Down the Security Rabbithole Podcast (DtSR)

TL;DR: I bet you don't generally think about the software that actually  runs the business when you're thinking security. In this episode, we tackle the security of SAP systems - the most popular business software on the planet - from some experts who tell us what we're missing. There's a lot to unpack here, and I bet you're not thinking about much of this, if any... I kno...

TL;DR: This week's episode features someone you've probably known for a while, without actually knowing him. Bob Brandon talks about his journey through publishing the wildly successful CSO Magazine (now an online publication) and being close the the CISO world for a long time. He has a great story to tell, so listen in, and enjoy. YouTube video: https://youtube.com/live/WafXp6xPpBY Have...

TL;DR: This week's guest is here to talk about Zero Trust... in a practical way. We're talking with Rob Allen of ThreatLocker about zero trust from a way you may have not thought about before. It's an interesting conversation and a piece of a much larger puzzle ... but from a practical standpoint, this may be the best actual place to start. Do you agree? YouTube Video: https://youtu...

TL;DR: This week on the pod, Jonathan Rau joins to talk about SIEM. The thing we all lover to hate on, that thing that's been declared dead, and yet it's on its umpteenth incarnation. What does the future hold? Why is it still an investment organizations make? What makes it a good versus bad use-case? Tune in, find out. YouTube video: https://youtube.com/live/FtCjMo_gDDc Have something t...

TL;DR: Friend of the pod, Karim Hijazi of Vigilocity , joins Rafal this week to talk about the state of ransomware, its "families", proliferation and motivations. It's a dark picture that's getting darker as it all evolves. Karim also provides some data-driven insights you can even investigate for yourself, check this show out on the video stream for more complete insights. You...

TL;DR: This week is part 2 of the 2-part series on "Outsourcing your security" with Paul Farley . Paul's expertise in this space means you should be taking notes! On this second part, we dive into how you can pick an effective model for your use-case (we talk through a few of the available models out there), how to effectively implement an MSSP, and then how to measure success. Gues...

TL;DR:  James and I spent a few minutes dissecting the high-level of a GAO report (Government Accountability Office) ...perhaps ironically named... that is awful in so, so many ways it's ridiculous. Listen in, comment with your thoughts. YouTube Video: (TBD) Have something to say? Let's hear it. Support the show >>> Please consider clicking the link above to support the show! -=-...

TL;DR:    This week Paul Farley , Deputy CISO of NCR Voyix joins myself, James, and Jim TIller to discuss outsourcing security in a modern company. We talk through a bit of history, some requirements for a good MSP, and the good and bad of the last couple of decades of MSPs. YouTube video: https://youtube.com/live/QzQFXyVcDSo Have something to say? Let's hear it. Support the show >>>...

TL;DR: Justin Foster is back (and James is out) with guest co-host Jim Tiller as we talk through network-based access control from the "old days" through today's modern approaches. What worked, what didn't, what we tried, and how far we've come. Give it a listen! Also ... if there's any episode you watch the video of - it has to be this show for that beginning piece.....

TL;DR: This week's episode is part 1 of ... (I'm not sure) in a series of conversations about that old, boring, yet remarkably relevant topic of "Access Control". We pull in Justin Foster and guest co-host Jim Tiller to talk through the topic and set up a few follow-up episodes. Maybe more than a few, who knows? YouTube video: https://youtube.com/live/m-4lJHQDaZQ Have something...

TL;DR: Sitting atop the Moscone Center North, I met up with Mark Simos and we talked through his impressions and our overall analysis of RSA Conference 2024. Some interesting observations, particularly about the "3 conferences" Mark observed.  Sorry, no video this time, but you do get the eloquent "caw!" of a crow that sat overhead and yelled at us for about half the show. Enjo...

TL;DR:  This episode is a recap (my recap) of RSA Conference 2024. I wrote up a brief post on LinkedIn on my way out of town (linked here: https://www.linkedin.com/feed/update/urn:li:activity:7194698322790547456/ ), and now I'm doing a full episode of thoughts and interviews from the show. You get some commentary, and then interviews with Adam Cullin , Kristin Demoranville , Ray Canzanese , a...

TL;DR:  -> 2hr party-line episode This feels surreal, as I write this, that DtSR is pushing episode  600 out to your ears right now. I couldn't possibly have imagined when I started 14 years ago, that this would be real. This episode is the culmination of a lot of hard work, so many amazing guests throughout the years, and  YOU , my listeners! Without you all, I wouldn't keep publishi...

Tl;DR: On the last episode before the big 600th extravaganza, James and I have a conversation about the types of conversations we've had on this show so far, reminisce about some of the favorite guests, and rehash some of the topics that (unfortunately) we could simply re-air today and it would make perfect sense. I know, a little depressing, eh? YouTube: https://youtube.com/live/4GsMSsuyjk8...

Tl;DR:  This week on episode 598 as we are 1 episode away from the Big 600, Adam Meyers joins the podcast to provide an update on the interesting things happening in the world of ransomware, threat actors, and general cyber criminals. Adam regales us with some interesting stories and always has that witty insight we expect from Adam. YouTube Video: https://youtube.com/live/5EBanXzfdtQ Have somethi...

TL;DR: On this episode of the DtSR Podcast, Shawn Tuma joins James & I to talk over what's changed, what's new, and what's not going well at the intersection of cyber and legal. Spoiler Alert: Nothing's that much better, and things are worse. YouTube video: https://youtube.com/live/VDqxohnvpXs Have something to say? Let's hear it. Support the show >>> Please co...

TL;DR:  On this installment of the podcast, David Monnier joins Rafal & special guest Jim TIller to talk about hunting bad actors in cyberspace. What it's like chasing down villains, challenges, and related discussion. David is a recognizable industry expert and someone who can dispense some great discussion and advice. Listen up! YouTube Video: https://youtube.com/live/t53yK6zkikE Have s...

TL;DR:  This week on the podcast, the conversation with Phil Beyer goes all over the map. We start with the interesting (but short) story of how Phil got into cyber, to vCISO vs CISO, and how we really feel about the CISOs opportunity to "win". Short answer - there isn't a win here. It's a very fast-paced episode you'll want to listen at normal speed because, frankly, it&a...

TL;DR: On today's episode of the podcast, Jessica Hoffman joins James and I to talk about Emotional Intelligence . What is it? Why is it desperately important to cybersecurity professionals in  leadership role? All these questions and more are addressed as we parse out the ins and outs of emotional intelligence. YouTube video: https://youtube.com/live/DUBX9r22zEs Have something to say? Let&#3...

TL;DR: This week Episode 593 features Jeff Reich of the Identity Defined Security Alliance as we talk about some of the big-picture challenges of identity, interoperability, and security of identity and identity security (yes those are different). YouTube video: https://youtube.com/live/oTWJEVTzTlY Have something to say? Let's hear it. Support the show >>> Please consider clicking the...

TL;DR:   On this episode, James and I welcome CEO Patrick Dennis , CISOs Jack Korzeniowski and Sam Masiello , former CISO and vCISO, and industry veteran Jim Tiller onto a panel to discuss ransomware . Ransomware is catastrophic for some businesses, and in this episode, we talk through some of the key topics that CEOs and CISOs lose sleep over. Huge thank you to all of these fine gentlemen who gav...

TL;DR:  *Warning: This episode is ranty, and potentially offensive to overly sensitive types*. That said, in this episode Jim Tiller and I sit down, drink in hand, and have a good old rant about the state of the industry right now. We talk through the "people problem", and the tech problem, and lay plenty of blame. At some point, I think we even suggested a solution. Maybe. Enjoy! YouTub...

TL;DR:  On this week's episode, James Beeson once again joins Rafal & James, with guest-host Tom Venables to talk about procurement's involvement in the security of an enterprise. What does procurement have to do with security? How can the two functions work together to improve the security of the enterprise both today and into the future? Listen as we discuss this vital topic. YouTu...

TL;DR:    This week's episode features one of the all-time greats. Joe Dibiase was the first CISO I worked under when I joined GE Power Systems back in the early 2000s and he's had a rather amazing career spanning many different industries. We chat about life, CISO'ing, and what he's up to now. Spoiler alert - Joe sports a Braves World Championship ring! YouTube Video: https://...

TL;DR: This week's episode has the one and only Jeremiah Grossman on the show to talk about liability in software, some of the fundamental problems with cyber security, the market forces that move (or could move) things in the positive direction - and where it could all potentially go. It's a fascinating discussion you'll not want to miss. YouTube Video: (coming soon) Have something...