Resilient Cyber

Nikki - Please tell us a little bit about your dissertation and why you felt like drone forensics needed further research? Chris - We know you have a Doctorate where your focus was UAV systems forensics framework. My background is largely with DoD which is increasingly embracing UAV/Drones etc. Are there any major security concerns a community like that should consider as they embrace these techno...

Nikki -  First, I need to hear about how you feel about women in technology and any words of encouragement for women who are interested in starting a business?  Chris - We know your organization raft is up to some innovative work in the Federal space, can you tell us a bit about that? Nikki - You have such a unique background with business and law and technology, I've actually considered gett...

Nikki - You are currently a Fellow with Stanford University - could you talk a little about the journey you've made to this point and how cybersecurity plays into the Fellowship? Chris - We know you served as a Senior Policy Advisor for the U.S. Cyberspace Solarium Commission. Can you speak about that, for those that aren’t familiar with the commission, and knowing the government has acted on...

- Can you tell us a bit about your background, how you got into the role you're in now? - For those unfamiliar with the term "Chaos Engineering" what is it and why should organizations be practicing it? - You currently support a program named Kessel Run, what do they do? - Performing something disruptive such as Chaos Engineering almost seems unheard of in organizations such as the...

What is vulnerability chaining for those unfamiliar with it? Is it becoming more prevalent among malicious actors? Why do you think we traditionally look at vulnerabilities in isolation? How do we get organizations to shift their mindset of how they look at vulnerabilities? How can organizations get context to understand what vulnerabilities can be chained together and how to mitigate those?

We know the DoD is pushing towards Zero Trust adoption and DISA is playing a key role in that. Can you tell us a bit about that? What do you think some of the biggest hurdles for Zero Trust adoption in the DoD are and how can we start to address them? Zero Trust has inevitably become a bit of a buzzword. If there is something people misunderstand about Zero Trust, what would you say that is? For t...

Chris - There's quite a push for Zero Trust in the Federal Government, with the Cyber EO and ZT publications from CISA. What do you see as some of the biggest impediments for the Government's adoption of ZT? What are some of the biggest opportunities? Nikki - One of your recent posts you mention the difference between zero trust being a concept vs being something to act on. What do you t...

Nikki - As someone who has such wide ranging experience in cybersecurity from practitioner and business owner to investor - what would you say are the largest concerns in cybersecurity right now? Zero trust? Incident Response? Cloud security? Chris - You hold several advisory and board member roles. For Cybersecurity professionals looking to perform similar roles, do you have any recommendations?...

Given your wide range of experience with AWS and cloud security - what would you say are some of the most common types of attacks for cloud platforms?  What would you say are the top three skills someone should work on if they're interested in a career on a Red Team or as a penetration tester?  Are there some really good resources or open-source tools you recommend for anyone learning about o...

Chris - You have a book coming out titled The CISO Evolution - Business Knowledge for Cybersecurity Executives. How critical do you think it is for CISO's to understand the business, and how do they balance their technical skills with business acumen? Nikki - I see you've posted several videos on LinkedIn - my favorite so far is the "paralysis-by-analysis" concept. We've d...

Chris - We know you are extremely passionate about DevSecOps in Government. What do you think some of the biggest impediments for widespread Government adoption of DevSecOps is? Nikki - I see you spoke recently about minimum viable continuous delivery - can you tell us a little bit about what that is and what it means? And what you think the possible implications may be on development cycles?  Chr...

Nikki - I'm so impressed with your wide range of cybersecurity - and with that experience you also are a Co-Founder and CEO. Can you talk a little bit about the transition from full time practitioner to business owner?  Chris - If you had to list 1-2 top issues facing the Cybersecurity community within Government in particular? Nikki - What would you say are some of the biggest challenges tha...

 For those unaware, what exactly is an SBOM, and why is it so important? One of the presentations you gave mentioned that software supply chain attacks shouldn't be discussed as "emerging threats" - these really have been going on for years. Why do you think we still talk about it as an emerging threat or something novel?  We know you've recently talked about an effort dubbed &...

You have just received your first-time role in cybersecurity as a Security Analyst - congratulations! How has your first experience been so far in this new role? LinkedIn can be a powerful method of meeting others. Of all the amazing things you've done - what is the best advice you could give for someone trying to break into cybersecurity? On the flip side - what is something you would like f...

I was reading the CISA document "Defending Against Software Supply Chain" and was curious if the guidance within was helpful or informative for anyone who wants to start a S-SCRM program?  What role do you feel compliance frameworks play in SCRM? We are seeing sources such as NIST 800-53 include SCRM specific controls now. Will it help? What would you say is the most resilient component...

Leadership and Business Accumen, we know you're passionate about these topics. How much do you think these play a role in the success of a person's career in Cyber and do you think these are things some of us may overlook? Organizational Influence is something we know you've spoken about. Can you elaborate on that? How do you go about influencing organizational change for cybersecur...

-As Founder of the Security Television Network, how did you come up with the idea? -We have so many channels right now in the airwaves, and it seems like every day there is a security incident, why STN? What does STN bring to the security news forum? -Can you tell us a little bit about the Indiegogo campaign? -You also have a Doctorate and teach at Capitol Technology University. Can you explain th...

You have some incredible accolades, titles, and roles - but before we dive into those, can you tell us about your journey? We always love hearing about how someone go to where they are, and the hard work, discipline, and sacrifice that went into that As mentioned previously, you have a lot of different titles - Cyber Exec, Professor, Author, Keynote Speaker. How important do you feel personal bran...

You have quite a bit of experience and a lot of research into implementing secure software - but we'd like to dig into a little bit about where organizations should start - tools, multiple developers? What kind of baselines should be consider? There's an increased focus on secure software supply chains, especially with the recent Executive Order (EO). The EO emphasizes the prevalence of...

1. You are part of several working groups within the NIST Cloud Computing area - could you tell us a little bit more about the Security and Forensic Sciences groups? For individuals who aren't with NIST but have relevant expertise, is there a way we can contribute to publications? 2. You have recently released the NIST Open Security Controls Assessment Language (OSCAL) document - could you gi...

Could you provide some advice for anyone who may want to be a CISO - or even provide some guidance for how and why someone may want to be a CISO?  You've written a book called "How to Measure Risk with Anything" - could you maybe provide some advice to cybersecurity professionals who have a topic in mind and want to write a book of their own?   With your vast knowledge and experienc...

Questions: Can you tell us a little bit about what rThreat does? We spoke a bit about your background in education and curriculum development - can you give us some more information about that and how it has impacted your new role? Can you give us a bit about what it's like to work at a startup and how your interest in security got you into that? How do you feel the threat landscape is changi...

Can you tell us a bit about your journey to becoming the CISO at CMS, we know you spent most of your time in the commercial industry prior. How has it helped, what are some of the major differences you've experienced? Can you give us some industry specific guidance on what it means to be a CISO in the healthcare industry? CMS handles the PII of over 50 Million Americans I believe - can you el...

1. You are an active member on LinkedIn as an ally to women wanting to get into or succeed in cybersecurity, can you explain why that is so important to you?   2. You have a number of public speaking engagements under your belt, could you give us some detail into how you came across it and what interested you about it?   3. Could you give some advice to anyone looking to get into speaking at cyber...

For those unfamiliar with Zero Trust, if you had to summarize what Zero Trust is, how would you describe it? Zero trust is in the news quite a bit recently, with NIST even coming out with their own guide just a year ago. Do you think this is really a new topic or more of a maturation of older processes? It seems like every breach we hear Zero Trust could have prevented x, y, and z - Do you think Z...