Redefining CyberSecurity

In a world where everything is connected and interdependent, complexity has become part of our very way of life, and it must be part of our way of thinking. But, especially when we look at infrastructure security, the boundaries between analog and digital, physical and cyber, are simply not there anymore. In today's conversation, we discuss the importance of looking at our society, economy, and se...

Every organization has exposure to risk. Every organization experiences events that cross over the risk threshold to quickly realize they are facing an incident head-on. It's how the organization prepares for these situations that matter most. Preparation is so much more than recognizing that a disaster might occur. It's also more than having a documented plan draft months (maybe even years ago) t...

Data is the fuel that powers the business. What are organizations doing to protect it? Organizations have become the custodians of critical information needed to remain competitive and sensitive information that their customers have entrusted them with. While some organizations have taken this responsibility seriously, governments (state, federal, and international) have had to step in to help gui...

Do you think you know all of the cybersecurity vendors on the market? Think again. Need help getting a clear view for how they all fit into the bigger InfoSec picture in your org? Have a listen. In today's episode, long-time industry analyst, Richard Stiennon, takes us on a journey down memory lane into the world of cybersecurity and the ever-growing landscape of innovation, technology, features,...

As the CISO role has revolved from chief security engineer to cyber risk advisor, successful CISOs are focusing on culture, strategy, and leadership.  Let's discuss some real-world observations and explore some tips for what can prove to be successful across a variety of industries. In addition to the fantastic conversation, there are a ton of resources that Rock and Dutch have provided. Have a li...

There's a cyber crisis brewing. Not the first. Definitely not the last. But current. Here's some advice as seen on social media (paraphrased)... "take your years of strategizing, planning, budgeting, staffing, and procuring … and do it all within a few days."  How is that helpful? It isn't. It could actually be counter-productive. With the rising concerns over the growing threat of cyberattacks fr...

If the goal is to fill a role and keep it filled, we may be missing the point of hiring and retaining top talent. More than ever, investing in the human element of cybersecurity is paramount. How we staff and maintain our cyber teams will determine the success of the individuals, the team, and the program. In today's conversation, we connect with two authors, Leeza Garber and Scott Olson, to talk...

Many organizations are ill-prepared when it comes to making sure their hospital is protected from risk, both from an organizational and IT standpoint. It's increasingly important to have a concrete risk assessment strategy, one that explicitly includes utilizing third-party (vendor) risk management.  When our guest, Jesse Fosolo, joined St. Joseph’s Health in August of 2014, he's completely flippe...

As is common for the Redefining Security show, conversations are often inspired by a social post. This one about standards is no different. However, what you think about standards may be different after you listen to this episode. Some of the social comments we discuss: For a standard to be good it has to align with current capabilities and business objectives. When they don't, problems arise. Sec...

The sea is broad and deep. So is the information that is created by and for the maritime vessels floating around and underneath the surface. What is this information used for? And how can it be misused? Some OSINT should give us a few answers.  Let's hear from a hacker with a passion to explore this world of open source intelligence generated by the maritime industry - commercial, defense, and oth...

It's time to change the way we think about cyber security training. Evidently, the cybersecurity community agrees — just look at the post made recently by Eric Thomas (you can find it in the resources section). To help us with this endeavor, Eric, a practitioner and training professional, takes us on a journey into the past, present, and future of bringing the next wave of cybersecurity profession...

Back in 2013, I wrote a piece for TechTarget (sadly, it’s no longer online). It focused on mobile security and app security and referenced a report that included some interesting open source software stats that showed one particular shared library’s use outpacing the others by a longshot. Can you guess which one? 🤔 Eight years later, that same library is making the news again — arguably, on a muc...

It seems that nearly every enterprise is in the midst of a cloud transformation. This begs the question, how and where does information security transformation fit into this bigger IT and business picture? That's exactly what we get to discuss with our guest, Helen Oakley, as she shares some thought-provoking insights regarding secure cloud transformation strategies, roadmaps, and best practices....

The problem is not the problem, it is the way you think about the problem. Get outside the box. Fear, manipulation, influence, and deceit are some of the most powerful tools in the arsenal used by nation-state attackers and criminal actors. The most significant breaches have not occurred just because of flaws in software, or lack of proper controls. They have occurred because of the flaws in our w...

Product Management: the team responsible for new product development. Information Security: the team responsible for ensuring systems and data are protected from inaccessibility, loss, theft, and misuse. How and where do these two teams collide? Let's find out. In today's episode, we catch up with information security leader Christie Chaffee. We dig into what product management is compared to secu...

We keep hearing the mantra that CISOs and CSOs need to be business leaders. So how come we keep seeing job descriptions and hearing about interviews that focus on the technical certifications like the CISSP and many others? That's exactly the question posed in a post on LinkedIn that caught our attention - and that of many others! Join us for a candid conversation with the post's author, a current...

Leadership can make or break an organization's chance for success, and eventually, it will.  It doesn't matter what company, organization, or community teams you lead—all you do and how you do it matters for the end result. Given the nature of the function within the cybersecurity industry, someone may think that their style needs to be more decisive than most; that maybe they even and get some "w...

So what's it like to be a CISO? We came across a thread on Twitter posted by now Deputy (and then acting) CISO of a billion-dollar crypto company that in the role for three months during the spring bull run. Aside from the burnout, what else can we glean from J.M. Porup's experience? ____________________________ Guest J.M. Porup On Twitter 👉 https://www.twitter.com/toholdaquill __________________...

Our guest, Robin Smith, Head of Cyber and Information Security, Aston Martin Lagonda, is a self-proclaimed advocate for lean cybersecurity. But does lean cybersecurity equate to weak cybersecurity? Only if you let it be defined that way. Robin doesn't let it be defined that way. Based on years of experience, Robin posits that cybersecurity has become key to protecting the value streams of any orga...

Security teams are very technical and tactical by nature, often looking at risk through a specific lens they've developed over time. But, of course, the reality is that the possible security incident can — and likely will be — much more extensive and require different teams and expertise. One bad mishandle and an event or incident could become an even more significant risk. Successfully managing r...

While it may seem appealing — and you can certainly try — sorry, but you can't tech your way out of ethics issues. In this episode we speak to co-authors of a research paper to critique existing governance in cyber-security ethics as they did so in providing an overview of some of the ethical issues facing researchers in the cybersecurity community and highlighting shortfalls in governance practic...

What is an architecture? Is it a document? A process? A policy? A map? A discipline? A mindset? When you hear what it is, you may have to re-evaluate how you approach your cybersecurity program. Are you ready? “The ideal architect should be a man of letters, a skillful draftsman, a mathematician, familiar with historical studies, a diligent student of philosophy, acquainted with music, not ignoran...

Threat intelligence automation should be how we share, not how “Intel” is produced. Yet, we continue to create more data - generate more noise - introduce more false positive - require more analysis - increase the need for correlation - which, in turn, forces the need for more automation. Guests CyberSquarePeg (aka Rebecca Ford) On Twitter 👉 https://twitter.com/CyberSquarePeg Andy Piazza On Twitt...

Geopolitical winds of change are upending global supply chains at an unprecedented pace and scope. There are challenges and opportunities. Guest Andrea Little Limbago On Twitter 👉 https://twitter.com/limbagoa On Linkedin 👉 https://www.linkedin.com/in/andrea-little-limbago/ This Episode’s Sponsors Edgescan: https://itspm.ag/itspegweb Key Resources Security: https://itspm.ag/keyresources-2876 ____...

The CISO role has always been challenging. The last year brought the meaning of RESILIENCE to an all new level. Guest Dr Reem Faraj AlShammari On Twitter 👉   https://twitter.com/Q8Thunders On Linkedin 👉   https://www.linkedin.com/in/dr-reem-faraj-alshammari-b6324159/ This Episode’s Sponsors Blue Lava: https://itspm.ag/blue-lava-w2qs Key Resources Security: https://itspm.ag/keyresources-2876 ____...