Listen Now

All links and images for this episode can be found on CISO Series https://cisoseries.com/we-recommend-a-know-the-right-people-certification/ There are so many fantastic certifications out there for security professionals. But we've found the one certification that will really help you land the right job really quickly, is to provide proof that you know some people at our company who can vouch for you. Remember, we are a business that operates on trust, not giving people their first chances in cybersecurity. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Jesse Whaley, CISO, Amtrak Thanks to our podcast sponsor, Adaptive Shield Adaptive Shield ensures companies gain control over their SaaS app security and prevents the misconfigurations and vulnerabilities that could lead to a leak or breach. Adaptive Shield connects to any app, continuously monitors all configurations, provides a complete picture of the company's SaaS estate, and enables quick remediation of any potential threats. In this week's episode Why is everybody talking about this now? Should cybersecurity professionals fight back rather than block and tackle? former US government cyber security chief Chris Krebs, has called on law enforcement and others to fight back against ransomware attackers. Krebs, suggested posting private information of the hackers, with malicious intent, AKA doxxing. "Hacking back" is dangerous as it's hard to determine the attacker, and you're essentially taking the law into your own hands, but Chris Krebs is recommending this, seeing that ransomware is the biggest threat. Dan Lohrmann of Security Mentor shared this article from the Financial Times and it drove a lot of debate. We've heard this before, but from someone like Chris Krebs, that's astonishing. What level of fighting back should people be comfortable with? Are we having communication issues? "I push back [on vendors] because I want depth and context from first contact," said John Keenan, director of Information Security, at Memorial Hospital at Gulfport. In this post on LinkedIn he said he's annoyed with vendors' generic first outreach and when he declines their response is "Well, I had to give it a shot". If they want a real connection, include "What's In It for Me". A generic response of "I think you'll really like what we've got to show," does not qualify. Let's talk about who has ever received a first (or heck any) contact that did have depth and context and could clearly articulate the "what's in it for you" message. "What's Worse?!" This week's challenge is from Nir Rothenberg, CISO, Rapyd. How have you actually pulled this off? Hiring in cybersecurity is a bear. As we've discussed before on this show, there's actually plenty of supply and demand in cybersecurity, yet jobs are not getting filled, possibly because of unreasonable requirements. Let's talk about what percentage of all the ideal skills people are willing to accept in a new hire, and situations where someone was hired who didn't possess that must have-skill for the job. ? And also let's look at the most effective training or mentoring technique used to get employees to adopt those skills. Hey you’re a CISO. What’s your take? On Twitter, Alyssa Miller AKA @alyssaM_InfoSec asked: "You're the CISO, rank the priority of the following list from a security perspective and explain your reasons: A. A well-defined vulnerability management program B. A reliable configuration management database/Asset Inventory C. A comprehensive metrics and reporting practice. A slight majority voted BAC or asset management, vulnerability management, then metrics. But there was plenty of disagreement. Let's look at that.        

All links and images for this episode can be found on CISO Series https://cisoseries.com/my-backup-plan-is-hoping-my-cloud-provider-has-a-backup-plan/ I think maybe I should check to see if we paid for cloud backup protection. Or maybe, we're doing it. Who knows? This episode is hosted by me, David Spark (@dspark), producer of CISO Series, and Mike Johnson. Our guest this week is Ty Sbano (@tysbano), chief security and trust officer, Sisense Thanks to our podcast sponsor, Adaptive Shield Adaptive Shield ensures companies gain control over their SaaS app security and prevents the misconfigurations and vulnerabilities that could lead to a leak or breach. Adaptive Shield connects to any app, continuously monitors all configurations, provides a complete picture of the company's SaaS estate, and enables quick remediation of any potential threats. On this week's episode Why is everybody talking about this now? Is your cloud service provider backing up your data, or should you be doing that? Many users of OVHcloud realized they should have been doing it because they didn't realize what they had bought. OVH suffered a fire that destroyed one of its data centers making some of the customer data unrecoverable. They had backup of some services, but no backups of other data. As of now, OVH is backing up all customer data for free, but this speaks to a big problem with trusting cloud providers, noted Enrico Signoretti of GigaOm in a post on LinkedIn. Did you pay for backups? How are they being provided? Where physically are they? And how often do you test restoring? Everyone knows they should do this, but how often is it actually being done? Someone has a question on the AskNetSec subreddit On the AskNetSec subreddit, the question was asked, "What's the advantage of reporting bugs to official sources over brokers?" Some really good pro and con discussions of both ranged from brokers usually pay more, to going straight to the source seems "the right thing to do." But there were so many variances that it wasn't that cut and dry. As a bug bounty hunter, if you find a significant bug, where should you go first?  "What's Worse?!" Rick Woodward from Gibbs & Cox asks, "which kind of dishonesty is the worst?" Hey you’re a CISO, what’s your take? Another redditor on the AskNetSec subreddit asks, what kinds of questions should the interviewee ask about a company's environment so they know they're not walking into a giant mess? There were a ton of good suggested questions in the thread. If you could only ask three, which three would you ask that would give you the most information about both the stability and challenge of the security environment? What would you advise? Ross Young asked, I want to be a board advisor, how am I going to be paid? How much effort do I want to spend on this? What compensation should I expect? What do companies expect a CISO as an advisor to do? You both are advisors, so what's your experience, advice, and what have you heard from others?  

All links and images for this episode can be found on CISO Series https://cisoseries.com/patches-yes-we-need-stinkin-patches/ There was a time we could trust a patch, but now our adversaries are actually looking at the patches to find even more vulnerabilities. And we keep patching those as well. Our patches' patches need patches. When does it stop?! This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Travis Hoyt (@travisehoyt), managing director, exec cybersecurity technology, TIAA Thanks to our podcast sponsor, Adaptive Shield Adaptive Shield ensures companies gain control over their SaaS app security and prevents the misconfigurations and vulnerabilities that could lead to a leak or breach. Adaptive Shield connects to any app, continuously monitors all configurations, provides a complete picture of the company's SaaS estate, and enables quick remediation of any potential threats. On this week's episode What’s the best way to handle this The vulnerability landscape is changing, according to a new report from Rapid7. One issue, as Rob Lemos of DarkReading reports, is that you can't necessarily trust patches. They're often incomplete, and attackers look at existing patches as an opportunity to find more flaws, which they do. And the threats come from different angles: they're widespread, targeted, often using a zero-day, and there are other vulnerabilities that are impending threats. It seems that the portion of the threats you know about and can defend against is shrinking, and you're battling more of the unknown. Have you seen similar, and if so how has your security program shifted as a result? That’s something I would like to avoid The NSA recently provided guidance on creating a Zero Trust security model. In the piece, the NSA says, "transitioning to a [zero trust] system requires careful planning to avoid weakening the security posture along the way." So what is the NSA talking about? What are common transitioning moves to zero trust that can make you vulnerable? "What's Worse?!" Jonathan Waldrop from Insight Global delivers a challenge specifically tailored for Mike. Please, Enough. No, More. Let's look at SaaS posture management, or just the ongoing management of potential issues that may come across SaaS platforms - and consider what we have heard enough about with regard to SaaS posture management, and what we would like to hear a lot more about. Umm is this a good idea OSINT should go beyond finding out a security practitioner's email and phone number, argued Alyssa Miller of S&P Global Ratings. Alyssa received an email pitch from a vendor offering a gift and she declined. That same vendor then followed up and called her. The vendor was pitching her something that wasn't in her department, that she had no control of, and she couldn't accept gifts because her company is in a heavily regulated market. In summary, Alyssa said if you're going to use OSINT, understand the person's business, their role, and if making such a request would be counterproductive. What types of vendor OSINT tactics work well and what types work poorly?      

All links and images for this episode can be found on CISO Series https://cisoseries.com/i-think-possibly-maybe-weve-solved-diversity-in-cybersecurity/ We're tired of hearing "we're trying" when it comes to the subject of how companies are trying to inject diversity into their organizations. It's a lopsided game and diverse candidates have to make ten times the number of attempts as their non-diverse counterparts. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Jimmy Sanders (@jfireluv), cybersecurity, Netflix DVD. Our guest this week is Jerich Beason (@blanketSec), svp, CISO, Epiq. Thanks to our podcast sponsor, Living Security Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change. This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers. On this week's episode How have you actually pulled this off? As discussed before on this show, being the next CISO at a company that was recently breached can be very lucrative. We've had guests that have very successfully negotiated huge salaries as the post-breach CISO. Are CISOs setting themselves up for far too much responsibility to be seen as a the company's digital savior? What are the responsibilities of a post breach CISO? Got a better answer than "we're trying?" Over the years we have interviewed dozens of business owners, security professionals, and hiring managers about diversity. Almost all their answers fall into the following buckets: We're trying but there's no pipeline. We're working with XXX group to improve. Diversity is needed because diversity of thought it needed to create a more secure organization. No one will admittedly say they're against diversity. Yet systemic racism, sexism, or just boys' clubism in general continues to exist. It appears most of the non-diverse business leaders are being pressured into admitting it's a problem. So they do it, and we even get token hires, but it all comes off as diversity theater and not the business actually making a shift. What is the story of diversity in cybersecurity many people don't get and need to actually be doing, not just giving lip service to? "What's Worse?!" Eugene Kogan, CSO at a confidential company sets it up: Who do you want on our side: executives or employees? And now a listener drops knowledge "Learn cybersecurity in public," suggests AJ Yawn of ByteChek who recommends joining a training program and then publishing what you've learned on a blog. As AJ explains, "Doing this will help you build relationships & prove to potential employers you’re applying your new knowledge." He concludes with the advice, "Don’t learn in silence." The community responded to AJ's advice. It's great advice, which everyone agreed to in the comments, but why then do so few people actually do it? There’s got to be a better way to handle this Zero trust is not a technology that can be purchases as a solution. It's an architecture, methodology, and framework that you have to consciously adopt, noted Stephen Lyons of F5 on a post on LinkedIn. Can solutions already in-house be rejiggered to adopt a zero trust methodology? And if so, what changes would need to be made to existing systems to have a more zero trust environment?

All links and images for this episode can be found on CISO Series https://cisoseries.com/unnecessary-research-reveals-cisos-hate-cold-calls/ In a study we never actually conducted, our fellow security leaders said unequivocally that there never has been a time they welcome a phone call from someone they don't know trying to book a demo to see a product they have no interest in. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Andy Steingruebl (@asteingruebl), CISO, Pinterest. Our guest this week is Andy Purdy (@andy_purdy), CSO, Huawei Thanks to our podcast sponsor, Living Security Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change. This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers. On this week's episode Here’s some surprising research As compared to small and medium companies, big enterprises don't appear to trust the big telcos to execute their 5G strategy. This according to new research from Omdia as reported by Iain Morris of Light Reading. When asked, "do you trust a communications service provider, AKA big telco, to execute your security strategy," SMEs overwhelmingly supported the telcos over all other options, and big enterprises didn't. They trusted their own expertise or wanted to lean on a cloud service provider like Amazon or Google. Let's investigate this discrepancy. If you're not paranoid yet here’s your chance As if you didn't know it already, get ready for some sobering news about third-party risk: According to a survey by BlueVoyant, as reported by SC Magazine, 80 percent of those surveyed had at least one breach caused by a third party vendor within the past year. Most of those surveyed didn’t monitor third-party suppliers for cyber risk. But, even if they wanted to, it's often a point in time measurement, sometimes only yearly, and organizations have an average of 1409 vendors. UK's National Cyber Security Center puts the focus of securing against third party risk squarely on the development of the software supply chain, and the need for isolation and proven security checks throughout the development process. That may be good advice, but it still seems so overwhelming given the volume and how much you can't control. "What's Worse?!" A vulnerability response and incident detection conundrum from Jonathan Waldrop, Insight Global What’s the best way to handle this Lessons learned from a big security incident and how these will be applied to the next big security incident. What do you think of this vendor marketing tactic Very few, if any, security leaders like cold calls. Yet, even with all the expressed distaste of them, they still exist, and that's probably because they still work, and still deliver significant ROI. But when these companies calculating that ROI, are they calculating all the people they've annoyed? One vendor sales rep who said after searching their CRM for "Do Not Call" there was a slew of vitriol from CISOs screaming to never contact them again. And as we all know, CISOs talk to other CISOs. So if you've angered one CISO sufficiently to never consider you, they've probably told a few friends as well. Let's discuss getting pushed over the edge by a vendor's aggressive sales tactics and what was done to essentially shut them off, including telling others about their actions.    

All links and images for this episode can be found on CISO Series https://cisoseries.com/one-day-youll-grow-up-to-know-less-than-you-do-now We know so little when we're born. We're just absorbing information. But then we get older, and get the responsibility to secure the computing environment of a large company, we actually see that knowledge we absorbed start slipping away. What we thought we knew of what's in our network is so far afield from reality. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Tomás Maldonado (@tomas_mald), CISO, NFL. Thanks to our podcast sponsor, Nucleus Security Nucleus unifies your existing security stack, integrating with over 70 scanners and external tools, creating a centralized hub to control the chaos of vulnerability analysis, triage, and remediation. Ready to make the tedious VM process simple through smart automation and workflow optimization? See for yourself at https://nucleussec.com/demo It’s time to measure the risk Outside of security basics and popular controls like SSO, MFA, and password management, what are the most effective means (or security control) to reduce risk? People have been offering some great suggestions on LinkedIn such as reducing attack surface, knowing what you're protecting, education, more conversations about risk, and actually having someone in charge of security and risk. All reduce risk, but what truly gives the biggest bang for the buck in terms of risk reduction? Are we making this situation better or worse? When things break, what's the best tactic to remediation? A bigger/better version of the last thing, or critical thinking? Both actually have serious costs associated to them. The first being equipment and maintenance, and the second having the talent that's able to think of unique and innovative soluitons. In a post on LinkedIn, Greg van der Gaast of cmcg argues that bigger walls just result in continued security problems at a more expensive, yet slower rate. He argues many issues could be avoided with critical examination, especially in IT. It's time to play, "What's Worse?!" Ross Young asks how badly do you need to measure your security program. How would you handle this situation? Our guest, Tomás Maldonado, describes what's unique about being a CISO for the NFL - the specific security concerns that aren't necessarily on the radar at his previous organizations, and the security issues around huge global events like the Super Bowl. Well that didn’t work out the way we expected Perception vs. reality in security. On LinkedIn, Ross Young, CISO at Caterpillar Financial Services said, "In April 2018, McAfee published a survey asking 1,400 IT professionals to estimate the number of cloud services in use within their organization. The average response was 31, with only 2% of respondents believing that they had more than 80—yet the real average is 1,935." This supports the great need of asset inventory. There are many instances CISOs have to make an estimate of what they have given the best information. We look at examples of when the reality of a situation was far from the initial perception, and how to manage this.

All links and images for this episode can be found on CISO Series https://cisoseries.com/would-you-look-at-that-unrealistic-licensing-deal/  CISOs know that salespeople want to make the best licensing deal they can possibly get. But unpredictability in the world of cybersecurity makes one-year licensing deals tough, and three-year licensing deals impossible. This episode is hosted by David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Mark Eggleston, (@meggleston) CISO, Health Partners Plans. This recording was recorded live in front of a virtual audience at the "SecTalks - Leading with grit in security" virtual conference brought to you by our sponsor, Cobalt. Thanks to our podcast sponsor, Cobalt Cobalt offers a faster more effective pentesting solution through its Pentest as a Service (PtaaS) platform. With it, you can schedule a pentest in as little as 24 hours for all kinds of assets. The platform also connects you with a global pool of pentesters called the Cobalt Core, whose skills can match what you need. And instead of sending you a huge PDF that raises more questions you can’t answer, they engage with your team throughout the pentest. Findings can land straight into Jira and GitHub, helping you fix vulnerabilities as soon as they’re discovered. Cobalt makes pentesting easy, quick to deploy, scalable, and simple to remediate. On this week's episode Why is everybody talking about this now? A redditor is struggling and overwhelmed! The person is in school studying, working, and loving cybersecurity, but has completely and utterly failed the foundations course and is on academic probation. The person told their story to the cybersecurity subreddit community, and the support came out in droves. We've seen this before. People hit a major wall professionally and they just reach out to the anonymous masses for support. The story hits a nerve and the community is eager to show encouragement. In fact, just this past week, the New York Times had an article about the unemployment subreddit offering advice and information to those struggling. We'll take a look at this tactic of reaching out for support and guidance through discussion boards. What do you think of this vendor marketing tactic? "Pro tip to vendors: don’t claim that you can’t do a one-year licensing deal. You might end up with a zero-year license deal", said Ian Amit, CSO, Cimpress on LinkedIn. We'll look at the art of negotiating a contract with a vendor: What is it ultimately you want? What are you willing to concede on and what must you have? And what are the situations that cause this to change? It's time to play, "What's Worse?!" Jason Dance of Greenwich Associates suggests two scenarios that others believe is security, but actually isn't. If you haven’t made this mistake, you’re not in security On Twitter, the CISO of Twitter, Rinki Sethi, said, "A career mistake I made, I rolled out a phishing testing program before the company was ready for it. The HR team said it was against the company culture and if I tried a trick like that again, I would be fired. Lesson - communication is important in #cybersecurity." Rinki asked for others' stories of failure. Let's explore a few. What Is It and Why Do I Care? For this week's game, the topic is vulnerability management. We look at four pitches from four different vendors. Contestants must first answer what "vulnerability management" is in 25 words or less, and secondly must explain what's unique about their vulnerability management solution. These are based on actual pitches - company names and individual identities are hidden. The winners will be revealed at the end.  

All links and images for this episode can be found on CISO Series https://cisoseries.com/this-is-the-year-im-going-to-lose-weight-and-care-about-security/ Every year I say I'm going to do it. I'm going to get healthy and be much better about securing my digital identity and my data. But then after about two weeks I give up, use the same password across multiple accounts, and eat a pint of Häagen-Dazs. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Dan Walsh, CISO, VillageMD. Our sponsored guest this week is Drew Rose, (@livsecaware)CSO, Living Security Thanks to our podcast sponsor, Living Security Traditional approaches to security communication are limited to one-off training sessions that fail to take customers, regulators, and other external stakeholders into account and rarely affect long-term behavioral change. This report lays out a four-step plan that CISOs should follow to manage the human risk. It provides design principles for creating transformational security awareness initiatives which will win the hearts and minds of senior executives, employees, the technology organization, and customers. On this week's episode What would you advise? Over on the AskNetSec subreddit, a pentester wants out. The redditor is looking for exit opportunities into another job in cybersecurity. Other redditors suggested IT audit, SOC operations, incident response, forensics. What would be an ideal next step for a pentester? We don’t have much time. What’s your decision? What happens when a previous employer of yours gets hacked and your information is potentially stolen. This happened to a redditor who asked this question on the cybersecurity subreddit. If nothing has actually happened, what can they do and what can potentially happen? Is a warning of "I may be compromised" to anyone going to do anything? "What's Worse?!" Jason Dance of Greenwich Associates delivers a really annoying "What's Worse?!" scenario. Please, Enough. No, More. The topic is "Security Awareness Training". David prefaces this with a top finding from a Forrester report that said, "Unless You Capture Hearts And Minds, No Amount Of Training Will Work". So with that said, what have people heard enough about with regard to security awareness training and what would they like to hear a lot more? Pay attention. It’s security awareness training time What if security behavior was rated as a performance score, suggested Ashish Paliwal of SONY. In his LinkedIn article, he agreed you can't train yourself to better security. It requires positive reinforcement. He suggested psychometric tests and a scoring system where you would gain points for good security behavior and lose points for bad security behavior (-10 for clicking on a phish, +10 for reporting). Creative ideas that he acknowledges have lots of challenges. The focus here is changing human behavior, possible the hardest feature to implement. What user experience does change behavior? And why would or why wouldn't Ashish's suggestions work?

All links and images for this episode can be found on CISO Series https://cisoseries.com/please-accept-this-not-a-bribe-gift-as-an-act-of-desperation/ Offering me a gift for a meeting was definitely not Plan A. Or was this a situation that you ran out of creative ideas and it's actually more cost efficient to buy your way into meeting with me? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is John Overbaugh, (@johnoverbaugh) vp, security, CareCentrix. Thanks to our podcast sponsor, Nucleus Security Nucleus unifies your existing security stack, integrating with over 70 scanners and external tools, creating a centralized hub to control the chaos of vulnerability analysis, triage, and remediation. Ready to make the tedious VM process simple through smart automation and workflow optimization? See for yourself at https://nucleussec.com/demo. On this week's episode OK, what’s the risk? People hear all too often that risk security isn't compliant security and vice versa, but isn't compliance just another form of risk? Shouldn't it be given quantitative and qualitative ratings like any other risk, prioritized, and remediated especially in highly regulated environments? Why is everyone talking about this now? On LinkedIn, LinkedIn CISO, Geoff Belknap asked, "Tech Vendors: Please, stop offering cash or gift cards for meetings. It throws into question the entire basis for a relationship and It's not ethical." Vendors take CISOs out for lunch all the time. That is a form of a gift. One vendor said because they can't take a CISO out they send a Starbucks card in lieu of the coffee they were going to purchase. Then there are the gifts that arrive for attending an event. Edward Kiledjian at OpenText, said, "I recently had a vendor get upset with me that I wasn't willing to accept his gifts. He said others in my position accept it and he couldn't understand why I was being so 'stubborn.'" How should this situation be handled and does a CISO's opinion of the vendor change as a result? "What's Worse?!" David tried to second guess Mike and was wrong on this bad idea from Jesse Whaley, CISO, Amtrak. If you haven’t made this mistake you’re not in security When Zero Day bugs arrive, security flaws just keep perpetuating. Garrett Moreau of Augury IT posted an article from MIT Technology Review about Google's research finding that when patches are released for zero days, they're often incomplete. Hackers can actually find the vulnerability sitting on the next line of code right next to the patched line of code, making it very easy for a hacker to reignite the zero day vulnerability. How can this problem stop perpetuating itself? Someone has a question on the cybersecurity subreddit A frustrated redditor eager to learn cybersecurity is getting stuck on CTFs (Capture the Flags ) and is losing the motivation as a result. The person is worried that relying on walkthroughs will be harmful. Responses from the reddit community were that the walkthroughs are there to help people learn, and that most CTFs don't resemble real life. They're there to teach a few tricks. So, is that the case?

All links and images for this episode can be found on CISO Series https://cisoseries.com/foul-that-interview-question-is-unfair/ Pick a side. You either want your employees to have a work/life balance, or you want them to be obsessed with security 24/7. You can't have both. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Arpita Biswas, (@0sn1s) senior incident response engineer, Databricks Thanks to our podcast sponsor, StackRox StackRox is the industry’s first Kubernetes-native security platform that enables organizations to securely build, deploy, and run cloud-native applications anywhere. The StackRox Kubernetes Security Platform delivers lower operational cost, reduced operational risk, and greater developer productivity through a Kubernetes-native approach that supports built-in security across the entire software development lifecycle. What would you advise? People speak a lot about the importance of integrating security and DevOps. Now it's time to learn some specifics, like how to energize developers to be more security minded in their development. What works? What hasn't worked? "What's Worse?!" You just learned something was breached. Uggh. (Thanks to Mike Toole, Censys) What’s the best way to handle this ? What questions should be asked to see if a security team is cloud incident ready? A good article over on F5 by Sara Boddy, Raymond Pompon, and Sander Vinberg, provides some suggestions such as "Can you describe our attack surface and how have you reduced it to the bare minimum?" and "How are we managing access control?" and "What do we do when systems or security controls fail?" Which of the questions is the most revealing to cloud security readiness and why? Should you ignore this security advice? On the AskNetSec subreddit someone inquired about a good hiring question. One redditor suggested asking "What do you do on your own home network with respect to security?" to which another redditor argued that the question was unfair. He left the security and networking for work. He had other hobbies and interests for home life. Another person said, yes it is unfair, but there are plenty of candidates who do breathe security 24/7 and if given a choice, the redditor would take that person. The politically correct thing to say is you want the person with the work-life balance, but wouldn't we be more impressed with the person who has security in their blood day and night? Close your eyes and visualize the perfect engagement Another question on AskNetSec subreddit asked "What are the most important skills you see missing among other coworkers or your team?" The two most common answers I saw on the thread were communications and critical thinking. Are these correct. or should something else go there? ? And if those two did improve, what would be the resulting effect to a company's security program?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/why-do-we-fire-the-ciso-tradition/) Yes, firing the CISO probably won't solve our security issues. But our community has a multi-generational heritage of relying on scapegoats to make them feel good about their decisions. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Kirsten Davies (@kirstendiva), CISO, Estee Lauder Companies. Thanks to our podcast sponsor, Kenna Security With Kenna Security, companies efficiently manage the right level of risk for their business. Our Modern Vulnerability Management model eliminates the friction between Security and IT teams about what to patch, providing clear prioritization based on real-time threat intelligence and guidance applied to each customer’s unique environment across infrastructure, applications and IoT. Why is everybody talking about this now? On the AskNetSec subreddit one redditor asked, "Why do people always get fired over a breach?" to which one responded, like many others, "it’s just tradition. Military, government, corporations. It’s an old-fashioned thing really, but a lot of people still believe a 'blood sacrifice' is required to restore faith from the public or the shareholders." How tenable is it to keep doing this with so many breaches? After a breach what are the different actions needed to appease shareholders, executives, employees, and customers? And when is blood letting warranted? How to become a CISO Over on the CISOseries subreddit, a hopefully soon-to-be-CISO asked, "What should I ask before being a CISO at a startup?" This startup is pre-IPO. 2000 employees. About $1B in valuation. The redditor is looking for advice beyond asking what's the current security strategy and what the reporting structure would look like. What would you want to ask in such a situation? "What's Worse?!" Probably the ultimate "What's Worse?!" scenario. Hey you’re a CISO. What’s your take? On LinkedIn, Kris Rides asked, "If you can only do one thing to retain your staff what would that be?" What have you done and has any of your staff let you know that certain actions you took meant a lot to them. According to research from leadership consulting firm DDI, 57 percent of employees who walk out the door, do so because they can't stand their boss. For that reason, the pressure is heavily on the CISO to make sure they're well-liked by their staff. There’s got to be a better way to handle this Can you think of a moment you had to make a significant shift in your security program? What did you do and why? Was there a specific event that triggered it?  

All links and images for this episode can be found on CISO Series (https://cisoseries.com/click-this-link-to-fail-a-phishing-test/) Our phishing tests are designed to make you feel bad about yourself for clicking a link. We're starting to realize these tests are revealing how insensitive we are towards our employees. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Yaron Levi, (@0xL3v1) former CISO, Blue Cross Blue Shield of Kansas City. Thanks to this week’s podcast sponsor, Stackrox StackRox is the industry’s first Kubernetes-native security platform that enables organizations to securely build, deploy, and run cloud-native applications anywhere. The StackRox Kubernetes Security Platform delivers lower operational cost, reduced operational risk, and greater developer productivity through a Kubernetes-native approach that supports built-in security across the entire software development lifecycle. Is this a cybersecurity disinformation campaign? On reddit, an explosive discussion formed around a ComputerWeekly.com article by Saj Huq of Plexal about the importance of making disinformation a security issue. The problem though has primarily fallen into the hands of social media companies mostly because that's where disinformation spreads. While we've seen disinformation being used as a political tool, for businesses, it can tarnish your corporate brand, consumer trust, and ultimately the value of your product. It's also used in phishing campaigns. Breaches are compromising your data. Disinformation is questioning the validity and value of data without even stealing it. How do you combat that? Are we having communication issues? We're recording this episode shortly after GoDaddy sent its infamous phishing test email that promised employees a $650 bonus check. Those who clicked on the email were rewarded with additional security training. It took the entire Internet to point out how insensitive this was, GoDaddy's response was "We understand some employees were upset by the phishing attempt and felt it was insensitive, for which we have apologized." They argued that while it may be insensitive, these types of well-timed phishing emails do happen. A lot of people do not like phishing tests and Yaron has proven that if creative enough, anyone can fall for a phish. How can the company and security be more sensitive to employees, respect them, while also letting them know they may receive a malicious email just like this? "What's Worse?!" An international What's Worse conundrum. How do you go about discovering new security solutions? Julia Wool, Evolve Security said, "I just finished a Splunk course and wanted to explore other SIEM platforms and I am having a difficult time understanding how an enterprise should choose a vendor in this space. I couldn't imagine being the guy at an enterprise that has to consider all these different vendors that seem to be doing the same thing." Julia brings up a really good concern: If you were completely green, didn't have CISO connections, and were going to choose a SIEM for the first time how would you go about determining your needs and then researching and deciding? What sources would you use? And how do you limit this effort so you're not overwhelmed? There’s got to be a better way to handle this Brian Fanny, Orbita, asks, "Vendor scope can change over time within a project or the start of another and harder to control than the initial evaluations. They start off when non-critical requirements/needs eventually grow into handing assets of greater value and/or gaining access to more critical systems. How do you keep up with vendor/project scope creep from the security sidelines?"

All links and images for this episode can be found on CISO Series https://cisoseries.com/our-hope-it-doesnt-happen-to-me-security-strategy/  We're thinking it just might be possible to wish our security problems away. This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Steve Giguere, (@_SteveGiguere_) director of solution architecture and community, StackRox. Thanks to this week’s podcast sponsor, Stackrox StackRox is the industry’s first Kubernetes-native security platform that enables organizations to securely build, deploy, and run cloud-native applications anywhere. The StackRox Kubernetes Security Platform delivers lower operational cost, reduced operational risk, and greater developer productivity through a Kubernetes-native approach that supports built-in security across the entire software development lifecycle. On this week's episode That’s something I would like to avoid Security theater is a security placebo. We're being told that it's effective, and we may fool ourselves into believing it is, but the reality is there's no real security medicine there. Over on Infosecurity Magazine, Danny Bradbury has identified a few key ones I want to call out. In particular, technology buzzwords - like getting a solution with AI, data collection - more data, more insights, right?, and endless security alerts - for practitioners and end users. All of these seem to be in regular practice today. Does calling out security theater result in pushback? And if so, how do you handle calling it out and how would you shift each of these security placebos into a more medicated version? There’s got to be a better way to handle this On reddit, kautica0 asks, "If a company becomes aware of a 0-day vulnerability and it impacts their production web application serving customers, what actions should be taken? Should it even be considered an incident?" Just because it's a 0-day vulnerability does that make it more threatening than any of the known vulnerabilities? There was a lot of logical advice that was akin to how we would handle any vulnerability, but the 0-day nature had the looming feeling of this could be an incident very quickly and would require an incident response plan. "What's Worse?!" A "What's Worse?!" entry from our youngest listener. Please, enough. No, more. The topic is Kubernetes Security. We discuss what we have heard enough about when it comes to Kubernetes security and what we would like to hear more. Where does a CISO begin Is being cloud first a security strategy? Over on the UK's National Cyber Security Centre, an article argues that we should not ask if the cloud is secure, but whether it is being used securely. What does that mean? And is there an argument for and against cloud first being a valid security strategy?  

All links and images for this episode can be found on CISO Series (https://cisoseries.com/hey-reseller-whats-the-value-youre-adding/) It seems that you're offering so much more when you add the VA ("value added") in front of your title. What is that? Why am I working with you rather than buying directly from the vendor? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is Doug Cahill (@dougcahill), vp, and group director, cybersecurity, Enterprise Strategy Group. Thanks to this week’s podcast sponsor, Dtex Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today’s organizations need and employees will embrace. Learn more at dtexsystems.com. On this week's episode How a security vendor helped me this week From Trevor Marcatte, The SCE Group, asks a question about the "value added reseller" or VAR vs. the "large account reseller" or LAR. I'm paraphrasing, but Trevor wants to know what we're seeing as the value of this middleman. Trevor said, "Being the middle man is tough and battling the big guys is tough. CDW's, SHI's of the world. The smaller guys have so much more to offer than a price. Price is dictated by the vendor anyways." What do the smaller VARs have to offer that the larger LARs can't offer? How do you go about discovering new security solutions How do we evaluate DevSecOps solutions? Mike hates the term, so I'll say how do we evaluate solutions that will improve the security of the DevOps pipeline? GigaOM Research has a report where they evaluate these solutions, but they also have another report that goes into detail on evaluation criteria. There is a lot of criteria such as seamless integration into tools, process, and dashboards, plus role-based access controls, automation driven by policy, management of secrets, and dependency analysis. What criteria do we look at? How does it change from company to company? And how do we supplement when a solution looks great, but misses a key criteria? "What's Worse?!" A question about DevSecOps. What’s the best way to handle this? Is cloud identity management going to stick? According to David Vellante over at Wikibon and The Cube, the pandemic has forced that shift for everyone and there's probably no turning back. For cloud-first companies this was business as usual before the pandemic. But what about all the new businesses that are going to the cloud and doing business with you. It's a very broad field and there are a lot of industry players, so actually skip the obvious stuff and just mention the items that have become sticking points or are still in need of development. Is this the best solution The "X" in XDR extends traditional endpoint detection and response or EDR to also include network and cloud sensors. We talked about this on our other podcast, Defense in Depth, and one of the issues came up was the disruptive nature of XDR. How much was real. David Thomas, Computacenter, said, "The aspiration to get fully integrated insights of all your tools and create the ultimate feedback loop responsive system is a worthy aim... Current vendor XDR pitches are up selling opportunities but customers have a challenge to adopt or shift to a single vendor platform due to a vast array of displace/replace challenges. It’s a great marketing story but the pragmatic reality is it’s a tough and long journey to realise the platform / single (pain) pane promise, unless you are a greenfield organisation." Is XDR a worthy goal and what is the marketing hype buyers should question?  

All links and images for this episode can be found on CISO Series (https://cisoseries.com/the-people-closest-to-you-will-hurt-you/) Insider threats. We know some are malicious, and sometimes it's the unwitting result of someone trying to do their job. Aren't you supposed to trust the people you hire? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Dr. Deanna Caputo, chief scientist for behavioral sciences and cyber security capabilities, senior principal behavioral psychologist for MITRE. Thanks to our sponsor, Dtex. Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today’s organizations need and employees will embrace. Learn more at dtexsystems.com. On this week’s episode What we've got here is failure to communicate Breaking News! The cybersecurity skills shortage is growing. The ISSA and Enterprise Strategy Group released a report claiming the reason that 70 percent of companies feel that they're at risk is because of the increased workload for cyber professionals, unfilled open job requisitions, and poor education on the relevant technologies. This discussion appeared on the cybersecurity subreddit and complaints ranged from entry level jobs asking for 3+ years experience (something we've discussed many times before), and people with many more years of experience struggling to find a job. Others who were contemplating entering cybersecurity said the discussion was turning them off from entering the field. There's supply and demand, yet there's frustration on both ends. Why aren't they connecting? What's going on?" Are we making this situation better or worse? What defines "usable security". We've discussed obvious things like trying to make it invisible to the user and just basic user experience. But what's unique to cybersecurity design that many don't consider when creating usable security. For example, for phishing there are an endless number of email programs AND we have lots of security awareness training. Could we do away with the awareness training if security was more usable? What's Worse?! Insider threats are no fun, but which one is the worst? Please, Enough. No, More. Topic is Insider Threats. What have we heard enough about with insider threats, and what would we like to hear a lot more? There’s got to be a better way to handle this What do you do after you get the certification? What are the next steps? Mo Shami reached out to me and mentioned that he was going to announce that he passed his CISSP or Certified Information Systems Security Professional exam. He wanted to share the excitement and I said when you post to LinkedIn ask everyone else what they did right after they passed. Most people ended up just saying congratulations, but a couple suggested more certifications or just research job openings (seems obvious). What should one do after you get the certification?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/when-should-you-stop-trusting-your-ciso/) How technically capable does my CISO need to be? If they lose their technical chops, should we stop trusting them? Should they even be a CISO if they had no technical chops to begin with? This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our guest this week is James Dolph, CISO for Guidewire Software. Thanks to our sponsor, Dtex. Traditional Employee Monitoring solutions are creepy. Capturing screenshots, recording keystrokes, monitoring web browsing and following social media activities is unnecessary and damages culture. DTEX InTERCEPT is the first and only solution that delivers the real-time workforce monitoring capabilities today’s organizations need and employees will embrace. Learn more at dtexsystems.com. On this week’s episode We mentioned past guest, Kelly Shortridge's new book with Aaron Rinehart, "Security Chaos Engineering". First 90 days of a CISO It's time for a CISO do-over. One of the great things about being a CISO is you get a chance to actually apply everything you learned from past jobs. Our guest, James, worked in product security with Salesforce before becoming a CISO. When we recorded the episode, James wasn't yet a full 90 days into his job. And Mike also came from Salesforce as well (they worked together) and working at Lyft was his first CISO job directly from Salesforce as well. Did they both have the same viewpoints of applying product security principles to the CISO role? How do you go about discovering new security solutions What criteria do you use to evaluate phishing solutions? GigaOM Research released a report earlier this year of the key criteria for evaluating phishing platforms. Some of the criteria they mentioned were phishing solutions that do and do not impede workflows, a security edge solution that's in-band vs. out-of-band, and do you need detonation chambers for potentially malicious emails. What criteria do Mike and James use to evaluate, and have they seen those criteria change from company to company? What criteria are not as important? What's Worse?! Failing as a professional or being a mediocre professional? What’s a CISO to do On Defense in Depth, my co-host Allan Alford said, "I think the lack of technical skills in a CISO is expected to a certain degree. You have to have the foundation, but I don't expect my CISOs to be rolling up their sleeves and doing a lot of the hands on work." I turned that quote into a meme image and it caused a flurry of response from the community. How much of applying of security controls that your staff currently does, could a CISO do themselves today? Let’s dig a little deeper What are our passion projects that are tangentially related to cybersecurity? Are we adopting any and how is it helping us stay mentally healthy during COVID? Tony Jarvis of Check Point brought this up. He suggested that we should be sharing our passion projects. What have been our passion projects? How have they helped our mood and our work? And have we been able to keep up with them?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/why-is-pay-the-ransom-in-next-years-budget/) With 25 percent of ransomware victims paying the ransomware, have we waved the white flag to the attackers? Should we just budget for it? This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest is Les McCollum (@doinmorewithles), managing vp, CISO, ICMA-RC. Thanks to our sponsor, BitSight. BitSight is the most widely used Security Ratings service with a mission to change the way the world addresses cyber risk. Learn how BitSight for Third-Party Risk Management helps you efficiently mitigate the growing risk across your vendor ecosystem by taking an automated, data-driven approach. On this week’s episode Why is everybody talking about this now Are culture fit and diversity mutually exclusive? Allan Alford, co-host of Defense in Depth podcast, brought up the conversation of needing diversity in all areas: age, gender, ethnicity, city vs. country, country of origin, military vs. civilian, college educated vs. self-taught, socioeconomic status, and disabilities. But at the same time, I'm thinking we NEVER see those types of groups hanging out together or getting along. So how do you create a culturally sane group among such a diverse group? People are tribal by nature and even if you're successful creating diversity on your team they're going to bond with people of similar types. Won't this introduce new problems? If you haven’t made this mistake you’re not in security At the end of the year when you look at your security budget, what are the costs you didn't expect or budget appropriately at the beginning of the year? On CSO Online, John Edwards has an article about seven overlooked cybersecurity costs that may bust your budget. He mentioned items such as staff acquisition and retention, incident response, third-party analysis, and replacement costs. What has been a surprise for you and has adjusting things for the next year helped, or is there always a surprise? Which is the one everyone should prepare for but they don't? More bad security advice Over a quarter of companies that fall victim to ransomware, pay the ransom, according to a study by Crowdstrike. In a discussion thread on reddit, user yourdigitalmind said they had a client who remarked, "WHEN we get hit, it will force us to start doing things right, but right now, it's cheaper'" So he's accepted being hit by ransomware is inevitable. That falls in line with Crowdstrike's study that found after a ransomware attack 75 percent of the victims do increase their security spend on tools and hiring. Humor for me a moment. Most of us do not want to pay the ransom, but sometimes you can't think of the greater good and you have to think of the survival of the business. Is this where I should put my marketing dollars? What types of vendor stories do you respond to? I bring this up because Mike O'Toole, president of PJA Advertising wrote a great piece about how to build a cybersecurity brand story. In the article, he offers up some really good advice such as "Position yourself against the category, not just your direct competitors," "Fear gets attention, but opportunity can drive purchase behavior," and "The strongest brand stories are about market change." Which advice most resonates with how you're pitched, and can you think of either a customer story or offering that you overheard that pushed you into exploring a vendor's solution?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/were-90-confident-weve-lost-all-confidence/) I don't think we're doing enough to protect ourselves against cyberattacks and I'm also pretty sure we're clueless as to what our third party vendors are doing. This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our sponsored guest is Stephen Boyer (@swboyer), co-founder and CTO, BitSight. Thanks to our sponsor, BitSight. BitSight is the most widely used Security Ratings service with a mission to change the way the world addresses cyber risk. Learn how BitSight for Third-Party Risk Management helps you efficiently mitigate the growing risk across your vendor ecosystem by taking an automated, data-driven approach. On this week’s episode There’s got to be a better way to handle this How confident are your employees in your cybersecurity efforts? And how does employee confidence affect corporate security? Tip of the hat to Tor Swanson of Premier IT for posting this survey from Nulab. The survey found that employees felt that their company's ability to secure digital data was a major to moderate problem. That percentage jumped up dramatically for companies with less than 100 employees. In addition, employees don't feel they're being heard with their cybersecurity concerns. For companies with less than 50 employees, 44 percent felt their employers were slightly or not at all responsive. Perception is a huge part of successful cybersecurity. If you were to let these perceptions continue, how does it affect your overall security program? Question for the board Ross Young, CISO, Caterpillar Financial Services asked, "What are the cyber metrics that should be reported to the board each month or quarter? Is this standardized (example does the financial industry say we want these five metrics), and where would you go to see how you benchmark against the industry?" I'll skip to one important metric we've mentioned on this show multiple times and that's "dwell time" or the time between an incident happening, discovering it, and then remediating it. How do you go about finding benchmarks, and what other metrics tell a good story to the board so they can better wrap their heads around the security program's effectiveness? What's Worse?! Third party issues? We've got 'em. Please, Enough. No, More. Topic is third party risk management. What have we heard enough about third party risk management, and what would we like to hear a lot more? Close your eyes and visualize the perfect engagement We're all getting bombarded with virtual events. Interested to know what virtual events have you attended that you've really enjoyed. Also, what virtual events are the most engaging where you find yourself NOT multi-tasking while watching. Plus, what does a virtual event need to offer for you to take time out in your day to attend?

All links and images for this episode can be found on CISO Series (https://cisoseries.com/networks-wobble-but-they-dont-fall-down/) Eager cyberprofessional looking to really impress a CISO? Create a home network lab and show how you can handle incidents on that network without shutting it down. This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest is Steve Zalewski, deputy CISO, Levi Strauss. Thanks to our sponsor, BitSight. BitSight is the most widely used Security Ratings service with a mission to change the way the world addresses cyber risk. Learn how BitSight for Third-Party Risk Management helps you efficiently mitigate the growing risk across your vendor ecosystem by taking an automated, data-driven approach. On this week’s episode Why is everybody talking about this now Following the horrible terrorist attack in Vienna, the EU has proposed a ban on encryption, requiring companies like WhatsApp and Signal to provide backdoor keys to decipher their end-to-end encryption. It's questionable whether this attack could have been thwarted had the data they couldn't see been read, but regardless, it appears this ban is going to be approved. As you might imagine, the cybersecurity community blew up... on reddit. This is obviously a complicated and thorny issue. What's at play here are authorities being blocked from doing their job because of technology. The loss of human life. And the loss of democratized privacy. Are there any checks and balances that can provide some benefit to any side of this equation? What would you advise? On a previous episode Mike mentioned that if you're an aspiring cybersecurity professional, one way to really impress a CISO is to setup a network and show how you can deal with incidents without taking down the network. I get Mike to talk specifics of that. What if he was in the shoes of that aspiring cyberprofessional. If he were to set one up, what would it have on it and how would he do it? "What's Worse?!" Do you need experience or communications? Close your eyes and visualize the perfect engagement On CSO Online, Jaikumar Vijayan wrote a best practices guide to negotiating SaaS contracts for risk and security. It's a good primer. He mentioned know your risks, state what's non-negotiable, insist on early breach notifications, and be clear on terms for termination. What is the most important concern when negotiating a SaaS contract, and what has been the most difficult to manage? "What Is It and Why Do I Care?" The panoply of security products is very confusing. There are so many product categories and then there are so many companies delivering solutions for all these categories. As a security vendor, how do you know if your pitch is landing with CISOs? That's why we play "What Is It and Why Do I Care?" I ask vendor listeners to submit to our game which you can find under the Participate menu option and then "Challenge Us". Today's category is penetration testing. We have four challengers. First, I will read four 25-word descriptions from four unnamed security vendors. That's our "What Is It?". Then I will read four 25-word differentiators from the same unnamed vendors. That's the "Why Do I Care?" It's up to our CISOs to pick their favorite. At the end I will announce the winners, and only the winners. Losers are not announced. YES, it's the only risk-free opportunity in cybersecurity. Ready to play? Submit your pitches to "What Is It and Why Do I Care?" I'm looking for vendors in the following categories to submit: Data loss prevention, human-layer security, MSSPs, third party vendor assessment, and managed detection and response.

All links and images for this episode can be found on CISO Series (https://cisoseries.com/why-dont-cybercriminals-attack-when-its-convenient-for-me/) Hey cybercrooks, I've got a really great weekend planned, so could you do us all a favor and cool it this Friday and just let all of us enjoy the weekend? This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest is Margarita Rivera, vp of information security, LMC. Thanks to our sponsor, Netskope. The Netskope security cloud provides unrivaled visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. Only Netskope understands the cloud and takes a data-centric approach that empowers security teams with the right balance of protection and speed they need to secure their digital transformation journey. On this week’s episode Is this the best solution? Geoff Belknap, CISO, LinkedIn asks, "If you could only buy one off the shelf security tool / product. What would it be and why?" Here’s some surprising research We've discussed a lot of how COVID is changing security. Well Eli Migdal, CEO of Boardish sent me some interesting research his company conducted regarding the last six months since the start of COVID. According to Boardish's report the top three threats now are: Immobility (not being able to work remotely) Ransomware Accidental Sharing And the top 3 solutions now are: User Awareness training Remote conferencing IAM (identity access management) Solutions Does this track with your current threats and solutions? What's Worse?! Two guaranteed bad things will happen. But one will cost far more damage. Which one? Pay attention. It’s security awareness training time. Jackson Muhiwre, deputy CISO at UC Davis said his cyber team "Are now extra vigilant on Fridays or call it the new Monday for cyber folks." The reason for this increased awareness is the number of cyber incidents that happen on a Friday or just before a holiday seems to go up. Past cyber incidents seem to show that pattern said Muhiwre who believes that malicious hackers know that users have their guard down at these times and it's the easiest time to attack. Are our CISOs of similar thinking and if so how do they prepare/warn/keep staff vigilant? What can be done on top of your existing protections if your staff lets its guard down? What’s the best way to handle this? On LinkedIn, Caitlin Oriel, wrote a very emotional post about her being unemployed for six months and how the non-stop stream of rejection has become overwhelming. The community response was equally overwhelming with nearly 80,000 reactions and 7,500 comments. Caitlin works in tech, not cyber, but the post was universal. The feelings she expressed about being rejected continuously and ghosted by companies left her sobbing in her car. All of this rejection made her question if she's doing the right thing and where she belongs. I have been in this position myself, as have my friends and family. I wish I knew the right things to say to someone or how to keep them moving. What are positive ways to combat ongoing rejection and get a sense you're still heading in the right direction?