Episódios
-
The CISO’s role is changing; that is clear enough.
Indeed, constant change and the need to adapt is always a feature of cybersecurity.
And that’s why our guest this week lists curiosity as one of the key attributes for a cybersecurity career.
Mani Nagothu is field CISO at SentinelOne. Before that she headed up IT security for an energy company. That followed a career as a consultant.
But she didn’t start out in cybersecurity, but as an engineer. And the CISO’s role itself is becoming less technical, and more business focused, she says.
In this episode Mani talks to Stephen Pritchard about her career so far, what it takes to be successful as a CISO, and why greater diversity is the key to strengthening our security teams, and so our defences.
-
The cybersecurity skills gap is a problem that won't go away.
Worldwide, there are close to 3.5 million vacancies in the industry. The problem seems to be worsening, not least because we are all doing more business online.
And moves to recruit and retain more staff, as well as to widen the talent pool, take time.
In the immediate term this leaves CISOs with gaps to fill. One option is outsourcing. Another is to use “on demand” cyber specialists. But how do these options work with building larger and more effective in-house teams?
Do they go hand in hand, or are the two measures likely to conflict?
In the second of the second of our three part series looking at the evolution of the CISO role, we speak to Victoria Parker, advisory professional services manager at Orange CyberDefense.
We discuss how external experts can help organisations secure their environments now - but how CISOs still need to invest in their own teams, and that critical talent pipeline.
-
Estão a faltar episódios?
-
What is a chief business security officer, and what do they do?
IT and data security are increasingly important. But so too are physical security and resilience.
The chief business security officer, though, is a fairly new addition to the security team.
Over the next three episodes of the Security Insights podcast, we’ll look at the changing role of the CISO, the role interim or outsourced security professionals can play in plugging the skills gap.
We’ll cover the role of interim and virtual CISOs, and whether outsourcing parts of security can make up for a growing skills gap.
But first, we ask Anaïs Beaucousin, Chief Business Security Officer at ADP International, about her role, the threats and risks she manages, and what is needed to make the most of a broader security team.
-
Ransomware now accounts for the vast majority of cyber attacks.
But regulators and law makers are increasingly concerned about the money being paid out to ransomware groups -- often, it is used to fund further crime.
Should paying ransoms be banned? Would a ban improve security, or make matters worse? And what steps can organisations take, to cut the risk of falling victim to a ransomware attack in the first place?
Our guest this week is Ian Thornton Trump, CISO at Cyjax. He believes that calls to ban ransomware are misplaced; a ban gives firms fewer options when it comes to responding to an attack. And fines for paying ransoms is further punishing victims of cybercrime.
He discusses the development of ransomware, why it is so dangerous, and how to counter it with Stephen Pritchard.
-
In this episode, we look at why a lack of robust identity controls are one of the biggest causes of cloud security failures.
Cloud operators, at least the larger ones, now have robust security in place. But that security is there, first and foremost, to protect their business. The "shared responsibility model" means that users are responsible for their data and applications.
The problem, as our guest this week identifies, is that senior managers fail to understand that point, and expect the cloud to fix everything.
It won't, and as Jennifer Cox, member of the global engineering team at Tenable, and director for Ireland of Women in Cybersecurity, warns "it always makes me a bit nervous when people think that something is foolproof".
-
Are passwords now a security risk? And if they no longer work, what should replace them?
In this episode, we speak to https://www.linkedin.com/in/johncapps/ at VIDA Digital Identify, and Ev Kontsevoy, CEO of infrastructure access firm Teleport.
They argue that relying on "secrets" and data to prove identity no longer guarantees security. Alternatives, including zero trust, hold out a lot of promise. But moving to zero trust needs the whole organisation behind it -- it's as much about culture as technology.
-
How are the threats to critical national infrastructure evolving, and how do we counter them?
And are we seeing a shift from attacks based on data and ransomware, towards disruption.
In this episode, we welcome back a previous guest, Trevor Dearing.
Trevor is Director of Critical Infrastructure at Illumio.
Trevor’s work is increasingly focused on resilience, and helping organisations to survive and recover from attacks.
We discuss how organisations in the CNI space need to improve their ability to react to, and survive, a cyber attack.
After all, a failure to do so could cause widespread economic and social disruption.
-
The EU’s Digital Operational Resilience Act, or DORA, comes into force in January 2025. So there is not much time for affected organisations to prepare.
DORA sets out to improve cybersecurity — or ICT risk management — across the EU’s financial services sector.
The Act covers both regulated firms and what the EU terms “critical third parties” in their supply chains. In fact managing third party risk is a big part of DORA, along with measures such as improved resilience testing, incident management plans, and strict reporting requirements.
Our guest is DORA expert and director of consulting firm SECFORCE Rodrigo Marcos.
-
The UK Government's Department of Science, Innovation and Technology (DSIT) is consulting on a new code of practice for business leaders, which aims to "improve cyber resilience across the UK economy".
But how will this operate, and will another code of practice -- alongside a host of existing laws and industry regulations -- help organisations be more secure?
We discuss this with our guest Amanda Finch, CEO of the Chartered Institute of Information Security.
Listeners can find out more about the proposed Code of Practice and the consultation on the UK Government's cyber security site.
-
As many as a third of serious vulnerabilities could be in web applications. But securing web apps, APIs and web-based interfaces is a challenge.
In this episode, we look at why vulnerabilities have seen a steady uptick over the last few years, how identifying and securing vital web applications is essential to enterprise security, and why a fixation on technical CVEs does little to boost defences.
Plus, why both security pros and reporters like a pie analogy.
Our guest is Alex Kreilein, vice president for product security at Qualys. Interview by Stephen Pritchard.
Listeners can also view the Qualys research on the firm's blog.
-
What are the key security challenges for 2024? And how will CISOs address them?
In our first episode for Series 5, Security Insights is joined again by Chris Dimitriadis, Chief Global Strategy Officer at ISACA.
He explains why AI both poses risks, and offers benefits, why the cyber skills shortage is not going away, and how cybersecurity's voice needs to be heard by the board.
Interview by Stephen Pritchard.
-
In our final episode of this season, and indeed for this year, we look at some of the key trends in cybersecurity during 2023. And we discuss some of the steps CISOs might need to take, to safeguard their organisations in 2024.
Our special guest is the CEO of the Chartered Institute of Information Security (CIISec), Amanda Finch.
-
Nothing seems able to stop the growth of cybercrime. And ransomware, above all, has woken up boards to the threat.
But there is more to cybercrime than ransomware, and the drivers behind online crime are varied too. And the scale of the problem means that few, if any, organisations can tackle it alone.
Our guest this week is security expert, chief scientist at Rapid 7 and Europol EC3 adviser Raj Samani. He talks to Stephen Pritchard about why cybercrime is far more than an IT security issue, and why a range of responses will be needed to reduce the threat.
-
Could quantum computing threaten our day to day security, and even the fabric of the internet? Researchers are increasingly concerned about the risks quantum technology poses to encryption.
Organisations need to act now, if they are they are to secure their data and their operations, argue this week's guests.
Ramy Shelbaya is CEO and co-founder of Quantum Dice. That’s a business spun out of Oxford university’s quantum optics lab – and which is now using quantum mechanics to create a self-certifying quantum random number generator.
And Axel Poschmann is a cybersecurity expert with a background in both the industry and academia. Currently, he works at PQShield, another business with links to Oxford, and which specialises in quantum-resistant cryptography.
We asked them to explain why quantum threatens security, and what CISOs can do about it.
Interviews by Stephen Pritchard
-
The upcoming European Cyber Resilience Act sets out to boost security for anything with “digital elements”.
The Act will apply to hardware and software. The idea is to make it easier to update devices, and to fix any vulnerabilities.
Why, then, has a group of cyber security professionals written an open letter to the European Commission asking them to change a key part of the proposed rules?
Experts are concerned that, by requiring organisations to disclose vulnerabilities within 24 hours, the Act could increase, rather than reduce, risks.
Our guest today is Christine Bejerasco, CISO at WithSecure and one of the signatories of the letter.
We asked her to set out the background to the Act, and why so many security professionals fear it could have unintended consequences.
Interview by Stephen Pritchard
-
As many as 96 per cent of vulnerabilities in open source software are because developers use an outdated, or unpatched version of the code.
And this matters, because open source is now the building block of almost all enterprise software, web applications, and even the code that runs consumer technology.
But open source can be secure. It just needs developers, and the organisation they work for, to think about security throughout the software lifecycle.
With guest Brian Fox, CTO and co-founder at Sonatype.
-
The cybersecurity industry faces an ongoing -- and some say worsening -- skills gap.
Both the private and public sectors need more skilled security professionals, as more operations go online. And there is only so much the education system, or training within the business, can do to solve the problem.
So do we need to rethink how cybersecurity operates? Perhaps it is time for the industry to undergo its own digital transformation, and look at automation to take the load off human professionals.
Our guest is Marie Wilcox, board director at the Chartered Institute of Information Security and also security evangelist at Panaseer.
-
Most boards -- and certainly all CISOs -- now understand that it is not if a cyber attack happens, but when.
None the less, organisations are not doing enough to ensure that they can continue to operate during a cyber attack, and recover from it.
And the latest UK Government Cyber Security Breaches survey goes further, suggesting that not only are organisations failing to invest in cyber security, but in some cases, are going backwards. They are paying less attention to the basic "cyber hygiene" measures that can help prevent breaches in the first place.
Our guest this week is Prof. Steven Furnell, professor of cyber security at Nottingham University,a senior member of the IEEE, and one of the researchers for the Cyber Security Breaches survey.
In this episode he discusses the pressures that could be prompting organisations to cut back on security, comparisons between cyber and "physical" crime, the need for awareness and resilience and what we need to do in a world where cyber attacks are now endemic.
Interview by Stephen Pritchard
-
Healthcare is coming under an increasing volume of cyber attacks, especially since the pandemic.
And attacks are spreading to smaller health care outfits, such as ambulance services, suppliers to the health care system, and the pharmaceutical industry.
Much of this is being driven by ransomware, but we are also seeing more complex attacks.
How can healthcare organisations protect themselves?
Our guest is Trevor Dearing, Director of Critical Infrastructure at Illumio, who reports that a growing percentage of his work now involves the health sector.
-
Is cyber war a risk that only governments can deal with? Or should enterprises be prepared to mount their own defences?
In this episode we speak to Prof Richard Benham, a UK Government adviser on cyber security, the first professor in cyber security management, Patron of The National Museum of Computing at Bletchley Park, and non-executive director at Emerge Digital.
He believes that, in some ways, a cyber war has already started. He speaks to editor Stephen Pritchard about the reasons why, and sets out what organisations can do to protect their digital assets and infrastructure.
- Mostrar mais