Player FM - Internet Radio Done Right
Checked 6d ago
Ajouté il y a deux ans
Contenu fourni par Adopting Zero Trust. Tout le contenu du podcast, y compris les épisodes, les graphiques et les descriptions de podcast, est téléchargé et fourni directement par Adopting Zero Trust ou son partenaire de plateforme de podcast. Si vous pensez que quelqu'un utilise votre œuvre protégée sans votre autorisation, vous pouvez suivre le processus décrit ici https://fr.player.fm/legal.
Player FM - Application Podcast
Mettez-vous hors ligne avec l'application Player FM !
Mettez-vous hors ligne avec l'application Player FM !
Podcasts qui valent la peine d'être écoutés
SPONSORISÉ
T
The Agile Brand with Greg Kihlström®
![The Agile Brand with Greg Kihlström® podcast artwork](https://cdn.player.fm/images/25641206/series/oilf68jgHPTH2oAn/32.jpg 32w, https://cdn.player.fm/images/25641206/series/oilf68jgHPTH2oAn/64.jpg 64w, https://cdn.player.fm/images/25641206/series/oilf68jgHPTH2oAn/128.jpg 128w, https://cdn.player.fm/images/25641206/series/oilf68jgHPTH2oAn/256.jpg 256w, https://cdn.player.fm/images/25641206/series/oilf68jgHPTH2oAn/512.jpg 512w)
![The Agile Brand with Greg Kihlström® podcast artwork](/static/images/64pixel.png)
1 638: What's the ROI on those Big Game Ads? Featuring Nataly Kelly, CMO at Zappi 28:17
28:17
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé28:17![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Much is made about the creative decisions in ads for the Big Game, but how does all that money, those requisite celebrity cameos, and everything else that goes into these multi-million dollar investments translate into Return on investment? Today we’re going to talk about what the numbers tell us from all those high-profile ads and who the winners and losers of the Advertising Bowl are in 2025. To help me discuss this topic, I’d like to welcome Nataly Kelly, CMO at Zappi, who unveiled their annual Super Bowl Ad Success report on Monday. We’re here to talk about the approach, the results, and what those results mean for brands that invested a lot of money - and time - into their campaigns. About Nataly Kelly I help companies unlock global growth For more than two decades, I have helped scale businesses across borders, as an executive at B2B SaaS and MarTech companies. I’m Chief Marketing Officer at Zappi, a consumer research platform. I spent nearly 8 years as a Vice President at HubSpot, a multi-billion-dollar public tech company, driving growth on the international side of the business. Having served as an executive at various tech companies, I’ve led teams spanning many functions, including Marketing, Sales, Product, and International Ops. I’m an award-winning marketing leader, a former Fulbright scholar, and an ongoing contributor to Harvard Business Review. I love working with interesting people and removing barriers to access. RESOURCES Zappi website: https://www.zappi.io/web/ Connect with Greg on LinkedIn: https://www.linkedin.com/in/gregkihlstrom Listen to The Agile Brand without the ads. Learn more here: https://bit.ly/3ymf7hd Don't miss a thing: get the latest episodes, sign up for our newsletter and more: https://www.theagilebrand.show Check out The Agile Brand Guide website with articles, insights, and Martechipedia, the wiki for marketing technology: https://www.agilebrandguide.com The Agile Brand podcast is brought to you by TEKsystems. Learn more here: https://www.teksystems.com/versionnextnow The Agile Brand is produced by Missing Link—a Latina-owned strategy-driven, creatively fueled production co-op. From ideation to creation, they craft human connections through intelligent, engaging and informative content. https://www.missinglink.company…
Adopting Zero Trust
Tout marquer comme (non) lu
Manage series 3462572
Contenu fourni par Adopting Zero Trust. Tout le contenu du podcast, y compris les épisodes, les graphiques et les descriptions de podcast, est téléchargé et fourni directement par Adopting Zero Trust ou son partenaire de plateforme de podcast. Si vous pensez que quelqu'un utilise votre œuvre protégée sans votre autorisation, vous pouvez suivre le processus décrit ici https://fr.player.fm/legal.
Adopting Zero Trust offers an ongoing conversation that elevates cybersecurity conversations that encourages you to rethink how you build strategies, defend against threat actors, and implement new technology. We go beyond the millions in marketing budgets fueled by VCs, and chat with practitioners like you who want to make a difference (or hack the planet, which ever happens first).
…
continue reading
51 episodes
Tout marquer comme (non) lu
Manage series 3462572
Contenu fourni par Adopting Zero Trust. Tout le contenu du podcast, y compris les épisodes, les graphiques et les descriptions de podcast, est téléchargé et fourni directement par Adopting Zero Trust ou son partenaire de plateforme de podcast. Si vous pensez que quelqu'un utilise votre œuvre protégée sans votre autorisation, vous pouvez suivre le processus décrit ici https://fr.player.fm/legal.
Adopting Zero Trust offers an ongoing conversation that elevates cybersecurity conversations that encourages you to rethink how you build strategies, defend against threat actors, and implement new technology. We go beyond the millions in marketing budgets fueled by VCs, and chat with practitioners like you who want to make a difference (or hack the planet, which ever happens first).
…
continue reading
51 episodes
Tous les épisodes
×![Artwork](/static/images/128pixel.png)
1 Kicking Off Season 4 of Adoption Zero Trust (AZT) 22:43
22:43
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé22:43![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Neal and I are excited to welcome you back to AZT as we kick off our fourth season. After four years of trying out different formats and episodes, including at least an entire season terrorizing vendors for slapping Zero Trust on their box as if it were something you could buy, we’re ready to narrow our focus a bit.…
![Artwork](/static/images/128pixel.png)
1 The key to growing a cybersecurity career are soft skills 50:38
50:38
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé50:38![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
In this episode of 'Adopting Zero Trust (AZT)', host Neal Dennis and producer Elliot Volkman delve into the often-overlooked realm of soft or 'non-tech' skills in cybersecurity. This week, we chat with Courtney Hans , VP of Cyber Services at AmTrust Financial Services, and Evgeniy Kharam , author of Architecting Success: The Art of Soft Skills, who help us explore how non-technical skills are vital in shaping the careers of cybersecurity professionals. Our guests share the importance of effective communication, emotional intelligence, and adaptability. The hosts and guests share personal anecdotes, training tips, and the necessity of bridging technical prowess with essential soft skills to improve stakeholder engagement and career advancement. The episode emphasizes the value of being comfortable with discomfort and soliciting feedback to enhance one’s professional journey in cybersecurity.…
![Artwork](/static/images/128pixel.png)
1 Behind the scenes of cybersecurity media and reporting 1:04:53
1:04:53
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé1:04:53![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 15: We gather a panel of journalists, communications, and a researcher to discuss how cybersecurity news and incidents are reported. You can read the show notes here . In the world of cybersecurity journalism, you can broadly divide it into four competing forces: reporters, communications teams, researchers, and readers. Each requires the other to accomplish its goals, but they all have very different priorities and goals. Journalists have a duty to inform the public about security-related events. Communication teams have a duty to inform the public about related incidents and research, but in a controlled setting. Researchers help provide answers to communication teams and journalists. Readers want to be informed of information that impact them, and their habits shape what kind of reporting is invested in the most. This week we explore some of these dynamics by bringing together a panel representing comms, journalism, and research to discuss the game of tug-of-war during incident response and incident reporting. Danny Palmer was a long-standing cybersecurity reporter at ZDNet prior to recently joining DarkTrace, Josh Swarz is the Senior Communications Manager at Microsoft focusing on threat intelligence, our host Neal Dennis is former NSA and has lived many lives around either keeping secrets or uncovering them, and producer Elliot Volkman has been a reporter for two decades and works with Josh on elevating research at Microsoft Threat Intelligence.…
![Artwork](/static/images/128pixel.png)
1 GRC tool or spreadsheets, that is the question | GRC Uncensored Preview 43:13
43:13
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé43:13![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
In our final preview episode of GRC Uncensored, we explore a particularly bipolar debate: do you need a GRC tool to manage compliance, or will spreadsheets suffice? After this, we will be back to our regularly produced AZT episodes. The last episodes of our pilot for GRC Uncensored can be found on your favorite podcast app or newsletter on Substack.…
![Artwork](/static/images/128pixel.png)
1 Podcast Preview: GRC Uncensored and the commoditization of compliance 41:30
41:30
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé41:30![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
We are interrupting our regularly scheduled podcast series to introduce you to a new series we developed: GRC Uncensored. This pilot season will elevate conversations about GRC that are often buried under millions of dollars in marketing spend. No boring talks about controls or frameworks, just unfiltered discussions with auditors and practitioners in the GRC space. We'll be back to our regular AZT episodes in a couple of weeks. ----- In the first episode of 'GRC Uncensored,' hosts Troy Fine, dubbed the 'GRC Meme King,' and Elliot Volkman, alongside guest Kendra Cooley dive into the complexities of Governance, Risk, and Compliance (GRC) in cybersecurity. The discussion unravels the 'love-hate' relationship many security professionals have with compliance frameworks like SOC 2, exploring how they have become commoditized and possibly devalued over time. The conversation touches upon the challenges security practitioners face in conveying the true value of GRC to businesses, the potential pitfalls of 'SOC in a box' offerings, and the broader implications of compliance becoming a 'check the box' exercise. Moreover, the episode delves into the broader regulatory landscape and the ongoing debates about the role of government regulations in cybersecurity compliance. This candid dialogue sets the stage for future episodes that promise further to dissect the nuances of cybersecurity audits and standards. 00:00 Welcome to GRC Uncensored 01:34 Introducing Kendra Cooley 02:05 Love-Hate Relationship with GRC 03:16 The SOC 2 Debate 04:33 Challenges with SOC 2 Audits 09:10 The Value of SOC 2 in the Industry 12:04 The Evolution of Compliance Frameworks 20:39 False Sense of Security in Compliance 24:46 The Buzz Around AI and Quantum 25:10 Staying Updated as a Security Professional 26:45 Challenges in Penetration Testing and Vendor Assessments 27:37 Compliance and Its Impact on Security 30:10 Government Regulations and Their Effectiveness 32:23 The Complexity of Privacy Laws 38:29 The Role of GRC Teams in Risk Management 42:30 Concluding Thoughts and Future Episodes…
![Artwork](/static/images/128pixel.png)
1 How to prepare your operations team for Zero Trust 46:17
46:17
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé46:17![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Welcome back to Adopting Zero Trust! In this episode, hosts Elliot Volkman and Neal Dennis are joined by Rob Allen, Chief Product Officer of ThreatLocker, to dive deep into the operationalization of Zero Trust. Despite covering various aspects over three seasons, this crucial topic is addressed thoroughly. They explore pre-adoption preparation, aligning organizational actions, and the importance of education in security. Additionally, the conversation highlights the 'assume breach' perspective and how concepts like default deny and least privilege are essential. With real-world examples and anecdotes, they provide actionable insights on implementing Zero Trust strategies effectively. Tune in to learn about the foundational steps necessary to transition into a Zero Trust environment. This is the first of a three-part mini-series, so stay tuned as we explore more aspects of how to prepare your organization for adopting a Zero Trust strategy.…
![Artwork](/static/images/128pixel.png)
1 Log4j Continues to act as Organizational Vulnerability 47:56
47:56
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé47:56![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 13: Cato Network’s Etay Maor provides fresh research on the abuse of unpatched log4j libraries. Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . This week on Adopting Zero Trust (AZT), we highlight a significant cybersecurity risk focused on the notorious Log4j vulnerability and the growing concern around shadow IT. Featuring expert insights from Etay Maor, the Chief Cybersecurity Strategist at Cato Networks, the conversation initially looks into the persistent exploitation methods, the importance of knowing one’s cybersecurity environment, and strategic approaches to mitigating risks.…
![Artwork](/static/images/128pixel.png)
1 Overturning of Chevron Deference’s Impact on Cybersecurity Regulation 51:44
51:44
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé51:44![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 12: Could the overturning of Chevron Deference impact cybersecurity and privacy regulations? Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Welcome back to Adopting Zero Trust or AZT. In our latest episode, we assembled a distinguished panel to dig into a timely topic affecting the cybersecurity landscape but has the fog of war wrapped around it. Today’s conversation centered around the recent developments in cybersecurity regulations and their potential impacts, ignited by the Supreme Court overturning Chevron Deference. This, of course, has other potential impacts on all regulation types enforced and shaped by federal agencies, but our focus is, of course, on cybersecurity, privacy, and AI. The Panel We welcome back Ilona Cohen, Chief Legal and Policy Officer at HackerOne, who joined us last year to discuss the National Cybersecurity Strategy . Ilona is also the former General Counsel for OMB. We are also joined by the GRC meme king, Troy Fine, the Director of SOC and ISO Assurance Services at Gills Norton. Beyond the memes, Troy takes a practical perspective on regulations and acts as our voice for those who may be most immediately impacted. Key Takeaways Chevron Deference overturned: The Supreme Court's decision removes the requirement for courts to defer to federal agencies' interpretations of ambiguous statutes and now relies on the courts. Increased regulatory uncertainty: This ruling may lead to more challenges to existing and future regulations, potentially affecting cybersecurity and AI policies. State vs. Federal regulation: The uncertainty at the federal level might prompt states to act more quickly on issues like AI and cybersecurity, potentially creating a patchwork of regulations. Impact on AI regulation: With about 40 federal bills addressing AI in the pipeline, the ruling could complicate the process of creating comprehensive federal AI regulations. Cybersecurity implications: Existing and proposed cybersecurity regulations, such as the Cyber Incident Reporting for Critical Infrastructure Act, may face new challenges. Business concerns: While some business organizations applauded the ruling, the resulting regulatory uncertainty could be problematic for companies trying to plan and comply with regulations. Expertise concerns: There are worries that courts may lack the technical expertise to make decisions on complex technological issues like AI without deferring to agency experts. Potential for innovation: The regulatory uncertainty might create a wild west period for AI, potentially fostering innovation before more stringent regulations are imposed. Self-regulation importance: In the absence of clear federal regulations, industry self-regulation initiatives may become more significant, especially in rapidly evolving fields like AI.…
![Artwork](/static/images/128pixel.png)
1 Applying Vulnerability Management to Zero Trust 45:43
45:43
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé45:43![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 11: Vulnerability management is critical to any Zero Trust strategy, but you probably already know that. Fortra’s Tyler Reguly breaks down severity vs. risk. Catch this episode on YouTube , Apple , Spotify , or Amazon . You can read the show notes here . Every organization relies on some form of technology to run, and each tool you add increases the risk of vulnerabilities causing problems. If you don’t stay on top of patching, you increase the odds of a bad actor finding their way more easily within your network. This week, we chat with Tyler Reguly, a senior manager of security research at Fortra, who shares insights from his 18 years in vulnerability management. Tyler discusses the importance of staying on top of patching to maintain a Zero Trust strategy, the differences between vulnerability and patch management, and emphasizes that the Common Vulnerability Scoring System (CVSS) measures severity, not risk. We also briefly nerd out about the significance of groups like the Canadian Cyber Threat Exchange (CCTX) for knowledge sharing and collaboration in cybersecurity. And then, we wrap things up by exploring the efficacy of existing security policies and benchmarks, such as CIS and DISA STIGs, and the role of vendor relationships in maintaining effective security practices.…
![Artwork](/static/images/128pixel.png)
1 The Unstoppable Phish: A Discussion with Vivek Ramachandran 26:31
26:31
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé26:31![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 10: Elliot chat’s with Vivek Ramachandran of SquareX about his approach to tackling the impossible: Social engineering. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . For nearly three decades, social engineering, particularly phishing, has been one of the most impactful and financially draining cyber threats. Between security awareness training, email security gateways, generative AI, enterprise browsers, and a slew of other tech like EDRs and XDRs, social engineering has yet to be thoroughly thwarted. The reason for that is straightforward enough: social engineering is a psychological threat, not just a technological one. In our last round of interviews from RSA, we chatted with Vivek Ramachandran, the founder of SquareX, who is attempting to tackle the challenge. Vivek also walks us through a more realistic perspective of how threat actors use generative AI today, which goes beyond the more unique what-if scenarios we’ve seen in headlines in the past two years. Key Takeaways Social engineering and phishing attacks remain a significant threat, and everyone can be a target. The sophistication of these attacks has increased due to advances in AI. AI can craft messages that sound remarkably like someone the recipient knows, enabling rapid scalability. Social media platforms are becoming common channels for launching phishing attacks. Attackers exploit the trust that users place in these platforms and their contacts. Vivek Ramachandran's company, SquareX, deploys a browser extension that can attribute attacks and detect and block them in real-time, providing valuable information to the enterprise. Traditional technologies like Secure Web Gateways (SWG) have matured, and attackers can easily bypass them. Enterprise browsers solve the problem for a small niche group of websites but have adoption friction due to the inconvenience of having a dedicated browser.…
![Artwork](/static/images/128pixel.png)
1 Breaking Down the SMB Threat Landscape and The Value of MSPs with SonicWall 46:22
46:22
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé46:22![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 9: We chat with SonicWall’s Doug McKee about the top 5 threats targeting SMBs based on recent research. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Cybersecurity challenges come in many different flavors regardless of how old your company is or how many employees it houses. Larger companies have to deal with layers upon layers of technology, processes, and the people who support it. Smaller organizations are resource-constrained, often lack the experience or expertise to build a proper program, and typically rely on external support systems. While larger companies may not be nimble, typically, they employ and understand the value of threat intelligence to hone in on risks that could impact the business. They also have larger targets on their back because they are seen as more valuable targets for data, financial drain, and other nefarious purposes. In the same, smaller organizations may not be as valuable as a direct target, but they can be seen as a doorway into these larger companies. It’s for these reasons that supply chain attacks, even older ones, are among the top threats targeting small businesses and startups. This week on AZT, we examine the top five threats targeting startups and small businesses and chat with SonicWall’s Executive Director of Threat Research about the WHY behind them. As a researcher and educator through SANS, Doug McKee shares his perspective on why smaller shops need to consider threat intelligence as part of their cybersecurity program and how MSPs can help fulfill that capability. Top 5 threats to SMBs (According to SonicWall) Log4j (2021) more than 43% of organizations were under attack Fortinet SSL VPN CVE-2018-13379 - 35% of orgs were under attack Heartbleed (2012) - 35% of organizations Atlassian CVE-2021- 26085 - 32 % Vmware CVE-2021 - 21975 - 28% of orgs The Guest: Douglas McKee Doug is an experienced information security professional who possesses extensive technical expertise acquired through involvement in application and system security testing, hardware and software vulnerability research, malware analysis, forensics, penetration testing, red team exercises, protocol analysis, application development, and risk mitigation activities. These technical proficiencies are complemented by adept leadership and communication skills, honed through the leadership of teams and projects, collaboration within both large and small teams, and the composition of technical reports for clients. Doug is recognized for discovering numerous CVEs and regularly speaks at prominent security conferences such as Blackhat, DEFCON, RSA, Hardware.io , and Ekoparty. Additionally, Douglas's research is frequently featured in publications with a wide readership, including Wired, Politico, Bleeping Computer, Security Boulevard, Venture Beat, CSO, Politico Morning eHealth, Tech Republic, and Axios. Key Takeaways None of these vulnerabilities in SonicWall’s research were found or disclosed between 2022-2024, and yet we’re still dealing with them Old vulnerabilities remain a significant threat The most widespread attacks for SMBs include Heartbleed and Log4j vulnerabilities Many widespread vulnerabilities are supply chain vulnerabilities These vulnerabilities are embedded in multiple products and systems Patching vulnerabilities can be complex and costly Compliance and regulatory standards can complicate the process Attackers are becoming increasingly nuanced in their approaches…
![Artwork](/static/images/128pixel.png)
1 Decoding Emerging Threats: MITRE, OWASP, and Threat Intel 25:00
25:00
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé25:00![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 8: AZT and Dr. Zero Trust have a crossover episode where we chat with reps from MITRE and OWASP about challenges associated with emerging threats. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Every few weeks, and occasionally every few days, we hear report of a new novel technique or zero day. Those headlines often create an unnecessary level of fear for organizations, but battle-worn cybersecurity professionals know just because it’s on a headline doesn’t necessarily mean it will impact their environment. That is because emerging threats are just that, new and novel. While zero day threats can be interesting and something to be aware of, most threat actors stick to tried and true methods. But how do we identify what is most impactful to our security posture, attack surface, or insert your other buzzy term? Threat intelligence and the collective defense. And for that, it’s time to introduce our two very equipped guests to navigate this conversation and our guest moderator: This week on AZT, we have representatives from OWASP and MITRE, with Dr Zero Trust leading the charge. The Guests Special Guest Moderator Dr. Chase Cunningham - Dr. Zero Trust and Vice President of Security Market Research for G2 Avi Douglen - Chair of the Global Board of Directors for the OWASP Foundation and Founder and CEO of Bounce Security. Avi is a security architect and software developer, leading development teams in building secure products for over 20 years. As a systems developer and security consultant, over the years Avi has amassed much technical knowledge and understanding of the enterprise security needs at the business level. Avi currently serves on the OWASP Global Board of Directors, and leads the Israel chapter. He is the founder and leader of the the popular AppSecIL security conference, the OWASP Threat Modeling Project, and co-authored the Threat Modeling Manifesto . He is a community moderator on Security StackExchange , and a frequent speaker at industry conferences, recent ones can be seen here . Stanley Barr - Senior Principcal Cyber Researcher for MITRE Dr. Stanley Barr is a three time graduate of University of Massachusetts Lowell. He has a BS in Information Sciences, an MS in Mathematics, and a PhD in Computer Science. He has coauthored published papers in malware analysis, barrier coverage problems, expert systems for network security, and robotic manufacturing. He has spoken at MILCOM, RSA, Bsides Boston, and Defcon. He has been a panelist for conferences. Panels topics have included fighting through real world computer network attacks from both external and internal threats. Currently, he is a Senior Principal Scientist at The MITRE Corporation, a not-for-profit corporation that manages six federally funded research and development centers (FFRDCs). Key Takeaways Emerging threats are interesting, but threat modeling and understanding how systems work to identify potential issues is more impactful AI can pose a threat due to its ability to remember and tailor information, as well as its scalability. The panel emphasized that basic security hygiene is often overlooked, such as enabling 2FA on all accounts. The OWASP Top 10 most common attack vectors are still a significant concern, but they should not be the only focus. The panel argued that responsibility for security breaches should extend beyond the CISO to the entire board and engineering organization. Cybersecurity is a people-centric challenge, and relying on people not to make mistakes is not a sustainable strategy. There is value in investing in proper security measures, as it can save organizations money in the long run.…
![Artwork](/static/images/128pixel.png)
1 Navigating the Ever-Changing Landscape of Cybersecurity Regulations With Lacework and Drata 30:10
30:10
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé30:10![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 7: Though regulation impacting cybersecurity moves slow, when new laws are introduced it often puts significant strain on companies. Lacework’s Tim Chase and Drata’s Matt HIllary discuss navigating the latest broad-sweeping regulations. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . The time between a law being proposed and going into effect may feel like a snails pace, but for cybersecurity and GRC professionals, it may feel like the DNA of an organization may need to change. This week we chat with cybersecurity leaders Tim Chase from Laceworks and Matt Hillary of Drata who delve deep into the ever-evolving landscape of cybersecurity regulations. They explore topics such as the challenges of rapid incident reporting, the role of collaboration in the industry, and the emerging onslaught of AI-related laws and proposed bills. This Week’s Guests Tim Chase, Lacework’s Global Field CISO With over 15 years of experience in the cybersecurity industry, Tim is a Global Field CISO at Lacework, a leading cloud security platform. Tim holds CCSK, CISSP, and GCCC certifications and has a deep understanding of product security, DevSecOps, application security, and the current and emerging threats in the cybersecurity landscape. Matt Hillary, Drata’s CISO Matt Hillary currently serves as VP, Security and Chief Information Security Officer at Drata. With more than 15 years of security experience, Matt has a track record of building exceptional security programs. He most recently served as SVP, Systems and Security and CISO at Lumio, and he’s also held CISO and lead security roles at Weave and Workfront, Instructure, Adobe, MX, and Amazon Web Services. He is also a closet raver. Like really, actually is. TL;DR The landscape of cybersecurity regulations is ever-changing, with new bills and regulations continually emerging which impact businesses of various sizes. The recent rules released by the SEC regarding the time frame for announcing a breach or incident have significantly impacted organizations. The term "material" is a key aspect of these rules, leading to discussions around what constitutes a material cybersecurity incident. The role of a CISO is challenging due to the potential for breaches and incidents despite implementing comprehensive security measures. The additional regulations add further complexity to the role. Transparency and honesty are vital in the event of a breach. Companies that are open about incidents and their impact are viewed more favorably than those that attempt to cover things up. The concept of 'carrot and stick' in regulation is discussed. There are mixed feelings about this approach, with some preferring collaboration and industry-led standards over punitive measures such as fines. However, there is recognition that both incentives (the carrot) and punitive measures (the stick) can drive companies to improve their cybersecurity measures. AI is a hot topic in the cybersecurity field, with potential to assist in quickly sorting through data and reducing false positives. However, the implementation of AI also brings its own set of regulations and challenges.…
![Artwork](/static/images/128pixel.png)
1 Ransomware: To Pay or Not to Pay? 59:08
59:08
Lire Plus Tard
Lire Plus Tard
Des listes
J'aime
Aimé59:08![icon](https://imagehost.player.fm/icons/general/red-pin.svg)
Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not? Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal answer, but how often does life throw us simplicity? Rarely. This week on Adopting Zero Trust, we continue our conversation that looked at the role cyber insurance plays in organizations and drill into one of the most challenging topics associated with it: Ransomware. And, because this is a heavy subject, we brought in two heavy hitters from past episodes to share their perspectives, Kris Lovejoy and Brian Willett TL;DR Paying ransomware ransoms is a complex decision that depends on various factors, such as the potential impact on the organization's services or employees. Having robust and tested backups is crucial in a ransomware situation, but organizations must be prepared for scenarios where ransomware affects backups. Cyber insurance can help mitigate the financial impact of ransomware attacks, but organizations should be cautious and consider all the potential outcomes. Avoiding ransomware attacks requires a proactive approach, which includes implementing hardening standards, good practices around vulnerability management, enforcing compliance on systems, and having good identity protection. AI holds promise in the cybersecurity sector, but its role in ransomware attacks is still in its infancy.…
Season 3, Episode 5: Cyber Insurance may not be the sexiest topic, but it’s an important piece of any mature cyber program. We chatted with a lawyer and a VC who share their perspective. Catch this episode on YouTube , Apple , Spotify , Amazon , or Google . You can read the show notes here . There are many aspects of cybersecurity that are not classified as cool or sexy, but every component plays a role in securing people, data, and businesses. One particular aspect that is often seen as a necessary evil, even more so than policies and documentation, is cyber insurance. On one hand, you have a system that forces backstops to protect the organization in the event of an incident; on the other, requirements to not only remain insured but reduce premiums encourage businesses to invest more in securing the business. This week, we chatted with Karl Sharman of Forgepoint Capital and Andy Moss of Reed Smith to better understand the role cyber insurance plays today.…
Bienvenue sur Lecteur FM!
Lecteur FM recherche sur Internet des podcasts de haute qualité que vous pourrez apprécier dès maintenant. C'est la meilleure application de podcast et fonctionne sur Android, iPhone et le Web. Inscrivez-vous pour synchroniser les abonnements sur tous les appareils.