CISO Tradecraft®

In this episode of CISO Tradecraft, host G Mark Hardy discusses the history and evolution of endpoint protection with guest Kieran Human from ThreatLocker. Starting from the inception of antivirus software by John McAfee in the late 1980s, the episode delves into the advancements through Endpoint Detection and Response (EDR) and introduces the latest in endpoint security: allowlisting and ring fencing. The conversation highlights the limitations of traditional antivirus and EDR solutions in today's threat landscape, emphasizing the necessity of default-deny approaches to enhance cybersecurity. Kieran explains how ThreatLocker’s allowlisting and ring-fencing capabilities can block unauthorized applications and actions, thus significantly reducing the risk of malware and ransomware attacks. Practical insights, war stories, and deployment strategies are shared to help cybersecurity leaders implement these next-generation tools effectively.

Thank you to our sponsor ThreatLocker

https://hubs.ly/Q02_HRGK0

Transcripts: https://docs.google.com/document/d/1UMrK44ysBjltNkddCkwx9ly6GJ14tIbC

Chapters

• 00:00 Introduction to Endpoint Protection
• 00:41 Upcoming Event: CruiseCon 2025
• 01:18 History of Endpoint Protection
• 03:34 Evolution of Antivirus to EDR
• 05:25 Next-Gen Endpoint Protection: Allowlisting
• 06:44 Guest Introduction: Kieran Human from ThreatLocker
• 08:06 Benefits of Allowlisting and Ring Fencing
• 17:14 Challenges and Best Practices
• 26:19 Conclusion and Call to Action

In this crucial episode of CISO Tradecraft, host G Mark Hardy delves into the urgent topic of the 'Salt Typhoon' threat, with insights from experts Adam Isles and Andreas Kurland from the Chertoff Group. The episode covers the implications for corporate security using SMS text messages when Chinese actors are breaking into major telecommunication entities. The conversation focuses on encryption, secure communications, and measures to mitigate risks from vulnerabilities in telecommunications infrastructure. The discussion includes practical steps for securing messaging, voice calls, virtual meetings, and emails. Learn actionable strategies to bolster your organization’s cybersecurity posture and ensure robust defense against sophisticated state-level cyber threats.

Thank you to our sponsor Threat Locker

https://www.threatlocker.com/pages/essential-eight-fast-track?utm_source=ciso_tradecraft&utm_medium=sponsor&utm_campaign=essential-eight_q4_24&utm_content=essential-eight&utm_term=podcast

Link to recommendations:

https://chertoffgroup.com/end-to-end-encryption-is-essential/ 

Transcripts https://docs.google.com/document/d/13NKPUBU3c-qYQtX18NR08oYVRSSnHD_a

Chapters:

• 00:00 Introduction to Salt Typhoon
• 01:31 Meet the Experts: Adam Isles and Andreas Kurland
• 02:03 Understanding the Salt Typhoon Threat
• 04:49 Telecommunications and Security Risks
• 07:37 Messaging Security: Risks and Recommendations
• 20:14 Voice Communication Security
• 28:44 Securing Virtual Meetings
• 34:45 Email Security: Challenges and Solutions
• 41:35 Conclusion and Contact Information

In this riveting episode of CISO Tradecraft, host G Mark Hardy welcomes back Richard Thieme, a thought leader in cybersecurity and technology, almost three years after his last appearance. Richard delves into the necessity of thinking like a hacker, provides insights into the AI singularity, and discusses the ethical and societal implications of emerging technologies. The conversation also touches on Richard's extensive body of work, including his books and views on cyber warfare, disinformation, and ethical decision-making. Tune in for a thought-provoking discussion that challenges conventional wisdom and explores the interconnectedness of technology, consciousness, and our future.

Big Thanks to our Sponsor CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

Link to Richard’s home page (and links to Amazon for his books): 

            https://thiemeworks.com/

Link to the book, The Ending of Time:

            https://store.kfa.org/products/the-ending-of-time-new-edition

Transcripts: https://docs.google.com/document/d/1Q7CJkF7Spji2iAbV_mYEyYHnKWobzo6N

Chapters 

• 00:00 Introduction and Guest Announcement
• 00:56 Upcoming Cybersecurity Event: CruiseCon
• 01:41 Welcoming Back Richard Thieme
• 02:06 Reflecting on Past Discussions
• 02:59 The Necessity for Thinking Like a Hacker
• 03:10 Exploring Richard Thieme's Books
• 08:25 Understanding AI and Its Implications
• 18:28 Soft Power and Global Influence
• 24:01 The Power of Fiction in Revealing Truth
• 24:37 Ethical Frameworks Post 9/11
• 26:12 The Role of Empathy in Intelligence Work
• 26:37 The Blurring Line Between Fact and Fiction
• 29:52 The Isolation of Intelligence Work
• 31:18 The Interconnectedness of Everything
• 33:36 Exploring Remote Viewing and Consciousness
• 36:50 The Rise of AI and Ethical Considerations
• 39:43 The Evolution of Technology and Society
• 45:07 Final Thoughts and Reflections

This podcast episode of CISO Tradecraft features Shawnee Delaney, an insider threat expert, discussing insider threats in cybersecurity. Delaney, whose background includes espionage, explains how understanding human motivation and vulnerabilities is crucial for identifying and mitigating insider threats. The conversation highlights the importance of organizational culture, employee well-being, and proactive measures like employee lifecycle management and psychological testing in preventing such threats. Practical advice is offered for leaders to foster a supportive and communicative work environment to detect potential threats early. Finally, methods for creating effective insider threat programs and addressing cultural issues are explored.

Shawnee Delaney's LinkedIn - https://www.linkedin.com/in/shawnee-delaney/

Vaillance Group - https://www.vaillancegroup.com/

Transcripts: https://docs.google.com/document/d/1xJiEMDL8CjNwwfBSvNHfnhfsrVgOMuk0

Chapters

• 00:00 Introduction to Insider Threat
• 00:26 Guest Introduction: Shawnee Delaney
• 00:58 CruiseCon 2025 Announcement
• 01:33 Shawnee's Career Journey
• 02:18 Understanding Espionage
• 03:43 Motivations Behind Espionage
• 07:46 Indicators of Insider Threat
• 10:48 Building a Positive Organizational Culture
• 18:21 Implementing an Insider Threat Program
• 21:05 Psychological Testing in Hiring
• 23:26 Assessing Organizational Culture
• 25:34 Core Values in the Navy and Marine Corps
• 26:16 A Commanding Officer's Story
• 28:32 Identifying Insider Threats
• 32:01 The Impact of Job Uncertainty
• 36:50 Gamifying Security Incentives
• 39:12 Building a Strong Security Culture
• 42:05 Final Thoughts and Recommendations

Welcome to another enlightening episode of CISO Tradecraft! In this episode, host G. Mark Hardy dives deep into the critical topic of CISO burnout with special guest Raghav Singh, a PhD candidate from the University of Buffalo. This is an eye-opening session for anyone in the cybersecurity field, especially those in or aspiring to the CISO role. Raghav shares valuable insights from his extensive research on the unique stresses faced by CISOs, the organizational factors contributing to burnout, and practical coping mechanisms. We also explore the evolutionary phases of CISOs, from technical experts to strategic business enablers. Whether you're dealing with resource limitations, seeking executive support, or managing ever-evolving cybersecurity threats, this episode offers actionable advice to navigate the demanding role of a CISO successfully. Don't forget to like, comment, and share to help other CISOs and cybersecurity leaders!

Big Thanks to our Sponsor CruiseCon - https://cruisecon.com/

• CruiseCon Discount Code: CISOTRADECRAFT10

Transcripts: https://docs.google.com/document/d/1fhLkaj_JetlYFQ50Q69uMGmsw3fS3Wqa

CISO Burnout - https://aisel.aisnet.org/amcis2023/sig_lead/sig_lead/4/

CISO-CIO Power Dynamics https://aisel.aisnet.org/amcis2024/is_leader/is_leader/6/ 

Cybersec professionals and AI integration https://aisel.aisnet.org/amcis2024/security/security/29/

Raghav can be reached on [email protected]

Chapters 

• 00:00 Introduction and Guest Welcome
• 02:34 Understanding CISO Burnout
• 03:24 PhD Journey and Challenges
• 10:12 Key Findings on CISO Burnout
• 18:39 Six Sources of CISO Burnout
• 32:47 CISO Maturity Levels
• 42:57 Conclusion and Call to Action

Setting Sail with Cybersecurity: Exclusive Insights from Ira Winkler on CruiseCon 2025 🛳️ Join us for an exciting episode of CISO Tradecraft as G Mark Hardy sits down with renowned cybersecurity expert Ira Winkler! Discover the groundbreaking CruiseCon 2025, the first at-sea cybersecurity conference, featuring top-tier speakers and unrivaled networking opportunities. Learn about Ira's illustrious career, the significance of certifications, and the current state of the cybersecurity job market. Don't miss out on this chance to enhance your career and connect with industry luminaries.

Big Thanks to our Sponsor CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

Transcripts: https://docs.google.com/document/d/1CGyFBxOrxvJitKsH9BRKwf2_g8rRPZ6K

Chapters

• 00:00 Introduction and Special Announcement
• 00:42 Reconnecting with Ira Winkler
• 04:07 Early Cybersecurity Days and Certifications
• 14:35 Innovative Ideas and CruiseCon
• 21:32 Meet the Top Cybersecurity Experts
• 22:13 Exciting Events and Networking Opportunities
• 24:10 Special Deals and Sponsorships
• 34:47 Addressing the Cybersecurity Job Market

Join G. Mark Hardy on this exciting episode of CISO Tradecraft as he interviews J.C. Vega, the first cyber colonel in the United States Army. Vega shares his invaluable insights on leadership, team building, and success strategies that can transform your cybersecurity career. Plus, learn about CruiseCon 2025, Wee Dram, and how you can take your leadership skills to the next level. Don't miss out on this episode packed with wisdom, actionable advice, and some fun anecdotes. Subscribe, comment, and share with your peers!

Big Thanks to our Sponsor CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

JC Vega - https://www.linkedin.com/in/jcvega-cyber-colonel/ 

Transcripts: https://docs.google.com/document/d/1ExuX-WVO4_qqLoIZDuT0QS2VAvN2resW

Chapters

• 00:00 Introduction and Special Guest Announcement
• 01:15 Meet J.C. Vega: The First Cyber Colonel
• 01:55 The Wee Dram Community
• 03:39 Building a Trusted Cybersecurity Community
• 09:12 Leadership Principles from Military to Civilian Life
• 12:31 Building and Leading Effective Teams
• 24:17 The Peter Principle and Career Progression
• 24:49 Creating a Shared Understanding in Cybersecurity
• 26:43 Commander's Intent: Defining Success
• 29:29 Empowering Teams and Accepting Prudent Risk
• 36:19 Rules to Live By: The Vega's Top Three
• 44:58 Final Thoughts and Farewell

In this special Halloween episode of CISO Tradecraft, host G Mark Hardy delves into the lurking dangers of Shadow IT and Zombie IT within organizations. Learn about the origins, risks, and impacts of these hidden threats, and discover proactive measures that CISOs can implement to safeguard their IT ecosystems. Strategies discussed include rigorous asset management, automation, and comprehensive compliance reviews. Tune in for insights to foster a secure, compliant, and efficient IT environment, and don't miss out on an exclusive opportunity to join a cybersecurity conference aboard a luxury cruise.

Big Thanks to our Sponsor

CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

Transcripts: https://docs.google.com/document/d/1lh-TQhaSOIA2rITaXgTaqugl7FRGevnn

Chapters 

• 00:00 Introduction to Shadow IT and Zombie IT
• 02:14 Defining Shadow IT
• 04:58 Risks of Shadow IT
• 07:29 Introduction to Zombie IT
• 09:35 Risks of Zombie IT
• 11:25 Shadows vs Zombies
• 11:25 Comparing Shadow IT and Zombie IT
• 19:11 Lifecycle Management Strategies
• 19:56 Summarizing the Threats and Solutions
• 22:32 Final Thoughts and Call to Action

Unlocking SOC Excellence: Master the SOC Capability Maturity Model Join host G Mark Hardy in this compelling episode of CISO Tradecraft as he explores the revolutionary SOC Capability Maturity Model (SOC CMM) authored by Rob van Os. This episode is a must-watch for CISOs, aspiring CISOs, and cybersecurity professionals aiming to optimize their Security Operations Center (SOC). Learn how to measure, evaluate, and enhance your SOC's maturity across key domains including Business, People, Process, Technology, and Services. Gain insights into leveraging radar charts for visualizing SOC capabilities and hear case studies such as a mid-sized financial company’s remarkable improvements. Discover why understanding your SOC's strengths and weaknesses and conducting risk-based improvement planning are crucial. Don't miss out—elevate your cyber resilience today, subscribe, and share with your network to set your SOC on the path to excellence!

References:

• SOC-CMM - https://www.soc-cmm.com/products/soc-cmm/
• Robert van Os - https://www.linkedin.com/in/socadvisor/

Transcripts: https://docs.google.com/document/d/1Fk6_t9FMyYXDF-7EfgpX_ZjLc0iPAgfN

Chapters

• 00:12 Introduction to CISO Tradecraft and SOCs
• 01:20 Understanding SOC CMM: A Game-Changing Tool
• 02:29 Evaluating SOC Maturity and Capability
• 06:04 Benefits and Implementation of SOC CMM
• 07:56 Understanding SOC Assessments
• 08:55 Deep Dive into SOC CMM Domains
• 12:42 Benefits and Flexibility of SOC CMM
• 14:40 Real-World Application and Conclusion

In this episode of CISO Tradecraft, host G Mark Hardy explores the challenges and misconceptions facing the next generation of cybersecurity professionals. The discussion covers the myth of a talent shortage, the shortcomings of current educational and certification programs, and the significance of aligning curricula with real-world needs. Hardy emphasizes the importance of hands-on experience, developing soft skills, and fostering continuous learning. The episode also highlights strategies for retaining talent, promoting internal training, and creating leadership opportunities to cultivate a skilled and satisfied cybersecurity workforce.

Transcripts: https://docs.google.com/document/d/12fI2efHXuHR4dS3cu7P0UIBCtjBdgREI

Chapters

• 00:00 Introduction to the Cybersecurity Talent Crisis
• 00:40 Debunking the Talent Shortage Myth
• 02:23 The Real Talent Gap: Mid-Career Professionals
• 03:04 Outsourcing and Its Impact on Entry-Level Jobs
• 08:29 Challenges in Cybersecurity Education
• 16:13 The Importance of Practical Skills Over Theory
• 23:52 The Importance of Writing Skills
• 25:10 Continuous Learning and Self-Investment
• 26:07 Performance and Career Progression
• 28:40 Mentorship and Onboarding
• 29:51 Training and Development Challenges
• 32:32 Retention Strategies
• 33:44 Engaging Junior Employees
• 39:07 Technology and Innovation
• 40:54 Conclusion and Final Thoughts

In this episode of CISO Tradecraft, hosted by G Mark Hardy, you'll learn about four crucial tools in cloud security: CNAPP, CASB, CSPM, and CWPP. These tools serve various functions like protecting cloud-native applications, managing access security, maintaining cloud posture, and securing cloud workloads. The discussion covers their roles, benefits, key success metrics, and best practices for CISOs. As the cloud security landscape evolves, understanding and integrating these tools is vital for keeping your organization safe against cyber threats.

Transcripts: https://docs.google.com/document/d/1Mx9qr30RuWrDUw1TLNkUDQ8xo4xvQdP_

Chapters 

• 00:00 Introduction to Cloud Security Tools
• 02:24 Understanding CNAPP: The Comprehensive Cyber Defense
• 08:13 Exploring CASB: The Cloud Access Gatekeeper
• 11:12 Diving into CSPM: Ensuring Cloud Compliance
• 13:40 CWPP: Protecting Cloud Workloads
• 15:08 Best Practices for Cloud Security
• 15:54 Conclusion and Final Thoughts

In this episode of CISO Tradecraft, hosts G Mark Hardy and Mark Rasch discuss the intersection of artificial intelligence and the law. Recorded at the COSAC computer conference in Dublin, this episode covers the legal implications of AI, copyright issues, AI-generated content, privacy concerns, and ethical considerations. They explore the nuances between directed and undirected AI, the importance of training data, and the potential risks and liabilities associated with AI-driven systems. Tune in for a deep dive into how AI is reshaping cybersecurity and legal landscapes.

Transcripts: https://docs.google.com/document/d/1s_eDwz-FPuyxYZRJaOknWi2Ozjqmodrl

Chapters

• 00:00 Introductions
• 01:13 Diving into Artificial Intelligence
• 04:04 Directed vs. Undirected AI
• 11:02 Legal and Ethical Issues of AI
• 23:47 AI and Copyright: Who Owns the Creation?
• 26:59 The Role of AI in Information Security
• 32:51 Ethical Dilemmas in AI Decision-Making
• 39:18 Future Challenges and Recommendations for AI

Join G. Mark Hardy in Torremolinos, Spain, for a deep dive into the security of Generative AI. This episode of CISO Tradecraft explores the basics of generative AI, including large language models like ChatGPT, and discusses the key risks and mitigation strategies for securing AI tools in the workplace. G. Mark provides real-world examples, insights into the industry's major players, and practical steps for CISOs to balance innovation with security. Discover how to protect sensitive data, manage AI-driven hallucinations, and ensure compliance through effective governance and ethical guidelines. Plus, get a glimpse into the future of AI vulnerabilities and solutions in the ever-evolving tech landscape.

References

OWASP Top 10 LLM Risks https://genai.owasp.org/

Gartner CARE Standard - https://www.gartner.com/en/documents/3980890

• Make sure your controls work consistently over time (Consistency)
• Make sure your controls meet the business needs (Adequacy)
• Make sure your controls are appropriate and fair (Reasonableness)
• Make sure your controls produce the desire outcome (Effectiveness)

Transcripts: https://docs.google.com/document/d/1V2ar7JBO503MN0RZcH7Q7VBkQUW9MYk6

Chapters

• 00:00 Introduction from Spain
• 00:42 Understanding Generative AI
• 03:25 Major Players in Generative AI
• 05:02 Risks of Generative AI
• 15:14 Mitigating Generative AI Risks
• 18:23 Implementing Solutions
• 24:09 Conclusion and Call to Action

G Mark Hardy dives deep into effective strategies for securing your business. Learn why it's essential for cybersecurity leaders to communicate the real business impact of vulnerabilities and discover the importance of identifying and prioritizing critical business processes.  Gain insights from historical references and practical frameworks like the CIA triad (Confidentiality, Integrity, Availability) to bolster your organization's cybersecurity posture. Tune in as G Mark, broadcasting from Glasgow, Scotland, shares valuable lessons on proactive security measures, risk-based decision-making, and crisis recovery strategies.

7 critical business processes common to most organizations.

1. Book 
2. Order 
3. Bill 
4. Pay
5. Ship 
6. Close
7. Communicate 

Transcripts

https://docs.google.com/document/d/1Ra3c0J5Wo6s2BSqhNoNyqm9D65ogT07h

Chapters

• 00:00 Introduction to Securing the Business
• 00:12 Begin Podcast
• 01:08 Understanding Critical Business Processes
• 02:23 Identifying and Prioritizing Business Functions
• 03:00 Real-World Example: Restaurant Booking System
• 04:57 Decision Making in Crisis Situations
• 10:38 Mapping Confidentiality, Integrity, and Availability
• 19:42 Conclusion and Final Thoughts

Join host G Mark Hardy as he dives deep into the complexities of compliance and reporting, featuring special guests Brian Bradley and Josh Williams from FedShark. Discover a unique and streamlined approach to compliance using FedShark's innovative tools and AI-assisted systems. Learn about their exclusive offers for CISO Tradecraft listeners, including free downloads and discounted pre-assessment tools. Topics covered include CMMC, HIPAA, PCI, and more. Whether you're part of the Defense Industrial Base or dealing with multiple compliance frameworks, this episode is packed with practical advice to make your compliance journey smoother and more effective.

Thanks to our podcast sponsor, Fedshark

CISO Traderaft Promo & Link to CMMC White Papers: https://fedshark.com/ciso

RapidAssess: https://fedshark.com/rapid-assess

Company website: https://fedshark.com

FedShark Blog: https://fedshark.com/blog

Schedule a Demo: https://fedshark.com/contact-us

LinkedIn Matt Beaghley: https://www.linkedin.com/in/mbeaghley/

LinkedIn Brian Bradley: https://www.linkedin.com/in/brian-bradley-97a82668/

Chapters 

• 00:00 Introduction and Special Offer
• 03:18 Meet the Experts: Brian and Josh
• 06:49 Challenges in Compliance
• 16:23 Understanding CMMC
• 29:02 Understanding Scope in Compliance
• 30:22 Introducing the AI-Enhanced Compliance Solution
• 31:24 Streamlining Interviews and Documentation
• 42:19 Final Thoughts and Recommendations

G Mark Hardy and guest Deb Radcliff talk about experiences and takeaways from Black Hat, and delve into the dynamic world of cybersecurity. Deb shares her perspectives on the intersection of AI, DevSecOps, and cyber warfare, while highlighting insights from her 'Breaking Backbones' trilogy. 

Transcripts: https://docs.google.com/document/d/1XN9HjdljJYKlUITrxZ10HTq9e91R8FNT

Book 1: Breaking Backbones: Information Is Power
        https://amzn.to/4dLSBxQ
Book 2: Breaking Backbones: Information Should Be Free
        https://amzn.to/4e3BRlB
Book 3: Breaking Backbones: From Chaos to Order
        https://amzn.to/3X8e4u2

Chapters

• 00:00 Introduction and Welcome Back
• 01:18 Black Hat and Security Leaders Dinner
• 04:39 The Evolution of Cybersecurity Conferences
• 10:59 AI and Cybersecurity Trends
• 22:01 The Chip Dilemma: Parenting in a Monitored Society
• 23:09 Crafting Characters: Inspirations and Transformations
• 25:58 Writing Process: From Drafts to Details
• 31:38 Future of Cybersecurity: Autonomous Systems and Legal Challenges

In this episode of CISO Tradecraft, host G Mark Hardy is joined by special guest Snehal Antani, co-founder of Horizon3.AI, to discuss the crucial interplay between offensive and defensive cybersecurity tactics. They explore the technical aspects of how observing attacker behavior can enhance defensive strategies, why traditional point-in-time pen testing may be insufficient, and how autonomous pen testing can offer continuous, scalable solutions. The conversation delves into Snehal’s extensive experience, the importance of readiness over compliance, and the future of cybersecurity tools designed with humans out of the loop. Tune in to learn how to elevate your cybersecurity posture in a rapidly evolving threat landscape.

Horizon3 - https://www.horizon3.ai

Snehal Antani - https://www.linkedin.com/in/snehalantani/

Transcripts: https://docs.google.com/document/d/1IFSQ8Uoca3I7TLqNHMkvm2X-RHk8SWpo

Chapters:

• 00:00 Introduction and Guest Welcome
• 01:43 Background and Experience of Snehal Antani
• 03:09 Challenges and Limitations of Traditional Pen Testing
• 14:47 The Future of Pen Testing: Autonomous Systems
• 23:10 Leveraging Data for Cybersecurity Insights
• 24:02 Expanding the Attack Surface: Cloud and Supply Chain
• 24:46 Third-Party Risk Management Evolution
• 44:37 Future of Cyber Warfare: Algorithms vs. Humans

In this episode of CISO Tradecraft, host G Mark Hardy delves into the intricate world of Identity and Access Management (IAM). Learn the essentials and best practices of IAM, including user registration, identity proofing, directory services, identity federation, credential issuance, and much more. Stay informed about the latest trends like proximity-based MFA and behavioral biometrics. Understand the importance of effective IAM implementation for safeguarding sensitive data, compliance, and operational efficiency. Plus, hear real-world examples and practical advice on improving your IAM strategy for a secure digital landscape.

Transcripts: https://docs.google.com/document/d/15zUupqhCQz9llwy21GW5cam8qXgK80JB

Chapters

• 00:00 Introduction to CISO Tradecraft
• 01:24 Understanding Identity and Access Management (IAM)
• 01:54 Gartner's Magic Quadrant and IAM Vendors
• 03:29 The Importance of IAM in Enterprises
• 04:28 User Registration and Verification
• 06:48 Password Policies and Best Practices
• 09:53 Identity Proofing Techniques
• 14:53 Directory Services and Role Management
• 18:27 Identity Federation and Credential Issuance
• 22:22 Profile and Role Management
• 26:17 Identity Lifecycle Management
• 29:23 Access Management Essentials
• 35:05 Review and Conclusion

In this comprehensive episode of CISO Tradecraft, host G Mark Hardy sits down with Christian Hyatt, author of 'The Security Team Operating System'. Together, they delve into the five essential components needed to transform your cyber security team from reactive to unstoppable. From defining purpose and values to establishing clear roles, rhythms, and goals, this podcast offers practical insights and tools that can improve the efficacy and culture of your security team. If you're looking for strategic frameworks to align your team with business objectives and create a resilient security culture, you won't want to miss this episode!

Christian Hyatt's LinkedIn Profile: https://www.linkedin.com/in/christianhyatt/

Link to the Book: https://a.co/d/aHpXXfr

Transcripts: https://docs.google.com/document/d/1ogBdtJolBJTOVtqyFLO5onuLxBsfqqQP

Chapters

• 00:00 Introduction and Guest Welcome
• 01:31 Overview of the Security Team Operating System
• 03:31 Deep Dive into the Five Elements
• 07:53 Aligning Security with Business Objectives
• 21:59 Defining Core Values for Security Teams
• 25:03 Aligning Organizational and Team Values
• 26:05 Establishing Clear Roles and Responsibilities
• 30:58 Implementing Effective Rhythms and Goals

Join host G Mark Hardy in this episode of CISO Tradecraft as he welcomes Olivia Rose, an experienced CISO and founder of the Rose CISO Group. Olivia discusses her journey in cybersecurity from her start in marketing to becoming a VCISO. They delve into key topics including the transition from CISO to VCISO, strategies for managing time and stress, the importance of understanding board dynamics, and practical advice on mentoring new entrants in the cybersecurity field. Olivia also shares her insights on maintaining business alignment, handling insurance as a contractor, and building a personal brand in the cybersecurity community.

Olivia Rose: https://www.linkedin.com/in/oliviarosecybersecurity/

Transcripts: https://docs.google.com/document/d/1S42BepIh1QQHVWsdhhgx6x99U188q5eL

Chapters

• 00:00 Introduction and Guest Welcome
• 01:14 Olivia Rose's Career Journey
• 06:42 Challenges in Cybersecurity Careers
• 15:47 Communicating with the Board
• 22:57 Navigating Compliance and Legal Challenges
• 24:10 Building Strategic Relationships
• 25:46 Aligning Security with Business Goals
• 35:05 The Importance of Reputation and Branding

In this episode of CISO Tradecraft, host G Mark Hardy continues an in-depth discussion with cybersecurity attorney Thomas Ritter on the legal considerations for cybersecurity leaders. The episode touches on essential topics such as immediate legal steps after a data breach, the importance of using correct terminology, understanding attorney-client privilege and discovery, GDPR's impact, data localization, and proactive measures CISOs should take. The conversation also explores the implications of evolving cybersecurity laws and regulations like the Digital Operations Resilience Act and the potential criminal liabilities for CISOs.

Thomas Ritter: https://www.linkedin.com/in/thomas-ritter-2b91014a/

Transcripts: https://docs.google.com/document/d/15xQINUOdziGdcEFfh5SN8lS7svtK0JCT

Chapters

• 00:00 Introduction and Recap of Part 1
• 01:43 Starting the Discussion: Data Breaches
• 02:22 Legal Steps After a Data Breach
• 07:19 Understanding Attorney-Client Privilege
• 08:21 Discovery in Legal Cases
• 13:31 Staying Updated on Cybersecurity Laws
• 19:38 Impact of GDPR on Cybersecurity
• 32:00 Data Localization Challenges
• 34:55 Proactive Legal Preparedness
• 37:23 Final Thoughts and Conclusion

In this episode of CISO Tradecraft, host G Mark Hardy interviews cybersecurity lawyer Thomas Ritter. They discuss key legal topics for CISOs, including regulatory compliance, managing third-party risk, responding to data breaches, and recent legislative impacts. Thomas shares his journey into cybersecurity law and provides practical advice and real-world examples. Key points include the challenges of keeping up with evolving regulations, the intricacies of vendor management, and the implications of recent Supreme Court rulings. They also touch on major breaches like SolarWinds and Colonial Pipeline, exploring lessons learned and the importance of implementing essential security controls.

Thomas Ritter - https://www.linkedin.com/in/thomas-ritter-2b91014a/ Transcripts: https://docs.google.com/document/d/1EvZ_dOpFOLCSSv5ffqxCoMnLZDOnUv_K

Chapters

• 00:00 Introduction to CISO Tradecraft
• 00:48 Meet Thomas Ritter: Cybersecurity Lawyer
• 03:48 Legal Challenges for CISOs
• 04:54 Managing Third-Party Risks
• 13:01 Understanding Legal and Statutory Obligations
• 15:57 Supreme Court Rulings and Cybersecurity
• 32:57 Lessons from High-Profile Cyber Attacks
• 38:32 Ransomware Epidemic and Law Enforcement
• 43:30 Conclusion and Contact Information

Emotional Intelligence for Cybersecurity Leaders | CISO Tradecraft In this episode of CISO Tradecraft, host G Mark Hardy delves into the essential topic of emotional intelligence (EI) for cybersecurity leaders. He explores the difference between IQ and EI, the origins and significance of emotional intelligence, and its impact on leadership effectiveness. The episode covers various models of EI, including the Ability Model, the Trait Model, and the Mixed Model, and emphasizes practical actions to enhance EI, such as self-awareness, self-regulation, empathy, and social skills. Tune in to understand how developing emotional intelligence can significantly benefit your career, leadership performance, and personal life. 

Transcripts: https://docs.google.com/document/d/15pyhXu3XVHJ_VE1OwKjSqM73Rybjbsm0

Chapters:

• 00:00 Introduction to CISO Tradecraft
• 00:53 Understanding IQ: The Basics
• 04:08 Introduction to Emotional Intelligence
• 07:38 Models of Emotional Intelligence
• 13:06 The Importance of Emotional Intelligence in Leadership
• 25:12 Practical Steps to Improve Emotional Intelligence
• 32:42 Conclusion and Final Thoughts

Securing Small Businesses: Essential Cybersecurity Tools and Strategies In this episode of CISO Tradecraft, host G Mark Hardy discusses cybersecurity challenges specific to small businesses. He provides insights into key tools and strategies needed for effective cybersecurity management in small enterprises, including endpoint management, patch management, EDR tools, secure web gateways, IAM solutions, email security gateways, MDR services, and password managers. Hardy also evaluates these tools against the CIS Critical Security Controls to highlight their significance in safeguarding small business operations.

Transcripts: https://docs.google.com/document/d/1Hon3h950myI7A3jzGmj7YIwRXow5W1V5

Chapters

• 00:00 Introduction to CISO Tradecraft
• 00:40 Challenges of Cybersecurity in Small Businesses
• 01:15 Defining Small Business and Security Baselines
• 01:53 Top Cybersecurity Tools for Small Businesses
• 02:05 Hardware and Software Essentials
• 04:35 Patch Management Solutions
• 05:19 Endpoint Detection and Response (EDR) Tools
• 06:06 Secure Web Gateways and Website Security
• 11:21 Identity and Access Management (IAM)
• 12:57 Email Security Gateways
• 14:15 Managed Detection and Response (MDR) Solutions
• 14:54 Recap of Essential Cybersecurity Tools
• 15:41 Bonus Tool: Password Managers
• 18:33 Aligning with CIS Controls
• 24:48 Conclusion and Call to Action

Welcome to another episode of CISO Tradecraft with your host, G. Mark Hardy! In this episode, we dive into how CISOs can drive the profitable growth of their company's products and services. Breaking the traditional view of security as a cost center, Mark illustrates ways CISOs can support business objectives like customer outreach, service enablement, operational resilience, and cost reduction. Tune in for insightful strategies to improve your impact as a cybersecurity leader and a sneak peek at our upcoming CISO training class! If you would like to learn more about our class, drop us a comment: https://www.cisotradecraft.com/comment

Transcripts: https://docs.google.com/document/d/19SDBdQSTLc58sP5ynwzhuedNHzk7QPKj

Chapters

• 00:00 Introduction to Profitable Growth for CISOs
• 01:16 Understanding Profit and Business Objectives
• 03:24 Enhancing Customer Experience through Cybersecurity
• 08:51 Service Enablement and Upselling Strategies
• 11:39 Ensuring Operational Resilience
• 13:36 Cost Reduction and Efficiency Improvements
• 18:31 Recap and Final Thoughts
• 19:10 Exciting Announcement: CISO Training Course

Exploring AI in Cybersecurity: Insights from an Expert - CISO Tradecraft with Tom Bendien In this episode of CISO Tradecraft, host G Mark Hardy sits down with AI expert Tom Bendien to delve into the impact of artificial intelligence on cybersecurity. They discuss the basics of AI, large language models, and the differences between public and private AI models. Tom shares his journey from New Zealand to the U.S. and how he became involved in AI consulting. They also cover the importance of education in AI, from executive coaching to training programs for young people. Tune in to learn about AI governance, responsible use, and how to prepare for the future of AI in cybersecurity.

Transcripts: https://docs.google.com/document/d/1x0UTLiQY7hWWUdfPE6sIx7l7B0ip7CZo

Chapters

• 00:00 Introduction and Guest Welcome
• 00:59 Tom Bendien's Background and Journey
• 02:30 Diving into AI and ChatGPT
• 04:29 Understanding AI Models and Neural Networks
• 07:11 The Role of Agents in AI
• 10:10 Challenges and Ethical Considerations in AI
• 13:47 Open Source AI and Security Concerns
• 18:32 Apple's AI Integration and Compliance Issues
• 24:01 Navigating AI in Cybersecurity
• 25:09 Ethical Dilemmas in AI Usage
• 27:59 AI Coaching and Its Importance
• 32:20 AI in Education and Youth Engagement
• 35:55 Career Coaching in the Age of AI
• 39:20 The Future of AI and Its Saturation Point
• 42:07 Final Thoughts and Contact Information

In this episode of CISO Tradecraft, host G Mark Hardy delves into the complex intersection of ethics and artificial intelligence. The discussion covers the seven stages of AI, from rule-based systems to the potential future of artificial superintelligence. G Mark explores ethical frameworks, such as rights-based ethics, justice and fairness, utilitarianism, common good, and virtue ethics, and applies them to AI development and usage. The episode also highlights ethical dilemmas, including privacy concerns, bias, transparency, accountability, and the impacts of AI on societal norms and employment. Learn about the potential dangers of AI and how to implement and control AI systems ethically in your organization. 

Transcripts: https://docs.google.com/document/d/10AhefqdhkT0PrEbh8qBZVn9wWS6wABO6

Chapters

• 00:00 Introduction to CISO Tradecraft
• 01:01 Stages of Artificial Intelligence
• 03:33 Ethical Implications of AI
• 05:24 Business Models and Data Security
• 13:52 Ethical Frameworks Explained
• 23:18 AI and Human Behavior
• 25:44 The TikTok Feedback Loop and Digital Addiction
• 26:54 AI's Unpredictable Capabilities
• 28:25 The Ethical Dilemmas of AI
• 30:57 Generative AI and Its Implications
• 42:10 The Role of Government and Society in AI Regulation
• 45:49 Conclusion and Ethical Considerations

In this episode of CISO Tradecraft, host G Mark Hardy explores the challenges complexity introduces to cybersecurity, debunking the myth that more complex systems are inherently more secure. Through examples ranging from IT support issues to the intricacies of developing a web application with Kubernetes, the discussion highlights how complexity can obscure vulnerabilities, increase maintenance costs, and expand the attack surface. The episode also offers strategies to tackle complexity, including standardization, minimization, automation, and feedback-driven improvements, aiming to guide cybersecurity leaders toward more effective and less complex security practices.

Transcripts: https://docs.google.com/document/d/1J0rPr0HxULpeVJMIwXKXqHuCfnXn4gDu

Chapters 

• 00:00 Introduction
• 01:03 The Misconception of Complexity in Cybersecurity
• 02:41 Real-World Complexities and Their Impact on IT
• 10:06 Simplifying Cybersecurity: Strategies and Solutions
• 14:48 Conclusion: Embracing Simplicity in Cybersecurity

This episode of CISO Tradecraft features a conversation between host G. Mark Hardy and Chris Rothe, co-founder of Red Canary, focusing on cloud security, managed detection and response (MDR) services, and the evolution of cybersecurity practices. They discuss the genesis of Red Canary, the significance of their company name, and the distinctions between Managed Security Service Providers (MSSPs) and MDRs. The conversation also covers the importance of cloud security, the challenges of securing serverless and containerized environments, and leveraging open-source projects like Atomic Red Team for cybersecurity. They conclude with insights on the cybersecurity labor market, the value of threat detection reports, and the future of cloud security.

Red Canary: https://redcanary.com/

Chris Rothe: https://www.linkedin.com/in/crothe/

Transcripts: https://docs.google.com/document/d/1XN4Bp7Sa2geGCVaHuqMRmJckms4q7_L6

This episode of CISO Tradecraft, hosted by G Mark Hardy, features special guest Debbie Gordon. The discussion focuses on the critical role of Security Operations Centers (SOCs) in an organization's cybersecurity efforts, emphasizing the importance of personnel, skill development, and maintaining a high-performing team. It covers the essential aspects of building and managing a successful SOC, from hiring and retaining skilled incident responders to measuring their performance and productivity. The conversation also explores the benefits of simulation-based training with CloudRange Cyber, highlighting how such training can improve job satisfaction, reduce incident response times, and help organizations meet regulatory requirements. Through this in-depth discussion, listeners gain insights into best practices for enhancing their organization's cybersecurity posture and developing key skill sets to defend against evolving cyber threats.

Cloud Range Cyber: https://www.cloudrangecyber.com/

Transcripts: https://docs.google.com/document/d/18ILhpOgHIFokMrkDAYaIEHK-f9hoy63u 

Chapters

• 00:00 Introduction
• 01:04 The Indispensable Role of Security Operations Centers (SOCs)
• 02:07 Building an Effective SOC: Starting with People
• 03:04 Measuring Productivity and Performance in Your SOC
• 05:36 The Importance of Continuous Training and Simulation in Cybersecurity
• 09:00 Debbie Gordon on the Evolution of Cyber Training
• 11:54 Developing Cybersecurity Talent: The Importance of Simulation Training
• 14:46 The Critical Role of People in Cybersecurity
• 21:57 The Impact of Regulations on Cybersecurity Practices
• 24:36 The Importance of Proactive Cybersecurity Training
• 26:26 Redefining Cybersecurity Roles and Training Approaches
• 30:08 Leveraging Cyber Ranges for Real-World Cybersecurity Training
• 36:03 Evaluating and Enhancing Cybersecurity Skills and Team Dynamics
• 37:49 Maximizing Cybersecurity Training ROI and Employee Engagement
• 41:40 Exploring CloudRange Cyber's Training Solutions
• 43:28 Conclusion: The Future of Cybersecurity Training

In this episode of CISO Tradecraft, host G Mark Hardy discusses the findings of the 2024 Verizon Data Breach Investigations Report (DBIR), covering over 10,000 breaches. Beginning with a brief history of the DBIR's inception in 2008, Hardy highlights the evolution of cyber threats, such as the significance of patching vulnerabilities and the predominance of hacking and malware. The report identifies the top methods bad actors use for exploiting companies, including attacking VPNs, desktop sharing software, web applications, conducting phishing, and stealing credentials, emphasizing the growing sophistication of attacks facilitated by technology like ChatGPT for phishing and deepfake tech for social engineering. The episode touches on various cybersecurity measures, the omnipresence of multi-factor authentication (MFA) as a necessity rather than a best practice, and the surge in denial-of-service (DDoS) attacks. Hardy also discusses generative AI's role in enhancing social engineering attacks and the potential impact of deepfake content on elections and corporate reputations. Listeners are encouraged to download the DBIR for a deeper dive into its findings.

Transcripts: https://docs.google.com/document/d/1HYHukTHr6uL6khGncR_YUJVOhikedjSE 

Chapters

• 00:00 Welcome to CISO Tradecraft
• 00:35 Celebrating Milestones and Offering Services
• 01:39 Diving into the Verizon Data Breach Investigations Report
• 04:22 Top Attack Methods: VPNs and Desktop Sharing Software Vulnerabilities
• 09:24 The Rise of Phishing and Credential Theft
• 19:43 Advanced Threats: Deepfakes and Generative AI
• 23:23 Closing Thoughts and Recommendations

In this joint episode of the Security Break podcast and CISO Tradecraft podcast, hosts from both platforms come together to discuss a variety of current cybersecurity topics. They delve into the challenge of filtering relevant information in the cybersecurity sphere, elaborate on different interpretations of the same news based on the reader's background, and share a detailed analysis on specific cybersecurity news stories. The discussion covers topics such as the implications of data sharing without user consent by major wireless providers and the fines imposed by the FCC, the significance of increasing bug bounty payouts by tech companies like Google, and a comprehensive look at how edge devices are exploited by hackers to create botnets for various cyberattacks. The conversation addresses the complexity of the cybersecurity landscape, including how different actors with varied objectives can simultaneously compromise the same devices, making it difficult to attribute attacks and protect networks effectively.

Transcripts: https://docs.google.com/document/d/1GtFIWtDf_DSIIgs_7CizcnAHGnFTTrs5

Chapters

• 00:00 Welcome to a Special Joint Episode: Security Break & CISO Tradecraft
• 01:27 The Challenge of Filtering Cybersecurity Information
• 04:23 Exploring the FCC's Fine on Wireless Providers for Privacy Breaches
• 06:41 The Complex Landscape of Data Privacy Regulations
• 16:00 The Economics of Data Breaches and Regulatory Fines
• 24:23 Bug Bounties and the Value of Security Research
• 33:21 Exploring the Economics of Cybersecurity
• 33:50 The Lucrative World of Bug Bounties
• 34:38 The Impact of Security Vulnerabilities on Businesses
• 35:50 Navigating the Complex Landscape of Cybersecurity
• 36:22 The Ethical Dilemma of Selling Exploit Information
• 37:32 Understanding the Market Dynamics of Cybersecurity
• 38:00 Focusing on Android Application Security
• 38:34 The Importance of Targeting in Cybersecurity Efforts
• 42:33 Exploring the Threat Landscape of Edge Devices
• 46:37 The Challenge of Securing Outdated Technology
• 49:28 The Role of Cybersecurity in Modern Warfare
• 53:15 Strategies for Enhancing Cybersecurity Defenses
• 01:05:25 Concluding Thoughts on Cybersecurity Challenges

In this episode of CISO Tradecraft, host G. Mark Hardy discusses seven critical issues facing the cybersecurity industry, offering a detailed analysis of each problem along with counterarguments. The concerns range from the lack of a unified cybersecurity license, the inefficiency and resource waste caused by auditors, to the need for a federal data privacy law. Hardy emphasizes the importance of evaluating policies, prioritizing effective controls, and examining current industry practices. He challenges the audience to think about solutions and encourages sharing opinions and additional concerns, aiming to foster a deeper understanding and improvement within the field of cybersecurity.

Transcripts: https://docs.google.com/document/d/1H_kTbCG8n5f_d1ZHNr1QxsXf82xb08cG

Chapters

• 00:00 Introduction
• 01:28 Introducing the Seven Broken Things in Cybersecurity
• 02:00 1. The Lack of a Unified Cybersecurity License
• 06:53 2. The Problem with Cybersecurity Auditors
• 10:09 3. The Issue with Treating All Controls as High Priority
• 14:12 4. The Obsession with New Cybersecurity Tools
• 19:23 5. Misplaced Accountability in Cybersecurity
• 22:38 6. Rethinking Degree Requirements for Cybersecurity Jobs
• 26:49 7. The Need for Federal Data Privacy Laws
• 30:53 Closing Thoughts and Call to Action

In this episode of CISO Tradecraft, hosts G Mark Hardy and guests Jeff Majka and Andrew Dutton discuss the vital role of competitive threat intelligence in cybersecurity. They explore how Security Bulldog's AI-powered platform helps enterprise cybersecurity teams efficiently remediate vulnerabilities by processing vast quantities of data, thereby saving time and enhancing productivity. The conversation covers the importance of diverse threat intelligence sources, including open-source intelligence and insider threat awareness, and the strategic value of AI in analyzing and prioritizing data to manage cybersecurity risks effectively. The discussion also touches on the challenges and potentials of AI in cybersecurity, including the risks of data poisoning and the ongoing battle between offensive and defensive cyber operations.

The Security Bulldog: https://securitybulldog.com/contact/

Transcripts: https://docs.google.com/document/d/1D6yVMAxv16XWtRXalI5g-ZdepEMYmQCe

Chapters

• 00:00 Introduction
• 00:56 Introducing the Experts: Insights from the Field
• 02:43 Unpacking Cybersecurity Intelligence: Definitions and Importance
• 04:02 Exploring Cyber Threat Intelligence (CTI): Applications and Strategies
• 13:11 The Role of AI in Enhancing Cybersecurity Efforts
• 16:43 Navigating the Complex Landscape of Cyber Threats and Defenses
• 19:07 The Future of AI in Cybersecurity: A Balancing Act
• 22:33 Exploring AI's Role in Cybersecurity
• 22:50 The Practical Application of AI in Cybersecurity
• 25:08 Challenges and Trust Issues with AI in Cybersecurity
• 26:52 Managing AI's Risks and Ensuring Reliability
• 31:00 The Evolution and Impact of AI Tools in Cyber Threat Intelligence
• 34:45 Choosing the Right AI Solution for Cybersecurity Needs
• 37:27 The Business Case for AI in Cybersecurity
• 41:22 Final Thoughts and the Future of AI in Cybersecurity

This episode of CISO Tradecraft features a comprehensive discussion between host G Mark Hardy and guest Rafeeq Rehman, centered around the evolving role of CISOs, the impact of Generative AI, and strategies for effective cybersecurity leadership. Rafeeq shares insights on the CISO Mind Map, a tool for understanding the breadth of responsibilities in cybersecurity leadership, and discusses various focal areas for CISOs in 2024-2025, including the cautious adoption of Gen AI, tool consolidation, cyber resilience, branding for security teams, and maximizing the business value of security controls. The episode also addresses the importance of understanding and adapting to technological advancements, advocating for cybersecurity as a business-enabling function, and the significance of lifelong learning in information security.

Cybersecurity Learning Saturday: https://www.linkedin.com/company/cybersecurity-learning-saturday/

2024 CISO Mindmap: https://rafeeqrehman.com/2024/03/31/ciso-mindmap-2024-what-do-infosec-professionals-really-do/

Transcripts: https://docs.google.com/document/d/1axXQJoAdJI26ySKVfROI9rflvSe9Yz50

Chapters 

• 00:00 Introduction
• 00:57 Rafeeq Rehman: Beyond the CISO MindMap
• 04:17 The Evolution of the CISO MindMap
• 08:30 AI and the Future of Cybersecurity Leadership
• 11:47 Embracing Change: The Role of AI in Cybersecurity
• 14:16 Generative AI: Hype, Reality, and Strategic Advice for CISOs
• 22:32 Navigating the Future Job Market with AI
• 22:53 Framing AI for Specific Roles
• 24:12 Harnessing Creativity with Generative AI
• 25:14 Consolidating Security Tools for Efficiency
• 28:31 Evaluating Security Tools: A Deep Dive
• 32:21 Cyber Resilience: Beyond Incident Response
• 35:51 Building a Business-Focused Security Strategy
• 39:39 Maximizing Business Value Through Security
• 43:15 Looking Ahead: Focus Areas for the Future
• 43:53 Concluding Thoughts and Future Predictions

In this episode of CISO Tradecraft, host G Mark Hardy welcomes Alex Dorr to discuss Reality-Based Leadership and its impact on reducing workplace drama and enhancing productivity. Alex shares his journey from professional basketball to becoming an evangelist of reality-based leadership, revealing how this approach helped him personally and professionally. They delve into the concepts of SBAR (Situation, Background, Analysis, Recommendation) for effective communication, toggling between low self and high self to manage personal reactions, and practical tools like 'thinking inside the box' to confront and solve workplace issues within given constraints. The conversation underscores the importance of focusing on actionable strategies over arguing with the drama and reality of workplace dynamics, aiming to foster a drama-free, engaged, and productive work environment.

Alex Dorr's Linkedin: https://www.linkedin.com/in/alexmdorr/

Reality-Based Leadership Website: https://realitybasedleadership.com/ 

Transcripts: https://docs.google.com/document/d/1wge0pFLxE4MkS6neVp68bdz8h9mHrwje 

Chapters

• 00:00 Introduction
• 00:57 Alex Dorr's Journey from Basketball to Leadership Expert
• 03:54 The Core Principles of Reality-Based Leadership
• 06:20 Understanding the Human Condition in the Workplace
• 09:19 Tackling Workplace Drama with Reality-Based Leadership
• 11:58 The Power of Positive Energy Management
• 17:42 Navigating Unpreferred Realities and Finding Impact
• 19:44 Reality-Based Leadership in Action: Techniques and Outcomes
• 23:12 The Importance of Skill Development Over Perfecting Reality
• 24:32 The Challenge of Employee Engagement
• 25:49 Secrets to Embracing Reality and Taking Action
• 25:58 Leadership vs. Management: Navigating Workplace Dynamics
• 28:28 Empowering Employees with the SBAR Framework
• 34:04 Addressing Venting and Negative Behaviors
• 36:17 Developing People: The Core of Leadership
• 37:50 Choosing Happiness Over Being Right
• 40:15 Integrating New Leadership Models and Making Them Stick
• 46:24 Concluding Thoughts and Contact Information

This episode of CISO Tradecraft dives deep into the New York Department of Financial Services Cybersecurity Regulation, known as Part 500. Hosted by G Mark Hardy, the podcast outlines the significance of this regulation for financial services companies and beyond. Hardy emphasizes that Part 500 serves as a high-level framework applicable not just in New York or the financial sector but across various industries globally due to its comprehensive cybersecurity requirements. The discussion includes an overview of the regulation's history, amendments to enhance governance and incident response, and a detailed analysis of key sections such as multi-factor authentication, audit trails, access privilege management, and incident response. Additionally, the need for written policies, designating a Chief Information Security Officer (CISO), and ensuring adequate resources for implementing a cybersecurity program are highlighted. The podcast also offers guidance on how to approach certain regulatory mandates, emphasizing the importance of teamwork between CISOs, legal teams, and executive management to comply with and benefit from the regulation's requirements.

AuditScripts: https://www.auditscripts.com/free-resources/critical-security-controls/

NYDFS: https://www.dfs.ny.gov/industry_guidance/cybersecurity 

Transcripts: https://docs.google.com/document/d/1CWrhNjHXG1rePtOQT-iHyhed2jfBaZud

Chapters

• 00:00 Introduction
• 00:35 Why Part 500 Matters Beyond New York
• 01:48 The Evolution of Financial Cybersecurity Regulations
• 03:20 Understanding Part 500: Definitions and Amendments
• 08:44 The Importance of Multi-Factor Authentication
• 14:33 Navigating the Complexities of Cybersecurity Regulations
• 20:23 The Critical Role of Asset Management and Access Privileges 25:37 The Essentials of Application Security and Risk Assessment
• 31:11 Incident Response and Business Continuity Management
• 32:36 Concluding Thoughts on NYDFS Cybersecurity Regulation

In this episode of CISO Tradecraft, host G. Mark Hardy delves into the crucial topic of the OWASP Top 10 Web Application Security Risks, offering insights on how attackers exploit vulnerabilities and practical advice on securing web applications. He introduces OWASP and its significant contributions to software security, then progresses to explain each of the OWASP Top 10 risks in detail, such as broken access control, injection flaws, and security misconfigurations. Through examples and recommendations, listeners are equipped with the knowledge to better protect their web applications and ultimately improve their cybersecurity posture.

OWASP Cheat Sheets: https://cheatsheetseries.owasp.org/

OWASP Top 10: https://owasp.org/www-project-top-ten/

Transcripts: https://docs.google.com/document/d/17Tzyd6i6qRqNfMJ8OOEOOGpGGW0S8w32

Chapters

• 00:00 Introduction
• 01:11 Introducing OWASP: A Pillar in Cybersecurity
• 02:28 The Evolution of Web Vulnerabilities
• 05:01 Exploring Web Application Security Risks
• 07:46 Diving Deep into OWASP Top 10 Risks
• 09:28 1) Broken Access Control
• 14:09 2) Cryptographic Failures
• 18:40 3) Injection Attacks
• 23:57 4) Insecure Design
• 25:15 5) Security Misconfiguration
• 29:27 6) Vulnerable and Outdated Software Components
• 32:31 7) Identification and Authentication Failures
• 36:49 8) Software and Data Integrity Failures
• 38:46 9) Security Logging and Monitoring Practices
• 40:32 10) Server Side Request Forgery (SSRF)
• 42:15 Recap and Conclusion: Mastering Web Application Security

In this episode of CISO Tradecraft, host G Mark Hardy delves into the critical subject of vulnerability management for cybersecurity leaders. The discussion begins with defining the scope and importance of vulnerability management, referencing Park Foreman's comprehensive approach beyond mere patching, to include identification, classification, prioritization, remediation, and mitigation of software vulnerabilities. Hardy emphasizes the necessity of a strategic vulnerability management program to prevent exploitations by bad actors, illustrating how vulnerabilities are exploited using tools like ExploitDB, Metasploit, and Shodan. He advises on deploying a variety of scanning tools to uncover different types of vulnerabilities across operating systems, middleware applications, and application libraries. Highlighting the importance of prioritization, Hardy suggests focusing on internet-facing and high-severity vulnerabilities first and discusses establishing service level agreements for timely patching. He also covers optimizing the patching process, the significance of accurate metrics in measuring program effectiveness, and the power of gamification and executive buy-in to enhance security culture. To augment the listener's knowledge and toolkit, Hardy recommends further resources, including OWASP TASM and books on effective vulnerability management.

Transcripts: https://docs.google.com/document/d/13P8KsbTOZ6b7A7HDngk9Ek9FcS1JpQij

OWASP Threat and Safeguard Matrix - https://owasp.org/www-project-threat-and-safeguard-matrix/

Effective Vulnerability Management - https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207

Chapters

• 00:00 Introduction
• 00:56 Understanding Vulnerability Management
• 02:15 How Bad Actors Exploit Vulnerabilities
• 04:26 Building a Comprehensive Vulnerability Management Program
• 08:10 Prioritizing and Remediation of Vulnerabilities
• 13:09 Optimizing the Patching Process
• 15:28 Measuring and Improving Vulnerability Management Effectiveness
• 18:28 Gamifying Vulnerability Management for Better Results
• 20:38 Securing Executive Buy-In for Enhanced Security
• 21:15 Conclusion and Further Resources

This episode of CISO Tradecraft, hosted by G Mark Hardy, delves into the concept, significance, and implementation of tabletop exercises in improving organizational security posture. Tabletop exercises are described as invaluable, informal training sessions that simulate hypothetical situations allowing teams to discuss and plan responses, thereby refining incident response plans and protocols. The podcast covers the advantages of conducting these exercises, highlighting their cost-effectiveness and the crucial role they play in crisis preparation and response. It also discusses various aspects of preparing for and executing a successful tabletop exercise, including setting objectives, selecting participants, creating scenarios, and the importance of a follow-up. Additionally, the episode touches on compliance aspects related to SOC 2 and the use of tabletop exercises to expose and address potential organizational weaknesses. The overall message underscores the importance of these exercises in preparing cybersecurity teams for real-world incidents.

Outline & References:

https://docs.google.com/document/d/13Qj4MOjPxWz9mhQCDQNBtoQwrXdTeIEf

Transcripts: https://docs.google.com/document/d/1yfmZALQfkhQCMfp9ao3151P9L2XcEXFm/

Chapters

• 00:00 Introduction
• 00:47 The Importance of Tabletop Exercises
• 01:53 The Benefits of Tabletop Exercises
• 03:06 How to Implement Tabletop Exercises
• 05:30 The Role of Tabletop Exercises in Compliance
• 08:24 The Participants in Tabletop Exercises
• 09:25 The Preparation for Tabletop Exercises
• 16:57 The Execution of Tabletop Exercises
• 21:58 Understanding Roles and Responsibilities in an Exercise
• 22:17 The Importance of a Hot Wash Up
• 23:36 Creating an After Action Report (AAR)
• 24:06 Implementing an Action Plan
• 24:34 Example Scenario: Network Administrator's Mistake
• 25:08 Formulating Targeted Questions for the Scenario
• 26:36 The Role of Innovation in Tabletop Exercises
• 27:11 The Connection Between Tabletop Exercises and Compliance
• 29:18 12 Key Steps to a Successful Exercise
• 30:43 The Importance of Realistic Scenarios
• 34:05 The Role of Communication in Crisis Management
• 37:33 The Impact of Cyber Attacks on Operations
• 39:57 The Importance of Tabletop Exercises and How to Get Started
• 40:35 Conclusion

In this episode of CISO Tradecraft, host G Mark Hardy converses with Cassie Crossley, author of the book on software supply chain security. Hardy explores the importance of cybersecurity, the structure of software supply chains, and the potential risks they pose. Crossley shares her expert insights on different software source codes and the intricacies of secure development life cycle. She highlights the significance of Software Bill of Materials (SBOM) and the challenges in maintaining the integrity of software products. The discussion also covers the concept of counterfeits in the software world, stressing the need for continuous monitoring and a holistic approach towards cybersecurity.

Link to the Book: https://www.amazon.com/Software-Supply-Chain-Security-End/dp/1098133706?&_encoding=UTF8&tag=-0-0-20&linkCode=ur2

Transcripts: https://docs.google.com/document/d/1SJS2VzyMS-xLF0vlGIgrnn5cOP8feCV9

Chapters

• 00:00 Introduction
• 01:44 Discussion on Software Supply Chain Security
• 02:33 Insights into Secure Development Life Cycle
• 03:20 Understanding the Importance of Supplier Landscape
• 05:09 The Role of Security in Software Supply Chain
• 07:29 The Impact of Vulnerabilities in Software Supply Chain
• 09:06 The Importance of Secure Software Development Life Cycle
• 14:13 The Role of Frameworks and Standards in Software Supply Chain Security
• 17:39 Understanding the Importance of Business Continuity Plan
• 20:53 The Importance of Security in Agile Development
• 24:01 Understanding OWASP and Secure Coding
• 24:20 The Importance of API Security
• 24:50 The Concept of Shift Left in Software Development
• 25:20 The Role of Culture in Software Development
• 25:52 Exploring Different Source Code Types
• 26:19 The Rise of Low Code, No Code Platforms
• 28:53 The Potential Risks of Generative AI Source Code
• 34:24 Understanding Software Bill of Materials (SBOM)
• 41:07 The Challenge of Spotting Counterfeit Software
• 41:36 The Importance of Integrity Checks in Software Development
• 45:45 Closing Thoughts and the Importance of Cybersecurity Awareness

In this episode of CISO Tradecraft, the host, G Mark Hardy, delves into the concepts of responsibility, accountability, and authority. These are considered critical domains in any leadership position but are also specifically applicable in the field of cybersecurity. The host emphasizes the need for a perfect balance between these areas to avoid putting one in a scapegoat position, which is often common for CISOs. Drawing on his military and cybersecurity experiences, he provides insights into how responsibility, accountability, and authority can be perfectly aligned for the efficient execution of duties. He also addresses how these concepts intertwine with various forms of power - positional, coercive, expert, informational, reward, referent, and connection. The host further empathizes with CISOs often put in tricky situations where they are held accountable but lack the authority or resources to execute their roles effectively and provides suggestions for culture change within organizations to overcome these challenges.

Transcripts: https://docs.google.com/document/d/1S8JIRztM6iaZonGv0qhtWY4vDyBfGhs-/

Chapters

• 00:00 Introduction
• 00:22 Understanding Responsibility, Accountability, and Authority
• 01:20 The Role of Leadership in Cybersecurity
• 02:47 Exploring the Concepts of Responsibility, Authority, and Accountability
• 03:08 Applying Responsibility, Authority, and Accountability to the CISO Role
• 04:20 The Interplay of Responsibility, Authority, and Accountability
• 11:57 Understanding Power and Its Forms
• 12:43 The Impact of Power on Leadership and Influence
• 24:04 The Role of Connection Power in Today's Digital Age
• 24:40 Understanding Different Sources of Power
• 25:13 The Power of Networking and Connections
• 26:49 The Challenges of Being a CISO
• 29:19 Understanding the Value of Your Role
• 33:56 The Importance of Expert Power
• 37:46 The Consequences of Ignoring Maintenance
• 43:40 Aligning Responsibility, Accountability, and Authority
• 44:39 The Importance of Legal Protections for CISOs
• 45:30 Wrapping Up: Balancing Responsibility, Authority, and Accountability

In this episode of CISO Tradecraft, host G Mark Hardy discusses various mishaps that can occur with Multi-Factor Authentication (MFA) and how these can be exploited by attackers. The talk covers several scenarios such as the misuse of test servers, bypassing of MFA via malicious apps and phishing scams, violation of the Illinois Biometric Information Protection Act by using biometric data without proper consent, and potential future legal restrictions on biometric data usage. G Mark also highlights the significance of correct implementation of MFA to ensure optimum organizational security and how companies can fail to achieve this due to overlooking non-technical issues like legal consent for biometric data collection.

Transcripts: https://docs.google.com/document/d/1FPCFlFRV1S_5eaFmjp5ByU-FCAzg_1kO

References:

• Evil Proxy Attack- https://www.resecurity.com/blog/article/evilproxy-phishing-as-a-service-with-mfa-bypass-emerged-in-dark-web
• Microsoft Attack - https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/microsoft-reveals-how-hackers-breached-its-exchange-online-accounts/amp/
• Illinois Biometric Law - https://www.ilga.gov/legislation/publicacts/fulltext.asp?Name=095-0994

Chapters

• 00:00 Introduction
• 00:43 Understanding Multi Factor Authentication
• 01:05 Exploring Different Levels of Authentication
• 03:30 The Risks of Multi Factor Authentication
• 03:51 The Importance of Password Management
• 04:27 Exploring the Use of Trusted Platform Module for Authentication
• 06:17 Understanding the Difference Between TPM and HSM
• 09:00 The Challenges of Implementing MFA in Enterprises
• 11:25 Exploring Real-World MFA Mishaps
• 15:30 The Risks of Overprivileged Test Systems
• 17:16 The Importance of Monitoring Non-Production Environments
• 19:02 Understanding Consent Phishing Scams
• 30:37 The Legal Implications of Biometric Data Collection
• 32:24 Conclusion and Final Thoughts

In this episode of CISO Tradecraft, host G Mark Hardy is joined by special guest Rick Howard, Chief Security Officer, Chief Analyst and Senior Fellow at CyberWire. Rick shares his insights on first principles in cybersecurity, discussing how these form the foundations of any cybersecurity strategy. He emphasizes the importance of understanding materiality and integrating the concept of time bound risk assessment to achieve a resilient cybersecurity environment. The episode also delves into the value of Fermi estimates and Bayes algorithm for risk calculation. Amid humor and personal anecdotes, Rick and Mark also reflect on their experiences during 9/11. Rick introduces his book, 'Cybersecurity First Principles', elucidating the rationale behind its conception.

Link to the Cybersecurity First Principles Book: https://www.amazon.com/Cybersecurity-First-Principles-Strategy-Tactics/dp/B0CBVSX2H2/?&_encoding=UTF8&tag=-0-0-20&linkCode=ur2&linkId=1b3010fb678a109743f1fb564eb6d0fc&camp=1789&creative=9325

Transcripts: https://docs.google.com/document/d/1y8JPSzpmqDMd-1PZ-MWSqOuxgFTDVvre

Chapters

• 00:00 Introduction
• 02:00 Guest's Career Journey and Achievements
• 08:49 Discussion on Cybersecurity First Principles
• 15:27 Understanding Materiality in Cybersecurity
• 21:56 The Gap Between Security Teams and Business Leaders
• 22:21 The Importance of Speaking the Language of Business
• 23:03 The Art of the Elevator Pitch
• 24:04 The Impact of Cybersecurity on Business Value
• 25:10 The Importance of a Clear Cybersecurity Strategy
• 26:04 The Value of Business Fluency in Cybersecurity
• 27:44 The Role of Risk Calculation in Cybersecurity
• 29:41 The Power of Estimation in Risk Management
• 30:33 The Importance of Understanding Business Imperatives
• 41:25 The Role of Culture and Risk Appetite in Cybersecurity
• 45:39 The First Principle of Cybersecurity

In this episode of CISO Tradecraft, host G Mark Hardy is joined by guest Craig Barber, the Chief Information Security Officer at SugarCRM. They discuss the increasingly critical topic of cybersecurity apprenticeships and Craig shares his personal journey from technical network engineer to CISO. They delve into the benefits of apprenticeships for both the individual and the organization, drawing parallels with guilds and trade schools of the past and incorporating real-world examples. They also look at the potential challenges and pitfalls of such programs, providing insights for organizations considering creating an apprenticeship scheme. Lastly, they examine the key attributes of successful apprentices and how these contribute to building stronger, more diverse cybersecurity teams.

Craig Barber's Profile: https://www.linkedin.com/in/craig-barber/

Transcripts https://docs.google.com/document/d/1J8nrhYCMBSmc0kLBasskBoY2RLIwR7Vb

Chapters

• 00:00 Introduction
• 00:23 Understanding Cybersecurity Apprenticeships
• 02:43 The Role of Mentorship in Cybersecurity
• 04:09 The Benefits of Cybersecurity Apprenticeships
• 07:17 The Evolution of Apprenticeships in the Tech Industry
• 10:00 The Value of Apprenticeships in Building Loyalty
• 11:08 The Difference Between Internships and Apprenticeships
• 15:32 The Role of Apprenticeships in Addressing the Skills Shortage
• 19:15 The Challenges of Implementing Apprenticeships
• 26:28 The Future of Cybersecurity Apprenticeships
• 44:32 Conclusion: The Value of Cybersecurity Apprenticeships

This video introduces a newly proposed acronym in the world of cybersecurity known as the 'Cyber UPDATE'. The acronym breaks down into Unchanging, Perimeterizing, Distributing, Authenticating and Authorizing, Tracing, and Ephemeralizing. The video aims to explain each component of the acronym and its significance in enhancing cybersecurity. 

References:

1. https://www.watchguard.com/wgrd-news/blog/decrypting-cybersecurity-acronyms-0
2. https://computerhistory.org/profile/john-mccarthy/
3. https://owasp.org/www-community/Threat_Modeling_Process#stride
4. https://attack.mitre.org/att&ck 
5. https://d3fend.mitre.org/
6. https://fourcore.io/blogs/mitre-attack-mitre-defend-detection-engineering-threat-hunting  
7. https://cars.mclaren.com/us-en/legacy/mclaren-p1-gtr
8. https://csrc.nist.gov/glossary/term/confidentiality
9. https://csrc.nist.gov/glossary/term/integrity
10. https://csrc.nist.gov/glossary/term/availability
11. https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services
12. https://www.nytimes.com/2006/06/30/washington/va-laptop-is-recovered-its-data-intact.html
13. https://cloudscaling.com/blog/cloud-computing/the-history-of-pets-vs-cattle/
14. https://apps.dtic.mil/sti/tr/pdf/ADA221814.pdf 

Transcripts https://docs.google.com/document/d/16upm5bKTsIkDo3s-mvUMlgkX1uqUKnUH

Chapters

• 00:00 Introduction
• 01:34 Cybersecurity Acronyms: Pre-1990s
• 02:26 STRIDE and DREAD Models
• 02:39 PICERL and MITRE Models
• 05:04 Defining Cybersecurity
• 07:52 CIA Triad and Its Importance
• 09:00 Confidentiality, Integrity, and Availability
• 11:52 The Parkerian Hexad
• 17:30 D.I.E. Triad Concept
• 24:28 Cybersecurity UPDATE
• 24:51 Unchanging
• 25:46 Perimeterizing
• 29:36 Distributing
• 29:50 Authenticating
• 33:58 Tracing
• 36:07 Ephemeralizing 

In this episode of CISO Tradecraft, host G Mark Hardy interviews JP Bourget about the security data pipeline and how modernizing SOC ingest can improve efficiency and outcomes. Featuring discussions on cybersecurity leadership, API integrations, and the role of AI and advanced model learning in future data lake architectures. They discuss how vendor policies can impact data accessibility. They also reflect on their shared Buffalo roots and because their professional journeys. Tune in for valuable insights from top cybersecurity experts.

Transcripts: https://docs.google.com/document/d/1evI2JTGg7S_Hjaf0sV-Nk_i0oiv8XNAr 

Chapters

• 00:00 Introduction
• 00:50 Guest's Background and Journey
• 05:27 Discussion on Security Data Pipeline
• 07:19 Introduction to SOAR
• 08:01 Benefits and Challenges of SOAR
• 12:40 Guest's Current Work and Company
• 14:04 Security Data Pipeline Modernization
• 22:20 Discussion on Vendor Integration
• 29:09 Security Pipeline Approach and AI
• 38:03 Closing Thoughts and Future Directions

In this episode of CISO Tradecraft, we debunk seven common lies pervasive in the cybersecurity industry. From the fallacy of achieving a complete inventory before moving onto other controls, the misconception about the accuracy of AppSec tools, to the fear of being viewed as a cost center - we delve deep into these misconceptions, elucidating their roots and impacts. We also discuss how ISO and FAIR, audits and certifications, risk assessments, and mandatory cyber incident reporting may not always be as straightforward as they seem. The episode is not only an eye-opener but also provides insightful guidance on how to navigate these misconceptions and enhance the effectiveness of your cybersecurity measures.

CloudGoat EC2 SSRF- https://rhinosecuritylabs.com/cloud-security/cloudgoat-aws-scenario-ec2_ssrf/

OWASP Benchmark - https://owasp.org/www-project-benchmark/

Transcripts - https://docs.google.com/document/d/1yZZ4TLlC2sRfwPV7bQmar7LY4xk2HcIo

Chapters

• 00:12 Introduction
• 00:56 The Lie of Accurate Inventory
• 05:29 The Lie of Accurate Risk Assessment
• 08:41 The Lie of Shifting Left in DevSecOps
• 13:45 The Lie of Certifications Ensuring Security
• 18:33 The Lie of Reporting Cyber Incidents in 72 Hours
• 20:44 The Lie of Accurate Application Security Tools
• 22:07 The Lie of Cybersecurity Not Being a Cost Center
• 24:44 Conclusion and Recap of Cybersecurity Lies 

Join G Mark Hardy in this episode of the CISO Tradecraft podcast where he details how cyber protects revenue. He clarifies how cybersecurity is seen as a cost center by most organizations, but stresses how it can become a protector of business profits. Concepts like Operational Resilience Framework (ORF) Version 2 by the Global Resilience Federation are discussed in depth. Hardy also outlines seven steps from ORF to operational resilience including implementing industry-recognized frameworks, understanding the organization's role in the ecosystem, defining viable service levels, and more. 

Link to the ORF - https://www.grf.org/orf

Transcripts - https://docs.google.com/document/d/1ckYj-UKDa-wlOVbalWvXOdEO4OYgjO0i

Chapters

• 00:12 Introduction
• 01:47 Introduction to Operational Resilience Framework
• 02:38 Understanding Resilience and Antifragility
• 03:32 Common Cybersecurity Attacks and How to Anticipate Them 06:22 Building Resilience in Cybersecurity
• 09:43 Operational Resilience Framework: Steps and Principles
• 17:50 Preserving Datasets and Implementing Recovery Processes
• 20:18 Evaluating and Testing Your Disaster Recovery Plan
• 21:11 Recap of Operational Resilience Framework Steps
• 22:04 CISO Tradecraft Services and Closing Remarks

Looking for accurate predictions on what 2024 holds for cybersecurity? Tune into our latest episode of CISO Tradecraft for intriguing insights and industry trends. Listen now and boost your cybersecurity knowledge!

Earn CPEs: https://www.cisotradecraft.com/isaca

Transcripts: https://docs.google.com/document/d/11YX2bjhIVThSNPF6yEKaNWECErxjWA-R

Chapters

• 00:00 Introduction
• 02:11 1) CISOs flock to buy private liability and D&O insurance. It also becomes the norm for CISO hiring agreements.
• 05:25 2) CISO reporting structure changes. No more reporting to the CIO.
• 11:43 3) More CISOs get implicated in lawsuits, but the lawsuits rule in favor of the CISO.
• 13:36 4) Harder to find cyber talent since universities are not graduating as many students. This plus inflation increases result in major spike in cyber salaries
• 16:59 5) Cyber industry minimizes external consulting costs to weather reduced revenues during recession
• 19:44 6) AI-generated fraud will increase significantly
• 22:15 7) Shadow AI will result in Hidden Vulnerabilities
• 24:24 8) LLM attacks new vector for "AI-enabled" companies
• 27:23 9) Cyber insurance exclusions will tend to normalize and will prescribe activities that must be done if payout to occur
• 31:44 10) Self-driving cars will encounter regulatory setback
• 34:02 Review of Last Year's Predictions
• 41:03 Actionable Items for the Future
• 41:29 Closing Remarks and Invitation for 2024

In the second half of the discussion about secure developer training programs, G Mark Hardy and Scott Russo delve deeper into how to engineer an effective cybersecurity course. They discuss the importance and impact of automation and shifting left, the customization needed for different programming languages and practices, and the role of gamification in engagement and learning. The conversation also touches upon anticipating secular trends, compliance with privacy and data protection regulations, different leaning styles and preferences, and effective strategies to enhance courses based on participant feedback. Scott highlights the lasting impacts and future implications of secure developer training, especially with the advent of generative AI in code generation.

ISACA Event (10 Jan 2024) With G Mark Hardy - https://www.cisotradecraft.com/isaca

Transcripts: https://docs.google.com/document/d/1zr09gVpJuZMUMmF9Y-Kc0DOy-1gH0cx-

Chapters

• 00:00 Introduction
• 01:08 Importance of Ongoing Support and Mentorship
• 01:46 The Role of Community in Training
• 03:03 Hands-on Exercises and Practical Experience
• 06:01 Success Stories and Testimonials
• 08:29 Incorporating Security Trends into Training
• 11:08 Balancing Security with Developer Productivity
• 18:17 Teaching Secure Coding Practices in Different Languages
• 20:27 Engaging and Motivating Participants
• 22:51 Promoting the Program: Engaging and Fun
• 23:37 Accommodating Different Learning Styles
• 24:16 Catering to Self-Paced Learners
• 26:19 Addressing Proficiency Levels and Remediation
• 28:55 Compliance with Privacy and Data Protection Regulations
• 30:48 Breaking Down Complex Security Concepts
• 32:05 Creating a Culture of Security Awareness
• 33:25 Partnerships and Collaborations in Secure Development
• 35:10 Feedback and Improvement of the Program
• 36:12 Cost Considerations for Secure Developer Training
• 39:20 Tracking Participants' Progress and Completion Rates
• 41:23 Trends in Secure Developer Training
• 43:42 Final Thoughts on Secure Developer Training

In this episode of CISO Tradecraft, host G Mark Hardy invites Scott Russo, a cybersecurity and engineering expert for a deep dive into the creation and maintenance of secure developer training programs. Scott discusses the importance of hands-on engaging training and the intersection of cybersecurity with teaching and mentorship. Scott shares his experiences building a secure developer training program, emphasizing the importance of gamification, tiered training, showmanship, and real-world examples to foster engagement and efficient learning. Note this episode will continue in with a part two in the next episode

ISACA Event (10 Jan 2024) With G Mark Hardy - https://www.cisotradecraft.com/isaca

Scott Russo - https://www.linkedin.com/in/scott-russo/

HBR Balanced Scorecard - https://hbr.org/1992/01/the-balanced-scorecard-measures-that-drive-performance-2

Transcripts - https://docs.google.com/document/d/124IqIzBnG3tPj64O2mZeO-IDTx9wIIxJ

Youtube - https://youtu.be/NkrtTncAuBA 

Chapters

• 00:00 Introduction
• 03:00 Overview of Secure Developer Training Program
• 04:46 Motivation Behind Creating the Training Program
• 06:03 Objectives of the Secure Developer Training Program
• 07:45 Defining the Term 'Secure Developer'
• 14:49 Keeping the Training Program Current and Engaging
• 21:10 Real World Impact of the Training Program
• 21:46 Understanding the Cybersecurity Budget Argument
• 21:58 Incorporating Real World Examples into Training
• 22:26 Personal Experiences and Stories in Training
• 24:06 Industry Best Practices and Standards
• 24:18 Aligning with OWASP Top 10
• 25:53 Balancing OWASP Top 10 with Other Standards
• 26:12 The Importance of Good Stories in Training
• 26:32 Duration of the Training Program
• 28:37 Resources Required for the Training Program
• 32:23 Measuring the Effectiveness of the Training Program
• 36:07 Gamification and Certifications in Training
• 38:56 Tailoring Training to Different Levels of Experience
• 41:03 Conclusion and Final Thoughts

In this episode of CISO Tradecraft, host G. Mark Hardy guides listeners on how to refresh their cybersecurity strategy. Starting with the essential assessments on the current state of your security, through to the creation of a comprehensive, one-page cyber plan. The discussion covers different approaches to upskilling the workforce, tools utilization, vulnerability management, relevant regulations, and selecting the best solution for your specific needs. The show also includes tips on building a roadmap, creating effective key performance indicators, and validation exercises or trap analysis to ensure the likelihood of success. At the end of the discussion, G. Mark Hardy invites listeners to reach out for any help needed for implementing these strategies.

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/

ISACA Event (10 Jan 2024) With G Mark Hardy https://www.cisotradecraft.com/isaca

CIO Wisdom Book - https://a.co/d/bmmZEAC

Transcripts - https://docs.google.com/document/d/1_bHsRtaRdlRJ9e9XXVh3GU7k3MbBLcHs

Chapters

• 00:00 Introduction
• 02:21 Building a Tactical and Strategic Plan
• 02:58 Assessing Your Current Cybersecurity Posture
• 03:11 Workforce Assessment and Rating
• 06:31 Understanding Your Cybersecurity Tools
• 08:29 Performing a Business Requirements Analysis
• 10:13 Defining the Desired Future State
• 12:03 Creating a Gap Analysis
• 14:14 Analyzing Current Options and Building a Roadmap
• 17:11 Presenting the New Plan to Management
• 21:36 Recap and Conclusion

Discover the key to a more effective cybersecurity strategy in the newest episode of CISO Tradecraft! We're talking SOC tools, building a data lake for security, and more with guest Noam Brosh of Hunters. Don't miss it!

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/
• Hunters - https://www.hunters.security/

Noam Brosh - https://www.linkedin.com/in/noam-brosh-5743938/

Transcripts: https://docs.google.com/document/d/1ArTixgEvRsVpLVdV2uVFAKCKSB2mBUKo

Youtube Link: https://youtu.be/ThEpI2_LpD8 

Chapters

• 00:00 Introduction and Welcome
• 01:20 Understanding the Role of SOC Tools
• 05:39 Challenges with Traditional SIEM Tools
• 08:48 The Shift to Data Lakes and the Impact on SIEMs
• 18:04 Understanding Different Cybersecurity Tools: SIEM, XDR, and SOC Platforms
• 19:25 The Role of Automation in Modern SOC Tools
• 26:01 The Importance of Third-Party Connection Tools in SOC Tools
• 27:27 Trends and Disruptions in the SIEM Space
• 28:09 Addressing False Positives in SOC Tools
• 31:14 Outsourcing Aspects of SOC and Staffing
• 36:28 Dealing with Multi-Cloud or Hybrid Cloud Environments
• 41:02 Reporting SOC Metrics to Executive Stakeholders

In this episode of CISO Tradecraft, G Mark Hardy and Hasan Eksi from CyberNow Labs continue the discussion about the vital skills needed for an effective incident responder within a Security Operations Center (SOC). The skills highlighted in this episode include: incident triage, incident response frameworks, communication, collaboration, documentation, memory analysis, incident containment and eradication, scripting and automation, cloud security, and crisis management.

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/
• Adlumin - https://adlumin.com/

Hasan Eksi's LinkedIn Profile: https://www.linkedin.com/in/eksihasan/

Transcripts: https://docs.google.com/document/d/1rWixzKgf_unanPlnoL6dt8qpEsbZj9lv

Chapters 

• 00:00 Introduction and Recap of the 10 Previous Skills
• 02:25 Skill #11) Incident Triage
• 04:21 Skill #12) Incident Response Frameworks
• 07:09 Skill #13) Communication
• 09:38 Skill #14) Collaboration
• 14:58 Skill #15) Documentation
• 19:35 Skill #16) Memory Analysis
• 22:36 Skill #17) Incident Containment and Eradication
• 25:31 Skill #18) Scripting and Automation
• 28:53 Skill #19) Cloud Security
• 31:10 Skill #20) Crisis Management
• 33:58 Recap of 20 SOC Skills and Conclusion

In this episode of CISO Tradecraft, host G Mark Hardy talks to Kevin O'Connor, the Director of Threat Research at Adlumin. They discuss the importance of comprehensive cybersecurity for Small to Medium-sized Businesses (SMBs), including law firms and mid-sized banks. The conversation explores the complexities of managing security infrastructures, the role of managed security service providers, and the usefulness of managed detection and response systems. The discussion also delves into the increasing threat of ransomware and the critical importance of managing data vulnerabilities and providing security awareness training.

Big Thanks to our Sponsor: Adlumin - https://adlumin.com/

Transcripts: https://docs.google.com/document/d/1V_qkMFdGC4NRLCG-80gcsiSA8ikT8SwP

Youtube: https://youtu.be/diCZfWWB3z8

Chapters

• 00:12 Introduction and Sponsor Message
• 01:42 Guest Introduction: Kevin O'Connor
• 02:29 Discussion on Cybersecurity Roles and Challenges
• 03:20 The Importance of Defense in Cybersecurity
• 04:23 The Role of Managed Security Services for SMBs
• 07:26 The Cost and Staffing Challenges of In-House SOCs
• 14:41 The Value of Managed Security Services for Legal Firms
• 16:30 The Threat Landscape for Small and Mid-Sized Banks
• 18:19 The Difference Between Compliance and Security
• 20:08 Understanding the Reality of Cybersecurity
• 20:45 The Challenges of Building IT Infrastructure
• 21:08 Outsourcing vs In-house Security Management
• 21:55 The Importance of Understanding Your Data
• 22:43 Security Operations Center vs Security Operations Platform
• 24:21 The Role of Managed Detection and Response
• 24:54 The Importance of Quick Response in Security
• 28:07 The Threat of Ransomware and Data Breaches
• 34:31 The Role of Pen Testing in Cybersecurity
• 36:33 The Growing Threat of Ransomware
• 38:28 The Importance of Security Awareness Training
• 40:42 The Role of Incident Response and Forensics
• 42:11 Final Thoughts on Cybersecurity

In this episode of CISO Tradecraft we have a detailed conversation with Hasan Eksi from CyberNow Labs. G Mark and Hasan discuss the top 20 skills required by incident responders, covering the first 10 in part 1 of this series. The discussion ranges from understanding cybersecurity fundamentals to incident detection, threat intelligence, and malware analysis. This episode aims to enhance listeners' understanding of incident response, its significance, the skills required, and strategies for effective training.

Big Thanks to our Sponsor

• Adlumin - https://adlumin.com/

Hasan Eksi's LinkedIn Profile: https://www.linkedin.com/in/eksihasan/

Transcripts: https://docs.google.com/document/d/1lE9Tz-um1II2aNX4JU-bQ-BND7fPNteE/

Chapters

• 00:00 Introduction
• 14:15 Skill 1) IT/Cyber Fundamentals
• 17:17 Skill 2) Incident Detection
• 18:34 Skill 3) Threat Intelligence
• 20:11 Skill 4) Cybersecurity Tools
• 24:12 Skill 5) Network Analysis
• 25:55 Skill 6) Endpoint Analysis
• 28:33 Skill 7) Log Analysis
• 32:41 Skill 8) Malware Analysis
• 35:20 Skill 9) Forensics
• 38:30 Skill 10) Vulnerability Assessment

In this episode of CISO Tradecraft, host G Mark Hardy welcomes special guest Amer Deeba, CEO and co-founder of Normalyze. They focus on the importance of data security in today's cloud-centric, multi-platform tech environment. Amer shares valuable insights on the need for a data security platform that offers a unified, holistic approach. The conversation also delves into the importance of understanding the value of your data, and how solutions such as Normalyze can accurately identify and classify sensitive data, measure its value, and mitigate risk of compromise. Ideal for CISOs and professionals navigating data security, this episode provides key recommendations for data visibility, security posture management, and response mechanisms, built around the principles of cybersecurity.

Big Thanks to our Sponsors

• Normalyze - https://normalyze.ai/
• Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts: https://docs.google.com/document/d/1_z20Y5Xvs7qv6K9D2TUvM3ufLYSmXbvs

Chapters

• 00:00 Introduction
• 02:46 Understanding Data Security
• 03:58 The Importance of Data Security
• 04:21 The Challenges of Data Security
• 08:26 The Role of Data Security Posture Management
• 10:31 The Value of Data and Compliance
• 13:58 The Importance of Real-Time Data Protection
• 15:31 The Role of Encryption in Data Security
• 17:19 Understanding the Risks of Data Breaches
• 18:45 The Importance of Holistic Data Security
• 36:26 The Role of Anomaly Checks in Data Security
• 37:48 Understanding Generational Data
• 40:38 Conclusion and Contact Information

On this episode we talk about the differences between Gamification and Game-Based Learning. We think you will enjoy hearing how Game-Based learning gets folks into the flow and creates novel training that resonates.  We also have a great discussion on how games can be applicable for Board Members and Techies.  You just need to get the right type of game for the right audience and let the magic happen.

Big Thanks to our Sponsors

• Haiku - https://www.haikuinc.io/
• Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts

• https://docs.google.com/document/d/1XmkMO7eJR3yAnXJPOCTaA5J9sakk639Q

Prefer to watch on YouTube?

• https://www.youtube.com/watch?v=45eViHH_ktA 

Chapters

• 00:00 Introduction
• 03:38 What is Game-Based Learning?
• 07:55 Training Board of Directors
• 10:18 Gamification vs Game-Based Learning
• 14:30 Do Your Duties
• 21:09 Delaware Fiduciary Duties
• 22:54 Building a Forge
• 26:11 Tailored Game Types
• 33:35 Teaching Girl Scouts Linux Commands
• 40:17 Retaining Your Best People

Learn the language of the board with Andrew Chrostowski. In this episode we discuss the 3 major risk categories of opportunity risk, cybersecurity risk and complex systems. We highlight intentional deficit and what to do about it. Finally, don't miss the part where we talk about the time for a digital strategy is past. What is needed today is a comprehensive strategy for a world of digital opportunities and existential cyber risks.

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/iso-27001-certification/

Transcripts https://docs.google.com/document/d/15PnB1gYwt7vj-wRE4ABuEWxvB-H96rp0

Chapters

• 00:00 Introduction
• 04:22 Communication is a Requirement
• 09:34 How does cyber create value?
• 11:30 Culture and Operational Excellence
• 16:51 How does growth strategy align with cyber?
• 22:30 Intention Deficit Disorder
• 26:48 Accountability Loops
• 28:39 What's the evolution for a digital strategy?
• 32:02 Sharpen your axe
• 36:40 Digital Directors Network & Qualified Technical Experts

On this episode we do a master class on cyber warfare. Learn the terminology. Learn the differences and similarities between kinetic and cyber warfare. There's a lot of interesting discussion, so check it out.

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts https://docs.google.com/document/d/1yJYoVs3pO4u_Zq8UC8YQmnYVGrsH93-H

Air Force Doctrine Publication 3-0 - Operations and Planning https://www.doctrine.af.mil/Portals/61/documents/AFDP_3-0/3-0-D15-OPS-Coercion-Continuum.pdf

Dykstra, J., Inglis, C., & Walcott, T. S. (Joint Forces Quarterly 99, October 2020) Differentiating Kinetic and Cyber Weapons to Improve Integrated Combat. https://ndupress.ndu.edu/Portals/68/Documents/jfq/jfq-99/jfq-99_116-123_Dykstra-Inglis-Walcott.pdf

Tallinn Manual 1.0 published April 2013; 2.0 in 2017 https://ccdcoe.org/research/tallinn-manual/

Version 3.0 under development; inputs solicited at https://ecv.microsoft.com/RRllEKKMJQ

https://www.csis.org/analysis/cyber-operations-during-russo-ukrainian-war

Chapters

• 00:00 Introduction
• 01:57 Definition of Cyber War
• 04:18 Kinetic vs Cyber War
• 07:02 Goal of Offensive Cyber Operations
• 10:06 International Law Applied to Cyber Operations (Sovereignty & Necessity)
• 11:33 Diplomatic, Information, Military, & Economic (DIME)
• 12:57 Proportionality
• 14:04 Law of Distinction
• 15:56 Tallinn Manual
• 18:15 Stuxnet, Sony Pictures, NotPetya, and SolarWinds attacks
• 23:47 Ukraine Cyber War
• 28:21 Comparing old tanks to old mainframes
• 39:55 Winning a Cyber War

On this episode we discuss the measuring results cheat sheet from Justin Mecham.  Key focuses include:

• Defining SMART Goals (Specific, Measurable, Achievable, Relevant, & Time-Bound)
• Identifying KPIs (Key Performance Indicators)
• Using the WOOP Model (Wish, Outcome, Obstacle, and Plan)
• Using a Gap Analysis
• Using the 5 Why Method
• Using Plan, Do, Check, & Act.

Link to the Measuring Results Cheat Sheet
https://www.linkedin.com/posts/justinmecham_harvard-says-leaders-are-10x-more-likely-activity-7112050615576391681-Ro60/

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts https://docs.google.com/document/d/1Ok9cFBdubI6M4ubhcR0HZzmauHiU7fsN

Chapters

• 00:00 Introduction
• 03:34 SMART Goals (Specific, Measurable, Achievable, Relevant, and Time Bound)
• 07:29 Key Performance Indicators
• 09:36 WOOP Model (Wish, Outcome, Obstacle, and Plan)
• 09:59 Gap Analysis
• 12:36 Root Cause Analysis and the 5 Whys
• 14:09 Plan, Do, Check, and Act

On this episode we discuss the four key roles Boards play in cybersecurity.

1. Setting the company's vision and risk strategy
2. Reviewing assessment results
3. Evaluating management cyber risk stance
4. Approving risk management plans

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts - https://docs.google.com/document/d/1jarCcQYioT59jtIrppH4xZqyAy4Vn_tB/

Chapters

• 00:00 Introduction
• 01:36 What is a Board of Directors and what do they do?
• 09:33 FFIEC requirements for Boards
• 16:51 Establishing an Information Security Culture
• 19:08 Vision and Risk Appetite
• 22:00 Reviewing Cyber Assessments
• 25:09 Are we secure?
• 32:44 Castle Walls and Attacks
• 33:37 Getting your budget requests approved
• 37:10 Using use or loose money and reserved funding

On this episode we bring on the leading expert of threat modeling (Adam Shostack) to discuss the four questions that every team should ask:

1. What are we working on?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good enough job?

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/whitepaper/

Adam Shostack's LinkedIn Profile - https://www.linkedin.com/in/shostack/

Learn more about threat modeling by checking out Adam's books on threat modeling Threats: What Every Engineer Should Learn From Star Wars https://amzn.to/3PFEv7L

Threat Modeling: Designing for Security https://amzn.to/3ZmfLo7 Also check out the Threat Modeling Manifesto: https://www.threatmodelingmanifesto.org/

Transcripts: https://docs.google.com/document/d/1Tu0Xj9QTbVqbVJNMbNRam-FEUvfda3ZS

Chapters

• 00:00 Introduction
• 06:02 The 4 Questions that allow you to measure twice cut once
• 09:29 How Data Flow Diagrams help teams
• 16:04 It's more than just looking at threats
• 19:23 Chasing the most fluid thing or the most worrisome thing
• 22:00 All models are wrong and some are useful
• 26:25 Actionable Remediation
• 31:05 LLMs and Threat Models

There's a lot of new cyber attacks occurring and today we are going to talk about them in more detail.  Many bad actors are using SMS spoofing and Social Engineering to get in.  Listen in an learn about how those attacks played out against the casino industry. You don't want to miss when we share what you can do to stop them.  Pro-tip: Good MFA is your friend.  Use it everywhere you can including on your employees and customers during phone calls.  

Big Thanks to our Sponsor

• Risk3Sixty - https://risk3sixty.com/whitepaper/

Mandiant Post - https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware

Rachel Tobac Post - https://www.linkedin.com/feed/update/urn:li:activity:7108040643905474562 

Transcripts: https://docs.google.com/document/d/186g8y_8wMcBPwdaiFjduhRiXC88ice0T/

Chapters

• 00:00 Introduction
• 01:06 Improving the Attacker Odds at the Casino
• 04:09 SEC 8-K filings
• 13:28 MGM Timeline of attack
• 16:55 What can we do against these attacks?
• 22:51 Upgrading your MFA
• 24:16 Custom Authentication Strength
• 27:11 New Social Engineering Attacks
• 32:31 OKTA attacks

Have you ever thought about what does it mean to say there has been a material incident? How is materiality determined? What is the history of how that term has been defined by U.S. Regulators. Listen to today's show and increase your CISO Tradecraft

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/whitepaper/
• CPRIME - For those valuing leadership, policy, and governance in tech risk and security, Cprime is here to help. Enhance your skills with our training and workshops, ensuring effective policy design and strategy alignment. As a tech coaching firm, Cprime offers classes for teams and executives on security analytics and risk management. Led by a Cprime expert, align expectations, prioritize, and map tools for robust governance across your tech portfolio. Upgrade risk management at www.cprime.com/train and use code 'cprimepod' for 15% off training. Elevate your approach!

Transcripts https://docs.google.com/document/d/1h7IBZI27ZOg4nxec2fCBmrX0c-0O15Zr 

Link to FAIR-MAM

https://www.fairinstitute.org/resources/fair-mam

Chapters

• 00:00 Introduction
• 02:16 What is the concept of material?
• 07:08 Investors increasingly seek information
• 11:21 Title 17 of the US Code Part 242
• 17:38 Backup and Recovery that is Resilient and Geographically Diverse
• 22:10 The New SEC requirements
• 26:38 Reporting Cyber Incidents
• 31:40 FAIR-MAM

On this episode we overview the CIS Document titled, "The Cost of Cyber Defense". https://www.cisecurity.org/insights/white-papers/the-cost-of-cyber-defense-cis-controls-ig1

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/whitepaper/
• CPRIME - For those valuing leadership, policy, and governance in tech risk and security, Cprime is here to help. Enhance your skills with our training and workshops, ensuring effective policy design and strategy alignment. As a tech coaching firm, Cprime offers classes for teams
  and executives on security analytics and risk management. Led by a Cprime expert, align expectations, prioritize, and map tools for robust governance across your tech portfolio. Upgrade risk management at Cprime.com/train and use code 'cprimepod' for 15% off
  training. Elevate your approach!

Transcripts https://docs.google.com/document/d/1TAltDwJxQg9MqVRNCCgwIJa1a3WKpep5---WVOUsdLE/ 

Chapters

• 00:00 Introduction
• 01:30 What are the CIS Critical Security Controls?
• 03:00 How have the CIS Critical Security Controls evolved over time?
• 05:30 What are the benefits of implementing the CIS Critical Security Controls?
• 07:30 The three crucial questions for implementing the CIS Critical Security Controls
• 10:30 How to prioritize the CIS Critical Security Controls
• 12:30 What are Implementation Groups?
• 13:37 Enterprise Profiles
• 14:00 Why are Implementation Groups important?
• 15:30 How to choose the right Implementation Group for your organization
• 19:46 Cost Breakdown
• 23:16 Thoughts on the CIS Study

In this episode of CISO Tradecraft, we delve into the evolving landscape of cybersecurity regulations. From data incident notifications to required contract language, we uncover common trends and compliance challenges. Learn how to prepare, adapt, and network within your industry to stay ahead. Tune in for insights and tips!

Thanks again to our Sponsors for supporting this episode:

• Risk3Sixty: Check out Risk3Sixty's weekly thought leadership webinars and downloadable resources at https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser
• CPrime: Today's "CISO Tradecraft" is sponsored by Cprime, offering advanced tech training for exceptional teams. Experience hands-on, lab-driven classes in just two days, enhancing your skills for immediate on-the-job impact. Discover our sought-after three-day Microsoft PowerBI training, empowering you to craft dashboards, integrate data, and perform swift statistical analysis. Visit Cprime.com/train, use code 'cprimepod' for 15% off, and elevate your expertise!

References

• AuditScripts: https://www.auditscripts.com/free-resources/critical-security-controls/
• Secure Controls Framework: https://securecontrolsframework.com/scf-download/

Transcripts https://docs.google.com/document/d/1RplLpZCMw8foLu9oqkZs1_A2aIbYk1Xo/

Chapters

• 00:00 Introduction
• 04:28 Meeting Cybersecurity Controls and Understanding Applicable Regulations
• 11:28 Ensuring Compliance with Laws and Regulations
• 15:42 Handling Regulatory Change: Mapping Controls & Tracking Requirements
• 22:02 Navigating Regulatory Changes and Ensuring Compliance

Here's a nice overview of cybersecurity on passwords, authentication, rainbow tables, and password managers. Enjoy the show and check out our other podcasts.

Special Thanks to our Sponsors:

• Risk3Sixty: Being able to clearly articulate your vision for your security program to the board and other executives within your firm is critical to obtaining the buy in you need for your program's success. Risk3Sixty has created a presentation template that helps you structure your thoughts while telling a compelling story about where you want your security program to go. Download it today for free at: https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser
• CPrime: Today's "CISO Tradecraft" is sponsored by Cprime, offering advanced tech training for exceptional teams. Experience hands-on, lab-driven classes in just two days, enhancing your skills for immediate on-the-job impact. Discover our sought-after three-day Microsoft PowerBI training, empowering you to craft dashboards, integrate data, and perform swift statistical analysis. Visit Cprime.com/train, use code 'cprimepod' for 15% off, and elevate your expertise!

Transcripts: https://docs.google.com/document/d/1BD6LnITOpq6wrM2CsJzCHefN0Dw4hFp9 

Chapters

• 00:00 Introduction
• 02:02 Evaluating Password Management Solutions and Design-Making Approaches
• 05:36 Password Security and Authentication Methods
• 27:25 Background Sanitization, Password Storage, and Login Screen Risks
• 28:52 The Importance of Commercial Password Managers and Security Threats
• 31:27 Considerations for Choosing a Password Manager

Join us at the heart of Hacker Summer Camp for insights into the cybersecurity world! Discover the art of asking powerful questions that can change your career and impact others. Learn how CISOs assess cyber solutions and how startups can win their attention. Uncover the secrets of building connections and value through meaningful inquiries. Don't miss this episode featuring expert advice on navigating the cybersecurity landscape.

Special Thanks to our Sponsors:

• The Chertoff Group: https://www.chertoffgroup.com
• CPrime: At work, bridging the gap between risk management, IT security, and departments like finance, product, and development can be daunting. Enter Cprime, specializing in harmonious integration through secure code training, DevSecOps implementation, and
  zero trust practices. We streamline, optimize, and drive innovation, empowering continuous security ops. Transform risk management at Cprime.com/train and use code 'cprimepod' for 15% off training. Unleash potential with us!

Transcripts: https://docs.google.com/document/d/1qf9kH9a5rPlK8zaOWXGAp0-E6p7PNNuT/

Chapters

• 00:00 Introduction
• 01:49 How to Get More Sales at Blackhat
• 05:57 How to Differentiate Yourself From the Competition
• 10:05 How to Solve a Priority Problem
• 16:07 How to Achieve Bigger Goals Through Accelerating Teamwork
• 18:13 How to Find a CISO Job
• 20:30 How to follow a Rich Dad's Advice
• 22:59 How to Create an Opportunity Not Just for Yourself, but for Others
• 24:18 How to Create Value for Others
• 26:20 How to Provide Value to Others
• 28:21 The Power of Open-Ended Questions as a CISO
• 32:33 How to Ask Powerful Questions

On this episode, David London and Adam Isles from the Chertoff Group stop by to discuss emerging risk topics such as AI, Supply Chain Attacks, and the new SEC regulations. Stick around and learn the tradecraft to better protect your company.

Special Thanks to our Sponsors:

• The Chertoff Group: https://www.chertoffgroup.com.Note you can read more about their thoughts on AI here: https://www.chertoffgroup.com/managing-ai-risks/
• Prelude: https://www.preludesecurity.com/
• CPrime: At work, bridging the gap between risk management, IT security, and departments like finance, product, and development can be daunting. Enter Cprime, specializing in harmonious integration through secure code training, DevSecOps implementation, and
  zero trust practices. We streamline, optimize, and drive innovation, empowering continuous security ops. Transform risk management at Cprime.com/train and use code 'cprimepod' for 15% off training. Unleash potential with us!

Transcripts: https://docs.google.com/document/d/1tW0kOYCURXgRF-z7UqeQGga0zAkwGuZ9/

Chapters

• 00:00 Introduction
• 02:33 The SEC's Final Rule on Cybersecurity Disclosure
• 05:29 What is a Material Incident?
• 07:13 The Commission's Final Rule on Board Engagement in Cybersecurity Risk
• 10:03 The Four Day Rule for Incident Reporting
• 12:46 The Implications of the New Role of the CISO
• 15:46 The Ticking Clock on Disclosure
• 18:31 SolarWinds and the Software Chain Security Exposure
• 19:53 The Role of the Software Bill of Materials (SBOM) in the Software Supply Chain Security Challenges
• 21:29 The Rise of the SBOM
• 23:16 The Rise of Expectations in the U.S. Government
• 25:02 The Future of Software Security
• 27:22 The Progress of the CMMC Program
• 29:59 The SEC Disclosure Requirements: What to Expect From Your Board
• 31:57 How to Reduce Complexity in Your Software Development Lifecycle
• 34:05 How AI is Impacting Our Business and Cyber
• 37:32 How to Measure and Manage Cyber Risks Effectively
• 39:57 The SEC's Final Rule on Disclosure

Don't let Bobby the Intern cause havoc in your network. On this episode of CISO Tradecraft, G Mark Hardy discusses the importance of training new hires in cybersecurity to create a strong security culture within an organization. The focus is on shaping employees' behavior and beliefs to enhance the overall cybersecurity posture.

Special Thanks to our Two Sponsors:

1) The Chertoff Group: www.chertoffgroup.com

2) Prelude: https://www.preludesecurity.com/ 

Transcripts: https://docs.google.com/document/d/1Z4ftmqZdUMkxD6ATRRLp0EmO_DVluQ4n

Chapters

• 00:00 Introduction
• 03:57 How to Build a Security Culture
• 07:19 The Importance of a Good Username and Password
• 11:24 How to Use MFA to Protect Your Brand
• 12:50 How to Teach Your Employees About Phishing
• 17:07 How to Deal with External Email Addresses
• 20:30 How to Avoid a Business Email Compromise
• 22:42 How to Protect Your Website from Attackers
• 24:40 How to Secure Your Applications
• 26:46 The Importance of Threat Modeling
• 30:48 QR Codes and How to Use Them Effectively
• 32:34 Delaying Desktop Patches
• 34:36 How to Teach Your New Hires About Security
• 36:30 How to Orient Your New Employees

On this episode we bring on CIA Veteran James "Jim" Lawler to discuss how spies are recruited, how individuals are turned, and what makes them vulnerable to being turned. Learn what managers and executives can and should know about their people to help them better understand who's at risk and the types of programs that executives can put into place to stop insider threats.

Special Thanks to our Two Sponsors:

1) Prelude: https://www.preludesecurity.com/

2) Risk3Sixty is cyber security technology and consulting firm that works with high-growth technology firms to help leaders build, manage and certify security, privacy, and compliance programs. They publish weekly thought leadership, webinars, and downloadable resources like budget and assessment templates. Learn more at: https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser

Be sure to read Jim's books

1) Living Lies: A Novel of the Iranian Nuclear Weapons Program https://amzn.to/3Y5x2Sc

2) In the Twinkling of an Eye: A Novel of Biological Terror and Espionage https://amzn.to/43EkvpE 

Chapters

• 00:00 Introduction
• 02:24 The Importance of Recruiting Insiders
• 08:06 How to Be a Successful Case Officer
• 11:09 The Importance of Identifying Vulnerabilities in Insider Threats
• 14:00 The Cockamamie Recruitment Pitch Scheme
• 18:50 The Importance of Rationality in Espionage
• 21:10 The Complex Motivations for Espionage
• 23:49 The Key to Stress in a Target Life
• 27:34 The Importance of Listening to Your People
• 30:02 How to Be a Good Leader
• 35:02 The Metaphysics of Recruitment
• 37:31 How to Firewall a Threat to Your Organization
• 41:00 Living Lies
• 44:49 How to Be a Better Writer
• 49:31 How to Be a Better Threat Manager

This week Rafeeq Rehman returns to discuss the 2023 updates to the CISO Mindmap. Note you can find his work here: https://rafeeqrehman.com/2023/03/25/ciso-mindmap-2023-what-do-infosec-professionals-really-do/

Thanks to our two sponsors for this episode.

1) Prelude: https://www.preludesecurity.com/

2) Risk3Sixty - Get a free copy of The Five CISO Archetypes eBook from risk3sixty. By reading this eBook, you will discover your strengths, weaknesses, areas where you need support from your team, and the types of organizations you best fit. The eBook also provides the tools to analyze organizations to understand their security priorities better. You will be able to use these tools to identify organizations that would most benefit from your natural strengths as a security leader. Organizations that you will love to work with and that would love to have you as part of their team. The steps outlined in this book will make you a more effective security leader and more satisfied with your career.

https://risk3sixty.com/whitepaper/five-ciso-archetypes-ebook/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook

Transcripts: https://docs.google.com/document/d/1tFhZ6DdzwG12dYXvuVpaZdmfNWBVFswx 

Chapters

• 00:00 Introduction
• 03:36 How to Write a Book
• 05:32 How to Master a Security Tool
• 09:19 Updating the Mind Map for 2023 and 2024
• 13:12 How to Resiliently Respond to Ransomware Attacks
• 16:15 The Importance of Redundancy in Security
• 19:18 How to Manage Your Security Budget Effectively
• 22:43 Building a Brand for a Security Organization
• 26:10 Untangle the Application Web of Components
• 29:38 The Importance of Software Build of Materials
• 33:28 How to Automate Security Operations
• 36:31 The Six Importances of a Security Mind Map
• 38:43 The Future of Generative AI
• 40:47 The Future of CISO Tradecraft

Imagine if you could get 1% better every day at something and do this for an entire year. Well, that's 365 days. And you go, okay, fine. 1%. 1%. That's going to be like 3.65%, right? No, because it compounds. And if you go ahead and open up your calculator and you take 1.01 and you raise it to the 365th power you're going to get 37.78. On today's show we have Andy Ellis discuss ways to get 1% better as a leader.

Thanks to our two sponsors for this episode.

1) Prelude: https://www.preludesecurity.com/

2) Risk3Sixty - Risk3Sixty is cyber security technology and consulting firm that works with high-growth technology firms to help leaders build, manage and certify security, privacy, and compliance programs. They publish weekly thought leadership, webinars, and downloadable resources like budget and assessment templates. https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook 

1% Leadership Book: https://www.amazon.com/1-Leadership-Master-Improvements-Leaders-ebook/dp/B0B8YXJ2H1?&_encoding=UTF8&tag=cisotradecr05-20&linkCode=ur2&linkId=51e35f5bdcbe65e448e03d779143278c&camp=1789&creative=9325

Transcripts: https://docs.google.com/document/d/1Ul9N9cw579JMB_e7Vlk91_JpYxOBXQmx/

Chapters:

• 00:00 Introduction
• 02:09 Andy's career in cyber
• 04:04 The Butterfly Effect
• 06:06 How to Be 1% More Efficient at Cyber
• 09:01 The Importance of Uncloneability
• 10:57 The Importance of Personal Improvement in Leadership
• 14:21 The Importance of Commitment
• 16:10 The Importance of Feedback
• 20:23 Planning for a Sudden Change in Your Environment
• 26:51 How to Create Safety for Cyber Professionals
• 29:01 How to Face Adversity with Grace
• 30:36 The Importance of Culture in Email Security
• 32:11 The Importance of Delegation
• 33:55 Delegating vs Dumping
• 36:02 How to Reduce the Energy Cost of Inclusion
• 40:18 The Importance of Diversity in Organizations
• 42:07 Don't Borrow Evil
• 44:17 How to Build a Relationship with Business Leaders
• 46:49 How to Stop Hurting Your Team

Are you a Chief Information Security Officer (CISO) looking to share your knowledge and insights with the world? In this episode, we explore how CISOs can embark on their journey of writing their first book. Join us as we delve into valuable tips and advice, including learning from renowned author Bill Pollock, who has paved the way for aspiring CISO authors.

Risk3Sixty is cyber security technology and consulting firm that works with high-growth technology firms to help leaders build, manage and certify security, privacy, and compliance programs.  They publish weekly thought leadership, webinars, and downloadable resources like budget and assessment templates.

https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook

Transcripts: https://docs.google.com/document/d/1uxNgxe7ad9VBfRLeRH4nWY6tSkI-Kexd

Chapters

• 00:00 Introduction
• 04:37 How No Starch Press was Founded
• 07:24 The Rise and Fall of the Hacking Underground
• 11:41 How to be a Successful Hacker
• 14:11 How to Edit a Book
• 16:38 How to Be a Good Writer
• 18:14 How to Write a Book Proposal
• 23:50 How to Overclock Your Computer
• 26:31 The Future of AI
• 28:15 The Value of a Author Book Publishing Agreement
• 33:39 How to Make Money Writing a Book
• 37:34 The No Starch Press Foundation and the Hacker Initiative
• 40:30 Hacker Initiative: A Public Charity for Cyber Security

One of the most important activities a CISO must perform is presenting high quality presentations to the Board of Directors.  Listen and learn from Demetrios Lazarikos (Laz) and G Mark Hardy as they discuss what CISOs are putting in their decks and how best to answer the board's questions. 

Special thanks to our sponsor Risk3Sixty for supporting this episode. Risk3sixty has created a presentation template that helps you structure your thoughts while telling a compelling story about where you want your security program to go. Download it today for free at: https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook

References

• RSAC ESAF Download: https://www.rsaconference.com/rsac-programs/executive-security-action-forum
• NACD 2023 Directors Handbook: https://www.nacdonline.org/insights/publications.cfm?ItemNumber=74777
• Blue Lava: https://bluelava.io/cybersecurity-board-reporting/

Transcripts: https://docs.google.com/document/d/1juM8MQUEtAZEDp1HpzkPdNw-D11O3ofq

Chapters

• 00:00 Introduction
• 05:17 The Importance of External Audits in Managing Risk
• 06:48 How to Help Your Business of Revenue Protection Reduce Risk
• 11:15 How to be a Successful CISO
• 12:52 How to Measure the Threat to Your Environment
• 15:04 How to Prepare for Cyber Threats and Incidents
• 18:49 The Importance of Understanding the Business's Critical Assets
• 22:28 OSINT and CSIRT.global Tools and Technologies
• 25:14 Building a Matrix of Good Intention, Bad Behavior, and Access Management
• 28:10 How to Create an Incident Response Plan
• 30:20 How to Keep Your Board of Directors Informed of Cybersecurity Incidents
• 31:50 How to Keep Track of the Latest Cyber Threats Coming Around the Corner
• 34:11 How to Achieve Cyber Insurance Coverage
• 37:06 Cyber Liability Insurance: A Necessary Component of Running Your Business in 2023
• 39:22 How to Measure the Effectiveness of a Company's Cybersecurity Program
• 40:54 The Importance of Business Alignment

A lot of times we focus on preventing ransomware, but we forget what we should do when we actually encounter it.  That's why we are bringing on Ricoh Danielson to talk about it.  Learn from him as he discusses tactics and techniques for businesses to follow then stuff hits the fan.

Special thanks to our sponsor Risk3Sixty for supporting this episode. https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook

Ricoh Danielson - https://www.linkedin.com/in/ricoh-danielson-736a0715/

Transcript: https://docs.google.com/document/d/1R82dUBChC3URM6iaP3D7dds_2nh27DTs/

Chapters

• 00:00 Introduction
• 03:19 How to Help a Small Business Dig Out of Cybercrime
• 05:00 How to Negotiate with Your Cyber Insurance Company
• 08:58 How to Deal with a Threat Actor
• 12:57 The Importance of Treating Everything Equally
• 15:45 How to Use Microsoft Tools to Capture Information
• 17:25 How to Combat a Threat Actor with Microsoft Defender
• 22:41 Set up PGP Keys in Advance
• 25:26 How to Negotiate with an OFAC sanctioned organization
• 28:24 How to Deal with Ransomware
• 30:28 The Nature of Instant Response
• 32:25 How to Get Concurrency in your Organization
• 34:05 The Importance of a a Strong Relationship with a Client
• 37:34 The Importance of Breach Notifications
• 39:21 How to Hand Combat a Threat Actor

This episode features Lee Kushner discussing various topics, including negotiating skills, the importance of degrees in the cybersecurity field, the need for diversity in the industry, challenges faced by cybersecurity professionals, starting a career in cybersecurity, and the value of technical skills. The conversation emphasizes the need for individuals to acquire technical skills, such as coding and networking, as they are in high demand and can differentiate them in the job market. It also mentions the importance of understanding the industry and its composition when seeking employment in cybersecurity.

Special thanks to our sponsor Risk3Sixty for supporting this episode. Be sure to check their weekly thought leadership, webinars, and downloadable resources like budget and assessment templates at: https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser

Transcripts: https://docs.google.com/document/d/11askuaFcV_jYov2FklkbZXxVN3JSNu6y/

Chapters

• 00:00 Introduction
• 07:56 The Importance of Professional First Mindset in the Staffing Industry
• 09:33 The Importance of Perception in a Staffing Environment
• 11:36 The Role of the Research Professional in a Hiring Process
• 16:03 How to Overcome Barriers in the Recruitment Process
• 18:09 The Importance of Education in Executive Search
• 20:41 The Importance of Diversity in Cyber Talent
• 25:25 How to Get a Job in Cyber Security
• 27:48 The Importance of a Technical Foundation in Careers
• 32:08 How to Become a Cybersecurity Professional
• 34:06 The Future of Cybersecurity Career Paths
• 35:56 The Future of Security
• 41:24 How to Get in Touch With Your Clients

On this episode we bring in Cyndi and Ron Gula from Gula Tech (https://www.gula.tech/) to talk about their cyber security experiences. Listen and enjoy as they tell their stories about leaving the NSA, creating the first commercial network Intrusion Detection System (IDS), Founding Tenable Network Security, and investing in multiple cybersecurity startups.

Special thanks to our sponsor Risk3Sixty for supporting this episode. Be sure to check their weekly thought leadership, webinars, and downloadable resources like budget and assessment templates at: https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser

Transcripts: https://docs.google.com/document/d/1zdJwzJUXHBLlQvOGYWtWVQqmxFzmAe5Z 

Chapters

• 00:00 Introduction
• 02:30 The Importance of Computer Security
• 04:46 The Career Path to the National Security Agency
• 07:39 The Importance of Compatibility
• 10:40 How to Get Your First Customer Off the Ground
• 14:28 How to Make your First Hire as a Beginning Entrepreneur
• 16:10 The Transition to Network Security Wizards
• 18:35 The Origins of Tenable
• 21:38 How to to Survive Contact with the Enemy
• 24:45 The Importance of Culture in the Military
• 29:31 Gula Tech Adventures
• 33:24 The Future of Venture Investing
• 36:13 Secrets of Working Together as Spouses
• 39:33 The Future of Venture Capital
• 42:21 Google Tech Adventures: How to Learn Startups

How do we frame an executive discussion so we can structure and present information in a way that effectively engages and aligns with the needs and interests of the executive audience?  On this episode we answer that question by discussing the 8 important elements of framing a discussion with executives:

1. Clearly define the objective
2. Start with the big picture
3. Identify key issues
4. Highlight impacts and benefits
5. Use visually compelling data and metrics
6. Be able to anticipate questions and concerns
7. Provide actionable recommendations
8. Seek alignment with existing perspectives of the organization

Special thanks to our sponsor Risk3Sixty for supporting this episode.  Be sure to check their Security Budget & Business Case Template: https://risk3sixty.com/whitepaper/security-budget-template/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=budget

Full Transcripts: https://docs.google.com/document/d/1vhLmqEAy-yQ01ZY1y8Nf7y-u_swTYCm8

Chapters

• 00:00 Introduction
• 02:42 How should we frame an executive discussion?
• 05:30 Start with the Bottom Line Up Front (BLUF)
• 07:11 1) Clearly Define the Objective
• 08:13 2) Start with the Big Picture
• 09:46 3) Identify Key Issues
• 10:47 4) Highlight Impact and Benefits
• 12:17 5) Use Visually Compelling Data and Metrics
• 13:07 6) Be able to Anticipate Questions and Concerns
• 15:06 7) Provide Actionable Recommendations
• 17:35 8) Seek Alignment with Existing Perspectives of the Organization

Learn how to unlock financial success with key strategies by Logan Jackson from Ray Capital Advisors.  Logan highlights how to set clear goals, choose the right asset class, diversify your portfolio for stability and growth, build a well-diversified investment portfolio to create wealth and mitigate risk, take control of your financial future through retirement planning and goal setting, & leverage tax loss harvesting. He also discusses how to prioritize tax planning, understand the impact of behavioral finance, seek professional money management, navigate conflicts of interest in financial planning, and discover hidden wealth advisors for personalized guidance.

Special thanks to our sponsor Risk3Sixty for supporting this episode.  Be sure to check their Security Program Maturity Presentation for CISOs: https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=template

Also if you would like to contact Logan Jackson please use his contact page at: https://www.raycapitaladvisors.com/ 

Full Transcripts: https://docs.google.com/document/d/1DLXnE5PTm4tDbONRSBarMa-1T8aduztf

Chapters

• 00:00 Introduction
• 02:37 The Importance of Financial Goal Setting
• 06:48 How to Choose the Right Asset Class for Your Family
• 11:17 How to Diversify Your Portfolio
• 12:56 How to Build a Diversified Investment Portfolio
• 15:22 How to Diversify a Portfolio and Build Wealth
• 19:48 How to Take Risk Off the Table
• 22:47 The Importance of Diversifying Your Portfolio
• 24:13 The Importance of Retirement Planning
• 28:56 The Importance of Goal Setting
• 30:35 The Importance of Tax Planning
• 33:10 How to Maximize Your Tax Implications in Taxable Investment Accounts
• 35:20 How to Use Tax Loss Harvesting to Avoid Tax Losses
• 39:51 The Importance of Behavioral Finance in Investing
• 43:39 The Importance of Professional Money Management
• 45:55 The Conflicts of Interest in Financial Planning
• 47:50 How to Find a Hidden Wealth Advisor

Are you looking for ways to protect your most valuable asset? In this episode, G Mark Hardy argues that our most valuable asset is our family, not the crown jewels or critical assets of a corporation. He emphasizes the importance of managing money, having an emergency fund, obtaining life insurance, building retirement savings, protecting against credit card fraud, and creating a plan for your children's digital life.  

Special thanks to our sponsor Risk3Sixty for supporting this episode. You can learn more about them from the Risk3Sixty Website: https://tinyurl.com/yc4xv7bj

Full Transcript:  https://docs.google.com/document/d/1vVASHmOV7n7Js0luDF1kWBF3qoytDnTy

Chapters

• 00:00 Introduction
• 02:01 How to Manage Your Money
• 05:54 The Millionaire Next Door
• 10:28 How to Diversity your Investments
• 12:35 The Importance of Paying Yourself First
• 15:41 How to Buy Paper I Bonds for Yourself
• 17:39 How to Choose the Right Life Insurance for You
• 21:28 The Cost of Life Insurance
• 23:12 The Importance of Retirement Savings
• 26:51 How to Optimize Your Retirement Income
• 28:47 How to Protect Yourself From Credit Card Fraud
• 30:40 How to Manage Your Credit
• 33:34 How to Avoid a Data Breach
• 35:44 How to Manage Your Passwords Effectively
• 37:36 How to Protect Your Children from the Risks of Online Content
• 41:23 How to Get Out of Dodge Quickly

In this episode of "CISO Tradecraft," G. Mark Hardy defines the role of a CISO and discusses the Top 10 responsibilities of a Chief Information Security Officer

Full Transcript: https://docs.google.com/document/d/1J_sCMkqEeIB7pUY4KmjCiS1sz7t6LX2F

Chapters

• 00:00 Introduction
• 01:25 Defining the Role of the CISO
• 04:43 1) Developing and implementing a cybersecurity strategy
• 07:27 2) Overseeing the organization's cybersecurity key programs and initiatives
• 08:20 3) Ensuring that the organization's cybersecurity policies and procedures are up-to-date and in compliance
• 10:44 4) Collaborating with other departments and teams
• 12:06 5) Developing and implementing a cybersecurity budget
• 14:21 6) Maintaining a high level of awareness about emerging cybersecurity threats, vulnerabilities, and technologies
• 15:29 7) Building and maintaining relationships with external partners and networking groups
• 18:07 8) Providing education, guidance, and support to the organization's employees
• 21:34 9) Leading and managing a team of cybersecurity professionals
• 24:10 10) Conducting regular risk assessments

In this episode of CISO Tradecraft, G Mark Hardy and guest Kevin Fiscus discuss the challenges of cybersecurity and the importance of prioritizing security decisions. Fiscus emphasizes the need for effective protective controls and detection measures, as well as the limitations of protective controls and the importance of detection. He suggests a "Detection Oriented Security Architecture" (DOSA) that includes high-fidelity, low-noise detection, automated response, and continuous monitoring. Fiscus also discusses the concept of cyber deception and proposes a new approach to cybersecurity that involves redirecting attackers to a decoy environment.

Kevin Fiscus: https://www.linkedin.com/in/kevinbfiscus/

Full Transcripts: https://docs.google.com/document/d/1zIph4r5u8UtuhsMSmIyi90bCtV52xnHv

Chapters

• 00:00 Introduction
• 04:55 The Average Time to Identify Bad Actors is 28-207 days
• 07:11 Why Protective Controls Don't Always Work
• 08:32 Protective Controls Create Resistance
• 10:34 The Cost of Detecting Bad Guys on Your Network
• 12:40 The Effects of Resistance on Protective Controls
• 15:56 The Problem with False Positive Alerts
• 20:08 How to Define Bad Guy Activity with 100% Accuracy
• 22:09 The Four Components of Security
• 24:14 Four Components of Detection Oriented Security Architecture (DOSA)
• 26:17 Differentiating between Monitoring & Alerting
• 27:13 High Fidelity and Low Fidelity Alerts 
• 33:06 Setting a Squelch for Radios
• 31:37 How to Deal with False Negatives
• 33:56 The Importance of Non Production Resources in Detection
• 37:56 How to Use Cyber Trapping to Deceive an Attacker
• 42:54 The Role of Environment Variability in Deception
• 47:08 Blowing Sunshine at Attackers

Have you heard about the latest trends in Generative Artificial Intelligence (GAI)? Listen to this episode of CISO Tradecraft to learn from Konstantinos Sgantzos and G Mark Hardy as they talk about the potential risks of GAI and how it generates new content.

Show Notes with Links: https://docs.google.com/document/d/10eCg3L00GgnHmze14g_JUkBbfHEdGZ8HW0eAGMk4PPE

Chapters

• 00:00 Introduction
• 01:37 The Future of Generative Artificial Intelligence (GAI)
• 06:08 The Implications of Hallucination in Generative AI
• 09:06 Hallucination Trivia Test for Large Language Models
• 10:48 The Consequences of Using Generative AI Models
• 12:39 The Importance of Education in Cybersecurity
• 14:45 The Future of Generative AI
• 16:17 The Importance of Understanding Large Language Models
• 19:47 The Differences Between Eliza and Machine Learning
• 24:26 How to Armorize Generative AI
• 29:39 The Future of Programming
• 31:23 The Future of Machines
• 33:53 The Future of Technology
• 37:52 The Future of CISOs
• 40:25 The Future of Generative AI

Are you worried about cyber threats and data breaches? Do you want to build a strong cybersecurity program to protect your organization? Look no further! In this episode of CISO Tradecraft, G Mark Hardy and Debbie Gordon discuss the three dimensions of an effective Information Security Management System: Policy, Practice, and Proof. G Mark emphasizes the importance of having a proper cybersecurity policy that references information security controls or outcome-driven statements. However, it's not enough to have policies on paper; organizations need to practice what's on paper to be prepared for cyber events. This is where ranges come in. Ranges are a full replica of an enterprise network with real tools, traffic, and malware. They allow teams to practice detecting and responding to attacks in a safe environment. Debbie Gordon, founder of Cloud Range, explains how ranges can help organizations accelerate experience and reduce risk in cybersecurity. She emphasizes the importance of educating an organization's user base to become the first and last lines of defense against cyber threats. By training non-technical executives to spot suspicious activity and bring it to the attention of the security team, organizations can minimize the damage caused by phishing attacks, ransomware, and other cyber threats. Gordon also highlights the importance of team training in cybersecurity because it's not just about individual skills, but also about how teams work together to respond to threats. By practicing together in a range environment, organizations can improve their processes, handoffs, and speed in detecting and responding to attacks.

Special thanks to our sponsor Cloud Range Cyber for supporting this episode.

Website: www.cloudrangecyber.com

Email: [email protected]

Full Transcripts: https://docs.google.com/document/d/1yWenwauzfAiQYafFW0Iew33vbzvlO2BO

Chapters

• 00:00 Polished Security Programs need Policy, Practice, and Proof
• 00:54 Policy
• 02:47 Practice
• 03:44 Proof
• 04:28 How to Apply the Concepts of Ranges to Help Organizations
• 06:05 The importance of Experiential Learning
• 07:48 The Importance of following Procedures
• 12:12 The Benefits of Team Training for Cyber Ranges
• 15:33 The Importance of Muscle Memory
• 20:22 How to Maximize Your Investment in Cybersecurity (KPIs & Measurable Results)
• 24:33 The Advantages of using the MITRE ATT&CK® Framework
• 27:41 The Advantages of Following ISO Standards
• 31:36 How to Improve your Cloud Range Exercises
• 33:22 How to use Cognitive Aptitude Assessments for Workforce Development
• 37:44 How to level the Playing field for Cyber Talent
• 39:39 The Importance of Degrees in Cyber Security
• 41:03 Making the CISO's job easier

Are you concerned about the security of your data? If so, you're in luck, because we have an incredible episode that has Brent Deterding discuss how to implement simple, easy, and cheap cybersecurity measures. 

One of the key takeaways from the episode is the importance of understanding, managing, and mitigating the risk of critical data being exposed, altered, or denied. Brent Deterding shares his top four tips for CISOs, which include implementing multi-factor authentication, device posture management, endpoint detection and response, and external patching. He emphasizes the importance of keeping things simple, easy, and cheap.

Overall, the episode emphasizes the importance of taking a proactive approach to cybersecurity and being prepared for potential cyber threats. Brett Dietrich shares his approach to reducing risk for his company when negotiating with underwriters.  Remember significant risk reduction is simple, easy, and cheap, so don't wait to implement these tools and strategies.

10 Immutable Laws of Security: https://learn.microsoft.com/en-us/security/zero-trust/ten-laws-of-security

Transcripts: https://docs.google.com/document/d/1eP7F8pD3kcrbja2sfSwSKGnJ-ADHviUt

Chapters:

• 00:00 Introduction
• 02:05 How to Protect Your Organization's Critical Data
• 01:43 Scenario of Protecting a Small Company
• 08:01 The 10 Immutable Laws of Security
• 14:26 Tips for CISOs
• 15:30 Simple, Easy, & Cheap is a Technology State
• 19:00 How Much Do You Care About Phishing Problems?
• 20:46 How to a be successful at RSA?
• 26:00 How to Enable the Business without Reducing Friction?
• 28:37 How to Adopt the Australian Essential 8
• 31:06 Team Platform vs Best of Bread
• 33:00 Those with a fear of vendor lock-in are retired
• 36:36 How to Save Money on Cyber Insurance
• 38:27 How to implement the Four Hills Strategy (MFA, EDR, Device Posture Management, & Patch Management)
• 40:57 How to Negotiate Effectively With Insurance Companies
• 42:48: Getting Material Risk Reduction is Simple, Easy, and Cheap

In this episode of "CISO Tradecraft," G Mark Hardy discusses how to build an effective cyber strategy that executives will appreciate. He breaks down the four questions (Who, What, Why, and How) that need to be answered to create a successful strategy and emphasizes the importance of understanding how the company makes money and what critical business processes and IT systems support the mission. Later in the episode, Branden Newman shares his career path to becoming a CISO and his approach to building an effective cyber strategy. Newman stresses the importance of communication skills and the ability to influence people as the most critical skills for a CISO. He also shares his advice on how to effectively influence executives as a CISO.

Full Transcripts - https://docs.google.com/document/d/1nFxpOxVl6spkK-Y8GLU5q2f6R_4VD-a2

Chapters:

• 00:00 Introduction
• 01:06 The Four Questions (Who, What, Why, and How)
• 08:11 Building an accepted cyber strategy
• 09:19 Importance of communication skills for a CISO
• 10:19 Understanding financial statements
• 12:47 Following the money
• 14:09 Reputation and cybersecurity
• 15:24 Getting executive buy-in into cybersecurity
• 15:57 Building Trust with Executives
• 16:45 Security Enables New Elements of Business
• 17:13 Why Cybersecurity Gets Ignored
• 20:07 Framing Cybersecurity as a Competitive Advantage
• 21:19 Mistakes CISOs Make When Communicating with Executives
• 22:54 Telling Stories to Communicate with Executives
• 24:09 Using Business Cases and Examples
• 27:28 The Importance of Listening to the Executives
• 29:31 Making Informed Risk-Based Decisions
• 30:54 Building Trust and Champions
• 32:55 Building a Network of Trust
• 35:13 Being Pragmatic

Sometimes you just need structure to the madness. Christopher Crowley stops by to talk about methodologies that can help security organizations. Come and see why you need them, how we get the scientific method wrong in cyber, and how to leverage a CIA analytical methodology that can help you. There's a lot more to check out so tune in.

Analysis of Competing Hypothesis https://www.cia.gov/static/9a5f1162fd0932c29bfed1c030edf4ae/Pyschology-of-Intelligence-Analysis.pdf

Christopher Crowley's Company https://montance.com/ 

Full Transcripts: https://docs.google.com/document/d/1P4MI02fIw3y_u8RhLVDbB3iu0o7e27Fr

Chapters

• 00:00 Introduction
• 02:30 The Morris Worm and the Internet
• 04:17 The Future of Cybersecurity
• 06:41 How to setup a shared drive for multitasking
• 10:26 The Evolution of Career Paths
• 12:02 The Importance of Methodology in Problem Solving
• 14:16 The Importance of Hypothesis in Cybersecurity
• 19:58 MITRE ATT&CK® Framework: A Two Dimensional Array
• 21:54 The Importance of a Foregone Conclusion Methodology
• 23:29 The Disruptor's Role in Hypothesis Brainstorming
• 25:18 The Importance of Resilience in Leadership
• 27:45 Methodologies and Threat Hunting
• 29:21 The Importance of Information Bias in Threat Hunting
• 34:31 How to Sort Hypothesis in a Spreadsheet
• 37:22 The Importance of Refining the Matrix
• 40:34 How to Automate Analysis of Competing Hypothesis

Have you ever wanted to get a legal perspective on cybersecurity?  On this episode of CISO Tradecraft, Evan Wolff stops by to discuss terms such as legal disclaimers, negligence, due care, and others.  He also provides important insights on how to structure your cyber policies, respond to regulators/auditors, and partner with general council.  Please enjoy. 

Full Transcripts: 
https://docs.google.com/document/d/1hbqB5GQfQsi0egPVdOtdfYEwLA3-1Jnh

Chapters

• 00:00 Introductions
• 01:52 The Attorney Client Privilege
• 04:49 What's the Difference Between a Discovery Order and an Attorney Client Privilege
• 06:30 CISO Disclaimer
• 09:23 Security Is a Component of Government Contracts
• 11:59 What are the Borders Between Information Security and Legal Risk
• 15:31 Cyber Security - Is there a Standard of Care?
• 18:11 Do you have a Reasonable Best Effort?
• 21:27 CMMC 2.0
• 26:22 Is your Privacy Policy going to expire?
• 28:30 What is Reasonable Assurance?
• 33:41 Advice for Partnering with the General Counsel

Have you ever wondered how to negotiate your best CISO compensation package?  On this episode, we invite Michael Piacente from Hitch Partners to discuss important parts of the compensation packages.  Examples include but are not limited to: - Base Salary,

• Bonuses (Annual, Relocation, & Hiring)
• Reserve Stock Units
• Annual Leave
• Title (VP or SVP)
• Directors & Officers Insurance
• Accelerated Vesting Clauses
• Severance Agreements

You can learn more about CISO compensations by Googling any of the following compensation surveys

• Hitch Partners CISO Compensation and Organizational Structure Survey Report: https://www.hitchpartners.com/ciso-security-leadership-survey-results-23
• Heidrick & Struggles Global Chief Information Officer Survey: https://www.heidrick.com/en/insights/...
• IANS CISO Compensation and Budget Benchmark Study: https://www.iansresearch.com/ciso-com...

Full Transcripts: https://docs.google.com/document/d/1e...

Chapters:

• 00:00 Introduction
• 01:58 What's the Difference?
• 06:50 The Three-Legged Stool (Base Salary, Bonuses, & RSUs)
• 11:44 Is there a signing bonus?
• 13:56 What's the difference between RSUs & Options?
• 18:52 Private Companies - What's the Value of the Offer?
• 22:04 Double Triggers in Private Companies
• 26:38 Should you counter an offer?
• 28:17 Corporate Liability Insurance
• 29:50 Do you want to be extended on the Director and Officer Insurance Policy?
• 32:56 How to negotiate a severance agreement
• 36:00 Compensation Survey Reports

One of the most difficult things to do as a manager or leader is to take an ethical stance on something you believe in.  Sometimes ethical stances are clear and you know you are doing what’s right.  Others are blurry, messy, and really weigh on your mind.  So we thought we would take this episode to talk about various ethical models, tricky ethical scenarios you might encounter as a CISO, and finally we will look at the Federal Case where Joe Sullivan the Former Chief Security Officer of Uber was convicted of federal charges for covering up a data breach.  Thanks to Stephen Northcutt for coming on today's show.

Full Transcript https://docs.google.com/document/d/1vin7gMBt9YvVGaVqT91ycPmacsKZe2T9

Chapters

• 00:00 Introduction
• 01:49 How to Make a Difference in Cybersecurity
• 03:34 Hackers and the Pursuit of Higher Principles
• 06:06 Is There a Use Case in Cybersecurity
• 10:56 Human Capital is the Most Important Asset That Any Organization Has
• 14:00 The Human Frailty Factor
• 18:21 Has Your Company Fully Embraced Diversity, Equity, and Inclusion
• 20:24 Do you have a Diversity of Experience
• 24:11 Getting Your EXO to Talk to Power and say you are wrong
• 27:40 CISOs and CISOs - Is this a Criminal Thing?
• 30:15 The Penalty of Crossing the Law
• 34:56 Pay the Ransom?
• 36:59 The Key to Resilience as a CISO

Our systems generate fantastic amounts of information, but do we have a complete understanding of how we collect, analyze, manage, store, and retrieve possibly petabytes a day? Gal Shpantzer has been doing InfoSec for over 20 years and has managed some huge data engineering projects, and offers a lot of actionable insights in this CISO Tradecraft episode.

Gal's LinkedIn Page - https://www.linkedin.com/in/riskmanagement/

Gal's Twitter Page - https://twitter.com/Shpantzer

Full Transcript - https://docs.google.com/document/d/14RXnsVttvKlRi6VL94BTrItCjOAjgGem/

Chapters

• 00:00 Introduction
• 02:00 How do you Architect Big Data Data Infrastructure
• 03:33 Are you taking a look at Ransomware?
• 06:11 Web Scale Technologies are used mostly in Marketing & Fraud Detection
• 08:11 Data Engineering - The Mindset Shift
• 10:51 The Iron Triangle of Data Engineering
• 13:55 Can I Outsource My Logging Pipeline to a Vendor
• 15:37 Kafka & Flink - Data Engineering in the Pipeline
• 18:12 Streaming Analytics & Kafka
• 22:08 How to Enable Data Science Analytics with Streaming Analytics
• 26:33 Streaming Analytics
• 30:25 Data Engineering - Is there a Security Log
• 32:30 Streaming Analytics is a Weird Thing
• 35:50 How to Get a Handle on a Big Data Pipeline
• 39:11 Data Engineering Hacks for Big Data Analytics

Has bad governance given you trauma, boring committees, and long speeches on irrelevant issues?  Today we are going to overcome that by talking about what good governance looks like.  We bring on the former CISO of Amazon Whole Foods (Sameer Sait) to discuss his lessons learned as a CISO.  We also highlight key topics of good governance found in the Cyber Security Profile from the Cyber Risk Institute.

Cyber Risk Institute - Cyber Security Profile https://cyberriskinstitute.org/the-profile/
Full Transcripts: https://docs.google.com/document/d/1vBM6A0utvhRFMA04wzrZvR8ktNwYo-li

Chapters

• 00:00 Introduction
• 03:10 Good Governances is a Good Thing, Right?
• 05:08 Cyber Strategy & Framework
• 06:43 Is NIST the Same as ISO?
• 08:40 How to Convince the Executive Leadership Team to Buy In
• 11:19 The CEO's Challenge is Taking Measured Risk
• 20:05 Is there a Cybersecurity Policy
• 22:32 Culture eats Policy for Lunch
• 24:14 The Role of the CISO
• 27:52 How do you Convince the Leadership Team that you need extra resources
• 29:51 How do you Measure Cybersecurity?
• 32:22 How do we communicate Risk Findings to Senior Management
• 36:07 Are you Aligning with the Audit Committee

In the US we often focus on SOC-2, NIST Special Pubs, and the Cybersecurity Framework. In Europe (and most of the rest of the world), ISO 27001 is the primary standard. ISO concerns itself with policy, practice, and proof, whereas NIST often shows the method to follow. Michael points out that a CISO is responsible for governance, (internal) consulting, and audit. In early stages of growing a security function, a CISO needs to be technically-focused, but as a security department matures, the CISO must be organizationally-focused. Also, to effectively grow your team, first determine what actions need to take place, how much effort it requires, and how often it needs to take place. Then, build an action sheet and collect data for three months. Finally, take that to your executives and document your requirements for more staff.

Michael Krausz LinkedIn Profile: https://www.linkedin.com/in/michael-krausz-b55862/

Michael Krausz Website: https://i-s-c.co.at/

Full Transcript: https://docs.google.com/document/d/13fghym7IWyPvuRANQXUvmv-ulkSj93xv 

Chapters

• 00:00 Introduction
• 04:01 Is there a Gap Analysis in ISO 27001?
• 08:05 Is there a Requirement for ISO Standards?
• 10:57 What is ISO 27001?
• 13:11 Is there a Parallel Development between the US and EU?
• 16:57 Do you want to be a trooper?
• 21:17 What's the Oldest Operating System?
• 23:09 Is there a Legacy Operating Systems that you can't get away with?
• 24:11 The Most Important Class for a CISO
• 26:33 The Secrets of a Successful CISO
• 29:30 CISO - I need 6 people period
• 33:40 What's the Primary Skill Needed in a CISO?
• 37:41 How to Maximize the Number of FTEs

How can cyber best help the sales organization?  It's a great thought exercise that we bring on Joye Purser to discuss. Learn from her experience as we go over how cybersecurity is becoming an even closer business partner with the creation of a new important role.

Full Transcript: https://docs.google.com/document/d/1Shd1Qldb8iKEHBgXJqFez81Iwfpl6JT-/

Chapters

• 00:00 Introduction
• 02:58 How did you marry those two cultures?
• 06:40 Building a Diverse Workforce
• 08:23 Is this a new role based on Pain Points?
• 10:27 Global Lead for Field Cyber Security
• 15:51 Is the Global Lead for Field Cybersecurity linked to sales numbers?
• 19:07 Is there a Global Lead for Field Cybersecurity?
• 24:46 Building Relationships in a Security Leadership Role
• 27:48 Do you have any lessons learned from your success at Global Management Consulting?
• 29:33 You need to schedule time to get things done
• 33:33 What about Due Diligence?
• 37:36 The Chief Technology Officer, CRO, & CTO

Did you ever wonder how much security you can implement with a single vendor?  We did and were surprised by how much you can do using the Australian Top Eight as a template.  We'll bet you can improve your security by using these tips, tools, and techniques that you might not have even known were there.

Special thanks to our sponsor Praetorian for supporting this episode.

https://www.praetorian.com/

Full Transcripts:

https://docs.google.com/document/d/12HsuOhY9an1QzIw9wOREPMX0pXe5hqkJ

Helpful Links

1. Essential 8 https://www.microsoft.com/en-au/business/topic/security/essential-eight
2. Blocking Macros https://ite8.com.au/the-essential-8/office-macros-explained/ 
3. Windows Defender Application Control or WDAC (available from Windows 10 or Server 2016 or newer) previously Windows had App Locker (Windows 7 / 8)
   • https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager
   • https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
4. Windows Group Policies
   • https://techexpert.tips/windows/gpo-block-website-url-google-chrome/
   • https://chromeenterprise.google/policies/#SafeBrowsingAllowlistDomains 
   • https://data.iana.org/TLD/tlds-alpha-by-domain.txt 
   • Software Restriction Policies http://woshub.com/how-to-block-viruses-and-ransomware-using-software-restriction-policies/
   • Blocking websites URL - only allow (.com, .org, .net, edu, .gov, .mil, and the countries you want).   
   • Locking down Active Directory https://attack.stealthbits.com/tag/active-directory 
5. File Service Resource Management
   • http://woshub.com/using-fsrm-on-windows-file-server-to-prevent-ransomware/
6. Enable MFA for RDP
   • https://docs.microsoft.com/en-us/azure/active-directory-domain-services/secure-remote-vm-access  
   • https://duo.com/docs/rdp
7. Enable MFA for SSH
   • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ssh
   • https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-linux 
8. Windows Controlled Folder Access
   • https://support.microsoft.com/en-us/topic/ransomware-protection-in-windows-security-445039d6-537a-488a-ad53-48906f346363
9. Use Windows File History to create backups to one drive.
   • https://www.ubackup.com/windows-10/file-history-backup-to-onedrive-4348.html
10. Storing your files to One Drive which has ransomware detection
    • https://support.microsoft.com/en-us/office/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f
11. Windows Update
    • Select Start > Settings > Windows Update > Advanced options. Under Active hours, choose to update manually or automatically in Windows 11. 
    • https://support.microsoft.com/en-us/windows/keep-your-pc-up-to-date-de79813c-7919-5fed-080f-0871c7bd9bde 
12. Microsoft Conditional Policies- https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common 
13. Microsoft Authenticator with Number Matching, Geo, & Additional Context
    • https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context 
    • https://websetnet.net/microsoft-rolls-out-new-microsoft-authenticator-features-for-enterprise-users/
14. Application Approve List- https://www.bleepingcomputer.com/tutorials/create-an-application-whitelist-policy-in-windows/

This episode provides a deep dive into Static Application Security Testing (SAST) tools.  Learn how they work, why they don't work as well as you think they will in certain use cases, and find some novel ways apply them to your organization.  Special thanks to John Steven for coming on the show to share his expertise.  

Special thanks to our sponsor Praetorian for supporting this episode.

https://www.praetorian.com/

Full Transcripts - https://docs.google.com/document/d/1zoA70k78IjqyJky-2u7_-i2jlWke8_cb

Chapters:

• 00:00 Introduction
• 02:51 Source Code Analyzers
• 04:22 The three bears of Static Analysis
• 06:01 Do Linters work Better?
• 08:00 The Value of Full Programming Analysis Tools over Linters
• 11:30 The Impact of a Developer's Analysis on a Developer Environment
• 13:05 SAST Testing
• 15:47 OWASP Benchmarking
• 19:13 The First Static Analysis Tools
• 20:53 Can you break up that worry about Automated Testing?
• 22:44 Using Static Analysis for Defect Discovery
• 24:18 Using Static Analysis to Improve Web Security
• 31:37 Using Static Analysis to Drive Cloud Security
• 33:15 The Second Thing to Look Out for When Choosing a Static Analysis Tool
• 34:55 Using Static Analysis to Build a Vulnerability Management Practice
• 37:35 Can you use Static Analysis to Find Insider Threat?

How do you defend against automated attacks in an era of ChatGPT-formulated malware, coordinated nation-state actors, and a host of disgruntled laid-off security professionals? Want to find your vulnerabilities faster than the bad actors do? Come listen to Richard Ford to learn how to apply best practices in attack surface management and defend your crown jewels.

Special thanks to our sponsor Praetorian for supporting this episode.

Full Transcripts - https://docs.google.com/document/d/18QyrN-7V91nxOyRQ0KsNeJU0-k-bTlqj

Chapters:

• 00:00 Introduction
• 04:22 The Impact of Continuous Attack Surface Mapping on Security Responses
• 07:48 What's the Difference between a CTO and a CIO?
• 10:24 What attracted you to the problem space?
• 12:53 Is the Attack Surface really exposed?
• 16:12 Shadow IT - The Unknown Unknowns that could Bite You
• 19:56 Is there a Shadow IT problem?
• 23:24 How to get management on board with Shadow IT?
• 26:38 Building an Attack Surface Management Program
• 29:57 You Get What You Measure, Right?
• 33:27 Do I Have Vulnerable Assets?
• 39:24 Attack Surface Management
  

Have you ever wanted to be like Neo in "The Matrix" and learn things like Kung Fu in just a few minutes?  Well on today's episode, we try to do just that by cramming powerful leadership concepts into your head in just 45 minutes.  So sit back, relax, and enjoy CISO Tradecraft.

Show Notes with Pictures & References:

https://docs.google.com/document/d/1z5FwVwYlNiJlevQXP9IK48Z5kYqG-Ee_/edit?usp=sharing&ouid=104989998442085477687&rtpof=true&sd=true

Full Transcript:
https://docs.google.com/document/d/11iTdKRxtg1UYiQeUn-mdgM7zKqafTq34/edit?usp=sharing&ouid=104989998442085477687&rtpof=true&sd=true

Want to know CISO Tradecraft's Top 10 cyber security predictions for 2023?  Listen to the episode to learn more about:

1. Proactive Identity Management = Automated Provisioning of Access + Minimizing Digital Blast Radius
2. Convergence of Security Tools
3. Collaboration Technology
4. Evolution of the Endpoint (Chromebooks or Browser Isolation)
5. Chatbots
6. Vague and unclear cyber laws
7. CISO liability increases
8. Umbrella IT general controls mapping
9. Companies will be less truthful during 3rd party questionnaires
10. Cyber defense will become more difficult because of people

Be sure to also check out G Mark Hardy's annual ISACA talk at
http://isaca-cmc.org/ 

Link to full transcripts of the podcast can be found here:
https://docs.google.com/document/d/1RkrtkuunBn-qaU-Y9HvgHJzAKoIIszcW/edit?usp=sharing&ouid=104989998442085477687&rtpof=true&sd=true

Success leaves clues, but sometimes we limit ourselves by only looking close by for them.  This week, we pondered what business skills are essential for a successful CISO, and then extended the search to some non-traditional sources to find some very relevant advice.  Take the time to listen and do a self-examination (you don't have to submit for a grade :) and see where you could boost your skills portfolio to increase your success as a security leader.  Some of the essential skills we discuss on this episode of CISO Tradecraft are:

• Be a leader
• Manage money and resources
• Differentiate yourself and your message
• Communicate with clarity and emphasis
• Delegate and hold subordinates accountable
• Build a personal network
• Mentor your team
• Be adaptable
• Be sensitive to cultural and political issues
• Watch the details and ensure your management makes informed risk-based decisions &
• Know your limitations

We thank our sponsor Nucleus Security for supporting this episode

Full Transcript: https://docs.google.com/document/d/1C357cX_4wKTRmhRUsGh_2d9vIMX5LspL/

Show links:

  https://www.smallbusiness.wa.gov.au/starting-and-growing/essential-business-skills

  https://cisotradecraft.podbean.com/e/108-budgeting-for-cisos-with-nick-vigier/

  https://nativeintelligence.com/

  https://github.com/cisotradecraft/Podcast#business-management--leadership

  https://www.ef.com/wwen/blog/efacademyblog/skills-for-success/

  https://www.criticalthinking.org/pages/defining-critical-thinking/766

  https://your.yale.edu/learn-and-grow-what-adaptability-workplace

  https://openai.com/blog/chatgpt/

  https://openai.com/dall-e-2/

There's a lot of things you need to know as a CISO, but one of the things least taught is budgeting best practices.  On today's episode, CISO Nick Vigier stops by to share his lessons learned on the topic.  His conversations focus on spends vs investments.  Remember spends = overhead, whereas investments = growth.  Here's a great point.

[10:00] There are opportunities that we have to frame some of these things as investments versus framing them as risk mitigations. And so one of the mantras or things that I like to think about is the business has a limited appetite for risk management, but they have infinite appetite for profits and making money. 

So if you're able to frame them as how they're actually going to help accelerate the business or improve the business that brings the CEO and the CFO along on the journey, that you're not just there to lock the doors, you might actually be there to help put another floor on the building and that's a very different conversation.

We also thank our sponsor Nucleus Security for supporting this episode.

Full Transcript: https://docs.google.com/document/d/1nURiml3BJFnszFRA8qov1CgO_VkDFaCY

Special thanks to Jeff Gouge for sharing his thoughts on consolidating vulnerability management.  We also thank our sponsor Nucleus Security for supporting this episode.

Consistently tracking and prioritizing vulnerabilities is a difficult problem.  This episode talks about it in detail and helps you increase your understanding in:

• Various application security scanning tools (SAST, DAST, SCA, Container, IoT, Secret Scanners, Cloud Security Scans, ...) and why companies need so many
• How CVSS base scores are actually calculated so you can understand its strengths and weaknesses
• How Threat Intelligence Data improves CVSS scoring
  • Knowing which vulnerabilities are being actively exploited by bad actors through the CISA Known Exploited Vulnerabilities Catalog
  • Knowing with vulnerabilities are being exploited in your industry or organization
  • Knowing how the Exploit Prediction Scoring System (EPSS) can predict which vulnerabilities will be exploited soon
    
• Learning about the Stakeholder-Specific Vulnerability Categorization Guide (SSVC)

Note a Full Transcript of this podcast can be found here:

https://docs.google.com/document/d/1dWDS8rd-iscZuZ28U27IBuPPfrlFAV69/

Are You Ready To Win Your First CISO role? Apply these techniques into your resume and interview process so both recruiters and hiring managers will offer you the job.  This show focuses on:

1. Highlighting the Different Types of CISO Roles
2. Showing how to progress from a Senior Director Role into a Fortune 100 CISO
3. Resume Tricks and Tips that get you noticed by recruiters
4. How to have a great interview with a recruiter
5. What Hiring Managers want to see from CISOs during their interviews

Please note the full show transcript can be found here
https://docs.google.com/document/d/18Feg4eXbezHVPiNQ9qO6Pdht3P0eQ5nn

Would you like to hear a master class on what Technology professionals need to know about startups?  On this episode Bob Cousins stops by to share his knowledge and experience on working in technology companies, dealing with founders, and partnering with venture capitalists.  Listen and learn more about:

• What should a technology professional know about venture capital and dealing with venture capitalists?
• What is the role of marketing?
• What do engineers get wrong with helping businesses create profitable growth?
• What is the value of a product?

Subscribe to the CISO Tradecraft LinkedIn Page

Special Thanks to our podcast sponsor, Cymulate. 

On this episode, Dave Klein stops by to discuss the 3 Digital Challenges that organizations face:

1. Cyber threats evolve on a daily basis and this constant threat to our environment appears to be only accelerating
2. The level of vulnerabilities today is 30x what it was 10 years ago.  We have more IT infrastructure, complexity, and developers in our current environment.
3. In the pursuit of digital innovation, we are changing our IT infrastructure by the hour.  For Example: Infrastructure as Code capabilities (Chef, Puppet, Terraform, etc.) allow developers to deploy faster and create more opportunities for misconfigured code at scale.  

Breach and Attack Simulation tooling address these 3 digital challenges by focusing on Breach Attack Simulation, Vulnerability Prioritization, & Threat Exposure Management.  This combined approach allows a cyber organization to ensure its security is fully optimized and its risk exposure is minimized.  Key benefits of adopting Breach and Attack Simulation software include:

• Managing organizational cyber-risk end to end
• Rationalizing security spend
• Prioritizing mitigations based on validated risks
• Protecting against the latest threats in near real-time
• Preventing environmental drift

Welcome back listeners and thank you for continuing your education in CISO Tradecraft.  Today we are excited to share with you a great episode focused on Breach and Attack Simulation software.  To begin we will provide a solid background on Breach and Attack Simulation then we are going to bring on our special guest Dave Klein who will give us the pro tips that help CISOs maximize the value from Breach and Attack Simulation Software.

Starting from the beginning.  What is Breach and Attack Simulation software and why is this needed?  At the end of the day most companies are not on an island.  They need to connect to clients, partners, and vendors.  They need the ability for employees to visit websites.  They need to host public facing websites to sell products and services.  Each of these activities result in creating organizational assets such as IT equipment that has internet connectivity.  Now internet connectivity isn’t a bad thing.  Remember internet connectivity allows companies to generate income which allows the organization to exist.  This income goes to funding expenses like the cyber organization so that is a good thing.  

If bad actors with the intent and capability to cause your company harm can find your company's internet connected assets which have vulnerabilities, then you have a risk to your organization.  So enter vulnerability assessment and penetration testing tools that companies can buy to identify and address this risk.  Now sometimes you will hear the terms Cyber Asset Attack Surface Management or (CAASM).  It’s also commonly referred to as continuous threat exposure management.  Essentially these two categories of tools are the latest evolution of vulnerability management tooling that have the additional benefit of ingesting data from multiple sources.  Essentially they are designed to address key questions such as: 

• How do we get an inventory of what we have?
• How do we know our vulnerabilities? and 
• How do we know which vulnerabilities might be exploited by threat actors?  

Now if you want to take this line of questioning one step further, then you should consider adopting Breach and Attack Simulation software.  Note Breach and Attack Simulation software overlaps with many of the CAASM capabilities, but it does something unique.  Breach and Attack Simulation software allows you to pose as bad actors on your network and perform red team exercises.  Essentially you learn how bad actors can bypass your cyber tooling and safeguards.  This means you go from knowing where you are vulnerable to actually seeing how well your incident response activities perform.  Example if I can take a normal user's laptop and spawn a Powershell Script or run a tool like MimiKatz to gain Domain Admin level privileges, then I want to know if the Cyber Security Incident Response team was alerted to that activity.  I also want to know if the Incident Response team blocked or disabled this account in a timely manner.  According to the 2022 Microsoft Digital Defense Report the median time it takes for an attacker to access your private data if you fall victim to a phishing email is 1 hour 12 minutes.  The report also stated that the median time for an attacker to begin moving laterally within your corporate network once a device is compromised is 1 hour 42 minutes.  Remember the difference to responding to these attacks in minutes vs hours can be the difference between how much files get encrypted when ransomware actors get into your environment.  

Another thing that CISOs need to ensure is that vulnerabilities get fixed.  How do you test that?  You have to replay the attack.  

You can think of fire drills as the comparison.  If an organization only did one fire drill every 24 months, then chances are the company’s time to exit the building isn’t going to decrease all that much.  It’s likely to stay the same.  Now if an organization does 8-12 fire drills over the course of 24 months, then you would generally see a good decrease in departure times as people get familiar with knowing how to leave the building in a timely fashion.  The good thing on Breach and Attack Simulation tools is they have the ability to replay numerous attacks with the click of a button.  This can save your penetration testing team hours over manual exploitation activities which would have to be repeated to confirm successful patches and mitigations.

If we look at Breach and Attack Simulation software the tools have typically come in two flavors.  One is an agent based approach.  Example.  A company might install an attack agent on a laptop inside the corporate environment that runs Data Loss Protection software.  The attack agent might look at how much data it can exfiltrate which is not stopped by the DLP tool.  The attack agent could also run similar attacks with how much malware the Antivirus detects, how much sensitive email it send outside the company despite there being an email protection solution.  These attack agents can also be placed on servers to determine how effective web applications firewalls are at stopping attacks.

Essentially having an attack agent on the internal side of a trusted network and one on the outside allows an organization to evaluate the effectiveness of various cyber tools.  Now there’s a few concerns with this type of approach.  One, companies don't want to add more agents across their network because it steals critical system resources and makes things slower.  Two, the time it takes to install and test agents means the value you can get out of these tools is delayed because cyber needs approvals from the desktop team, the network team, the firewall team, etc. before these solutions can be deployed.  Three, by having an agent you don’t always truly simulate what an attacker would do since you don't have to live off the land and gain permissions the attacker did.  Your agent may not be know to antivirus or EDR tools, but using windows libraries to gain access does. 

Now let’s compare this with an agentless approach.  This approach is quite popular since labs where agents are run don’t always look like a production environment.  Example they lack the amount of traffic, don’t possess the same amount of production data, or contain last month’s versions of software.  

Here attacker software may start with the premise what happens if someone from the Accounting Team opens an Excel document containing a malicious macro.  Let’s see how we can automate an attack after that initial compromise step occurs.  Then let’s walk through every attack identified by the Mitre Attack Framework and see what gets caught and what doesn’t.  The tooling can then look at the technical safeguards in the organization that should have been applied and provide recommendations on how to increase their effectiveness.  This might be something simple like adding a Windows Group Policy to stop an attack.  Also breach and attack simulation tools can provide alerting recommendations to the SIEM that help identify when an endpoint attack occurred.  Example: Instead of knowing that bad actors can run an attack, the Breach and Attack Simulation software actually gives you the Splunk Signature that your SOC team can leverage.  That’s a great add to minimize the amount of time to improve your alerting capabilities.  

Now when the breach and attack simulation software replays attacks each month, cyber leadership can look at how fast the Incident Response team detected and remediated the attack.  It might be as simple as we stopped this attack before it could happen by applying the new Windows Group Policy or it took the team 4 hours to determine XYZ account had been taken over.  These metrics allow you to know how well your Response plans work.  So you get the value of a penetration test with the automation & scaling of vulnerability management tools.  

What’s even more impressive is how these tools are evolving to meet the larger mission of cyber organizations.  

Example: Most Financial and Health Care organizations have to demonstrate evidence that IT controls are working effectively.  Generally this is a manual process done in the Governance Risk and Compliance (GRC) team within a cyber organization.  GRC teams have to ask developers to provide evidence to various IT controls such as are you monitoring and alerting to privilege activity.  Now imagine if you had an automated tool that showed evidence that monitoring tools are installed on 99% of endpoints and these tools actually stopped various MITRE attacks immediately.  That evidence would minimize the data call which takes time from the developer teams. 

Have you ever just met someone that was so interesting that you just sat and gave them your full attention?  On this episode of CISO Tradecraft, we have Bill Cheswick come on the show.  Bill talks about his 50 years in computing.  From working with the pioneers of Unix at Bell Labs, inventing network visualization techniques for the DoD, and creating the early best practices in firewalls and perimeter defenses.  He was also the first person to co-author a book on Internet Security.  So listen in and enjoy.

Also special thanks to our sponsor, Obsidian Security.  You can learn more about them at: https://www.obsidiansecurity.com/sspm/

Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cybersecurity leader.  My name is G. Mark Hardy, and today's episode is about how to better mentor your people (and in doing so, improve yourself as well.)  Mentoring is an important part of being a leader, and I would venture that most listeners have achieved their current level of success with the insights of a mentor, along with a lot of hard work.  Today we're going to give you a template for creating a personal development plan you can use with your team.  I also want to introduce you to a booklet that I keep on my desk.  It was written in 1899.  Do you have any idea what it might be?  Well, keep listening and you'll find out, and you may end up getting yourself a copy of your own.

Let's take a moment to hear from today's sponsor Obsidian Security.

Career success rarely happens independently -- it usually involves multiple milestones, promotions, and sometimes moves.  But success shouldn't be a secret.  As Tony Robbins said, "success leaves clues."  One of the best ways to achieve personal or professional success, or indeed help others do the same, is through mentoring and sponsorship.  But the right person rarely shows up at our doorstep offering us the key to the future -- we have to go out and make that relationship happen.  Today we're going to talk about mentors, protégés, sponsors, and that little booklet that has a repeatable secret for success.

Let's start with what is a mentor - the dictionary definition is "an experienced and trusted adviser."  My definition is it's a person with more experience and WISDOM who is willing to provide guidance to someone else -- a protégé.  Notice I didn't say anything about careers -- you can have a spiritual mentor, an academic mentor, and if you're a new grandparent you want to pass along some tips to help raise your grandkids.  You may also hear the term "mentee" instead of protégé -- I see that used from time to time, but it makes me think of those big slow sea creatures that keep getting run over by speedboats.

Let's talk about the who, what, when, why, and how of being a mentor.  The WHO part is someone with experience and wisdom willing to share insights.  Insights about WHAT, at least as far as we're concerned today, is usually career-related -- what jobs or assignments may be best, what personal characteristics are important, whom should you meet and why.

The WHEN portion of mentoring is usually a condition of the type of relationship.  A traditional one-on-one mentor relationship may be established formally or informally.  We established a program at work where those willing to offer advice could volunteer as a mentor and those seeking advice could request the assistance of a mentor.  I was asked by our most senior technical security expert if I would serve as his mentor -- an assignment which I was pleased to accept, and we held mentoring sessions quarterly.  Of course, we worked together more frequently than that, but those sessions were specifically about what he could learn from me as a mentor, and what I could do to structure his experiences to help with his personal and career growth.  [Irish whiskey story]

The WHY can be either because there is a mentorship program at your organization (and if there isn't one, do your homework and consider proposing one) or because someone reached out and requested assistance.  Mentoring is not like doing the dishes where anyone can do a competent job.  It requires empathy, communication skills, wisdom, and time commitment.  I'm at the point in my life and career where I actively try to help others who are not as old as I am.  Many times, that's appreciated, but some people seem to prefer to make all of their own mistakes and resist the effort.  Oh, well.  As my Latin teacher used to say, "suum quique" -- to each their own.

Finally, the HOW.  Mentors should prioritize their sessions by preparing in advance and setting aside time without interruptions.  Establish an agenda based upon specific requirements -- not just what the protégé wants but what the mentor believes he needs.  Martina Bretous published an article on HubSpot where she points out ten ways to be an amazing mentor:

1. Understand what you want out of the relationship.
2. Set expectations together in the very beginning.
3. Take a genuine interest in your mentee as a person.
4. Build trust.
5. Know when to give advice.
6. Don’t assume anything about your mentee – ask.
7. Share your journey.
8. Celebrate their achievements.
9. Seek out resources to help your mentee grow.
10. Be sure you have the bandwidth.

In summary, if you want to be a mentor and seek out the right people in whom to invest your time, here's a short checklist.  Look for protégés with a strong work ethic -- people who have built a reputation of delivering on time on budget.  Select only those people of the proper character -- you don't want to be teaching a sociopath how to take over the organization.  And you'll find you work better with others who share similar values.  If you value hard work, honesty, humility, and perseverance, look for those characteristics, or at least the potential to develop those characteristics, in your potential mentee.  We all know how hard it is to change ourselves.  Think about how much harder it is to change someone else.  In the end, you're just showing the way and it's up to the other person to take the appropriate actions, but you want to build a winning record of successful mentorships -- it doesn't help your own career if you're viewed as the incubator of failure.

As listeners of this show, you are likely in a position to be a mentor.  But that doesn't mean you can't benefit from having a mentor yourself.  Let's look at the who, what, when, why, and how of being a protégé.  The WHO is someone who can gain insight from a relationship with someone farther along in a given path.  Mentees may be assigned a mentor relationship, or they may seek out that relationship on their own.  Both are valid paths, and even if a formal program exists it's often up to the mentee to select from available mentors.  It doesn't always work the other way around [Navy mentor story.]

The WHAT is the reason for participating in this type of relationship.  Usually, it's to gain insight into career and professional goals, but as I mentioned earlier, it can be about most anything where you could learn from someone who's not in the role of a teacher or supervisor.

WHEN should you seek the advice of a mentor?  Well, there's probably never a time NOT to seek advice, but if you're heads-down in a long project that you enjoy or find yourself in a position where you're content and soon winding down your career, then I suppose you're fine going it alone.  Otherwise, after you've been in a position for a year or so and you've figured out your current role and how you fit in, that might be a suitable time to start looking for a mentor.

I think the WHY is obvious, but let's address it.  No one knows everything, but someone usually knows what you need.  Seeking a mentor is a rational way of gaining insights that can help move your career along.

And HOW do you become a protégé?  You need to a-s-k to g-e-t.  Potential mentors are usually busy people -- they don't go looking for more things to add to an already overwhelming calendar.  That said, the saying "if you want something done, give it to a busy person" is often true, because busy people are in the business of making things happen.  If your organization offers a mentorship program, jump at the opportunity.  Just make sure that the person with whom you are paired has the time, the expertise, and the interest to help you in your career.

When searching for a mentor, remember that you should have a clear goal in mind.  "Hey, I need a mentor" isn't very specific, and the Mr. Rodger's "won't you be my mentor?" isn't very compelling.  Rather, start with a specific objective.  For example, it could be, "how do I become fully qualified to become a first-line manager?" or "what does this organization look for when selecting a C-level executive?"  Once you have your goal, you can start your search, but remember that you need to stay professional.  You're not seeking a drinking buddy -- a mentor rarely is a peer (although technically I have heard of peer-to-peer mentoring, but that runs the risk of the parable of the two blind men who both fall into a ditch.)  You want someone with relevant knowledge and experience.  And ideally first develop a working relationship before you pop the question.  A busy mentor will feel more comfortable working with a known quantity than being left to wonder if this person represents a reputational risk.

Let's turn our conversation now to sponsors.

Executive coach May Busch recommends forming a career board of directors to advance your career.  She points out that you need both mentors and sponsors -- sponsors are those in your organization with sufficient clout to put you into key assignments and can advocate behind closed doors for your career advancement.  Wow -- sounds great; where do I sign up?  The issue is that you typically can't recruit sponsors; they come looking for you.  Like a mentee, a "sponsee" represents potential risk to sponsors -- they are putting their own credibility with peers on the line by advocating for you.  If you crash and burn, you both lose.

Like any sales effort, you shouldn't put all of your eggs in a single basket, so if you want to identify a potential sponsor, look for a couple of candidates.  Now, where you work there may be exactly one person who controls the vertical and the horizontal, but in most matrixed organizations, there is a range of opportunities to find advocacy.  Find out who is senior enough to influence the decisions that can affect your career and also whether they are "in on things" to ensure that recommendations move you in the right direction.  There are people who continue to serve past their key roles -- often called "emeritus" as an honorary title, but they probably aren't keeping up with the details.  Look for someone who is still actively "in the game."  And, like finding a mentor, you must identify a natural link between their business interests and your interests.  Now, the intersection of all these criteria might yield exactly zero people, and if so, it's up to you to figure out your own way forward.  But if you do identify potential sponsors, you need to attract their attention.  But how?

Your potential sponsors need to see you in action.  Find ways to deliver executive presentations where they are present or participate in working groups and let the quality of your work differentiate you from peers.  Circulate innovative ideas that represent a step forward for your organization.  The result of these efforts should be to get you noticed.  Note also that you can do this for members of your team.  You may want to sponsor them for bigger and better things but don't have the organizational capital to make it happen on your own initiative.  By placing your best people in front of these more powerful decision-makers, you can facilitate their sponsorship when one of them decides this person should be going places.

Now, it's not just about performance.  During COVID, most of us got comfortable working in bunny slippers from home, but that's not going to differentiate you to a potential sponsor.  If you want to convince executives that you're C-level material, then you need to consistently look the part.  Check your appearance.  Do you look like the other executives in your organization?  I spent 30 years in the military, so part of that "look" was proper grooming, a pressed neat uniform, and being physically fit.  I remember my last semiannual physical fitness test -- I scored 295 out of 300 points and the young Sailor taking scores remarked, "not bad for an old man."  But looking the part is important if you are going to be present yourself as a leader.  [story at CNL -- overweight memorandum.]  Now, I suppose if you work in a dot com startup and the founders all wear t-shirts and jeans every day, then wearing a three-piece suit is not going to help.  But find a way to align with the organization's senior leadership culture so that you don't look like an outsider, which translates into risk.

Make sure your office space isn't full of junk and clutter and your home background on Zoom calls looks like a professional office space (or at least blur out the background.)  Better yet, use a corporate-logo themed background which says, "I'm on the team."

Okay, so let's say you've done all this and are now looking like you just came out of casting for The West Wing and you're sufficiently visible to senior executives.  Beyond looking the part, you need to act the part.  Sit up straight in meetings; don't fiddle with your phone when executives are in the room, no matter how boring the conversation may be at that moment.  I remember back in 2000 when I was working at a startup, our CEO nearly lost our biggest client because she couldn't put down her Blackberry when we were briefing the client's head of security.  He was a retired Navy captain and remarked to me privately (as a fellow Navy officer) how offended he was that this person couldn't be bothered to put down that phone for half an hour and focus on the conversation.  Better yet?  There is a superpower that few people have but you could master if you're a phone addict -- leave your phone on your desk when you go to a meeting.  That's right -- separate yourself from your "life support unit."  Now, in some circumstances you feel you need it because, "what if they ask who's available for a meeting next week and I don't have my calendar?"  Bring your laptop or tablet instead, and only consult it when you're asked something that needs looking up to answer.  Remember, even a CEO doesn't get a pass on distractions when your biggest client is in the room.

In addition to looking the part and acting the part, you need to deliver.  Make sure your work is exceptional and error-free.  At the Pentagon we had a term -- "finished staff work."  It means that what you turn in is correct, complete, and free of grammatical or typographical errors EVERY TIME.  That's a tough discipline.  I was a computer science and mathematics major at Northwestern, and there was nothing I wanted to avoid more than an English composition or writing class -- after all, I was going to be a technologist.  Years later when I joined the staff of Booz|Allen, I saw the importance of mastering a professional writing style.  As a consultant, you live or die by the pen -- how well you write proposals and deliverables.  As I became more senior in both my civilian as well as my military career, I kept improving that ability to write well.  

A small but powerful book you should own and master is Strunk and White's The Elements of Style.  It's the most succinct summary of writing rules I've read -- think of it as a syntax guide to the English language.  Granted, some of these conventions are considered quaint or even obsolete -- the Oxford comma and two spaces after a sentence, but I still write that way.  There's no reason if you can write a program that will compile (or if you're a Python programmer, not throw a Syntax Error) that you cannot write English with the same consistency.

May Busch points out that there are four mistakes you can make that will ruin your attempts to attract a sponsor.  One, which seems obvious, is that you're perceived as lacking potential.  Note I said "perceived."  I think all of us have slightly inflated expectations of ourselves -- that's called a healthy ego, but let's face it:  some people are rightly classified as low potential, high achievers -- they work really hard to achieve mediocre results.  "But I do consistently outstanding work at my current job!"  Okay, I'll give you that.  But remember -- we're talking about getting a sponsor for the NEXT job, and if you're not virtue signaling that you can perform at the next level, then a wise boss is likely to leave you where you are -- delivering consistently outstanding work.  Remember my four-phase career model:  technical, management, leadership, political?  You can often move easily within one of those phases without sponsorship, but to get to the next level usually requires something or someone external to yourself.

The second disqualifier is to be seen as "selectively motivated," meaning you only put forth full effort at the last minute.  It's somewhat of a synonym for a procrastinator -- many of us know there's nothing like the last minute to make sure things get done.  Sure, there are important things that are urgent, but if your MO is to goof off until just before a deadline and then rush out a finished product, that calls into question your long-term reliability for more responsible assignments.

The third disqualifier is lack of self-confidence.  If you present yourself as hesitant and uncertain, you do not inspire confidence.  "Do you think, umm, maybe we might possibly consider doing this?" is not as reassuring as, "Here's what we're going to do."  I'm not advocating for arrogancy here; but if you secretly worry about imposter syndrome or a belief that you're not as good as others perceive you to be, then that's likely to leak out in your words and actions and cause potential sponsors to pause.

The fourth way you can discourage a potential sponsor is to be inappropriate.  You say and do the wrong things at the wrong time to the wrong people.  You put your feet up on the conference table or make inappropriate or even offensive jokes when no one was looking for that type of input.  Walking up a senior executive and saying, "won't you be my sponsor?" is another example.  It's fine for Mr. Rodgers to ask, "won't you be my neighbor?" but as you know by now, you have to become the one who attracts attention, not demands it.

One of the best ways to help others move forward is to show them an example of what represents success.  I mentioned earlier the booklet that sits on my desk -- have you figured out what it might be?  It's "A Message to Garcia" written by Elbert Hubbard, the founder of the Roycrofters in East Aurora NY.  Hubbard was a writer, publisher, artist, and philosopher, who wrote that he sat down and penned this essay after dinner in under an hour.  What started as article in his magazine grew rapidly.  After receiving requests for a thousand copies of that issue, he inquired as to the reason.  "It's the stuff about Garcia."  The New York Central Railroad reprinted over one million copies in booklet form.  The Director of Russian Railways was in New York, was so impressed that when he returned to Moscow, ensured a translated copy was given to every railroad employee in Russia.  Every Russian soldier in the Russo-Japanese war had a copy, and when the Japanese officials noted Russian prisoners of war all carried it, they concluded it must be a good thing, translated it into their language and gave copies to every employee of the Japanese government.  By December 1913, over forty million copies of A Message to Garcia had been printed.  Tragically, Hubbard died on the 7th of May 1915 as a passenger onboard RMS Lusitania, which was torpedoed by a German U-boat.  I have a number of his publications, but this is the one that I reread the most.  It's not that long -- less than fifteen hundred words, and if you haven't heard it before, you should, and if you have heard it before and you're like me, you'll want to hear it again.  Remember, the context is 1899.  Here is…

A Message to Garcia By Elbert Hubbard

In all this Cuban business there is one man stands out on the horizon of my memory like Mars at perihelion. When war broke out between Spain and the United States, it was very necessary to communicate quickly with the leader of the Insurgents. Garcia was somewhere in the mountain vastness of Cuba- no one knew where. No mail nor telegraph message could reach him. The President must secure his cooperation, and quickly.

What to do!

Some one said to the President, "There’s a fellow by the name of Rowan will find Garcia for you, if anybody can."

Rowan was sent for and given a letter to be delivered to Garcia. How "the fellow by the name of Rowan" took the letter, sealed it up in an oil-skin pouch, strapped it over his heart, in four days landed by night off the coast of Cuba from an open boat, disappeared into the jungle, and in three weeks came out on the other side of the Island, having traversed a hostile country on foot, and delivered his letter to Garcia, are things I have no special desire now to tell in detail. The point I wish to make is this: McKinley gave Rowan a letter to be delivered to Garcia; Rowan took the letter and did not ask, "Where is he at?" By the Eternal! there is a man whose form should be cast in deathless bronze and the statue placed in every college of the land. It is not book-learning young men need, nor instruction about this and that, but a stiffening of the vertebrae which will cause them to be loyal to a trust, to act promptly, concentrate their energies: do the thing- "Carry a message to Garcia!" General Garcia is dead now, but there are other Garcias.

No man, who has endeavored to carry out an enterprise where many hands were needed, but has been well nigh appalled at times by the imbecility of the average man- the inability or unwillingness to concentrate on a thing and do it. Slip-shod assistance, foolish inattention, dowdy indifference, and half-hearted work seem the rule; and no man succeeds, unless by hook or crook, or threat, he forces or bribes other men to assist him; or mayhap, God in His goodness performs a miracle, and sends him an Angel of Light for an assistant. You, reader, put this matter to a test: You are sitting now in your office- six clerks are within call. Summon any one and make this request: "Please look in the encyclopedia and make a brief memorandum for me concerning the life of Correggio". Will the clerk quietly say, "Yes, sir," and go do the task?

On your life, he will not. He will look at you out of a fishy eye and ask one or more of the following questions: 

 Who was he?

 Which encyclopedia?

 Where is the encyclopedia?

 Was I hired for that?

 Don’t you mean Bismarck?

 What’s the matter with Charlie doing it?

 Is he dead?

 Is there any hurry?

 Shan’t I bring you the book and let you look it up yourself?

 What do you want to know for?

And I will lay you ten to one that after you have answered the questions, and explained how to find the information, and why you want it, the clerk will go off and get one of the other clerks to help him try to find Garcia- and then come back and tell you there is no such man. Of course I may lose my bet, but according to the Law of Average, I will not.

Now if you are wise you will not bother to explain to your "assistant" that Correggio is indexed under the C’s, not in the K’s, but you will smile sweetly and say, "Never mind," and go look it up yourself.

And this incapacity for independent action, this moral stupidity, this infirmity of the will, this unwillingness to cheerfully catch hold and lift, are the things that put pure Socialism so far into the future. If men will not act for themselves, what will they do when the benefit of their effort is for all? A first-mate with knotted club seems necessary; and the dread of getting "the bounce" Saturday night, holds many a worker to his place. Advertise for a stenographer, and nine out of ten who apply, can neither spell nor punctuate- and do not think it necessary to.

Can such a one write a letter to Garcia?

"You see that bookkeeper," said the foreman to me in a large factory.

"Yes, what about him?"

"Well he’s a fine accountant, but if I’d send him up town on an errand, he might accomplish the errand all right, and on the other hand, might stop at four saloons on the way, and when he got to Main Street, would forget what he had been sent for."

Can such a man be entrusted to carry a message to Garcia?

We have recently been hearing much maudlin sympathy expressed for the "downtrodden denizen of the sweat-shop" and the "homeless wanderer searching for honest employment," and with it all often go many hard words for the men in power.

Nothing is said about the employer who grows old before his time in a vain attempt to get frowsy ne’er-do-wells to do intelligent work; and his long patient striving with "help" that does nothing but loaf when his back is turned. In every store and factory there is a constant weeding-out process going on. The employer is constantly sending away "help" that have shown their incapacity to further the interests of the business, and others are being taken on. No matter how good times are, this sorting continues, only if times are hard and work is scarce, the sorting is done finer- but out and forever out, the incompetent and unworthy go. It is the survival of the fittest. Self-interest prompts every employer to keep the best- those who can carry a message to Garcia.

I know one man of really brilliant parts who has not the ability to manage a business of his own, and yet who is absolutely worthless to any one else, because he carries with him constantly the insane suspicion that his employer is oppressing, or intending to oppress him. He cannot give orders; and he will not receive them. Should a message be given him to take to Garcia, his answer would probably be, "Take it yourself."

Tonight this man walks the streets looking for work, the wind whistling through his threadbare coat. No one who knows him dare employ him, for he is a regular fire-brand of discontent. He is impervious to reason, and the only thing that can impress him is the toe of a thick-soled No. 9 boot.

Of course I know that one so morally deformed is no less to be pitied than a physical cripple; but in our pitying, let us drop a tear, too, for the men who are striving to carry on a great enterprise, whose working hours are not limited by the whistle, and whose hair is fast turning white through the struggle to hold in line dowdy indifference, slip-shod imbecility, and the heartless ingratitude, which, but for their enterprise, would be both hungry and homeless.

Have I put the matter too strongly? Possibly I have; but when all the world has gone a-slumming I wish to speak a word of sympathy for the man who succeeds -- the man who, against great odds has directed the efforts of others, and having succeeded, finds there’s nothing in it: nothing but bare board and clothes. I have carried a dinner pail and worked for day’s wages, and I have also been an employer of labor, and I know there is something to be said on both sides. There is no excellence, per se, in poverty; rags are no recommendation; and all employers are not rapacious and high-handed, any more than all poor men are virtuous.

My heart goes out to the man who does his work when the "boss" is away, as well as when he is at home. And the man who, when given a letter for Garcia, quietly take the missive, without asking any idiotic questions, and with no lurking intention of chucking it into the nearest sewer, or of doing aught else but deliver it, never gets "laid off," nor has to go on a strike for higher wages. Civilization is one long anxious search for just such individuals. Anything such a man asks shall be granted; his kind is so rare that no employer can afford to let him go. He is wanted in every city, town and village- in every office, shop, store and factory. The world cries out for such: he is needed, and needed badly- the man who can carry a message to Garcia.

-THE END- 

In 2009 as president of the Association of the United States Navy, I wrote a short article entitled "A New Message to Garcia."  There I called out the actions of a Sailor who went above and beyond what was expected without even being asked.  I hope he went on to bigger and better things because he had the right stuff.

Let's put all of this together.  One of the best ways to formalize mentoring is to create a written performance development plan.  We've included a sample template in the show notes.  This is a way to memorialize conversations with SMART goals -- you remember, specific, measurable, achievable, relevant, and time-bound?  If you are a mentor, you can use this as a template for your counseling sessions.  If you are a mentee and there is no template in your organization, feel free to introduce this to your mentor -- you're showing initiative and creating potential value for more people than just yourself.

By putting goals in writing, they experience a magical transformation.  It was Napoleon Hill who wrote that "a goal is a dream with a deadline."  Until you write it down, it's easy to find other things that seem more important or urgent at the moment.  In addition, a written set of goals offers accountability -- it's a commitment between mentor and mentee that can be honored like a contract.

Start with the manager's organizational priorities and goals that provide a context for the session.  For example, if you are in the cybersecurity organization, these could be things such as, "create a cyber vigilant organization," "enable cybersecurity controls and compliance," and "safeguard the organization against major threats."  Each of these could have subgoals that get into a little more detail -- awareness training for users, secure coding training for developers, establishing a governance structure around cyber risk.  This requires inside knowledge, and if the mentor is within the same organization, it shouldn't be too difficult to ascertain.  In addition, if the mentor is the supervisor, then even better -- this shows how the protégé's goals fit in with the boss's vision of what should happen.  Better to find out early on that an idea isn't practical then to spend a year working on it only to find out it will never be implemented.

Next, the protégé lists individual development goals.  Not too many, especially if you are meeting quarterly.  Two or three may be sufficient.  If there are too many things to work on, the natural tendency is to go for those that are easiest, which may not be the ones that are the most important.  Next comes the BHAG -- the big, hairy, audacious goal -- the one that will represent a signature accomplishment.  Chances are, this won't happen in a month or a quarter, but it's perfectly reasonable for an annual cycle to align with performance reviews to specify a stretch goal.  And by doing it in writing and knowing someone is holding accountability, it's more likely to happen.

When it comes to making progress, actions can be separated into experiences, relationships, and learning.  Most of our progress is done through experience, so list multiple experiences that one expects to accomplish before the next session.  It can be part of a larger goal -- work on the team deploying a SIEM or complete a particular phase of a larger project.  This is where the majority of the accountability will reside -- did you complete what you set out to do?  It's helpful to be a bit aspirational, but this isn't another set of stretch goals.

List at least two relationship improvement opportunities -- these can be key relationships or even potential sponsors.  For example, it could include the head of a particular business unit that has specific security requirements -- that meeting would help address those concerns and provide an opportunity for the person seeking visibility.

Lastly, include learning opportunities.  Not all of us are going to school full-time, but we all should be working on self-improvement.  For example, you might set a goal to complete the next course in your degree program or take the exam that grants a particular certification.

What you have is a template for action and professional growth.  The action comes from the accountability of a written document, and the growth comes from the joint goal-setting that takes place under the guidance of a mentor.  Don't just file it away with the rest of your paperwork -- put it where you'll see it every day and challenge yourself to check off another accomplishment by week's end.  By encouraging this culture of accomplishment, you'll significantly increase the probability of success.

Inside the front cover of my Garcia booklet is a short essay entitled "Initiative."  Let me leave you with this as a final thought:

The world bestows its big prizes, both in money and in honors, for but one thing. And that is Initiative.

What is Initiative?

I’ll tell you: it is doing the right thing without being told.

But next to doing the thing without being told is to do it when you are told once. That is to say, carry the Message to Garcia: those who can carry a message get high honors, but their pay is not always in proportion.

Next, there are those who never do a thing until they are told twice; such get no honors and small pay.

Next, there are those who do the right thing only when necessity kicks them from behind, and these get indifference instead of honors, and a pittance for pay. This kind spends most of its time polishing a bench with a hard-luck story.

Then, still lower down in the scale than this, we have fellow who will not do the right thing even when some one goes along to show him how and stays to see that he does it; he is always out of job, and receives the contempt he deserves, unless he happens to have a rich Pa, in which case Destiny patiently awaits around a corner with a stuffed club.

To which class do you belong?

Thank you for listening to CISO Tradecraft; we hope you've found this show valuable.  If you learned something that you like, please help us by leaving us a 5-star review on your favorite podcast platform -- those ratings really help us reach other security leaders.  The more CISOs we can help, the more businesses we can protect.  This is your host, G. Mark Hardy.  Thanks again for listening and stay safe out there.

References:

• https://blog.hubspot.com/marketing/mentor-tips-positive-impact
• https://www.businessnewsdaily.com/6248-how-to-find-mentor.html
• https://www.businessnewsdaily.com/3504-how-to-mentor.html
• https://maybusch.com/career-board-of-directors-advance-career/
• https://maybusch.com/find-sponsor/
• https://www.amazon.com/Elements-Style-4th-William-Strunk/dp/0205313426?&_encoding=UTF8&tag=-0-0-20&linkCode=ur2
• https://www.nato.int/nrdc-it/about/message_to_garcia.pdf
• https://gmarkhardy.com/Navy_Articles/NRA-0909%20A%20New%20Message%20to%20Garcia.pdf

Example: Individual Performance Plan

Name: ________________________________ Date:  ________________

Leadership's Cyber Priorities and Goals

1.       Create a Cyber Vigilant Organization

• Cyber Awareness Training, Secure Developer Training, and Proper Risk Approval and Governance

2.       Enable Compliance, Controls, and Cyber Security 

• Controls (IT General Controls & SOX), Audits, and Cyber Maturity Frameworks (ISO 27001, NIST CSF, or FFIEC)

3.       Safeguard the Business against Key Threats

• Phishing and Ransomware, Software Vulnerabilities, and Third-Party Risks

Individual Development Goals

1. Goal:
2. Goal:

Signature Accomplishment

•  My Big Goal is to accomplish …

Actions I am taking this year (How)

•  Experiences (70%)
  • Experience 1
  • Experience 2
  • Experience 3
  • …

Relationships (20%)

• Relationship Improvement Opportunity 1
• Relationship Improvement Opportunity 2

Learning (10%)

• Learning Opportunity

Support Needed from My Manager

• I need help with …

Special Thanks to our podcast sponsor, Obsidian Security.  

We are really excited to share today’s show on SaaS Security Posture Management.  Please note we have Ben Johnson stopping by the show so please stick around and enjoy.  First let’s go back to the basics:

Today most companies have already begun their journey to the cloud.  If you are in the midst of a cloud transformation, you should ask yourself three important questions:  

1. How many clouds are we in?
2. What data are we sending to the cloud to help the business?
3. How do we know the cloud environments we are using are properly configured?

Let’s walk through each of these questions to understand the cyber risks we need to communicate to the business as well as focus on one Cloud type that might be forecasting a major event.  First let’s look at the first question.  

How many clouds are we in?  It’s pretty common to find organizations still host data in on premises data centers.  This data is also likely backed up to a second location just in case a disaster event occurs and knocks out the main location.  Example if you live in Florida you can expect a hurricane.  When this happens you might expect the data center to lose power and internet connectivity.  Therefore it’s smart to have a backup location somewhere else that would be unlikely to be impacted by the same regional event.  We can think of our primary data center and our backup data center as an On-Premises cloud.  Therefore it’s the first cloud that we encounter.  

The second cloud we are likely to encounter is external.  Most organizations have made the shift to using Cloud Computing Service providers such as Amazon Web Services, Azure, Google Cloud Platform, or Alibaba.  Each of these cloud providers has a multitude of offerings designed to help organizations reduce the need to host IT services on premises.  Now if you are using both on-premises and a cloud computing provider such as AWS, congratulations you are in what is known as a hybrid cloud environment.  If you use multiple cloud computing providers such as AWS and Azure then you are in a multi-cloud environment.  Notice the difference between terms.  Hybrid cloud means you host on premises and use an external cloud provider, whereas multi-cloud means you use multiple external cloud providers.  If you are using a Common Cloud platform like AWS, Azure, or GCP then you can look into a Gartner Magic Quadrant category known as Cloud Workload Protection Platforms.  Here you might encounter vendors like Palo Alto Prisma Cloud, Wiz, or Orca who will provide you with recommendations for your cloud configuration settings.

So let’s say your organization uses on premises and AWS but not Azure or GCP.  Does that mean you only have two clouds?  Probably not.  You see there’s one more type of cloud hosted service that you need to understand how to defend.  The most common cloud model organizations leverage is Software as a Service commonly pronounced as (SaaS). Frankly we don’t hear about SaaS security being discussed much which is why we are doing a deep dive on its security in this episode.  We think there's a real danger of SaaS clouds turning from a nice cloud that gently cools down a hot summer day into a severe weather storm that can cause an event.  So let’s look at SaaS Security in more depth.  

SaaS refers to cloud hosted solutions whereby vendors maintain most everything.  They run the application, they host the data, they host runtime environments, middleware, operating systems, virtualization technologies, servers, storage, and networking.  It can be a huge win to run SaaS solutions since it minimizes the need to have IT staff running all of these IT services.  Example: Hiring HVAC folks to ensure we have proper heating and cooling for servers on premises won’t add new sales revenue to the business.  

Now that you understand why SaaS is important you should ask yourself.  How many external SaaS providers are we sending sensitive data to?  Every company is different but most can expect to find dozens to hundreds of SaaS based solutions.  Examples of external SaaS solutions commonly encountered by most businesses include: 

• Service Now or Jira in use as a ticketing service, 
• Salesforce for customer relationship management
• Workday for HR information
• G Suite or Microsoft Office 365 in use to send emails and create important documents
• Github as a source code repository for developers
• Zoom for virtual teleconferences
• Slack for instant messaging like conversations
• Okta for Identity and Access Management

Once you build out an inventory of your third parties hosted SaaS solutions, you need to understand the second question.  What kind of data is being sent to each service?  Most likely it’s sensitive data.  Customer PII and PCI data might be stored in Salesforce, Diversity or Medical information for employees is stored in Workday, Sensitive Algorithms and proprietary software code is stored in GitHub, etc. 

OK so if it is data that we care about then we need to ensure it doesn’t get into the wrong hands.  We need to understand why we care about SaaS based security which is commonly known as SaaS Security Posture Management.  Let’s consider the 4 major benefits of adopting this type of service.  

1. Detection of Account Compromise.  Today bad actors use man in the middle attacks to trick users to give their passwords and MFA tokens to them.  These attacks also provide the session cookie credentials that allow a website to know a user has already been authenticated.  If attackers replay these session cookie credentials there’s no malware on the endpoints.  This means that Antivirus and EDR tools don’t have the telemetry they need to detect account compromise.  Therefore, you need log data from the SaaS providers to see anomalous activity such as changing IP addresses on the application.  Note we talked about this attack in much more detail on episode 87 From Hunt Team to Hunter with Bryce Kunze.  
2. In addition to detecting account compromises, we see that SaaS security posture management solutions also improve detection times and response capabilities.  Let’s just say that someone in your organization has their login credentials to Office 365 publicly available on the dark web.  So a bad actor finds those credentials and logs into your Office 365 environment.  Next the bad actor begins downloading every sensitive file and folder they can find.  Do you have a solution that monitors Office 365 activity for Data Loss Prevention?  If not, then you are probably going to miss that data breach.  So be sure to implement solutions that both log and monitor your SaaS providers so you can improve your SaaS incident detection and response capabilities.
3. A third benefit we have seen is improvements to configuration and compliance.  You can think of news articles where companies were publicly shamed when they lost sensitive data by leaving it in a Public Amazon S3 bucket when it should have been private.  Similarly there are settings by most SaaS solutions that need to be configured properly.  The truth is many of these settings are not secure by default.  So if you are not looking at your SaaS configurations then access to sensitive data can become a real issue.  Here’s an all too common scenario.  Let’s say your company hires an intern to write a custom Salesforce page that shows customer documents containing PII.  The new intern releases updates to that webpage every two weeks.  Unfortunately the intern was never trained on all of the Salesforce best practices and creates a misconfiguration that allows customer invoices to be discovered by other customers.  How long would this vulnerability be in production before it’s detected by a bad actor?  If you think the answer is < 90 days, then performing yearly penetration tests is probably too slow to address the brand damage your company is likely to incur.  You need to implement a control that finds vulnerabilities in hours or days not months.  This control might notify you of compliance drift in real time when your Salesforce configuration stopped meeting a CIS benchmark.  Now you could pay a penetration testing provider thousands of dollars each week to continually assess your Salesforce environment, but that would become too cost prohibitive.  So focus on being proactive by switching from manual processes such as penetration testing to things that can be automated via tooling
4. The fourth major benefit that we observe is proper access and privilege management. Here’s one example.  For critical business applications you often need to enforce least privilege and prevent the harm that one person can cause.  Therefore, it’s common to require two or more people to perform a function.  Example: One developer writes the new code for a customer facing website, another developer reviews the code to detect if there’s any major bugs or glaring issues that might cause brand damage.  Having a solution that helps mitigate privilege creep ensures that developers don’t increase their access.  Another example of the importance to proper access management occurs when bad employees are fired.  When a bad employee is fired, then the company needs to immediately remove their access to sensitive data and applications.  This is pretty easy when you control access via a Single Sign On solution.  Just disable their account in one place.  However many SaaS providers don’t integrate with SSO/SAML.  Additionally the SaaS website is generally internet accessible so people can work from home even if they are not on a corporate VPN.  Therefore it’s common to encounter scenarios where bad employees are fired and their account access isn’t removed in a timely manner.  The manager probably doesn’t remember the 15 SaaS accounts they granted to an employee over a 3 year time frame.  When fired employees are terminated and access isn’t removed you can generally expect an audit finding, especially if it’s on a SOX application.  

OK so now that we talked about the 4 major drivers of SaaS Security Posture Management (detection of account compromise, improved detection and response times, improvements to configuration and compliance, and proper access and privilege management) let’s learn from our guest who can tell us some best practices with implementation.

Now I’m excited to introduce today’s guest:  Ben Johnson
Live Interview

Well thanks again for taking time to listen to our show today.  We hoped you learning about the various clouds we are in (On Premises, Cloud Computing Vendors, and SaaS), Understanding the new Gartner Magic Quadrant category known as SaaS Security Posture Management.  So if you want to improve your company’s ability on SaaS based services to:

1. detect account compromise, 
2. improve detection and response times, 
3. improve configuration and compliance, and 
4. proper access and privilege management 

Remember if you liked today’s show please take the 5 seconds to leave us a 5 star review with your podcast provider.  Thanks again for your time and Stay Safe out there.

References

• https://github.com/cisotradecraft/Podcast
• https://cisotradecraft.podbean.com/e/84-gaining-trust-with-robin-dreeke/
• https://www.youtube.com/shorts/vSART2mutwc
• https://www.peopleformula.com/selfmastery
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-roses-buds-thorns/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-how-to-compare-software/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-shall-we-play-a-game/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-aligning-security-initiatives-with-business-objectives/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-promotion-through-politics/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-presentation-skills/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-avoiding-death-by-powerpoint/
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-partnership-is-key/
  
  

Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cybersecurity leader.  My name is G. Mark Hardy, and today's episode is something special for us and we hope for you as well.  It’s hard to believe it but CISO Tradecraft has been producing episodes for about two years now.  This is our 100th episode!  We've covered quite a bit of ground over that time, and we thought we would do a little reflection on our previous episodes and highlight seven differentiators that set World Class CISOs apart from others.  So, stick around and learn these seven tips that will enable you to enhance your CISO Tradecraft and help you have a more successful career.

1. The first tip we want you to understand is that you must always help others to understand your viewpoints through Connection.  Now there is one thing to note:  the way you connect depends on the size of the audience.  We observe that there’s usually three different audience sizes that you will connect with: Individuals or 1:1, Small Teams (between 2 and 20), and Large Groups (more than 20).
   1. With Individuals it’s all about building the one-on-one connection.  An example of folks who excel at building connections are spies.  Spies have a mission to build connections with others and recruit them to share important information.  Now if you go back to Episode #84, we brought Robin Dreeke on the show to talk about Building Relationships of Trust.  Robin was a long time FBI agent who excelled in recruiting and turning Russian spies.  In the episode, Robin talked about the key to building relationships of trust.  He mentioned four key recommendations:
      1. Seek the thoughts and opinions of others;
      2. Talk in terms of priorities, pain points, and challenges of others;
      3. Use nonjudgmental validation (i.e., seek to understand others without judging); and
      4. Empower others with choices and give them the cause and effect of each choice.

There’s a lot more detail in that episode, so be sure to check it out if you haven't yet listened to it.  We would like to add one more key point to these thoughts from Robin.  It’s about seeking the thoughts and opinions of others.  You might be thinking to yourself, how do I connect with others, so they actually tell me their unfiltered opinions?  Jim Lawler, a 25-year veteran CIA operations officer came on Robin’s Dreeke’s Forging Trust podcast and provided a very interesting quote, “You don’t recruit people when you are in transmit mode.  You recruit people by listening.”  Therefore, find ways to listen with great questions.  Imagine if you asked these three powerful questions from Andy Ellis:

1. What is the stupidest risk that we are not taking care of that no one has dealt with?
2. What is the dumbest security control that gets in your way?
3. What is something that you wish we did better in security?

Now after you ask those three questions, take Jim’s advice, and just listen.  We mean to actively listen to every word coming off of the other person’s lips.  Don’t just listen for the purpose of responding right away and providing your opinion and guidance.  Remember, good listeners are very hard to come by.  It’s uncommon to find people who really take an interest in others.  So, listen with the purpose of understanding what the other person wants, not what you intend to say back.  When you care enough to truly listen, people feel heard, which generates a connection.

1. Small Teams - In addition to listening with others you will often need to connect with small teams.  This might be your executive leadership team.  It might be your boss and your peers.  To build connections with small groups you must enable Conversations of Candor.  If you haven’t heard of the word candor it means the quality of being open and honest in expression or frankness.  Here’s two examples of doing that:
   1. On Episode #27, we talked about how the Boy Scouts use the concept of Roses, Buds, and Thorns.  For those who were scouting leaders, after each campout you would talk about what’s going well (i.e., roses), what new ideas are working (i.e., buds) and what are the things you want to stop (i.e., thorns).  By consistently asking these questions in each of your staff meetings, you enable everyone the opportunity to speak their mind.  They have a venue to speak up.  Now if you really want to connect with small groups and build trust, then please act on their guidance.  If someone says a particular person isn’t responding, reach out to that other individual and say, "I would appreciate if you could assist so-and-so with this problem."  You're using the power of your leadership position to influence this other person.  When you step in for your team and work to help them, they will consider you as a good leader who helps his or her people.  [Navy story] By doing this, you enable trust and strengthen connections.
   2. Another example of creating conversations of candor is problem framing.  Note you can learn about all the steps in problem framing from Episode #14, How to Compare Software.  Now in today's discussion we're not talking about software but about people, but in that episode, we talked about the importance of applying problem framing to understand limitations and politics.  The first two steps of the seven in that methodology were defining the problem and stating the intended objective.  To best solve problems in an organization, it’s important everyone agrees that something is a real problem worth focusing on.  If each person has a different problem in mind, then there really isn’t going to be any meaningful agreement.  Start by getting consensus -- we all agree this is the exact problem we are solving today.  Once the room agrees on a problem, you need everyone to agree on an intended objective.  You can think of these as SMART goals.  You know the acronym: specific, measurable, achievable, relevant (or realistic), and time bound.  For example, let's say that today our organization is unable to retain quality talent.  We see many of our best and brightest going to other companies for more money.  So, your organization creates an intended objective.  For next year, we will seek to retain 80% of our employee population throughout the year that are not retiring.  This metric will enable our company to measure ourselves each month to see if we are successful and will allow everyone to connect by working together on the same issue.  Naturally, there needs to be resources allocated to achieve this goal; but if you have this stated objective in place, you're much more likely to set up your organization for success.
2. Large Groups- The last audience size is large groups.  In large groups you don’t have the opportunity to connect with everyone and have detailed conversations.  Additionally, with over twenty folks it becomes very difficult to have a conversation with everyone being able to provide their opinions and feedback.  So, for this audience, we recommend using gamification techniques to build connections.  Most executives are competitive.  We have all been involved in friendly competitions growing up as well as many of us have played some type of organized sport.  So, if we can create a game that increases active participation, provides immediate feedback, includes dynamic interaction, has competition or novelty, and improves a company’s ability to achieve a goal, then you are on to something truly special.  If you would like to learn more about gamification concepts and the four player types that you need to support, please check out Episode #65 which is entitled, "Shall We Play a Game?"

1. The second differentiator of the seven used by World-Class CISOs involves understanding how to build an effective metrics program that drives ownership and accountability.  If there isn’t someone accountable, then chances are the project is going to fail.  So, we need to have an accountable party and a good metric to show progress.  Remember, that which gets measured gets done; that which gets done well gets funded again.  To create good metrics, we want to you use the 4 Lines Approach.  Every metric needs a start line, a trend line, a goal line, and a timeline.
   1. A metric needs to have a Start Line to show the current status of where the organization is right now.  This allows the accountable parties to have a scoreboard.  You can think of playing a pick-up game of basketball.  If you are just playing for fun, people might not play their best.  However, if you put up a scoreboard, suddenly it becomes competitive, and players put forth a little more effort.  This helpful competition increases individual as well as team productivity.
   2. A metric should have a Trend Line to show how things have gone over the past four months.  Are things getting better, getting worse, or staying the same?  This tells management when something is going wrong, because negative trends indicate we need to change our course of action.  For example, if we see that the number of high and critical vulnerabilities on our SOX applications continues to increase, then we need to identify the root cause.  Are there enough resources on those teams, is something wrong from an architecture perspective, are our vendors not giving us the support we need, and so on?  If you are not watching the trend line, you will miss identifying when things are forecasted to go bad and end up taking corrective action much later than you could have.
   3. Metrics need a Finish   Line- This is a goal that the organization is targeting.  It has a clearly defined definition of done.  For example, let’s say we really care about ransomware and being able to restore critical applications from offline backups.  We need to be specific on our restoration capabilities.  If a server goes down do we have 4 hours, 8 hours, 24 hours, or more before it catastrophically impacts the business?  This matters since the business is going to have to both recreate all of the data lost in that amount of time as well as account for loss of operational efficiencies when key IT systems are down.  Compliance can have a big impact on this as well, so make sure you know your requirements.
   4. Metrics also need a Timeline- We need to set a time to which we hold people accountable for reaching the finish line.  Goals or definition of "done" might go on forever, which isn’t what you want.  You want results and that comes from accountability.  Therefore, ensure every task has a clear owner with a clear deadline.  Note if you want to hear more about these four lines, please check out Episode #69 on aligning security initiatives with business objectives.

1. The third differentiator of seven for World-Class CISOs is understanding the shift between being competent versus being effective.  On Episode #62 entitled Promotion Through Politics, we talked about the four major phases in your career and the different skillsets you must display to get promoted.  At first you are an individual contributor.  In this role you get promoted by demonstrating technical skills.  This phase usually lasts several years, and if you are proficient in your area of expertise, you'll get promoted to first line manager.  [If we use the Navy as an example, if you're a skilled pilot you'll compete well for promotion to Lieutenant Commander, or Major in the non-sea services.]  Here you must demonstrate your management skills -- executing to budget, managing paperwork effectively, meeting deadlines.  If you learn and do all this well, you get to become a manager of managers and are welcomed into middle management.  [Back to the Navy, if you do well as a department head, you'll be a strong candidate to promote to Commander (or Lieutenant Colonel) and select for Executive Officer or Commanding Officer.]  This is where you must demonstrate leadership skills -- inspiring and strengthening your team, setting and achieving stretch goals, accomplishing your mission through innovation.  [Today, less than half of those officers will be offered a promotion to Captain (or Colonel.)]  If you've seen the Top Gun Maverick movie, you'll see that Tom Cruise's character as a Captain does all of these things -- he portrays a seasoned leader building a team, teaching teamwork skills, inspiring confidence, and leading by example rather than just playing a hotshot pilot competing against his peers as he did in the first movie (although he still is the best of the best in the cockpit, but I don't want to spoil any of the plot if you still want to see it.)  This is where you get some of the most rewarding opportunities in your career -- leading men and women in accomplishing great tasks.  Many careers top out here.  Brigadier General Jeremy Horn writes in his article, The 10 Secret Rules of the Colonel, "Colonel is the last rank that you can make through personal effort.  Everything from here on out is luck and timing."  He's right.  Invitations to the executive suite, known in the military as Flag Officer, requires excellence in your record, your reputation, and your relationships.  If you want to read some more of my thoughts on that topic, look up my article on Running Up the Flagpole.  Finally, if you are lucky and haven’t burned too many bridges you get welcomed into the executive level.  [In the Navy, that would be promotion to Rear Admiral (Brigadier General), a selection rate by the way that was less than 1% in my community.  Think about that -- 99% of Navy captains retire as captain.  Essentially, you can consider this as your terminal pay grade.  That realization does one of three things -- there are a few that hit cruise control and are on what we call the ROAD program -- retired on active duty.  The majority work well in their roles and serve honorably and effectively while looking for a good civilian job to transition out of the military.  But for a handful of us, it became "no fear" -- leadership couldn't hold not getting your promotion over your head if you took a risk and lost, so you go for things that are considered impossible and make them happen.  [pin on story]  If you consider some of the names you might remember from the military -- Colonel John Boyd's OODA Loop -- observe, orient, decide, and act; Colonel David Hackworth, the most decorated officer from the Korean War and the Vietnam War with two Distinguished Service Crosses, ten Silver Stars, and eight Bronze Stars -- they retired as Colonels, not Generals].  In this final career phase at the very top, it's not about leadership, it's all about politics.  Leaders show their political acumen to get recognized as being able to serve at this level.  Those who do not understand this think they're just brown-nosing, but it really is a manner of virtue-signaling, IF done at the right point in one's career.

Now as you are moving between levels in your career there’s one subtle thing that we want to you understand about executives.  It’s this concept of being competent versus being effective.  When you are in an individual contributor and first line manager roles, you must be competent.  For example, a pentester who can’t go hands-on to the keyboard to find vulnerabilities isn’t providing much value.  A firewall engineer who can’t change the access control rules isn’t helping.  You must display competence.  However, by the time you are a manager of managers you aren’t touching a keyboard much anymore.  So, your competence isn’t as important.  It’s important you know what good looks like so you can provide your team guidance.  However, your ability to troubleshoot a firewall is probably behind you.  You need to make the shift to focus on effectiveness.  Instead of improving only yourself, you need to improve the effectiveness of the people assigned to you.  If you could make everyone 100% more productive, then that is like having twice as many people on your team.  Here’s another example.  There was a company that hired a CISO who wasn’t technical.  He had never had traditional cyber security roles such as running a Security Operations Center, building a compliance organization to keep auditors happy, or implementing antivirus and firewalls.  However, this CISO was really good at connecting with others and getting resources.  After meeting with all the technical experts within the cyber organization, he learns they needed funding.  So, he plays a round of golf with the CEO and gets the resources necessary to increase the team size to the appropriate levels.  Later on, he gets asked technical questions by the CIO about why the application security tools have so many false positives.  He responds that he will discuss this concern with his technical experts.  Later on, he brings those experts into a meeting where they brief the CIO on why the AppSec tools have issues and the recommended way forward to fix them.  This resolves the CIO's concerns.  We mention this story because the CISO was not competent as an application security expert.  However, he was extremely effective in his role.  Of course, competent CISOs can do more, but the main point we want you to understand is at the executive level you need to spend your time learning how to get things done more effectively, and you do this by enabling (or coercing) others to accomplish the work, not by becoming increasingly competent as a technical contributor.

1. The fourth differentiator of World-Class CISOs is they are amazing communicators.  Who wants to listen to a boring presentation?  The answer is no one.  So don’t be that type of speaker.  Imagine you are a world class communicator that your CXO peers love hearing from.  That type of speaker is going to get invited to talk again and again.  When that happens, you get the opportunity to influence, to change behavior, to discuss high priority risks, and to be seen.  This is all goodness.  On Episode #61, we talk about presentation skills and how to give great presentations.  We discuss a JP Phillips Ted Talk that explains if you want listeners to remember your talk, try adding a cliffhanger.  If you want to build trust with a team, then tell something vulnerable about yourself.  Finally, if you want people to be focused and relaxed, try being overly dramatic or funny.  Also don’t just try to communicate via email and PowerPoint.  On Episode #75, Avoiding Death by PowerPoint, we talk about using escape rooms, tabletop exercises, and polls to create unique experiences that others will enjoy.  Mix it up a little and you'll improve your ability to influence others.

1. The fifth differentiator that sets up World-Class CISOs for success is they align security initiatives with business objectives.  In Episode #69 we talk about profit generation, cost reduction, service enablement, and customer and market outreach as the four key objectives that build profitable growth for businesses.  To best learn the business objectives and build relationships of trust with the C Suite, you need to learn how to partner.  We give detailed explanations of this process in Episode #70, Partnership Is Key.  One example is the marketing department.  They often direct where the IT organization needs to build its next webpage or widget.  However, marketing folks are often not technical.  Now imagine if you are the CISO that really gets on well with them.  So, you and they both partner together to identify a way to send marketing material via text and social media platforms such as TikTok, WeChat, and others.  Marketing estimates this will create millions of dollars of new sales.  So, the marketing team, the CIO, and the CISO brief the CEO and CFO to ask for an additional budget to perform this effort.  The CEO and CFO hear the business case and listen to the CIO saying this can be built in a six-month time frame.  The CEO and CFO also hear from the CISO that this can be done securely.  After due consideration, they approve the funding request.  Guess what?  That’s a big win for the company.  Since you were involved early with marketing, you also have the greatest opportunity to design security correctly on the new solution, versus being asked to approve something the week before going live.  So, find ways to connect through partnership and always focus on enabling business objectives.

1. The sixth differentiator that sets CISOs up for success is they can create effective risk governance and management processes within an organization.  The business must see that cyber is a business risk and not just an IT risk.  For example, when system XYZ is unavailable, how does that affect each of the users of that IT system?  What business processes fail?  What are the potential impacts on revenue and customer service?  This is why cyber risks need to be acknowledged by both the business owners who can identify the consequences of downtime and the IT maintainers who can actually remediate the findings.

Now one important thing to remember is approval authorities.  For example, who in the organization has purchasing authority for two million dollars of software?  Can any manager do this, or does it need to receive approval from a director, vice president, or senior vice-president?  A quick conversation with the CFO can confirm spending levels.  Once you know the spending authorities, then you can make a comparison that accepting two million dollars in cyber risk is the same as approving two million dollars in additional spending.  If a third-party risk assessment identifies two million dollars in new software risk, then the business must acknowledge the risk by either moving forward, rejecting the software, or finding a way to remediate the vulnerability before using the software.  Remember, the purpose of cyber isn’t to say "no."  The purpose of cyber is to be in the business of revenue protection.  Cyber protects revenue when the business owners can make business decisions in their best interest.  Most business executives will not understand the likelihood of a system being compromised, but that’s where cyber can show real value.  Cyber can communicate the vulnerabilities within systems to the business in risk committees and governance boards.  This allows cyber and the business to document the risk decisions being made.  When you document discussions and decisions based on risks and money, then you are acting like an executive.  This is the way to success.

1. The last world class differentiator for CISOs is they are successful in their jobs.  Want to know how to set up for success in any job?  If so, then please follow this piece of advice.  You must accomplish three things:
   1. First you need to get the job done.  If others refer to you as a "closer" for finishing the job, then you build trust.  When leadership knows they can trust you with little things, you get bigger responsibilities.  Mission accomplishment is the coin of the realm.
   2. The second thing to being successful in any job is you must cover all the angles.  Never let an overlooked detail derail you.  Good executives run efficient programs and projects that finish on time and within budget.  When things don’t go as forecasted there should not be big surprises to anyone since you keep a close watch of the details.  If you keep track of the details and think things through, then you can be successful.  You can succeed in this area by creating a culture of no-fear, specifically of not shooting messengers.  Are your people confident they can come to you early with potential issues for situational awareness, consideration, or possible resolution?  Can even your most junior person speak up and point out what might be a problem?  If it isn't, don't  cut them down, but patiently point out that that issue is already covered, but thank you for keeping your eyes open, and if you see other potential problems, continue to speak up.  You make better decisions when you don't have people afraid to bring you bad news.  I think we can all imagine a global leader today that none of us would want to approach saying things aren't going well and according to plan.  Don't be that kind of boss.
   3. The final and most important thing to succeed in any job is to keep the customer happy.  Remember, if the customer isn’t happy, then it doesn’t matter what you have done.  The key thing to remember is determining who is the customer with every project.  Sometimes it’s your boss, sometimes it’s the business, sometimes it’s actually an external corporate customer.  If you know who that is and you keep them happy, then you usually have a high probability that you will stay gainfully employed.

Well, we hope you have enjoyed listening to the seven ways world class CISOs set themselves up for success.  Let's recap:

1. They focus on building connections;
2. They leverage effective metrics programs that drive ownership and accountability;
3. They know effectiveness is more valuable than being competent at the executive level;
4. They are great communicators;
5. They align security initiatives with business objectives;
6. They create effective risk governance and management processes; and finally,
7. They practice the three tips to be successful in any job.

If you want to learn more great tips on being an effective CISO, please take a look at our GitHub Page which lists each of our podcast episodes under ten high-level topics.  Also note there’s a link to each of the episodes we mentioned in our show notes.   And finally, if you learned something that you like, please help us celebrate one hundred episodes of CISO Tradecraft by leaving us a 5-star review on your favorite podcast platform -- those ratings really help us reach other security leaders.  The more CISOs we can help, the more businesses we can protect.  This is your host, G. Mark Hardy.  Thanks again for listening and stay safe out there.

Episode 99 - Cyberwar and the Law of Armed Conflict with Larry Dietz

We bring you another episode from Naas, Ireland today speaking about cyberwar and the law of armed conflict with Larry Dietz, a retired US Army Colonel and practicing attorney. This is a follow-up to Episode 98, where we cover the Tallin Manual, discover a surprise resource on cyber conflict hosted by the Red Cross, examine what critical infrastructure might be legitimate targets, and the importance for CISOs to establish relationships with law enforcement before things go bad.

References:

• https://ccdcoe.org/research/tallinn-manual/
• https://www.icrc.org/en/war-and-law/conduct-hostilities/cyber-warfare
• https://www.cisa.gov/critical-infrastructure-sectors
• https://www.secretservice.gov/contact/ectf-fctf
• https://psyopregiment.blogspot.com/

Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cybersecurity leader.  My name is G. Mark Hardy, and today we are going to discuss how nation state conflict and sponsored cyberattacks can affect us as non-combatants, and what we should be doing about it.  Even if you don't have operations in a war zone, remember cyber has a global reach, so don't think that just because you may be half a world away from the battlefield that someone is not going to reach out and touch you in a bad way.  So, listen for what I think will be a fascinating episode, and please do us a small favor and give us a "like" or a 5-star review on your favorite podcast platform -- those ratings really help us reach our peers.  It only takes a click -- thank you for helping out our security leadership community.

I'm not going to get into any geopolitics here; I'm going to try to ensure that this episode remains useful for quite some time.  However, since the conflict in Ukraine has been ongoing for over two hundred days, I will draw examples from that.

The ancient Chinese military strategist Sun Tzu wrote:

“If you know the enemy and know yourself, you need not fear the result of a hundred battles.  If you know yourself but not the enemy, for every victory gained you will also suffer a defeat.  If you know neither the enemy nor yourself, you will succumb in every battle.”

That's a little more detailed than the classic Greek aphorism, "know thyself," but the intent is the same even today.  Let me add one more quote and we'll get into the material.  Over 20 years ago, when he was Secretary of Defense, Donald Rumsfeld said:

"As we know, there are known knowns; there are things we know we know.  We also know there are known unknowns; that is to say we know there are some things we do not know.  But there are also unknown unknowns—the ones we don't know we don't know.  And if one looks throughout the history of our country and other free countries, it is the latter category that tends to be the difficult ones.

So, knowledge seems extremely important throughout the ages.  Modern governments know that, and as a result all have their own intelligence agencies.  Let's look at an example.  If we go to the CIA's website, we will see the fourfold mission of the Central Intelligence Agency:

1. Collecting foreign intelligence that matters
2. Producing objective all-source analysis
3. Conducting effective covert action as directed by the President
4. Safeguarding the secrets that help keep our nation safe.

Why do we mention this?  Most governments around the world have similar Nation State objectives and mission statements.  Additionally, it’s particularly important to understand what is wanted by "state actors" (note, I'll use that term for government and contract intelligence agents.).

What are typical goals for State Actors?  Let's look at a couple:

• Goal 1: Steal targeting data to enable future operations.  Data such as cell phone records, banking statements or emails allow countries to better target individuals and companies when they know that identifying information.  Additionally, targeting data allows Nation state organizations to understand how individuals are connected.  This can be key when we are looking for key influencers for targets of interest.  All targeting data should not be considered equal.  Generally, Banking and Telecom Data are considered the best for collecting so be mindful if that is the type of company that you protect.  State Actors target these organizations because of two factors:
  • The Importance of the Data is the first factor.  If one party sends a second party an email, that means there is a basic level of connection.  However, it’s not automatically a strong connection since we all receive emails from spammers.  If one party calls someone and talks for 10 minutes to them on a phone call, that generally means a closer connection than an email.  Finally, if one party sends money to another party that either means a really strong connection exists, or someone just got scammed.
  • The Accuracy of the Data is the second factor.  Many folks sign up for social media accounts with throw away credentials (i.e., fake names and phone numbers).  Others use temporary emails to attend conferences, so they don’t get marketing spam when they get home.  However, because of Anti Money Laundering (or AML) laws, people generally provide legitimate data to financial services firms.  If they don’t, then they risk not being able to take the money out of a bank -- which would be a big problem.
• A second goal in addition to collecting targeting data, is that State Actors are interested in collecting Foreign Intelligence.  Foreign Intelligence which drives policy-making decisions is very impactful.  Remember, stealing secrets that no one cares about is generally just a waste of government tax dollars.  If governments collect foreign intelligence on sanctioned activity, then they can inform policy makers on the effectiveness of current sanctions, which is highly useful.  By reporting sanctioned activity, the government can know when current sanctions are being violated and when to update current sanctions.  This can result in enabling new intelligence collection objectives.  Examples of this include:
  • A country may sanction a foreign air carrier that changes ownership or goes out of business.  In that case, sanctions may be added against different airlines.  This occurred when the US sanctioned Mahan Air, an Iran’s airline.  Currently the US enforces sanctions on more than half of Iran's civilian airlines.
  • A country may place sanctions on a foreign bank to limit its ability to trade in certain countries or currencies.  However, if sanctioned banks circumvent controls by trading with smaller banks which are not sanctioned, then current sanctions are likely ineffective.  Examples of sanctioning bank activity by the US against Russia during the current war with Ukraine include:
    • On February 27th sanctions were placed against Russian Banks using the SWIFT international payment systems
    • On February 28th, the Russian Central Bank was sanctioned
    • On March 24th, the Russian Bank Sberbank CEO was sanctioned
    • On April 5th, the US IRS suspended information exchanges with the Russian tax authorities to hamper Moscow’s ability to collect taxes.
    • On April 6th, the US sanctioned additional Russian banks.
  • These sanctions didn't just start with the onset of hostilities on 24 February 2022.  They date back to Russia's invasion of Crimea.  It's just that the US has turned up the volume this time.
  • If sanctions are placed against a country’s nuclear energy practices, then knowing what companies are selling or trading goods into the sanctioned country becomes important.  Collecting information from transportation companies that identify goods being imported and exported into the country can also identify sanction effectiveness.
• A third goal or activity taken by State Actors is covert action.  Covert Action is generally intended to cause harm to another state without attribution.  However, anonymity is often hard to maintain.
  • If we look at Russia in its previous history with Ukraine, we have seen the use of cyber attacks as a form of covert action.  The devastating NotPetya malware (which has been generally accredited to Russia) was launched as a supply chain attack.  Russian agents compromised the software update mechanism of Ukrainian accounting software M.E. Doc, which was used by nearly 400,000 clients to manage financial documents and file tax returns.  This update did much more than the intended choking off of Ukrainian government tax revenue -- Maersk shipping estimates a loss of $300 million.  FedEx around $400 million.  The total global damage to companies is estimated at around $10 billion.
  • The use of cyberattacks hasn’t been limited to just Russia.  Another example is Stuxnet.  This covert action attack against Iranian nuclear facilities that destroyed nearly one thousand centrifuges is generally attributed to the U.S. and Israel.

Changing topics a little bit, we can think of the story of two people encountering a bear.

Two friends are in the woods, having a picnic.  They spot a bear running at them.  One friend gets up and starts running away from the bear.  The other friend opens his backpack, takes out his running shoes, changes out of his hiking boots, and starts stretching.  “Are you crazy?” the first friend shouts, looking over his shoulder as the bear closes in on his friend.  “You can’t outrun a bear!”  “I don’t have to outrun the bear,” said the second friend.  “I only have to outrun you.”

So how can we physically outrun the Cyber Bear?

• We need to anticipate where the Bear is likely to be encountered.  Just as national park signs warn tourists of animals, there’s intelligence information that can inform the general public.  If you are looking for physical safety intelligence you might consider:
  • The US Department of State Bureau of Consular Affairs.  The State Department hosts a travel advisory list.  This list allows anyone to know if a country has issues such as Covid Outbreaks, Civil Unrest, Kidnappings, Violent Crime, and other issues that would complicate having an office for most businesses.
  • Another example is the CIA World Factbook.  The World Factbook provides basic intelligence on the history, people, government, economy, energy, geography, environment, communications, transportation, military, terrorism, and transnational issues for 266 world entities.
  • Additionally you might also consider data sources from the World Health Organization and The World Bank
• If we believe that one of our remote offices is now at risk, then we need to establish a good communications plan.  Good communications plans generally require at least four forms of communication.  The acronym PACE or Primary, Alternate, Contingency, and Emergency is often used
  • Primary Communication: We will first try to email folks in the office.
  • Alternate Communication: If we are unable to communicate via email, then we will try calling their work phones.
  • Contingency Communication: If we are unable to reach individuals via their work phones, then we will send a Text message to their personal cell phones.
  • Emergency Communication: If we are unable to reach them by texting their personal devices, then we will send an email to their personal emails and next of kin.
• Additionally, we might purchase satellite phones for a country manager.  Satellite phones can be generally purchased for under $1,000 and can be used with commercial satellite service providers such as Inmarsat, Globalstar, and Thuraya.  One popular plan is Inmarsat’s BGAN.  BGAN can usually be obtained from resellers for about $100 per month with text messaging costing about fifty cents each and calls costing about $1.50 per minute.  This usually translates to a yearly cost of $1,500-2K per device.  Is $2K worth the price of communicating to save lives in a high-risk country during high political turmoil?  Let your company decide.  Note a great time to bring this up may be during use-or-lose money discussions at the end of the year.
• We should also consider preparing egress locations.  For example, before a fire drill most companies plan a meetup location outside of their building so they can perform a headcount.  This location such as a vacant parking lot across the street allows teams to identify missing personnel which can later be communicated to emergency personnel.  If your company has offices in thirty-five countries, you should think about the same thing, but not assembling across the street but across the border.  Have you identified an egress office for each overseas country?  If you had operations in Ukraine, then you might have chosen a neighboring country such as Poland, Romania, or Hungary to facilitate departures.  When things started going bad, that office could begin creating support networks to find local housing for your corporate refugees.  Additionally, finding job opportunities for family members can also be extremely helpful when language is a barrier in new countries.

If we anticipate the Bear is going to attack our company digitally, then we should also look for the warning signs.  Good examples of this include following threat intelligence information from:

• Your local ISAC organization.  ISAC or Information Sharing Analysis Centers are great communities where you can see if your vertical sector is coming under attack and share your experiences/threats.  The National Council of ISACs lists twenty-five different members across a wide range of industries.  An example is the Financial Services ISAC or FS-ISAC which has a daily and weekly feed where subscribers can find situational reports on cyber threats from State Actors and criminal groups.
• InfraGard™ is a partnership between the Federal Bureau of Investigation and members of the private sector for the protection of US Critical Infrastructure.  Note you generally need to be a US citizen without a criminal history to join
• AlienVault offers a Threat Intelligence Community called Open Threat Exchange which grants users free access to over nineteen million threat indicators.  Note AlienVault currently hosts over 100,000 global participants, so it’s a great place to connect with fellow professionals.
• The Cybersecurity & Infrastructure Security Agency or CISA also routinely issues cybersecurity advisories to stop harmful malware, ransomware, and nation state attacks.  Helpful pages on their websites include the following:
  • Shields Up which provides updates on cyber threats, guidance for organizations, recommendations for corporate Leaders and CEOs, ransomware responses, free tooling, and steps that you can take to protect your families.
  • There’s even a Shields Technical Guidance page with more detailed recommendations.
  • CISA routinely puts out Alerts which identify threat actor tactics and techniques.  For example, Alert AA22-011A identifies how to understand and mitigate Russian State Sponsored Cyber Threats to US Critical Infrastructure.  This alert tells you what CVEs the Russian government is using as well as the documented TTPs which map to the MITRE ATT&CK™ Framework.  Note if you want to see more on the MITRE ATT&CK mapped to various intrusion groups we recommend going to attack.mitre.org slant groups.
  • CISA also has notifications that organizations can sign up for to receive timely information on security issues, vulnerabilities, and high impact activity.
  • Another page to note on CISA’s website is US Cert.  Here you can report cyber incidents, report phishing, report malware, report vulnerabilities, share indicators, or contact US Cert.  One helpful page to consider is the Cyber Resilience Review Assessment.  Most organizations have an IT Control to conduct yearly risk assessments, and this can help identify weaknesses in your controls.

Now that we have seen a bear in the woods, what can we do to put running shoes on to run faster than our peers?  If we look at the CISA Shield Technical Guidance Page we can find shields up recommendations such as remediating vulnerabilities, enforcing MFA, running antivirus, enabling strong spam filters to prevent phishing attacks, disabling ports and protocols that are not essential, and strengthening controls for cloud services.  Let’s look at this in more detail to properly fasten our running shoes.

• If we are going to remediate vulnerabilities let’s focus on the highest priority.  I would argue those are high/critical vulnerabilities with known exploits being used in the wild.  You can go to CISA’s Known Exploited Vulnerabilities Catalog page for a detailed list.  Each time a new vulnerability gets added, run a vulnerability scan on your environment to prioritize patching.
• Next is Multi Factor Authentication (MFA).  Routinely we see organizations require MFA access to websites and use Single Sign On.  This is great -- please don’t stop doing this.  However, we would also recommend MFA enhancements in two ways.  One, are you using MFA on RDP/SSH logins by administrators?  If not, then please enable immediately.  You never know when one developer will get phished, and the attacker can pull his SSH keys.  Having MFA means even when those keys are lost, bad actor propagation can be minimized.  Another enhancement is to increase the security within your MFA functionality.  For example, if you use Microsoft Authenticator today try changing from a 6 digit rotating pin to using security features such as number matching that displays the location of their IP Address.  You can also look at GPS conditional policies to block all access from countries in which you don’t have a presence.
• Running antivirus is another important safeguard.  Here’s the kicker -- do you actually know what percentage of your endpoints are running AV and EDR agents?  Do you have coverage on both your Windows and Linux Server environments?  Of the agents running, what portion have signatures updates that are not current?  How about more than 30 days old.  We find a lot of companies just check the box saying they have antivirus, but if you look behind the scenes you can see that antivirus isn’t as effective as you think when it’s turned off or outdated.
• Enabling Strong Spam Filters is another forgotten exercise.  Yes, companies buy solutions like Proofpoint to secure email, but there’s more that can be done.  One example is implementing DMARC to properly authenticate and block spoofed emails.  It’s the standard now and prevents brand impersonation.  Also please consider restricting email domains.  You can do this at the very top.  Today, the vast majority of legitimate correspondents still utilize one of the original seven top-level domains:  .com, .org, .net, .edu, .mil, .gov, and .int, as well as two-letter country code top-level domains (called ccTLDs).  However, you should look carefully at your business correspondence to determine if communicating with all 1,487 top-level domains is really necessary.  Let’s say your business is located entirely in the UK.  Do you really want to allow emails from Country codes such as .RU, .CN, and others?  Do you do business with .hair, or .lifestyle, or .xxx?  If you don’t have a business reason for conducting commerce with these TLDs, block them and minimize both spam and harmful attacks.  It won’t stop bad actors from using Gmail to send phishing attacks, but you might be surprised at just how much restricting TLDs in your email can help.  Note that you have to be careful not to create a self-inflicted denial of service, so make sure that emails from suspect TLDs get evaluated before deletion.
• Disabling Ports and Protocols is key since you don’t want bad actors having easy targets.  One thing to consider is using Amazon Inspector.  Amazon Inspector has rules in the network reachability package to analyze your network configurations to find security vulnerabilities in your EC2 Instances.  This can highlight and provide guidance about restricting access that is not secure such as network configurations that allow for potentially malicious access such as mismanaged security groups, Access Control Lists, Internet Gateways, etc.
• Strengthening Cloud Security- We won’t go into this topic too much as you could spend a whole talk on strengthening cloud security.  Companies should consider purchasing a cloud security solution like Wiz, Orca, or Prisma for help in this regard.  One tip we don’t see often is using geo-fencing and IP allow-lists.  For example, one new feature that AWS recently created is to enable Web Application Firewall protections for Amazon Cognito.  This makes it easier to protect user pools and hosted UIs from common web exploits.

Once we notice there’s likely been a bear attack on our peers or our infrastructure, we should report it.  This can be done by reporting incidents to local governments such as CISA or a local FBI field office, paid sharing organizations such as ISAC, or free communities such as AlienVault OTX.

Let's walk through a notional example of what we might encounter as collateral damage in a cyberwar.  However, to keeps this out of current geopolitics, we'll use the fictitious countries Blue and Orange.

Imagine that you work at the Acme Widget Corporation which is a Fortune 500 company with a global presence.  Because Acme manufactures large scale widgets in their factory in the nation of Orange, they are also sold to the local Orange economy.  Unfortunately for Acme, Orange has just invaded their neighboring country Blue.  Given that Orange is viewed as the aggressor, various countries have imposed sanctions against Orange.  Not wanting to attract the attention of the Orange military or the U.S. Treasury department, your company produces an idea that might just be crazy enough to work.  Your company is going to form a new company within Orange that is not affiliated with the parent company for the entirety of the war.  This means that the parent company won’t provide services to the Orange company.  Additionally, since there is no affiliation between the companies then the legal department advises that there will not be sanction evasion activity which could put the company at risk.  There’s just one problem.  Your company has to evict the newly created Orange company (Acme Orange LLC) from its network and ensure it has the critical IT services to enable its success.

So where do we start?  Let’s consider a few things.  First, what is the lifeblood of a company?  Every company really needs laptops and Collaboration Software like Office 365 or GSuite.  So, if we have five hundred people in the new Acme Orange company, that's five hundred new laptops and a new server that will host Microsoft Exchange, a NAS drive, and other critical Microsoft on premises services.

Active Directory: Once you obtain the server, you realize a few things.  Previous Acme admin credentials were used to troubleshoot desktops in the Orange environment.  Since exposed passwords are always a bad thing, you get your first incident to refresh all passwords that may have been exposed.  Also, you ensure a new Active Directory server is created for your Orange environment.  This should leverage best practices such as MFA since Orange Companies will likely come under attack.

Let’s talk about other things that companies need to survive:

• Customer relations management (CRM) services like Salesforce
• Accounting and Bookkeeping applications such as QuickBooks
• Payment Software such as PayPal or Stripe
• File Storage such as Google Drive or Drop Box
• Video Conferencing like Zoom
• Customer Service Software like Zendesk
• Contract Management software like DocuSign
• HR Software like Bamboo or My Workday
• Antivirus & EDR software

Standing up a new company’s IT infrastructure in a month is never a trivial task.  However, if ACME Orange is able to survive for 2-3 years it can then return to the parent company after the sanctions are lifted.

Let’s look at some discussion topics.

• What IT services will be the hardest to transfer?
• Can new IT equipment for Acme Orange be procured in a month during a time of conflict?
• Which services are likely to only have a SaaS offering and not enable on premises during times of conflicts?
• Could your company actually close a procurement request in a one-month timeline?

If we believe we can transfer IT services and get the office up and running, we might look at our cyber team's role in providing recommendations to a new office that will be able to survive a time of turmoil.

• All laptops shall have Antivirus and EDR enabled from Microsoft.
• Since the Acme Orange office is isolated from the rest of the world, all firewalls will block IP traffic not originating from Orange.
• SSO and MFA will be required on all logins
• Backups will be routinely required.

Note if you are really looking for effective strategies to mitigate cyber security incidents, we highly recommend the Australian Essential Eight.  We have a link in our show notes if you want more details.

Additionally, the ACME Orange IT department will need to create its own Incident Response Plan (IRP).  One really good guide for building Cyber Incident Response Playbooks comes from the American Public Power Association.  (I'll put the link in our show notes.)  The IRP recommends creating incident templates that can be used for common attacks such as:

• Denial of Service (DoS)
• Malware
• Web Application Attack (SQL Injection, XSS, Directory Traversal, …)
• Cyber-Physical Attack
• Phishing
• Man in the middle attack
• Zero Day Exploit

This Incident Response Template can identify helpful information such as

• Detection: Record how the attack was identified
• Reporting: Provide a list of POCs and contact information for the IT help desk to contact during an event
• Triage: List the activities that need to be performed during Incident Response.  Typically, teams follow the PICERL model.  (Preparation - Identification - Containment - Eradication - Recovery - Lessons Learned)
• Classification: Depending on the severity level of the event, identify additional actions that need to occur
• Communications: Identify how to notify local law enforcement, regulatory agencies, and insurance carriers during material cyber incidents.  Additionally describe the process on how communications will be relayed to customers, employees, media, and state/local leaders.

As you can see, there is much that would have to be done in response to a nation state aggression or regional conflict that would likely fall in your lap.  If you didn't think about it before, you now have plenty of material to work with.  Figure out your own unique requirements, do some tabletop exercises where you identify your most relevant Orange and Blue future conflict, and practice, practice, practice.  We learned from COVID that companies that were well prepared with a disaster response plan rebranded as a pandemic response plan fared much better in the early weeks of the 2020 lockdown.  I know my office transitioned to remote work for over sixty consecutive weeks without any serious IT issues because we had a written plan and had practiced it.  Here's another one for you to add to your arsenal.  Take the time and be prepared -- you'll be a hero "when the bubble goes up."  (There -- you've learned an obscure term that nearly absent from a Google search but well-known in the Navy and the Marine Corps.)

Okay, that's it for today's episode on Outrunning the Bear.  Let's recap:

• Know yourself
• Know what foreign adversaries want
• Know what information, processes, or people you need to protect
• Know the goals of state actors:
  • steal targeting data
  • collect foreign intelligence
  • covert action
• Know how to establish a good communications plan (PACE)
  • Primary
  • Alternate
  • Contingency
  • Emergency
• Know how to get out of Dodge
• Know where to find private and government threat intelligence
• Know your quick wins for protection
  • remediate vulnerabilities
  • implement MFA everywhere
  • run current antivirus
  • enable strong spam filters
  • restrict top level domains
  • disable vulnerable or unused ports and protocols
  • strengthen cloud security
• Know how to partition your business logically to isolate your IT environments in the event of a sudden requirement.