In this episode, we are joined by Lea Cure Thorpe and Kayne McGladrey to unpack the less-discussed consequences of recent security decisions: RTO exposure, endpoint blind spots, tooling overload, analyst burnout, and the slow erosion of junior talent (thanks AI).

Rather than going too crazy on hot takes and obvious trends, we focus in on operational reality, business risk, and what security leaders need to confront before these issues compound further.

Where to Skim

02:00 | Is the perimeter really dead?

06:30 | RTO fallout and the return of local network risk

12:30 | Endpoint sprawl, dirty devices, and SOC fatigue

18:30 | Cloud tooling, visibility gaps, and false assurances

26:00 | AI adoption: risk appetite vs. reality

33:30 | Identity, agentic AI, and trust amplification risk

41:00 | Workforce erosion and the efficiency trap

50:30 | The business math CISOs can’t avoid

58:30 | Career development, communication, and relevance

Hosted on Acast. See acast.com/privacy for more information.

01:30 – What Whisper Leak Actually Is
02:30 – Understanding Side-Channel Attacks
04:00 – Why LLMs Are Uniquely Vulnerable
08:00 – Stream Ciphers vs Block Ciphers
13:30 – “Did You Break Encryption?” Clearing Up Misconceptions
16:00 – Fixes & Mitigations Across LLM Vendors
18:30 – Why Some Vendors Were More Vulnerable Than Others
20:00 – Could High-End Adversaries Still Pull This Off?
24:00 – How API Users Can Protect Themselves
25:00 – Designing LLM Systems with Side Channels in Mind

Guests: Jonathan (JBO) Bar Or, Principal Security Researcher, Microsoft Threat Intelligence, who just joined CrowdStrike

Hosts: Elliot Volkman & Neal Dennis

Hosted on Acast. See acast.com/privacy for more information.

The discussion centers around the philosophical and strategic approaches to handling incidents and breaches, especially in the operational technology (OT) realm. Branson highlights the importance of understanding what needs protection, the integration of IT and OT security, and the crucial role of threat intelligence. They also explore the evolving need for converging physical and digital security data to manage risks effectively.

01:37 Starting Point for Protecting Critical Infrastructure

04:52 Funding and Resource Allocation for Cybersecurity

10:57 Threat Intelligence and Incident Response

16:25 IT and OT Convergence

23:47 Discussing Employee and Equipment Management

26:19 Integrating Physical and Cyber Security

34:39 Proactive Security Measures in New Constructions

40:46 Balancing Rapid Response and Availability

Hosted on Acast. See acast.com/privacy for more information.

01:16 Shadows within shadows

04:15 AI in Approved Solutions

09:14 Enterprise Browser and Security

14:25 Transition to Browser-Based Applications

16:23 Enterprise Browser Capabilities

18:45 Data Protection and Shadow IT

24:39 Shepherding Data in the Enterprise Browser

25:17 Policy Perspectives on AI and Data Flow

28:16 Exploring SBOM and AI Integration

35:39 Browser Security and Application Boundaries

41:40 BYOD and Privacy Concerns

44:48 Third-Party Scenarios and Onboarding

Hosted on Acast. See acast.com/privacy for more information.

Live from ThreatLocker’s Zero Trust World (ZTW), cybersecurity heavyweights Dave Bittner, host of CyberWire Daily and Dr. Chase Cunningham AKA Dr. Zero Trust shared their unfiltered thoughts on the state of cybersecurity, AI, and government regulations. From the shifting landscape of compliance enforcement to the role of hitting critical mass of AI in both defense and cybercrime, we can expect an extraordinary level of change in the years ahead.

01:37 Cybersecurity Landscape Overview

01:58 Government and Cybersecurity

02:39 Leadership and Appointments in Cybersecurity

03:47 Future of CISA and Compliance

06:41 Managing Cybersecurity News

14:54 The Role of LLMs in Cybersecurity

16:22 Global Perspective on AI and LLMs

18:47 Reflecting on Past Technological Predictions

20:18 The Double-Edged Sword of AI and Surveillance

24:21 The Dark Side of Technological Advancements

26:17 Debating the Term 'AI' and Its Implications

28:43 Historical Anecdotes and Unanswered Questions

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.

To properly kick off season four, we have the privilege of chatting with two wonderful guests:

Lawrence Pingree, VP of Technical Marketing at Dispersive, but you are more likely to know his name from his time at Gartner. However, he has a varied background ranging from CTO to security engineer, so don’t let that marketing line in his title fool you.

Oliver Plante, VP of Support at ThreatLocker, has around 15-20 years of IT under his belt. He also has seen a thing or two when it comes to implementing new cybersecurity strategies

03:21 Predictions for the Year Ahead

04:06 Zero Trust and Least Privilege

05:40 The Future of Cyber Defense

07:21 AI and Cybersecurity

08:41 Threat Intelligence and Preemptive Defense

09:50 Challenges and Innovations in Cybersecurity

14:23 The Role of AI in Cyber Attacks

26:18 Quantum Computing: Threat or Savior?

29:31 Passwordless Security: The Future

30:57 Challenges of Deepfake Technology and Passwordless Security

33:03 Blockchain and Its Applications in Security

35:33 Debate on Password Management Practices

38:03 User Responsibility and Security Automation

47:50 Government's Role in Cybersecurity

57:14 Future of Cybersecurity and Zero Trust

Hosted on Acast. See acast.com/privacy for more information.

Neal and I are excited to welcome you back to AZT as we kick off our fourth season. After four years of trying out different formats and episodes, including at least an entire season terrorizing vendors for slapping Zero Trust on their box as if it were something you could buy, we’re ready to narrow our focus a bit.

Hosted on Acast. See acast.com/privacy for more information.

This week, we chat with Courtney Hans, VP of Cyber Services at AmTrust Financial Services, and Evgeniy Kharam, author of Architecting Success: The Art of Soft Skills, who help us explore how non-technical skills are vital in shaping the careers of cybersecurity professionals.

Our guests share the importance of effective communication, emotional intelligence, and adaptability. The hosts and guests share personal anecdotes, training tips, and the necessity of bridging technical prowess with essential soft skills to improve stakeholder engagement and career advancement. The episode emphasizes the value of being comfortable with discomfort and soliciting feedback to enhance one’s professional journey in cybersecurity.

Hosted on Acast. See acast.com/privacy for more information.

You can read the show notes here.

In the world of cybersecurity journalism, you can broadly divide it into four competing forces: reporters, communications teams, researchers, and readers. Each requires the other to accomplish its goals, but they all have very different priorities and goals.

• Journalists have a duty to inform the public about security-related events.
• Communication teams have a duty to inform the public about related incidents and research, but in a controlled setting.
• Researchers help provide answers to communication teams and journalists.
• Readers want to be informed of information that impact them, and their habits shape what kind of reporting is invested in the most.

This week we explore some of these dynamics by bringing together a panel representing comms, journalism, and research to discuss the game of tug-of-war during incident response and incident reporting.

Danny Palmer was a long-standing cybersecurity reporter at ZDNet prior to recently joining DarkTrace, Josh Swarz is the Senior Communications Manager at Microsoft focusing on threat intelligence, our host Neal Dennis is former NSA and has lived many lives around either keeping secrets or uncovering them, and producer Elliot Volkman has been a reporter for two decades and works with Josh on elevating research at Microsoft Threat Intelligence.

Hosted on Acast. See acast.com/privacy for more information.

After this, we will be back to our regularly produced AZT episodes. The last episodes of our pilot for GRC Uncensored can be found on your favorite podcast app or newsletter on Substack.

Hosted on Acast. See acast.com/privacy for more information.

This pilot season will elevate conversations about GRC that are often buried under millions of dollars in marketing spend. No boring talks about controls or frameworks, just unfiltered discussions with auditors and practitioners in the GRC space. We'll be back to our regular AZT episodes in a couple of weeks.

-----

In the first episode of 'GRC Uncensored,' hosts Troy Fine, dubbed the 'GRC Meme King,' and Elliot Volkman, alongside guest Kendra Cooley dive into the complexities of Governance, Risk, and Compliance (GRC) in cybersecurity. The discussion unravels the 'love-hate' relationship many security professionals have with compliance frameworks like SOC 2, exploring how they have become commoditized and possibly devalued over time.

The conversation touches upon the challenges security practitioners face in conveying the true value of GRC to businesses, the potential pitfalls of 'SOC in a box' offerings, and the broader implications of compliance becoming a 'check the box' exercise. Moreover, the episode delves into the broader regulatory landscape and the ongoing debates about the role of government regulations in cybersecurity compliance. This candid dialogue sets the stage for future episodes that promise further to dissect the nuances of cybersecurity audits and standards.

00:00 Welcome to GRC Uncensored

01:34 Introducing Kendra Cooley

02:05 Love-Hate Relationship with GRC

03:16 The SOC 2 Debate

04:33 Challenges with SOC 2 Audits

09:10 The Value of SOC 2 in the Industry

12:04 The Evolution of Compliance Frameworks

20:39 False Sense of Security in Compliance

24:46 The Buzz Around AI and Quantum

25:10 Staying Updated as a Security Professional

26:45 Challenges in Penetration Testing and Vendor Assessments

27:37 Compliance and Its Impact on Security

30:10 Government Regulations and Their Effectiveness

32:23 The Complexity of Privacy Laws

38:29 The Role of GRC Teams in Risk Management

42:30 Concluding Thoughts and Future Episodes

Hosted on Acast. See acast.com/privacy for more information.

They explore pre-adoption preparation, aligning organizational actions, and the importance of education in security. Additionally, the conversation highlights the 'assume breach' perspective and how concepts like default deny and least privilege are essential. With real-world examples and anecdotes, they provide actionable insights on implementing Zero Trust strategies effectively. Tune in to learn about the foundational steps necessary to transition into a Zero Trust environment.

This is the first of a three-part mini-series, so stay tuned as we explore more aspects of how to prepare your organization for adopting a Zero Trust strategy.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.

This week on Adopting Zero Trust (AZT), we highlight a significant cybersecurity risk focused on the notorious Log4j vulnerability and the growing concern around shadow IT. Featuring expert insights from Etay Maor, the Chief Cybersecurity Strategist at Cato Networks, the conversation initially looks into the persistent exploitation methods, the importance of knowing one’s cybersecurity environment, and strategic approaches to mitigating risks.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.

Welcome back to Adopting Zero Trust or AZT. In our latest episode, we assembled a distinguished panel to dig into a timely topic affecting the cybersecurity landscape but has the fog of war wrapped around it. Today’s conversation centered around the recent developments in cybersecurity regulations and their potential impacts, ignited by the Supreme Court overturning Chevron Deference. This, of course, has other potential impacts on all regulation types enforced and shaped by federal agencies, but our focus is, of course, on cybersecurity, privacy, and AI.

We welcome back Ilona Cohen, Chief Legal and Policy Officer at HackerOne, who joined us last year to discuss the National Cybersecurity Strategy. Ilona is also the former General Counsel for OMB. We are also joined by the GRC meme king, Troy Fine, the Director of SOC and ISO Assurance Services at Gills Norton. Beyond the memes, Troy takes a practical perspective on regulations and acts as our voice for those who may be most immediately impacted.

• Chevron Deference overturned: The Supreme Court's decision removes the requirement for courts to defer to federal agencies' interpretations of ambiguous statutes and now relies on the courts.
• Increased regulatory uncertainty: This ruling may lead to more challenges to existing and future regulations, potentially affecting cybersecurity and AI policies.
• State vs. Federal regulation: The uncertainty at the federal level might prompt states to act more quickly on issues like AI and cybersecurity, potentially creating a patchwork of regulations.
• Impact on AI regulation: With about 40 federal bills addressing AI in the pipeline, the ruling could complicate the process of creating comprehensive federal AI regulations.
• Cybersecurity implications: Existing and proposed cybersecurity regulations, such as the Cyber Incident Reporting for Critical Infrastructure Act, may face new challenges.
• Business concerns: While some business organizations applauded the ruling, the resulting regulatory uncertainty could be problematic for companies trying to plan and comply with regulations.
• Expertise concerns: There are worries that courts may lack the technical expertise to make decisions on complex technological issues like AI without deferring to agency experts.
• Potential for innovation: The regulatory uncertainty might create a wild west period for AI, potentially fostering innovation before more stringent regulations are imposed.
• Self-regulation importance: In the absence of clear federal regulations, industry self-regulation initiatives may become more significant, especially in rapidly evolving fields like AI.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.

Every organization relies on some form of technology to run, and each tool you add increases the risk of vulnerabilities causing problems. If you don’t stay on top of patching, you increase the odds of a bad actor finding their way more easily within your network.

This week, we chat with Tyler Reguly, a senior manager of security research at Fortra, who shares insights from his 18 years in vulnerability management. Tyler discusses the importance of staying on top of patching to maintain a Zero Trust strategy, the differences between vulnerability and patch management, and emphasizes that the Common Vulnerability Scoring System (CVSS) measures severity, not risk.

We also briefly nerd out about the significance of groups like the Canadian Cyber Threat Exchange (CCTX) for knowledge sharing and collaboration in cybersecurity. And then, we wrap things up by exploring the efficacy of existing security policies and benchmarks, such as CIS and DISA STIGs, and the role of vendor relationships in maintaining effective security practices.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

For nearly three decades, social engineering, particularly phishing, has been one of the most impactful and financially draining cyber threats. Between security awareness training, email security gateways, generative AI, enterprise browsers, and a slew of other tech like EDRs and XDRs, social engineering has yet to be thoroughly thwarted. The reason for that is straightforward enough: social engineering is a psychological threat, not just a technological one.

In our last round of interviews from RSA, we chatted with Vivek Ramachandran, the founder of SquareX, who is attempting to tackle the challenge. Vivek also walks us through a more realistic perspective of how threat actors use generative AI today, which goes beyond the more unique what-if scenarios we’ve seen in headlines in the past two years.

• Social engineering and phishing attacks remain a significant threat, and everyone can be a target. The sophistication of these attacks has increased due to advances in AI.
• AI can craft messages that sound remarkably like someone the recipient knows, enabling rapid scalability.
• Social media platforms are becoming common channels for launching phishing attacks. Attackers exploit the trust that users place in these platforms and their contacts.
• Vivek Ramachandran's company, SquareX, deploys a browser extension that can attribute attacks and detect and block them in real-time, providing valuable information to the enterprise.
• Traditional technologies like Secure Web Gateways (SWG) have matured, and attackers can easily bypass them.
• Enterprise browsers solve the problem for a small niche group of websites but have adoption friction due to the inconvenience of having a dedicated browser.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

Cybersecurity challenges come in many different flavors regardless of how old your company is or how many employees it houses. Larger companies have to deal with layers upon layers of technology, processes, and the people who support it. Smaller organizations are resource-constrained, often lack the experience or expertise to build a proper program, and typically rely on external support systems.

While larger companies may not be nimble, typically, they employ and understand the value of threat intelligence to hone in on risks that could impact the business. They also have larger targets on their back because they are seen as more valuable targets for data, financial drain, and other nefarious purposes. In the same, smaller organizations may not be as valuable as a direct target, but they can be seen as a doorway into these larger companies. It’s for these reasons that supply chain attacks, even older ones, are among the top threats targeting small businesses and startups.

This week on AZT, we examine the top five threats targeting startups and small businesses and chat with SonicWall’s Executive Director of Threat Research about the WHY behind them. As a researcher and educator through SANS, Doug McKee shares his perspective on why smaller shops need to consider threat intelligence as part of their cybersecurity program and how MSPs can help fulfill that capability.

• Log4j (2021) more than 43% of organizations were under attack

• Fortinet SSL VPN CVE-2018-13379 - 35% of orgs were under attack

• Heartbleed (2012) - 35% of organizations

• Atlassian CVE-2021- 26085 - 32 %

• Vmware CVE-2021 - 21975 - 28% of orgs

Doug is an experienced information security professional who possesses extensive technical expertise acquired through involvement in application and system security testing, hardware and software vulnerability research, malware analysis, forensics, penetration testing, red team exercises, protocol analysis, application development, and risk mitigation activities. These technical proficiencies are complemented by adept leadership and communication skills, honed through the leadership of teams and projects, collaboration within both large and small teams, and the composition of technical reports for clients.

Doug is recognized for discovering numerous CVEs and regularly speaks at prominent security conferences such as Blackhat, DEFCON, RSA, Hardware.io, and Ekoparty. Additionally, Douglas's research is frequently featured in publications with a wide readership, including Wired, Politico, Bleeping Computer, Security Boulevard, Venture Beat, CSO, Politico Morning eHealth, Tech Republic, and Axios.

• None of these vulnerabilities in SonicWall’s research were found or disclosed between 2022-2024, and yet we’re still dealing with them

• Old vulnerabilities remain a significant threat

• The most widespread attacks for SMBs include Heartbleed and Log4j vulnerabilities

• Many widespread vulnerabilities are supply chain vulnerabilities

• These vulnerabilities are embedded in multiple products and systems

• Patching vulnerabilities can be complex and costly

• Compliance and regulatory standards can complicate the process

• Attackers are becoming increasingly nuanced in their approaches

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

Every few weeks, and occasionally every few days, we hear report of a new novel technique or zero day. Those headlines often create an unnecessary level of fear for organizations, but battle-worn cybersecurity professionals know just because it’s on a headline doesn’t necessarily mean it will impact their environment. That is because emerging threats are just that, new and novel. While zero day threats can be interesting and something to be aware of, most threat actors stick to tried and true methods.

But how do we identify what is most impactful to our security posture, attack surface, or insert your other buzzy term? Threat intelligence and the collective defense. And for that, it’s time to introduce our two very equipped guests to navigate this conversation and our guest moderator:

This week on AZT, we have representatives from OWASP and MITRE, with Dr Zero Trust leading the charge.

Dr. Chase Cunningham - Dr. Zero Trust and Vice President of Security Market Research for G2

Avi Douglen - Chair of the Global Board of Directors for the OWASP Foundation and Founder and CEO of Bounce Security.

Avi is a security architect and software developer, leading development teams in building secure products for over 20 years. As a systems developer and security consultant, over the years Avi has amassed much technical knowledge and understanding of the enterprise security needs at the business level. Avi currently serves on the OWASP Global Board of Directors, and leads the Israel chapter. He is the founder and leader of the the popular AppSecIL security conference, the OWASP Threat Modeling Project, and co-authored the Threat Modeling Manifesto. He is a community moderator on Security StackExchange, and a frequent speaker at industry conferences, recent ones can be seen here.

Stanley Barr - Senior Principcal Cyber Researcher for MITRE

Dr. Stanley Barr is a three time graduate of University of Massachusetts Lowell. He has a BS in Information Sciences, an MS in Mathematics, and a PhD in Computer Science. He has coauthored published papers in malware analysis, barrier coverage problems, expert systems for network security, and robotic manufacturing. He has spoken at MILCOM, RSA, Bsides Boston, and Defcon. He has been a panelist for conferences. Panels topics have included fighting through real world computer network attacks from both external and internal threats. Currently, he is a Senior Principal Scientist at The MITRE Corporation, a not-for-profit corporation that manages six federally funded research and development centers (FFRDCs).

• Emerging threats are interesting, but threat modeling and understanding how systems work to identify potential issues is more impactful
• AI can pose a threat due to its ability to remember and tailor information, as well as its scalability.
• The panel emphasized that basic security hygiene is often overlooked, such as enabling 2FA on all accounts.
• The OWASP Top 10 most common attack vectors are still a significant concern, but they should not be the only focus.
• The panel argued that responsibility for security breaches should extend beyond the CISO to the entire board and engineering organization.
• Cybersecurity is a people-centric challenge, and relying on people not to make mistakes is not a sustainable strategy.
• There is value in investing in proper security measures, as it can save organizations money in the long run.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

The time between a law being proposed and going into effect may feel like a snails pace, but for cybersecurity and GRC professionals, it may feel like the DNA of an organization may need to change. This week we chat with cybersecurity leaders Tim Chase from Laceworks and Matt Hillary of Drata who delve deep into the ever-evolving landscape of cybersecurity regulations. They explore topics such as the challenges of rapid incident reporting, the role of collaboration in the industry, and the emerging onslaught of AI-related laws and proposed bills.

Tim Chase, Lacework’s Global Field CISO

With over 15 years of experience in the cybersecurity industry, Tim is a Global Field CISO at Lacework, a leading cloud security platform. Tim holds CCSK, CISSP, and GCCC certifications and has a deep understanding of product security, DevSecOps, application security, and the current and emerging threats in the cybersecurity landscape.

Matt Hillary, Drata’s CISO

Matt Hillary currently serves as VP, Security and Chief Information Security Officer at Drata. With more than 15 years of security experience, Matt has a track record of building exceptional security programs. He most recently served as SVP, Systems and Security and CISO at Lumio, and he’s also held CISO and lead security roles at Weave and Workfront, Instructure, Adobe, MX, and Amazon Web Services. He is also a closet raver. Like really, actually is.

1. The landscape of cybersecurity regulations is ever-changing, with new bills and regulations continually emerging which impact businesses of various sizes.
2. The recent rules released by the SEC regarding the time frame for announcing a breach or incident have significantly impacted organizations. The term "material" is a key aspect of these rules, leading to discussions around what constitutes a material cybersecurity incident.
3. The role of a CISO is challenging due to the potential for breaches and incidents despite implementing comprehensive security measures. The additional regulations add further complexity to the role.
4. Transparency and honesty are vital in the event of a breach. Companies that are open about incidents and their impact are viewed more favorably than those that attempt to cover things up.
5. The concept of 'carrot and stick' in regulation is discussed. There are mixed feelings about this approach, with some preferring collaboration and industry-led standards over punitive measures such as fines. However, there is recognition that both incentives (the carrot) and punitive measures (the stick) can drive companies to improve their cybersecurity measures.
6. AI is a hot topic in the cybersecurity field, with potential to assist in quickly sorting through data and reducing false positives. However, the implementation of AI also brings its own set of regulations and challenges.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal answer, but how often does life throw us simplicity? Rarely.

This week on Adopting Zero Trust, we continue our conversation that looked at the role cyber insurance plays in organizations and drill into one of the most challenging topics associated with it: Ransomware. And, because this is a heavy subject, we brought in two heavy hitters from past episodes to share their perspectives, Kris Lovejoy and Brian Willett

• Paying ransomware ransoms is a complex decision that depends on various factors, such as the potential impact on the organization's services or employees.
• Having robust and tested backups is crucial in a ransomware situation, but organizations must be prepared for scenarios where ransomware affects backups.
• Cyber insurance can help mitigate the financial impact of ransomware attacks, but organizations should be cautious and consider all the potential outcomes.
• Avoiding ransomware attacks requires a proactive approach, which includes implementing hardening standards, good practices around vulnerability management, enforcing compliance on systems, and having good identity protection.
• AI holds promise in the cybersecurity sector, but its role in ransomware attacks is still in its infancy.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

There are many aspects of cybersecurity that are not classified as cool or sexy, but every component plays a role in securing people, data, and businesses. One particular aspect that is often seen as a necessary evil, even more so than policies and documentation, is cyber insurance. On one hand, you have a system that forces backstops to protect the organization in the event of an incident; on the other, requirements to not only remain insured but reduce premiums encourage businesses to invest more in securing the business.

This week, we chatted with Karl Sharman of Forgepoint Capital and Andy Moss of Reed Smith to better understand the role cyber insurance plays today.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

Zero Trust is a concept, a strategy, a philosophy, and, for some poor souls, a solution you can buy (it’s not). Through our three seasons, we have heard about MVPs, learned from the godfather of Zero Trust, been aided by Dr Zero Trust, and even heard from current and former federal officials about their stance on the concept. However, we have yet to touch on the current an future state of Zero Trust, and for that, we look to Forrester Principal Research Analyst on Zero Trust, David Holmes.

Prior to joining Forrester, David spent a decade researching, writing, and speaking about cybersecurity topics for network and application security vendors. Before entering the cybersecurity space, he was a C/C++ software developer specializing in authentication and authorization, network protocols, and cryptography. So you could say he knows a thing or two about the subject at hand.

• Holmes explains that Zero Trust's core principles remain unchanged: all networks are untrusted, least privilege access is enforced, and everything is inspected and monitored.
• The COVID-19 pandemic has accelerated the adoption of Zero Trust as organizations were forced to work remotely and faced VPN overloads.
• David shares his perspective on the current and future state of Zero Trust, as well as areas he would like to see the vendor market seek to solve.
• The biggest example of successful Zero Trust implementation is Google. Since implementing Zero Trust, no major breaches have been reported.
• In addition to Google, there is a smaller organization that successfully implemented Zero Trust using existing tools, indicating that Zero Trust can be achieved without significant financial investment.
• However, achieving full Zero Trust is a journey rather than a destination, similar to cybersecurity itself. It's an ongoing process of adaptation and improvement.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

This week on Adopting Zero Trust (AZT) we chat with Kane Narraway, the head of Head of Enterprise Security at Canva. Prior to his current role. Kane has been adopting Zero Trust for around a decade, starting with the UK government, and later to organizations like Shopify, Atlassian, and BT. You could say he’s seen a thing or two, and has absolutely been part of the evolutions occurring within cybersecurity and Zero Trust. Kane walks, crawls, and runs us through how he has built out Zero Trust strategies and recommends where organizations get started.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

It’s a mystery as old as time: the cybersecurity and technology budget and acquisition strategy. How are they formed? How are these projects prioritized? How are internal teams proposing changes and asking for new dollars (and likely not getting them)? This week, we chat with someone at the heart of the matter for their business who walks us through how they build their security and information roadmap, or in what I lovingly call: quit bugging the C-suite.

David Weisong is the CIO for Energy Solutions and has a background in software development, DevOps, and managing IT functions, which makes him the perfect candidate to properly discuss the ins and outs of cybersecurity and IT roadmaps.

Hosted on Acast. See acast.com/privacy for more information.

A new year, a new season, and plenty of new threats to impact the world of cybersecurity. This week we break from our typical conversations about modern cybersecurity strategies and concepts to focus on one of the most important aspects of our space: people.

People are the why behind what we do. We protect, support, and educate them about the dangers that lurk online. However, cybersecurity is also driven by people, and for new entries into our field, it can feel nearly impossible to break in. This week we turn to two experts who lived the lives of practitioners and shifted their energy toward telling amazing stories that drive our industry forward. This duo has built a masterclass on what it means to be in cybersecurity and has guided countless people through every nook and cranny.

And with that, we’re excited to introduce Hacker Valley Media’s Ron Eddings and Chris Cochran who discuss breaking down the barriers to cybersecurity and why practitioners need to invest in soft skills.

Read more at adoptingzerotrust.com

Hosted on Acast. See acast.com/privacy for more information.

You know what they say, you save the best for last. As we wrap season two of Adopting Zero Trust, we take a shift from our standard conversations about modern cybersecurity strategies and look back at some of the history that got us to where we are today.

This week we chat with Hector Monsegur, Co-Founder of LulzSec, and current Director of Research for Alacrinet, who discusses his journey from hacktivism to white hat pen testing.

In May of 2011, a series of cyber attacks swept the globe. Starting with Fox News, after a broadcaster called rapper Common ‘vile’, then an attack on X Factor (yes, the show Joe Rogan used to host) leaking contestant data, and through to taking down the Sony Playstation network. A, at the time, black hat hacking group was founded and picked off targets for laughs (lulz) rather than financial gain. Among the group was co-founder Hector Monsegur, better known by his alias Sabu, who shaped the movement into cause-based cyber attacks or hacktivism.

But the story starts well before the formation of Lulzsec, and before the FBI knocked on Hector’s door. It stretches back to a time when there weren’t resources for people to learn how to hack, pen test, and become cybersecurity practitioners didn’t exist, unlike the endless amount of certs and higher education programs that exist today.

• The evolution of one's ethical stance: Hector's journey highlights the importance of questioning and reassessing one's actions and beliefs.
• Collaboration and collective impact: Working together can amplify efforts and create positive change, even in the realm of cybersecurity.
• Balancing curiosity and responsibility: Exploring technology and hacking skills should be accompanied by a sense of responsibility and ethical considerations.

The season finale of AZT is here, and we couldn’t have found a more interesting way to wrap things up. Hector has such a unique and storied past, and we can’t recommend his own series enough. The very agent who knocked on his door joins him as the cohost on Hacker and the Fed.

We also can’t thank you, our listeners, enough for another year of the show. Neal and I do this as a passion project first and foremost, but as we seek to attract harder-to-reach guests, we are also building in some ad opportunities. We are ensuring that doesn't impact how we highlight the practitioner's perspective on modern cybersecurity strategies, too.

Speaking of growing, that other podcast I mentioned last episode? Mastering the Art of Failing can now be found at failingpod.com or on your favorite podcast app. The pilot series will highlight people who have found success in their lives, but not without some challenges along the way. Our first guest, Glen Hellman, was part of several successful exits… and quite a few not-so-successful flops. As the series progresses we’ll expand beyond just career-oriented stories and dig into physical, mental, and other states of pushing boundaries and levels of success.

Hosted on Acast. See acast.com/privacy for more information.

You can read the show notes here and subscribe to updates.

In the latest episode of AZT, Evgeniy Kharam, a founder, CISO, architect, and podcast producer, joins the discussion to talk about the rise of Enterprise (Secure) browsers. The conversation explores the importance of browser security and its relevance to the Zero Trust framework.

1. The birth of the enterprise browser - Remote Browser Isolation: Evgeniy explains the concept of remote browser isolation, which creates a layer of separation between users and potentially harmful websites. By browsing through a remote browser, users can mitigate the risks associated with malware and other online threats.
2. Customized Browser Profiles: The conversation delves into the idea of using customized browser profiles to enhance security and control access. By providing contractors or temporary workers with specific browser profiles, organizations can ensure that only authorized individuals can access certain applications or data.
3. Managed Device and Compliance: The discussion highlights the trend of using managed devices and the impact on compliance requirements. With the ability to enforce the use of specific browsers through Mobile Device Management (MDM), organizations can strengthen security measures and simplify compliance audits.

Hosted on Acast. See acast.com/privacy for more information.

The word AI, much like Zero Trust, has come with a lot of baggage in the past few years. It’s a term that’s been misused, slapped on the front of startups’ overpriced booths at RSA and Black Hat, and it feels like every cybersecurity product under the sun now supports it in some flavor or fashion. It's the same cycle we’ve been in the past, but this time everyone is jumping in. This week we are getting in front of the bandwagon and chat with a pioneer in the cybersec AI space who has seen how the technology has been evolving over the past decade, Oliver Tavakoli, the CTO of Vectra AI.

“My contemporaneous definition of AI at any given moment in time is there's got to be enough pixie dust in it for people to view it as somewhat magical; so that's my incredibly technical definition. I'd say over the past 10-15 years, that is typically meant neural nets-that has those have been a stand in-and and obviously, neural nets can be used for discrimination [As opposed to a generative AI model]. Again, the example of cat (You search “Cat” on Google images, and it returns results that show images, in theory, of only cats) is an example of how they can be used in a generative sense, which is really the latest revolution that you see. And then the other thing is how broadly applicable they are and how well read they are.

Tavakoli’s definition of AI provides the context for how AI is primarily applicable today in cybersecurity. But, in the past, typically these concepts were held back by technology. There is also a stark difference between what has been referred to as AI, or a discriminative AI model, and what is most popular today, or generative AI.

It turns out in these large language models, as you make them bigger, there was always kind of the question of if you make them big enough. Will they just plateau or will they take off? It really wasn't a foregone conclusion that if you made them big enough they would take off, but it was a bet that was placed and a bet that turned out to have some merit to it.

And that is the crux of today’s interview: what was and will be the past and future impact of AI on cybersecurity?

• AI plays a significant role in both offensive and defensive cybersecurity strategies.
• Threat actors use AI to enhance their attacks, making them more believable and harder to detect.
• Defensive uses of AI include improving workflow and making SOCs more productive.
• Organizations must always assume that compromise is possible and focus on minimizing the impact of breaches.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

There are several guiding concepts that make it easier for organizations to build a Zero Trust strategy. The first that typically come to mind come from CISA and NIST. These core elements, ranging from the five pillars through to building a ZT architecture, offer a vendor-neutral path towards removing implicit trust. Organizations like CSA also do a great job of expanding upon this knowledge with more contributions from technology and service providers. This week, we take our first step towards understanding what goes on behind these policies, standards, and recommendations, and for that we have a well-equipped guest to walk us through it.

Zack Butcher is one of the founding engineers over at Tetrate, a vendor that provides a consistent way to connect and protect thousands of individual microservices and deliver Zero Trust security operations across any environment. They also have their roots stemming from a team that worked at Google, which many of you are likely familiar with their connection to Zero Trust through BeyondCorp. However, he is also the co-author on NIST special publication 800-207A. If that looks familiar, it’s because it’s an expansion of the earlier mentioned core NIST resource, 800-207.

NIST SP 800-207A builds upon that core architecture piece and hones in on access controls in cloud-native applications in multi-cloud environments. That is a bit of a mouthful, so here is Zack on what you need to know.

When we talk about Zero Trust at runtime, there's a lot of FUD and a frustrating amount of FUD in the in the marketplace and a lot of vendors claiming certain things are Zero Trust and not.

And you know, in that landscape, I wanted to really kind of push for people to have a very clear definition of Zero Trust at runtime, and it's a minimum definition. Let me be clear. You can do a whole lot more than what we talk about in the SP, but I try and give a very, very simple minimum definition. And that is five policy checks at runtime, and we call that identity based segmentation.

Butcher also co-authored NIST SP 800-204A that focuses on building secure microservices-based applications using service-mesh architecture. So this week, Neal and Butcher ran down the rabbit hole of expanding upon these core Zero Trust resources, implications of a more secure environment at runtime, and identity-based segmentation.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

In the past few years, supply chain attacks and their impacts have or will soon overtake that of the damage done by ransomware. It’s of no surprise then that APIs are a critical attack vector that threat actors like to exploit, yet many organizations do not have a good understanding of how many doors they have running into their data.

This week we chat with the godfather of Zero Trust, Dr. Zero Trust, and a chief security officer about the current state of API security maturity. Considering our guests, we, of course, also took the opportunity to chat a bit about Zero Trust's history.

This week we have three very special guests:

• John Kindervag, the creator (godfather) of Zero Trust
• Chase Cunningham, AKA Dr Zero Trust, and the now VP of Market Research for G2
• Richard Bird, Traceable AI’s Chief Security Officer

• Like any other cybersecurity concept, APIs must have an asset inventory
• There is enough margin of error tied to the intended use of APIs that require continuous monitoring/verification
• There is a current maturity gap associated with securing the use of APIs in the name of speed and innovation, and often there is not a well-established owner

We will be taking a publishing break for the month of September as my daughter has arrived, and I will need to catch up on all the sleep I can get. We should be back in October and run through until the holiday break before we wrap season two. I’m also working on a few experimental podcast series during my parental leave, so stay tuned. At least one in particular should be of interest to our audience here. Also, if you work for a cybersecurity org and are interested in launching a podcast, slide into my inbox if you need a hand.

Hosted on Acast. See acast.com/privacy for more information.

True or False: The concept of passwordless is new. False.

This is shocking, we know.

Considering the amount of hype around the concept, it certainly can feel like a new concept since the masses are becoming more familiar with it; however, the message is a bit jumbled.

For ages, we’ve used things like biometrics (fingerprints or iris scans) and even a PIN to access money on a debit card, but more recently, there has been an increase in misrepresentations about how secure passwordless technology is, simply because there is not a password involved. As cybersecurity practitioners, we know that the simple removal of passwords alone won’t prevent a successful phishing attack, which means multifactor authentication needs to play a role in getting us closer to the Zero Trust concept.

Fortunately, we have a guest this week who is well-equipped to help us navigate the ins and outs of passwordless concepts, passkeys, and the split between identification and authentication. Derek Hanson is the Vice President of Solutions Architecture and Alliances at Yubico, who has spent the last 8 years contributing to the shaping of a physical piece of hardware, Yubikeys, designed to improve authentication. Prior to that, he worked at Costco, focusing on identification and IAM. But first, let’s improve your personal security stack…

If you already have a Yubikey, you already know there is always an opportunity for one more in your stack. If you’re new to Yubico’s offering, this is the perfect time for you to grab your very own YubiKey 5C NFC and gain phishing-resistant MFA. It even works with most password managers, too.

To enter, we’ve given you a bunch of options on how you can increase your odds of winning one of two keys. You must be based in the US, though.

[**Enter the giveaway here](https://www.rafflecopter.com/rafl/display/c9435e741/?).**

We’ll close the giveaway in about two weeks and announce it in our next episode.

Hosted on Acast. See acast.com/privacy for more information.

At the heart of Zero Trust is the idea of prevention. If you don’t trust anything or any person, you are playing in the same pool as risk avoidance. While total risk avoidance isn’t feasible, Zero Trust gets us closer to reality. Now, map this up to an organization with a global footprint, with significant infrastructure sprawl, and you’ve got one very complex scenario on your hands.

This brings us to this week’s guest, Janet Heins, iHeartMedia's Global CISO, who will help us navigate the philosophy of cybersecurity prevention on a global scale.

Putting The Conversation Into Context

With more than a decade behind her as a CISO, Heins’ experience stems from working with some massive brands. As a leader, she’s particularly passionate about translating business needs into technology processes or solutions, while at the same time bridging the language barriers that often stem between IT, cybersecurity, and the other adjacent areas.

iHeartMedia has over 11,000 employees and a vast physical and digital footprint. With 860 radio stations across the US and 20,000 events annually, the company is part of the emergency broadcast system and has to be ready to respond to threats quickly.

At a global level, Heins makes it clear that strong detection and response capabilities, as well as prevention measures, are critical elements of prevention. And while prevention can take many forms, in the context of today’s episode, we dig into security tools, hiring security professionals, and the basics, such as providing security awareness training to employees.

One challenge of securing a large organization like iHeartMedia is consolidating the tech stack. iHeartMedia has a blended architecture of OT and IT, with legacy hardware and systems that need to be secured. Heins stresses the importance of communication and collaboration between the IT and OT teams, as well as being open to new tools and automation.

Hosted on Acast. See acast.com/privacy for more information.

Not just crawling up from the baseline of zero but achieving continuous trust. The short answer? Defense in depth, building security in layers, and ensuring every 1 and 0 is secure at the offset while continuously monitored through automation.

And this is where we get to introduce this week’s guests, who were kind enough to be pulled away from a busy conference. This is also a special episode for us, too, as it’s the first in-person interview we’ve done since launching this series. Live (June 22, 2023) from Drataverse, we have Daniel Marashlian, the co-founder and CTO of Drata, Ty Sbano, the CISO for Vercel and an angel investor at Silicon Valley CISO Investment Group (SVCI), and Matt Hilary, the Vice President of Security and CISO at Drata.

You can read the show notes here.

Hosted on Acast. See acast.com/privacy for more information.

Cerby’s Chief Trust Officer, Matt Chiodi, was kind enough to add a bit of color to a research report they released at RSA that helps validate what they’ve been building the past 3 years. Before we get to that, it’s worthwhile to define what nonfederated applications are, as, like many cybersecurity concepts, it’s going through an identity crisis.

Nonfederated applications are essentially the opposite of how organizations should be inventorying, tracking, and providing access to applications (SaaS platforms are a good example). To align with Zero Trust, or really any modern cybersecurity strategy, SSO, SAML, and other solutions designed to scale are necessary so IT and security teams can properly manage access. However, there are always outliers, which the business still needs access to, such as managing admin access to a social media profile.

This brings us back to Matt and the Ponemon Institute, who produced the recent research report: The Hidden Cybersecurity Threat in Organizations: Nonfederated Applications.

Hosted on Acast. See acast.com/privacy for more information.

Haseeb was kind enough to share his personal experience of being SIM swapped where he describes the fear and anxiety felt as a result of the attacks and explained how easy it is to compromise a phone number.

Hosted on Acast. See acast.com/privacy for more information.

Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.

What does implementing a Zero Trust strategy actually look like in an organization? Nearly a year into our podcast’s journey covering how practitioners view, define, and apply zero trust, it’s time to look under the hood at how a notable organization put its strategy into motion. This week we chat with Bloomberg’s Head of Information Security Architecture and the Information Security Program, Phil Vachon, about how they transformed their security organization with Zero Trust.

Most interestingly though, while many organizations are just now exploring how they will start their zero trust journey, Bloomberg was ahead of the curve even before covid thrust the concept into the limelight.

“I will always say it is continuing to be a journey. It's not a destination,” said Vachon.

• Zero trust is not a new concept but has been repackaged and branded as a solid ideology.
• Zero trust involves three principles: trust but verify, assume compromise, and strong posture.

• Zero trust is a continuing journey, not a destination.
• Zero trust requires a good mindset about how to implement controls and how to reason about security architecture.
• Zero trust is not just about securing the corporate IT estate but also about securing the data center estate and the communications between components.

• Balancing security with usability is a challenge that must be addressed to enable a high-collaboration, low-friction workflow.
• Bloomberg leverages many SaaS services for collaboration, but they also have their own core services that are still on-premises. They focus heavily on their offerings on-premises and have a big drink-your-own champagne culture around them.

Hosted on Acast. See acast.com/privacy for more information.

But we are not here to throw rocks in the glass house nor try to dissect what goes well or goes wrong in these situations; however, we should all focus on what we can take away from them and ensure they are not repeated. This concept aligns well with Zero Trust, where we should assume systems are already breached, that your users - be it intentionally to shitpost in a discord channel or accidentally fall for a phishing lure- and we should remove as much implicit, unchecked trust as possible. At least until Skynet takes us all out, but we have a few good years ahead. 

Jokes aside, we have a great episode for you and appreciate Bitwarden lending us two of their C-suite members who cover a range of topics, including how they navigate these challenges. This week we chat with Bitwarden’s CEO Michael Crandell and Chief Customer Officer Gary Orenstein. Bitwarden offers an integrated open-source password management solution for individuals, teams, and business organizations. It also offers a self-hosted solution, which appeals to those who want greater control over their secrets.

• The use of a Zero Knowledge architecture means that the company, whether cloud-hosted or self-hosted, should not be able to access sensitive information without the user's permission.
• Open-sourced solutions offer additional layers of trust as there are more eyes are on the product and can vet it for security
• Passwordless authentication is the future

Hosted on Acast. See acast.com/privacy for more information.

This week on AZT, Neal and I chat with Kris Lovejoy, Kyndryl’s (IBM spinoff) Global Security and Resilience Leader, former CEO of Virginia-based BluVector, and a former IBM CISO prior to being made GM of their security division. Having danced the line between startups and mega-enterprise organizations, there are few others who could so adequately discuss the role of cybersecurity leadership within modern organizations and why having a competent person at the helm is critical to the business (not just to reduce risk). We also play a bit of RSA buzzword bingo.

Hosted on Acast. See acast.com/privacy for more information.

This week on AZT, Neal and I chat with Andrew “AJ” Grotto, current Stanford University Fellow and Director of Security at Turtle Rock Studios (makers of Back 4 Blood and other popular video games). Prior to his current roles, AJ was an advisor at NIST and was the Senior Director for Cybersecurity Policy for The White House National Security Council. As a practitioner and academic who danced the line between public and private sectors, AJ is well suited to help us navigate the question of what drives innovation around cybersecurity if the federal government is behind the curve or creates chain reactions, and where policy comes into play.

Hosted on Acast. See acast.com/privacy for more information.

Ilona Cohen is the former General Counsel at Office of Management and Budget (OMB), was an Associate White House Counsel and Special Assistant to the President during the Obama administration, and is currently the Chief Legal Officer, Chief Policy Officer, and Corporate Secretary at HackerOne.

Tony Scott is the former U.S. Federal CIO during the Obama administration, has worked for brands such as Disney and GM, and is currently the President and CEO of Intrusion.

Together, they both experienced the Office of Personnel Management (OPM) breach of 2015, and have been involved with the ever-shifting threat landscape that impacts and leads to new initiatives like the latest National Cybersecurity Strategy. In particular, it resulted in the Cybersecurity National Action Plan, which resulted in the first bug bounty program.

Hosted on Acast. See acast.com/privacy for more information.

Though Netfoundry’s bread and butter is a Zero Trust Network Access (ZTNA) solution that can be built into other technology via API and even supports IoT systems, and they also manage OpenZiti. OpenZiti is an open-source self-hosted solution of a similar nature with input and contributions from Zero Trust and developer communities. Rather than honing too deep into the technology aspect, Zino and Neal go down the rabbit hole of open source tools and communities and why they are so critical to much of today’s existing security infrastructure.

Hosted on Acast. See acast.com/privacy for more information.

This week on Adopting Zero Trust (AZT), we chat with infosec author, practitioner, and educator George Finney about ways to make ZT more approachable. Finney is the best-selling author of Project Zero Trust, which currently offers the most approachable way to understand John Kindervag's 5-Step methodology for implementing Zero Trust, the four Zero Trust design principles, and how to limit the impact of a breach.

Hosted on Acast. See acast.com/privacy for more information.

Tide Foundation lives between authentication and micro-segmentation, or if we look at CISA’s Foundation of Zero Trust principles: identity, network/environment, and data. The solution also impacts devices and application workloads, which means they fully align with the philosophy behind Zero Trust.

On today’s episode, we ground Zero Trust back to reality with how much implicit trust can truly be removed, dig into the concept of Zero-Knowledge Authority and how it chips away at ZT gaps of today, and follow up with Abel on how ZT has changed over the past 6 months.

Hosted on Acast. See acast.com/privacy for more information.

On the docket for this week is Zero Trust as a philosophy, why Less Trust is a more applicable term, and the need for a threat model to narrow down your protect surface. As a side note, Ismael also just published a new post highlighting findings from BlackBerry’s new global threat intel report. The team will also discuss these findings today (Jan 26) on LinkedIn live.

Hosted on Acast. See acast.com/privacy for more information.

Since this is our season one wrap episode, and much of what we cover is a stream of consciousness, there are no key takeaways. Swing back around in January as we kick off the next season with another group of amazing guests. We have plenty of surprises in the works, too!

We hope your year winds down well, and we will cross our fingers for no X-mas cyber incidents.

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.

For those who have been on the receiving end of cyber security solution pitches, and there are twice as many wrong ways as those that are considered beneficial. Fortunately, Maureen has seen it all, is a wonderful example of being a neutral party, and has a long history of speaking to the subject (including recently with Dr Zero Trust).

Get the full recap on adoptingzerotrust.com

Hosted on Acast. See acast.com/privacy for more information.

Get the full recap on http://adoptingzerotrust.com/

Hosted on Acast. See acast.com/privacy for more information.

Be sure to get the full recap on adoptingzerotrust.com

Hosted on Acast. See acast.com/privacy for more information.

Be sure to get the full recap on adoptingzerotrust.com

Hosted on Acast. See acast.com/privacy for more information.

Be sure to get the full recap on adoptingzerotrust.com

Takeaways From Nic and Neal

A decade ago, Iran got into federal systems, but Zero Trust would have prevented lateral movement

The days of boots-on-the-ground war is shifting towards cyber, and federal Zero Trust implementation may curb a potentially colossal attack

Beuarcacy is the largest hindrance of momentum when pursuing a cybersecurity-driven digital transformation

It’s easy to become obsolete in IT and cybersecurity, you need to educate yourself constantly

Neutral Zero Trust resources and maturity models are important, but are incredibly complex

Hosted on Acast. See acast.com/privacy for more information.

EDG provides distributed sensor monitoring through a cloud-based solution and associated hardware for organizations with critical data needs. As a hardware manufacturer, that also provides software with important data sets, they have a double edge sword to consider when securing their products.

Find the transcript and video format of AZT on adoptingzerotrust.com

Episode Takeaways

Access by contractors and third-party vendors should be highly limited, which is why solutions like VPNs do not align with Zero Trust

Through an Identity Provider (IdP) such as Okta, Microsoft, Apple, etc. you can limit access by user to specific cloud-based apps, but these solutions may not support 100% of your items out of the box (may need custom builds via API integrations).

From hardware to software, it should be assumed that nothing is fully secure and that runs under the scope that you already have been infiltrated.

There are no silver bullets in security, ever. Always verify, especially security claims, and lean on third-party validators (pen testing, security or privacy compliance, etc.)

Being transparent and honest is one of the best ways to build trust. Ryan suggests having a continuity plan that includes a vulnerability disclosure plan and a way for people to report issues.

Hosted on Acast. See acast.com/privacy for more information.

Andrew has been involved with Zero Trust for some time, holds Forrester’s Zero Trust certification, and has an extensive background with solutions architecture and identity management, both of which play significant roles in the adopting of Zero Trust.

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.

Hosted on Acast. See acast.com/privacy for more information.