Great Security Debate

This week we look at the security organisation through the looking glass. From within the org, the leaders and the partners and product/service providers we work with, we dig into some of the ways that security works with the rest of the business and customers, and how the needs of each org changes over time and necessitates the need for different mindsets to support those needs from a security pe...

It's Valentine's Day and you get presents. Dan, Brian and Erik discuss the books, people and tools that they each love and changed their lives. None are specifically security-related, so see what's been impactful on each of them in this episode. The links are an especially big part of the episode, so take a look in your podcast app or on the site ( https://www.greatsecuritydebate.net/17 ) to see a...

The time for job change happens and there are a lot of things go along with it including. We cover a ton of them in this week's episode: The reasons to make a career change Deciding the time is right to make a change (and how do you know) Taking our own advice when it comes to our own career change The importance of support of family to make more drastic changes The power of self-reflection and th...

We are 9 months into a period in which many workers, including technology and security professionals, are still doing their jobs remotely. Some have moved away from their primary homes, often without letting their company know that this has happened. As business processes catch up with this change in approach, some companies are taking steps to a) formalise work from home as a more standard offeri...

A few weeks ago, a company called SolarWinds was discovered to have had some bad actors in placing things in their technology (code) for a while. How did it happen? What does it mean to others? We don't know all the answers yet but we do know that it means we will have to make some changes to things like those universally hated security questionnaires, and how we manage our own source code to ensu...

One of the ways that companies have tried to improve education and awareness about the risks of phishing is the use of phishing tests to see if colleagues click on the link or open the suspect attachment in an unsuspecting yet controled environment. If they do, some instant education comes their way. There are those that think that this approach keeps the topic at the front of everyone's mind, and...

A regular complaint by those who consume and use technology is that security adds friction to their process, which often means they get frustrated at the control put in their path, curse technology in general, or abandon the activity altogether. In today's episode, Dan, Erik and Brian explore the balance necessary to understand when certain controls (and the friction they add) are necessary, or ca...

When bad things happen to the computers in your organisation, who is the first person you call? IT, the FBI, your general counsel, the insurance company? Today, Erik, Dan and Brian cover attacks, response and middle people negotiating with the attackers on your behalf. Other topics discussed include: The risk of cheap IoT devices and long term support (or lack thereof), Whose insurance policy cove...

So many movies about technology and security, so little time. We start our with some of our favourite (and least favourite) security movies. We also wander into a few other areas including: data use and ethics, balancing when to let an attack happen vs. when to let it happen to not let on that you know, Shodan, Stuxnet, Wannacry and more. Check out the complete list of movies we discuss and mentio...

In what will surely become a recurring topic, the discussion turns to the short-term vs. long-term implications of privacy decisions we each make, the ethics of collecting and using data, and whether a European model of privacy (or data protection as Dan reiterates we should be calling it) would help in the US. We ask why we can't stop needing instant replies and gratification, is the value of the...

The school year is upon us. This week Erik, Brian and Dan are talking about things related to security and education. First, we cover the ongoing dilemma of which is better to establish and grow your career in security: certifications or experience. We also debate how traditional education (aka degrees) fit into the equation, and how to jump in if you have neither formal experience nor education a...

Ransomware is increasing. Brian, Dan and Erik discuss the evolution of ransomware, the preparation and the response, and the debate about whether to pay the ransom or not. Support The Great Security Debate Links: You’ll need a Facebook account to use future Oculus headsets - The Verge AIDS Trojan | PC Cyborg | Original Ransomware | KnowBe4 What is the WannaCry Ransomware Attack? Backdoors and Brea...

On the debate today: it was overheard (over-read?) by one of the crew that security leaders and teams shoudl stop whining when security is not a “superstar” part of the business, but rather should focus on being a reliable supporting act that is there to prop up the actual “superstars.” There was a flawed comparison in this same read to the relationship between Scottie Pippen and Michael Jordan on...

Support The Great Security Debate Links: Backup Strategies: Why the 3-2-1 Backup Strategy is the Best Data Privacy + Big Tech: How Facebook, Amazon, Apple, Netflix, and Google Deal With Data (And What It Means for You)   - METRO Wizer

Dan, Brian and Erik discuss the pros and cons of managed services for security vs. building similar capability internally, best of breed security vs. suite (for the 5th time since 1995), and education and awareness. Visit our website at https://www.greatsecuritydebate.net Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate Support The Great Sec...

Dan, Brian and Erik debate the pros and cons to starting a product (or even a project) fully focused on hitting MVP (minimum viable product) or focusing more on TSP (totally secure product). Spoiler alert: it's somewhere in the middle! Also covered: the importance of support, defence vs response, and the mission of the podcast. Visit our website at https://www.greatsecuritydebate.net Contact us at...

Dan, Brian and Erik discuss how to talk about security in ways that encourage end users to understand security and want to be part of the process, and the challenges of selling security products into security organisations. Visit our website at https://www.greatsecuritydebate.net Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate Support The G...

Episode 1: Privacy Drone. Dan, Brian and Erik discuss expectation of privacy; privacy as a business enabler; transparency and ethical increase of privacy and how much should leaders and legislators understand privacy innately. Visit our website at https://www.greatsecuritydebate.net Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate Support Th...