongoing work in using LLMs to automate customer support activities.LLM usage has dramatically shifted to include creative capabilities such as image generation, copywriting, design creation, and code writing.There are three main LLM attack vectors: a) Attacking the LLM Model directly, b) Attacking the infrastructure and integrations, and c)Attacking the application.Prevention and mitigation strategies include a) Strict input validation and sanitization, b) Isolating the LLM environment from other critical systems and resources, c) Restricting the LLM's access to sensitive resources and limiting its capabilities to the minimum required for its intended purpose; d) Regularly audit and review the LLM's environment and access controls; e) Implement real-time monitoring to promptly detect and respond to unusual or unauthorized activities; and f) Establish robust governance around ethical development and use of LLMs.Time Stamps
00:02 -- Introduction
01:54 -- Guest's Professional Highlights
02:50 -- Overview of Large Language Models (LLMs)
07:33 -- Common LLM Applications
08:53 -- AI-Safe Jobs and Skill Sets
11:41 -- LLM Related Risks
15:30 -- Protective Measures
19:09 -- Retrieval Augmented Generation (RAG)
20:57 -- Securing Sensitive Data
23:07 -- Selecting Appropriate Data Loss Protection Platforms
25:00 -- Human Involvement in Processing Alerts
26:56 -- Closing Thoughts
Memorable Rohan Sathe Quotes/Statements
"Large Language Models (LLMs) are built on specialized machine learning models and architectures called transformer-based architectures, and they are leveraged in Natural Language Processing (NLP) contexts. It is really just a computer program that has been fed enough examples to be able to recognize and interpret human language or other complex types of data. And this data comes from the internet."
"The quality of the LLM responses depends upon the data it's trained on."
"LLM is a type of deep learning model, and the goal is to understand how characters, words, and sentences function together and do that probabilistically."
"There's been a lot of ongoing work in using LLMs to automate customer support activities."
"The LLM usage has dramatically shifted to include creative capabilities such as image generation, copywriting, creating designs, and writing code."
"There are three kinds of core LLM attack vectors. One is just to attack the LLM model directly. The second is to attack the surrounding infrastructure and the integrations that the LLM has. The third is to attack the application that may use an LLM under the hood."
"I have seen a lot of infrastructure attacks and attacking the integrations around the LLMs. And then, of course, just the standard attack: attacking...
-
The importance of maintaining uninterrupted services cannot be overemphasized, especially in light of the recent global IT outage fiasco. With the increasing dependence on cloud-based services, uninterrupted connectivity is essential to maintaining business continuity. Since identity providers control access to an organization's application and data, any downtime can shut down mission-critical operations. It was great to have Eric Olden, Co-Founder, Chairman, and Chief Executive Officer of Strata Identity, share his thoughts and perspectives on this critical topic.
Action Items and Discussion Highlights
Inventory applications and dependencies to understand risk exposure.
Conduct risk assessment to quantify risk and start with highest priority applications.
Identify single points of failure.
Trust but verify. You want to test things repeatedly so that when that inevitable outage happens, you're confident that the incident will not have drastic consequences.
Balance investment in identity continuity solutions against the cost of potential downtime.
Consider using existing on-premise identity systems like Active Directory as a low-cost redundancy option.
Consider implementing identity orchestration and continuity solutions to introduce redundancy after evaluating cost vs risk.
Create a culture of resilience that is not surprised when an outage happens but can handle it with grace and confidence.
Time Stamps
00:02 -- Introduction
02:33 -- Guest's Professional Highlights
04:32 -- Eric Olden's Perspective on the Global IT Outage Fiasco
09:16 -- Practicality of Maintaining Redundancy
13:21 -- Identity as Mission-Critical Systems
14:03 -- Identifying Single Points of Failure
20:00 -- Developing Always-On Identity Continuity Solution
21:59 -- Interruption Factors
23:12 -- Continuous and Meticulous Risk Assessment
25:11 -- Incident highlighting a proactive approach to identity risk management
29:42 -- Lessons from the Incident
36:35 -- Final Thoughts
Memorable Eric Olden Quotes/Statements
"I think a lot of people are realizing that there's more single points of failure in their environments, which creates a significant amount of risk."
"Identity system is like the front door of the house; without identity security, you cannot access those applications. So identity has become a mission critical system because it has a primacy in terms of how people access the applications and the data to run today's modern enterprise."
"Understand where you have single points of failure because until you do that analysis, you may be assuming that you aren't in a dependent situation because you've got rid of single points of failure in your data infrastructure, but what about the other parts that are not necessarily under your control."
"Trust but verify. You want to test things repeatedly so that when that inevitable outage happens, you're confident that things will not take your business down with you."
"It's not a question of whether something bad will happen in the future. It was a question of when it will happen and how bad it will hurt."
"If you think about the cost of an investment for continuity, you want to ensure that you're not spending more for continuity than it would cost you for downtime."
"Create a culture of resilience that is not surprised when an outage happens, but can handle it with grace and confidence."
Connect with Host Dr. Dave Chatterjee and Subscribe to...
-
In this episode, Chris Petersen, Co-Founder and CEO of RADICL, and I discuss the challenges of securing the small and medium-sized businesses (SMBs) that serve the United States defense industrial base (DIB) and critical infrastructure. These SMBs play a significant role in supporting the Advanced Defense Systems that protect our nation from domestic and international threats. So, it is imperative to review what it takes to keep these SMBs safe from cyber-attacks.
Action Items and Discussion Highlights
• Treat cybersecurity as a strategic opportunity and invest adequate resources to build and sustain this competency.
• Establishing fail-safe software development practices.
• Software testing and rollout models must be continuously and rigorously tested.
• Proactively determine disaster scenarios and stress test organizational resilience in dealing with those situations.
• Consider establishing key metrics to measure the effectiveness and maturity of cybersecurity operations.
• Demand visibility and transparency into the specific activities a managed service provider is conducting to protect the organization, such as vulnerabilities remediated, security incidents handled, and training completed. Regular reporting should be provided.
• Conduct thorough due diligence when selecting a cybersecurity service provider, including validating the qualifications and expertise of the individuals responsible for security, the technologies used, and references from other customers.
Time Stamps
00:02 -- Introduction
02:09 -- Guest's Professional Highlights
04:32 -- Chris Petersen's Perspective on the Global IT Outage Fiasco
08:01 -- What could Delta have done differently? Could they have proactively predicted such a disaster scenario and prepared for it?
11:45 -- Key Findings from RADICL's 2024 DIB Cybersecurity Maturity Report
13:29 -- Chris Petersen's take on the survey findings
19:49 -- Recommendations on how SMBs serving the defense industrial base and critical infrastructure can meet and exceed compliance requirements.
24:21 -- Cybersecurity as a strategic opportunity
28:43 -- Guidance on selecting service providers and managing outsourced relationships
34:27 -- Advice for SMB CEOs
37:18 -- Closing Thoughts
Memorable Chris Petersen Quotes/Statements
"When we build software, our quality practices need to be fail-safe, especially when you have a footprint like CrowdStrike does that can be so impactful if there is an issue."
"CrowdStrike needs to look at their testing model and perhaps their rollout model of how they roll out content updates."
"Microsoft also shouldn't be so susceptible to a program operating in the kernel that can repeatedly cause a blue screen of death. There should be some resiliency built into the operating system itself."
"I think the technology providers need to build more resiliency into their technologies, especially when they're foundational and are platform-level technologies. For security, folks need to make sure we are doing a really thorough job on the quality side."
"I'm especially concerned because most of these companies typically don't have sophisticated incident response operations in place."
"I'm concerned that these companies have accounts that have been compromised, have endpoints that have been compromised, but the vast majority of them don't have that class of forensic capability to detect and remove the malicious files."
"The thing with compliance, though, is it comes down to how well you achieve compliance."
"Fundamentally, business operations are...
-
In this episode, John Funge, Managing Director at DataTribe, and I discuss the Global IT Outage caused by a flawed update to CrowdStrike's cloud-based security software. We also review DataTribe's recently published report on cybersecurity trends and predictions for 2024. In closing, John shares some tips and recommendations for those seeking cybersecurity funding.
Action Items and Discussion Highlights
Organizations need to incentivize and spend more time and effort hardening the QA cycles.Continue to focus on building secure software through tools/processes that embrace best practices.Assess the concentration of risks and take proactive mitigation steps.Take malware at scale, reverse engineer it, and look inside the malware to use that as training for AI models that can detect and mitigate entire classes of malware.Create a set of tooling that can monitor what happens in CICD (Continuous Integration & Continuous Delivery) pipelines, create the necessary evidence to help enforce process and risk management compliance, and make the software development process much more transparent.Cybersecurity trends include quantum computing, security for serverless architecture, operational technology (OT) security, autonomous defenses, passwordless authentication, AppSec 2.0, and AI SOC Analyst.Time Stamps
00:02 -- Introduction
01:44 -- Guest's Professional Highlights
06:33 -- Global IT Outage Fiasco -- Lessons
08:11 -- Hardening QA Cycles
10:41 -- Software Malfunction in an AI-Driven World -- Corrective Action
15:50 -- Reviewing Cyber Trends -- Quantum Computing, AI-Enabled Autonomous Defenses, AI SOC Analyst, AppSec Scans, etc.
25:30 -- Cybersecurity Governance Process Improvements and Innovations
31:18 -- What does DataTribe, a cyber foundry, look for when evaluating potential investment opportunities?
34:35 -- Cyber Predictions
36:44 -- Closing Thoughts
Memorable John Funge Quotes/Statements
"Software is just really brittle and creaky. Over time, there's been a combination of incentives toward speed of delivery and time to market rather than spending more effort hardening QA cycles."
"Within the security industry, there's this sort of patch advice: Just keep your systems patched, etc. There isn't much discussion in that conversation about how we can engineer the software so it's more secure with fewer bugs."
"It's unclear whether we are increasing the hardness of many software tools and systems at the same time that their responsibility is increasing."
"At the end of the day, AI is really a tool for consolidating training data and creating a decision mechanism based on that."
"Security is just so rich with data. So, if you follow the data, you really do start to see interesting opportunities to potentially create predictive models that allow you to increase your security performance and efficacy."
"There is this opportunity to create a set of tooling that can monitor what goes on in CICD (Continuous Integration and Continuous Deployment) pipelines and create all the necessary evidence that can help enforce process and give confidence to auditors risk management compliance, and essentially take what's going on inside the software development process, and making it much, much more transparent."
"AI models and the data science teams that work on them represent a bit of a black box, and it can be challenging to...
-
The recent breach of the Change Healthcare platform serves as a strong reminder that the healthcare sector remains extremely vulnerable to different types of attacks. In late February, a ransomware gang known as Black Cat claimed responsibility for hacking Change Healthcare, a subsidiary of UnitedHealth Group. The intruders disrupted operations and stole up to four terabytes of data, including personal information, payment details, insurance records, and other sensitive information. It is also reported that a ransom payment of $22 million was made. What is even more concerning is that Change Healthcare is being extorted again by another ransomware group. Incidents such as this jeopardize the survival of countless healthcare providers nationwide due to delays in patient care and delays in making reimbursements. This hack generated massive economic and legal shockwaves across the US healthcare industry, from major industry players to small-town, rural physician practices. In this episode, Amer Deeba, CEO and Co-founder at Normalyze joins me to review the state of cyber security and maturity of the healthcare industry and talk about proactive defense strategies to fortify sensitive healthcare data.
Action Items
Quantify the value of sensitive data assets and identify the highest risk areas.Implement continuous monitoring and controls where sensitive data resides.Connect data security priorities to organizational mission and goals to gain leadership buy-in.Innovate solutions focused on data visibility, classification, access controls, and continuous auditing.Time Stamps
00:02 -- Introduction
03:18 -- Guest's Professional Highlights
04:19 -- State of Cybersecurity Maturity in the Healthcare Industry
9:01 -- Consequences of healthcare data leak
10:54 -- Challenges of securing healthcare data
12:03 -- Practical strategies for securing healthcare data
18:07 -- A proactive approach to securing healthcare data
21:55 -- Best practices
29:21 -- Making the business case
32:46 -- Closing Thoughts
Memorable Amer Deeba Quotes/Statements
"We're expecting that by 2026, about 175 zettabytes of data will be available across multiple types of cloud environments."
"It all starts by understanding where are your most important and critical assets, where are your crown jewels, and whether you are able to understand at any point in time where this information is, who has access to that information, how can they access that information? Do you have the right controls and mechanisms in place in order to secure it, to understand the value of it for your organization and make sure that it's fortified from such attacks."
"With data exploding and moving everywhere, between environments and between cloud and SaaS applications and on-prem, this is the new frontier for attackers."
"You're not boiling the ocean; you are prioritizing based on where your most sensitive information is, and you are making sure there are no attack paths to this data."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee on these platforms:
LinkedIn: https://www.linkedin.com/in/dchatte/
Website:
-
The fast-evolving quantum computing phenomenon represents a paradigm shift in how computers process data. Due to its ability to process vast amounts of data and solve complex problems at an unprecedented speed, quantum computing holds great promise for new material discovery through the simulation of physical systems, portfolio optimization in finance, and more. It also poses a significant threat to cybersecurity, requiring a change in how we encrypt our data. Even though quantum computers don’t technically have the power to break most of the current forms of encryption yet, we need to stay ahead of the threat and come up with quantum-proof solutions now. If we wait until those powerful quantum computers start breaking our encryption, it will be too late. I had the pleasure of discussing the quantum computing phenomenon and its cybersecurity implications with Duncan Jones, Head of Cybersecurity, at Quantinuum. We discussed the potential threats and opportunities of quantum computing for cybersecurity, as well as its potential to revolutionize various industries. We recognized the need for new algorithms resistant to quantum computing, staying ahead of technological innovations, investing in cybersecurity measures, and prioritizing the migration of sensitive data to quantum-resistant algorithms.
Action Items
Assess organizational risk exposure from quantum computing threats like "store now decrypt later" attacks.Prioritize migration of sensitive long-term data to quantum-safe encryption.Speak to vendors about their roadmaps for quantum-safe migration.Explore available quantum random number generators and other quantum cybersecurity technologies through pilot programs and starter kits.Choose credible service providers who are partnering with reputed organizations and prove their claims.Raise awareness of quantum computing implications among leadership and get buy-in for piloting relevant quantum cybersecurity technologies.Time Stamps
00:02 -- Introduction
01:59 -- Guest's Professional Highlights
06:19 -- Overview of Quantum Computing
08:19 -- Commercially Leveraging Quantum Computing
10:51 -- Evolution of Quantum Computing and Cyber Attacks
12:55 -- Recommendations on Leveraging Quantum Computing Benefits and Securing Data from Quantum Computing Enabled Cyber Attacks
17:49 -- Roadmap for Proactive Safeguards
23:34 -- Can quantum computing enabled encryption ensure that even if a human is a victim of a phishing attack, it will be hard to get into systems? Is that a fair aspiration?
26:38 -- What recommendations would you make for organizations who are trying to explore and adopt quantum computing?
29:19 -- Cybersecurity Challenges and Hurdles
32:52 -- Challenges of Quantum-Safe Migration
34:09 -- Cryptographic debt
37:32 -- Final Thoughts
Memorable Duncan Jones Quotes/Statements
"I think of my career as a series of very fortunate accidents, rather than some very carefully planned out thing."
"Quantum computing as a different form of computation, as opposed to necessarily always a better form of computation."
"Leading companies are now starting to engage with quantum computing because they know they have to build the skill sets, they have to develop the intellectual property that will begin to deliver value in the not too distant future."
"Quantum computers are becoming more and more powerful every year."
"We'll actually see Quantum as a as a big benefit for cybersecurity, but we've got some headaches to get through...
-
In this podcast, I enjoyed talking with Chirag Shah, Model N's Global Information Security Officer and Data Privacy Officer, about creating a security-minded culture. Infusing a security culture within organizations starts with leadership buy-in and support. Chirag highlighted the need for interactive and engaging training programs tailored to specific departments, involving real-world examples and practical scenarios. He stressed the significance of fostering a security mindset among employees through daily reminders and reinforcement and leveraging free or low-cost resources to implement effective security awareness programs. Chirag also emphasized the need for a strategic approach to security and a security-minded culture where employees are empowered and responsible for maintaining a strong security posture.
Action Items
Develop an interactive that delivers bite-sized security awareness content, quizzes, and scores performance.
Organize escape room and security hackathon events as hands-on learning initiatives.
Contextualize training for specific employee roles and responsibilities.
Incorporate security into employees' goals and recognize adherence to policies.
Lead by example and make security part of a company's vision and operations
Time Stamps
00:02 -- Introduction
02:38 -- Guest's Professional Highlights
04:14 -- Why do you emphasize the importance of infusing a culture of security?
06:35 -- How do you create a security-minded culture?
09:42 -- How do organizations create engaging and effective cybersecurity awareness training to develop security-minded cultures and cyber hygiene habits among employees?
15:49 -- Personalizing security
19:49 -- Dealing with common challenges and hurdles associated with creating security-minded cultures.
27:53 -- How do you get top management buy-in?
29:05 -- Creating a culture of accountability
36:35 -- Treating cybersecurity as a strategic enabler
37:57 -- Final Thoughts
Memorable Chirag Shah Quotes/Statements
"Security belongs to everyone, not just the security team. It's about embedding security awareness and responsibilities into the vision, mission, and day-to-day operations of all departments and employees."
"Security should become part of the daily goals for the execution of the business."
"Focus on security awareness training that is engaging, fun, and rewarding for employees, and move beyond annual compliance training to create a continuous security learning culture."
"When anyone asks, how big is your security team, I say about 1300 some people, right, because that's what my company is. All of them are our security team, and they are the security champions, and they helped me manage and drive the security program to the next level."
"What you want to do is implement a phased approach to security awareness training, starting with basic concepts and gradually increasing the complexity of those concepts."
"90% of the employees in US companies use laptops to conduct personal transactions, whether they're paying the credit card bill or they're booking travel tickets, they're all doing it online, and using a company laptop."
"Appoint security champions within different departments to assist in training and awareness."
"The message has to be very simple and to the point, so employees can understand and have an open dialogue."
"Implement pre-and post-training assessments and measure changes in employee knowledge."
"Leaders and managers should lead by...
-
Student-led cybersecurity clinics are increasingly playing an essential role in strengthening the digital defenses of nonprofits, hospitals, municipalities, small businesses, and other under-resourced organizations in our communities while also developing a talent pipeline for cyber-civil defense. Sarah Powazek, Program Director - Public Interest Cybersecurity at the University of California, Berkeley Center for Long Term Cybersecurity (CLTC), sheds light on this important development. One of the highlights of the discussion was the recognition that the cybersecurity field is such a melting pot of different skill sets. In Sarah's words, "it's actually one of the biggest advantages we have; threats are changing every day. If we don't have folks from different backgrounds and different life experiences, we're really not going to be prepared; we're not going to be able to adapt."
Time Stamps
00:02 -- Introduction
01:46 -- Guest's Professional Highlights
04:35 -- Center for Long-Term Cybersecurity (CLTC) Initiatives
06:13 -- Training students
07:20 -- How do the cybersecurity clinics benefit students?
09:11 -- Resources for Non-Profits and Under-Privileged Organizations
11:01 -- Types of Clients for Student-Run Cybersecurity Clinics
11:42 -- Guidance to universities who want to create student-led cybersecurity clinics
14:29 -- Consortium of Cybersecurity Clinics
17:20 -- Not-technical roles in cybersecurity
18:46 -- Cybersecurity field is a melting pot of different skill sets
21:12 -- Different Cybersecurity Roles
23:32 -- Final Thoughts
Memorable Sarah Powazek Quotes/Statements
"Cybersecurity clinics are modeled after medical and law school clinics."
"We're running programs where students will learn how to provide a cybersecurity maturity assessment. We accept students from all different majors, at least at UC Berkeley, it's very interdisciplinary. They spend the first part of the course learning all about cybersecurity and about the basics, basic cyber hygiene, multi-factor authentication, regular patching schedules, incident response plans, etc."
"There isn't a real clear academic pathway into cybersecurity."
"One of the big student-run clinics is the University of Nevada, Las Vegas. They operate as a student club; the students train each other, create programming, and engage with the clients, and they operate year-round. They've got a really interesting model for clinics where they're working with clients, but the students are really the ones taking on that responsibility. And the faculty advises them."
"We have a toolkit on the Consortium's website that actually has step-by-step instructions on how to design a clinic. How do you pick out the curriculum? "
"There's a couple of things that we really encourage folks to have, if they want to start up a clinic program, the first is a faculty champion."
"So we've really switched the focus and formed the consortium a number of years ago around centralizing resources, making it easier for folks around the country to start up programs, making the programs even better and more effective at both training students and providing real value to clients. And we have a goal of having a clinic in every state by 2030."
"I think that there are many people worldwide who care about the mission and protecting their communities but haven't gotten some of those skills yet. And anyone can learn. Anyone can learn cybersecurity. I truly believe that, I think people from all backgrounds provide something really valuable to the field."
"Cybersecurity is really a trade. It's something that anyone can learn."
"I'm starting to meet a lot of...
-
Developing and maintaining resilient and secure data centers is a huge part of cybersecurity readiness. Spiros Liolis, Chief Technologist and Managing Consultant, EYP Mission Critical Facilities, Part of Ramboll, joins me to discuss the challenges and best practices of creating and maintaining state-of-the-art data centers. Topics covered include a) elements and attributes of resilient data centers, b) creating and maintaining a resilient and adaptive data center, and c) the different types of risks – geological, meteorological, and human – that must be considered when building and maintaining the data centers.
Time Stamps
00:02 -- Introduction
00:49 -- Setting the Stage and Context for the Discussion
01:54 -- Guest's Professional Highlights
02:56 -- Overview of Data Center Resiliency
05:41 -- Criticality of Data Centers
07:53 -- Key Elements of a Resilient Data Center
12:06 -- Build Your Own or Co-locate
15:00 -- Assessing the Effectiveness of a Data Center
19:32 -- Significance of Simulated Exercises/Tabletop Exercises
21:46 -- Importance of On-Site Visits
23:56 -- Technical, Commercial and Operational Due Diligence
26:17 -- Adaptive Design
28:32 -- Data Center Facility Locations
30:15 -- Best Practices & Final Thoughts
Memorable Spiros Liolis Quotes/Statements
"Everything we do today, as professionals and as consumers, relies heavily on data centers."
"There's a cloud of course, but nothing up there, 35,000 feet above the ground, is hosting servers. The cloud is practically data centers on Earth, right."
"What do we mean by secure and resilient data centers? will refer to the ability of essential data center infrastructure to withstand and recover from disruptions and ensure their continued operations."
"When we talk about potential threats, we need to think of them in terms of geological, meteorological, accidental, or even intentional risks. These are primarily the risk types we talk about when it comes to data center resiliency."
"The moment you power up a data center, you practically cannot shut it down."
"So the resiliency of a data center must consider how to build enough redundancy by design and by implementation into these data centers."
"So our methodology is to look at the different risk factors that may have an impact on the facility itself, whether it is your own, or whether it is being hosted; you need to evaluate, and measure the impact of different risks and these are geological risks, meteorological risks and human risks, whether accidental or unintentional."
"Nothing beats an on-site visit to check a data center's resiliency."
"So the hybrid design is really all about building the necessary critical infrastructure that capitalizes on multiple sources of energy."
"Education awareness is absolutely paramount. And that is probably one of our faults as well, data centers today are considered to be the naughty neighbors. I mean, they say, Oh, they're energy consuming, they take our water, they take our power; we as an industry need to educate our communities, we need to tell them what is it that we do. And of course, we need to make sure that we build them in a sustainable way, we'll use renewables, we will become community friendly. All of that must happen."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee on these platforms:...
-
Application Programming Interfaces (APIs) play a vital role in modern software development, enabling the integration of services and facilitating the exchange of information. The ubiquity of APIs is a testament to their success in supporting many functions. However, their prominence has also made APIs a target for cyberattacks. Jeremy Snyder, Founder & CEO of Firetail.io, joins me in discussing how to secure APIs effectively. Our discussion revolves around the following questions:
What do we need APIs for? Why do we need API security? What are the consequences of lax API security?
What are the risks of APIs today? How can we remedy current API security issues?
Time Stamps
00:02 -- Introduction
00:49 -- Setting the Stage and Context for the Discussion
02:26 -- Guest's Professional Highlights
04:37 -- Overview of APIs
09:12 -- Common API Security Risks and Vulnerabilities
12:29 -- Design with security in mind
13:23 -- Securing APIs
13:36 -- Integrating Security into the Development Process
13:52 -- Different Ways of Security Testing APIs
17:08 -- Vulnerability Monitoring and Promptly Acting on Alerts
19:22 -- Role of Humans in Acting on Vulnerability Alerts
21:33 -- Staying on the Right Side of the Law
23:37 -- Significance of Maintaining Logs
25:36 -- Selecting Robust APIs
27:59 -- Key Takeaways
28:57 -- API Governance
30:25 -- Zero Trust Approach
32:10 -- Use of APIs in Leveraging Large Language Models (AI)
33:41 -- API Governance and Taking Ownership
36:12 -- Final Thoughts
Memorable Jeremy Snyder Quotes/Statements
"Application Programming Interface (API) -- It's basically the way two pieces of software talk to each other, that can be to send data from system A to system B, or that can be for system A to request system B to process something for it."
"We've got sensitive data crossing the wires over an API, but we've also got critical business functions like processing credit card transactions over an API."
"API's are pretty much happening behind the scenes, they enable a huge volume of interactions and transactions every day."
"So we've been cataloging the API data breaches for the last couple of years, these breaches go back about a decade or started about a decade ago, or let me say started to be recognized about a decade ago. And as we've catalogued them, we've kind of categorized them as well, to try to understand in each of these breach scenarios, what was the primary error or breach vector? How was the API breached? And if there's a secondary cause, or things like that, we look at that as well. Two of the main things that we see are are really authentication and authorization."
"Authorization turns out to be the number one root cause of data breaches around API's. And this has been true for many years now."
"Proactive security is always much cheaper than reactive security."
"From the proactive standpoint, the number one thing that any provider of an API can do is actually just check the API's before they go live."
"You should actually pen test your API's before they go live."
"Very often, we find that API's get shipped into production environments without going through either the static code analysis, or the pre launch testing."
"The average time that a vulnerability existed in a production environment before being patched and updated, was around 180 days."
"The best practice that we recommend to customers about reacting to the logs or the alerts or the suspicious conditions that you're seeing in your logs
-
Attackers have started increasingly targeting victims' backups to prevent organizations from restoring their data. Veeam's "2023 Ransomware Trends Report" found more than 93% of ransomware attacks specifically targeted backup data. My discussion with Gabe Gambill, VP of Product and Technical Operations at Quorum, revolves around the following questions:
• What vulnerabilities of data backups do ransomware hackers exploit?
• What are the common mistakes and barriers when recovering against a ransomware attack?
• How to successfully recover from a ransomware attack?
Time Stamps
00:02 -- Introduction
00:49 -- Setting the Stage and Context for the Discussion
01:41 -- Guest's Professional Highlights
02:16 -- Revisiting Ransomware Attacks
03:24 -- Phishing, the Primary Delivery Method for Ransomware
04:33 -- Ransomware Attack Statistics
05:34 -- Payment of Ransom
06:51 -- Protecting and Defending from Ransomware Attacks
08:07 -- Franchising Ransomware
08:51 -- Last Line of Defense against a Ransomware Attack
10:23 -- Data Backups and Prioritization
11:33 -- Data Recovery Best Practices
13:31 -- Holistic Approach to Tabletop Exercises
14:40 -- Significance of Practicing the Data Recovery Process
14:48 -- Common Mistakes and Barriers when Recovering from a Ransomware Attack
18:47 -- Being Appropriately Prepared For Disaster Recovery
20:38 -- Vulnerability Management
21:37 -- Reasons for Not Being Proactive
24:48 -- CISO Empowerment
25:54 -- Cross-Functional Involvement and Ownership
26:56 -- CISO as a Scapegoat
28:43 -- Multi-factor Authentication
29:47 -- Best Practices to Recover from Ransomware Attacks
31:26 -- Final Thoughts
Memorable Gabriel Gambill Quotes/Statements
"The next logical step was ransomware, where they're taking your data, and they're literally encrypting it right from under your nose and holding you accountable, so that they can get money out of you to give you back your own data."
"More people are paying and not talking about it, which is the worst thing you can do in that situation."
"80% of people that are hit with ransomware are hit again. So if I'm the ransomware person, who am I going to attack? I'm going to attack Caesars Palace (hotel in Las Vegas) again, I know they're going to pay. So there's the trade off there between the right thing to do and the hard thing to do."
"The last line of defense are your backups. So it's like an onion, you're gonna have multiple layers of defense, you're gonna have security layers on your perimeter, you're gonna have antivirus, you're gonna have endpoint protection, you're gonna have things such as network scans. There's all kinds of things you can do to provide layers of protection into your environment."
"The ransomware attack is not through vulnerabilities as much as through phishing. And because of that, people are the weakest link in your security plan, inevitably, it's going to happen to everybody."
"The most common thing that I've found is when they recover from ransomware, they don't contact their insurance first. And the bad part about that, whether you're going to pay whether you're not going to pay, if you didn't contact your insurance first, chances are, they're not going to pay you back."
"The other big mistake I see is people rushing the recovery to get back online versus getting back online safely."
"On the technical side, the mistakes that I often see people make is they want everything to be integrated and simple. And there is a level for that in your production environment that is...
-
While tabletop exercises (TTX) are considered a proven tool for finding gaps in an organization’s security posture, they can be painstakingly challenging to plan and implement effectively. In a time where information security teams are understaffed and overworked, are TTX still worth the time and resources? Or are there other ways of ensuring incident response readiness? Navroop Mitter, the CEO of ArmorText, a mobile security and privacy startup, sheds light on the various aspects of tabletop exercises and their effectiveness as a preparedness tool.
Time Stamps
00:02 -- Introduction
00:49 -- Setting the Stage and Compelling Stats
02:48 -- Guest's Professional Highlights
05:12 -- Overview of Tabletop Exercises
07:15 -- Comparing Tabletop Exercises to Simulation
11:12 -- Benefits of Running a Tabletop Exercise
12:36 -- Table Top Exercise Resources
15:18 -- Legal Representation in Tabletop Exercises
17:07 -- Doing Tabletop Exercises Right
23:20 -- Mistakes To Be Avoided
29:14 -- Building Resilient Communication Capabilities
34:28 -- Final Thoughts
Memorable Navroop Mitter Quotes/Statements
"A tabletop is a tool for organizations seeking to enhance their cyber resilience and readiness. It helps you develop muscle memory and identify gaps in your existing plans or other opportunities for enhancement."
"Unfortunately, too often, tabletops are seen as something the cyber folks do alone in their dungeons. But they're just as essential for C-suite senior leadership and the board."
"When we're helping organizations think through tabletops, or the simulations they're going to run, whether it's a very quick, lightweight discussion around the table, or a much more nuanced, immersive simulation, we're asking them to assemble stakeholders like senior leadership board members, IT and security teams, public relations, communications teams, legal counsel, human resources and finance together. This is not about the technologist. It's not just about security. This is about operational resilience. And that means the entire organization."
"When you test your IR plan, even without having a formal team in place, just testing the IR plan alone was nearly as effective; you still had 48 days saved just by having rehearsed and tested your plan, just by having run the playbook before, and understanding what it was to be in that scenario, or something similar to it."
"I think the need of the hour is increased executive and senior leadership involvement."
"Done right, tabletops are actually there to help you prepare for managing regulatory litigation and reputational concerns that often follow these events."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes are released every two weeks.
Connect with Dr. Chatterjee on these platforms:
LinkedIn: https://www.linkedin.com/in/dchatte/
Website: https://dchatte.com/
Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338
-
As artificial intelligence (AI) technologies continue to evolve and be leveraged, organizations need to make a concerted effort to safeguard their AI models and related data from different types of cyber-attacks and threats. Chris Sestito (Tito), Co-Founder and CEO of Hidden Layer, shares his thoughts and insights on the vulnerabilities of AI technologies and how best to secure AI applications.
Time Stamps
00:02 -- Introduction
01:48 -- Guest's Professional Highlights
03:55 -- AI is both a cure and a disease
04:49 -- Vulnerabilities of AI
07:01 -- Hallucination Abuse
10:27 -- Recommendations to secure AI applications
13:03 -- Identifying Reputable AI security experts
15:33 -- Getting Rid of AI Ethics Teams
19:18 -- Top Management Involvement and Commitment
Memorable Chris Sestito Quotes/Statements
"Artificial intelligence systems are becoming single points of failure in some cases."
"AI happens to be the fastest deployed and adopted technology we've ever seen. And that sort of imbalance of how vulnerable it is and how fast it's getting out into the world, into our hardware and software, is really concerning."
"When I talk about artificial intelligence being vulnerable, it's vulnerable in a bunch of ways; it's vulnerable at a code level, it's vulnerable at inference time, or essentially, at real time when it's making decisions, It's vulnerable at the input and output stages with the users and customers and the public interacting with your models, it's vulnerable over networks, it's vulnerable at a generative level, such as writing vulnerable code."
"Hallucination abuse would be the threat actor trying to manage and manipulate the scope of those hallucinations to basically curate desired outcomes."
"We should be holding artificial intelligence to the same standards that we hold other technologies."
"The last thing we want to do is slow down innovation, right? We want to be responsible here, but we don't want to stop advancing, especially when other entities that we can be competing against, whether that's in a corporate scenario, or a geopolitical one, we don't want to handcuff ourselves."
"If we're providing inputs and outputs to our models to our customers, they're just as available to threat actors. And we need to see how they're interacting with them."
"If you're bringing a pre trained model, and and you're going to further train it to your use case, scan it, use the solution to understand if there is code where it doesn't belong."
"If we're providing inputs and outputs to our models to our customers, they're just as available to threat actors. And we need to see how they're interacting with them."
"Red teaming models is a wonderful exercise but we also need to look at things that are a little bit more foundational to security before we get all the way to AI red teaming."
"The threats associated with artificial intelligence are the exact same threats that are associated with other technologies. And it's always people. It's always bad people who want to take advantage of the scenario and there's an enormous opportunity to do that right now."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee on these platforms:
LinkedIn:
-
The latest disaster recovery statistics reveal that modern businesses still face costly interruptions due to a variety of threats, ranging from ransomware attacks to sudden hardware failures. The monetary costs of disasters and outages can be significant. According to results from Uptime Institute's "Annual Outage Analysis 2023" survey, 25% of respondents reported that their latest outage incurred more than $1 million in direct and indirect costs. In addition, 45% reported that the cost of their most recent outage ranged between $100,000 and $1 million. Another research report reveals that just over half of organizations have disaster recover plans and around 7% of organizations never test their disaster recovery plans. It was a real pleasure having Sagi Brody, Co-Founder and CTO at Opti9 on the podcast to shed light on the various aspects of disaster recovery and how to do it well.
Time Stamps
00:02 -- Introduction
00:54 -- Disaster Recovery Statistics and Guest Introduction
03:08 -- Guest's Professional Highlights
04:40 -- Overview of Disaster Recovery
09:12 -- How do you ensure that the disaster recovery infrastructure does not become the next security incident?
11:51 -- Disaster Recovery Best Practices
15:23 -- Around 7% of organizations never test their disaster recovery plan. Why is that the case? Why wouldn't organizations want to ensure that whatever they have documented whatever they have planned actually works?
19:49 -- How effective are tabletop exercises in the context of rehearsing for disaster recovery? Should organizations be doing more than tabletop exercises?
22:09 -- Disaster Recovery and Outsourcing
25:09 -- Final Thoughts
Memorable Sagi Brody Quotes/Statements
"When you think of backups, I like to think of the word RECOVER. When you think of disaster recovery, I like to think of the word RESUME, you're not restoring data, you're resuming your business operations after a disruption."
"I think one of the biggest mistakes that people make is they sort of build their entire production infrastructure, or their application, get it all up and running, make it perfect. And then later on, they want to focus on disaster recovery."
"Imposing disaster recovery strategy on an already built, let's say, application is much more difficult than having resilience be part of your thought process as you go along building your production environment."
"We need Runbooks (or Playbooks) for what we do during a disaster. Not only that, but we need Runbooks for different types of disasters. If we need to fail over one application versus our entire environment, we need a separate Runbook for testing."
"Today, a lot of people have their applications highly integrated with third party SaaS platforms. So let's be sure that when we test our disaster recovery infrastructure, we're testing the applications, we're not poisoning our production data sitting somewhere else inadvertently."
"You have to be super careful when making decisions on what platforms, what vendors, what software you're using to build your applications and your infrastructure. When you make those decisions, you have to weigh them against your resilience framework and your security framework."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee
-
In a very thought provoking discussion, Artificial Intelligence (AI) expert, Tony Hoang, Ph.D., traced the evolution of Gen AI, highlighted the many benefits, and also shared his concerns about the irresponsible and abusive use of this technology. What got my attention were the following realities:
Innovators often prioritize speed over responsible AI development, leading to potential negative consequences.How easy it is to create a software-generated duplicate of someone's voice or video avatar without their consent, using online content such as images and videos.There are no current safeguards to prevent someone from exploiting AI-generated images of someone else, making it a challenge for parents to advise their children on how to protect themselves.Time Stamps
00:02 -- Introduction
00:49 -- Dr. Tony Hoang's Professional Highlights
02:47 -- AI's evolution, data science, machine learning, and generative AI
10:05 -- Generative AI and cybersecurity
14:07 -- AI and cybersecurity threats in the enterprise
18:45 -- AI-generated explicit content and its impact on teenagers
22:48 --AI-generated content and its potential impact on society
30:05 -- AI-generated fake reviews and their impact on businesses
34:55 -- The potential dangers and benefits of generative AI
Memorable Tony Hoang Quotes/Statements
"Right now, there is a big emphasis on the on the client-side of obviously, privacy and security, on the development side, there isn't primarily because of the fact that everyone wants to rush to the top."
"So, what they're doing is they are taking all of the responsible AI committees, all of the privacy committees, and they basically just laid everyone off in the past six months. And that's kind of frightening to see, because what that means is when you fire your responsible AI committee, what that signals is they want to go fast, because these committees actually slow them down in order to accomplish their goal."
"The stuff that really worries me the most about Gen AI isn't phishing attacks, or any of that stuff; my biggest fear right now is the replication of human images, or video or voices."
"One of the ways that you could use Gen AI to take down a competitor, you would go on their website onto the product review, hit it with AI generated responses and just flood it with negative one star or two star reviews. So that's a way to destroy a company's reputation using Gen AI, and we're actually seeing that right now."
"There's no way for anybody to detect AI generated content right now in an automated fashion."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee on these platforms:
LinkedIn: https://www.linkedin.com/in/dchatte/
Website: https://dchatte.com/
Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338
-
A 2023 State of Vulnerability Management Report finds that only half of the surveyed organizations (51%) have, at best, a moderate level of visibility into vulnerabilities. Several other vulnerability management metrics, such as maturity levels, frequency of vulnerability scans, and patch deployment speed, reveal an alarming and troublesome trend. In this episode, Ashley Leonard, CEO at Syxsense, joins me in reviewing the research report findings and discussing vulnerability management challenges and best practices.
Time Stamps
00:02 -- Introduction
02:20 -- Ashley Leonard's Professional Highlights
04:00 -- Scope of Vulnerability Management
06:34 -- Human Vulnerability Factor
08:57 -- AI-enabled Phishing Attacks
09:32 -- Vulnerability Management Objectives
15:50 -- Continuous Vulnerability Scanning and Remediation
18:24 -- Practicality of Continuous Vulnerability Scanning
22:37 -- Securing All Attack Surfaces, Especially IoT Devices and Cloud Assets
25:57 -- Vulnerability Management Maturity Levels
31:33 -- Apparent Disconnect Between Scanning and Visibility
36:15 -- Promptly Acting On Vulnerability Report Findings
41:49 -- Selecting Appropriate Vulnerability Management Tools and Solutions
43:55 -- Vulnerability Management Best Practices
46:30 -- Final Thoughts
Memorable Ashley Leonard Quotes/Statements
"We try and train most of our users not to log in an unknown USB device. But there have been cases where threat actors will take the USB devices and drop them in the parking lot of companies they're trying to breach. People will often pick up these USB sticks, wonder what's on it, walk into the office, and plug it in. It's shocking."
"I would share that patching should not be a monthly process. Many companies do this kind of, "Oh, it's Patch Tuesday, so we're gonna go and deploy our patch Tuesday patches to our organization." It's not even a weekly process, this should be a continuous process."
"New vulnerabilities are being published constantly, we have a whole threat research team that is constantly publishing new content. And if you're not scanning on a continuous basis, then your organization's exposed. So you really need to find technologies and partners that can do this kind of continuous vulnerability management for you."
"In the past, after a vulnerability was publicly announced, it typically took three to seven days before you started to see attackers actually weaponizing these vulnerabilities and attacking, which meant you kind of had a week or so to get your act together, deploy the patches and make sure your organization was safe. It's now down to 24 hours. And that's a problem. That's a huge problem for most organizations, because, unless you are doing continuous vulnerability scanning and remediation, you're not going to be able to respond quickly enough, and your organization is going to be exposed. So you really need technology to step in here. And you need automation that you can use to deploy these patches to your most vulnerable assets as quickly as possible."
"Patches don't get tested normally as much as a full release of a product; that's also a risk."
"Automation can really help you respond quickly but also thoughtfully in the way that you go about remediating these patches."
"Think carefully about the data, categorize how important it is, and think about where it's stored. And that's a really good starting place."
"Threat actors are now using AI to analyze the exfiltrated data from the organization. And then using that data from the AI, for example, finding customer lists, and then contacting those customers, and getting those customers
-
While cloud computing has become a great digitization enabler to enterprises, multiple clouds—especially when intersecting with on-premises systems and one another—can produce some challenges. Many organizations can end up with an "identity gridlock" of competing identity systems and protocols since each cloud platform cannot exchange access policy data with other cloud providers. It was an absolute pleasure having Gerry Gebel, Head of Standards at Strata Identity, join me to discuss the significance of standardizing identity management.
Time Stamps
00:02 -- Introduction
02:09 -- Gerry Gebel's Professional Highlights
04:15 -- Role of Standards in Identity and Access Management
08:14 -- Avoiding Identity Gridlocks
11:38 -- Competing Interests in Developing Standards
14:49 -- Role of Standards in Achieving Fine-Grained Access Controls
18:25 -- Rationale Behind Having Numerous Standards
21:02 -- Senior Leadership Involvement in Standards Setting Process
25:39 -- Streamlining and Standardizing Security
28:07 -- Final Thoughts
Memorable Gerry Gebel Quotes/Statements
"Standards allow for interoperability between domains that different organizations run, and this can provide the user with a lot of convenience."
"Each of these cloud and computing platforms has its own way of defining and configuring access to resources. That's where the gridlock comes in because they're not interchangeable; they are not interoperable."
"Realize that you're not standardizing the whole offering; you're standardizing different pieces that have maybe become a commodity."
"It really comes down to having customers involved in the process, because they're the ones who ultimately, will, or will not purchase products. If there's a lock-in, or there's a lack of interoperability, the customer may choose to stay away from that product or solution."
"You can be an active participant (in the standards-setting process) and look out for your own interests, rather than delegating that to someone else who may not represent the same point of view."
"What is the purpose of creating these standards? And we've sort of alluded to that a couple of times here. I think that's where the enterprise perspective is very important. Because, as a programmer, as a developer, we can easily get lost in the weeds of the technology, you know, how do I write this Go routine? Or how do I write this API? And I think the enterprise perspective keeps the focus on what's the real business purpose for doing this. Does it enhance security? Does it give us vendor independence? Does it reduce risk in some way? Or does it enable new business? So I think it's important to have that [customer] voice in the conversation."
"I would say from the enterprise administrative perspective, there's more capability to properly govern the deployment, the configurations, if you have standards involved, because it gives you more visibility of exactly what is connected to what and who has access to what. It gives you better visibility or reporting capability to show, "Oh, well, I'm compliant with these HIPAA rules, or I'm compliant with, you know, some of their financial rules." So, that's where the standards can be of great benefit in overall governance."
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee on these platforms:
LinkedIn:
- もっと表示する
