CISO Tradecraft® (CISO Tradecraft®)

Welcome to another enlightening episode of CISO Tradecraft! In this episode, host G. Mark Hardy dives deep into the critical topic of CISO burnout with special guest Raghav Singh, a PhD candidate from the University of Buffalo. This is an eye-opening session for anyone in the cybersecurity field, especially those in or aspiring to the CISO role. Raghav shares valuable insights from his extensive research on the unique stresses faced by CISOs, the organizational factors contributing to burnout, and practical coping mechanisms. We also explore the evolutionary phases of CISOs, from technical experts to strategic business enablers. Whether you're dealing with resource limitations, seeking executive support, or managing ever-evolving cybersecurity threats, this episode offers actionable advice to navigate the demanding role of a CISO successfully. Don't forget to like, comment, and share to help other CISOs and cybersecurity leaders!

Big Thanks to our Sponsor CruiseCon - https://cruisecon.com/

• CruiseCon Discount Code: CISOTRADECRAFT10

Transcripts: https://docs.google.com/document/d/1fhLkaj_JetlYFQ50Q69uMGmsw3fS3Wqa

CISO Burnout - https://aisel.aisnet.org/amcis2023/sig_lead/sig_lead/4/

CISO-CIO Power Dynamics https://aisel.aisnet.org/amcis2024/is_leader/is_leader/6/ 

Cybersec professionals and AI integration https://aisel.aisnet.org/amcis2024/security/security/29/

Raghav can be reached on rsingh45@buffalo.edu

Chapters 

• 00:00 Introduction and Guest Welcome
• 02:34 Understanding CISO Burnout
• 03:24 PhD Journey and Challenges
• 10:12 Key Findings on CISO Burnout
• 18:39 Six Sources of CISO Burnout
• 32:47 CISO Maturity Levels
• 42:57 Conclusion and Call to Action

Looking for accurate predictions on what 2024 holds for cybersecurity? Tune into our latest episode of CISO Tradecraft for intriguing insights and industry trends. Listen now and boost your cybersecurity knowledge!

Earn CPEs: https://www.cisotradecraft.com/isaca

Transcripts: https://docs.google.com/document/d/11YX2bjhIVThSNPF6yEKaNWECErxjWA-R

Chapters

• 00:00 Introduction
• 02:11 1) CISOs flock to buy private liability and D&O insurance. It also becomes the norm for CISO hiring agreements.
• 05:25 2) CISO reporting structure changes. No more reporting to the CIO.
• 11:43 3) More CISOs get implicated in lawsuits, but the lawsuits rule in favor of the CISO.
• 13:36 4) Harder to find cyber talent since universities are not graduating as many students. This plus inflation increases result in major spike in cyber salaries
• 16:59 5) Cyber industry minimizes external consulting costs to weather reduced revenues during recession
• 19:44 6) AI-generated fraud will increase significantly
• 22:15 7) Shadow AI will result in Hidden Vulnerabilities
• 24:24 8) LLM attacks new vector for "AI-enabled" companies
• 27:23 9) Cyber insurance exclusions will tend to normalize and will prescribe activities that must be done if payout to occur
• 31:44 10) Self-driving cars will encounter regulatory setback
• 34:02 Review of Last Year's Predictions
• 41:03 Actionable Items for the Future
• 41:29 Closing Remarks and Invitation for 2024

On this Episode of CISO Tradecraft we talk about the Top 10 areas of concern for the C Suite about Ransomware.  Note you can read the full ISC2 Study here (Link).

Cybersecurity professionals should keep the following golden rules in mind when communicating with the C-suite about ransomware.

1. Increase Communication and Reporting to Leadership
2. Temper Overconfidence as Needed
3. Tailor Your Message
4. Make the Case for New Staff and Other Investments
5. Make Clear that Ransomware Defense is Everyone’s Responsibility

On this episode of CISO Tradecraft, we feature Allan Alford from The Cyber Ranch Podcast.  Allan brings a wealth of knowledge as a CISO and shares the three things every CISO needs to bring to the table:

1. Use a Cyber Maturity Model such as CMMI to identify the current situation and build a roadmap of where the organization is headed 

2. Quantify Known Risks through a Risk Register which gets routinely briefed to Executives
3. Align Cyber to Business Objectives to enable the business

If you enjoy listening to Allan Alford, then please subscribe to The Cyber Ranch Podcast for more great content.

Infographic:

In the US we often focus on SOC-2, NIST Special Pubs, and the Cybersecurity Framework. In Europe (and most of the rest of the world), ISO 27001 is the primary standard. ISO concerns itself with policy, practice, and proof, whereas NIST often shows the method to follow. Michael points out that a CISO is responsible for governance, (internal) consulting, and audit. In early stages of growing a security function, a CISO needs to be technically-focused, but as a security department matures, the CISO must be organizationally-focused. Also, to effectively grow your team, first determine what actions need to take place, how much effort it requires, and how often it needs to take place. Then, build an action sheet and collect data for three months. Finally, take that to your executives and document your requirements for more staff.

Michael Krausz LinkedIn Profile: https://www.linkedin.com/in/michael-krausz-b55862/

Michael Krausz Website: https://i-s-c.co.at/

Full Transcript: https://docs.google.com/document/d/13fghym7IWyPvuRANQXUvmv-ulkSj93xv 

Chapters

• 00:00 Introduction
• 04:01 Is there a Gap Analysis in ISO 27001?
• 08:05 Is there a Requirement for ISO Standards?
• 10:57 What is ISO 27001?
• 13:11 Is there a Parallel Development between the US and EU?
• 16:57 Do you want to be a trooper?
• 21:17 What's the Oldest Operating System?
• 23:09 Is there a Legacy Operating Systems that you can't get away with?
• 24:11 The Most Important Class for a CISO
• 26:33 The Secrets of a Successful CISO
• 29:30 CISO - I need 6 people period
• 33:40 What's the Primary Skill Needed in a CISO?
• 37:41 How to Maximize the Number of FTEs

Unlocking SOC Excellence: Master the SOC Capability Maturity Model Join host G Mark Hardy in this compelling episode of CISO Tradecraft as he explores the revolutionary SOC Capability Maturity Model (SOC CMM) authored by Rob van Os. This episode is a must-watch for CISOs, aspiring CISOs, and cybersecurity professionals aiming to optimize their Security Operations Center (SOC). Learn how to measure, evaluate, and enhance your SOC's maturity across key domains including Business, People, Process, Technology, and Services. Gain insights into leveraging radar charts for visualizing SOC capabilities and hear case studies such as a mid-sized financial company’s remarkable improvements. Discover why understanding your SOC's strengths and weaknesses and conducting risk-based improvement planning are crucial. Don't miss out—elevate your cyber resilience today, subscribe, and share with your network to set your SOC on the path to excellence!

References:

• SOC-CMM - https://www.soc-cmm.com/products/soc-cmm/
• Robert van Os - https://www.linkedin.com/in/socadvisor/

Transcripts: https://docs.google.com/document/d/1Fk6_t9FMyYXDF-7EfgpX_ZjLc0iPAgfN

Chapters

• 00:12 Introduction to CISO Tradecraft and SOCs
• 01:20 Understanding SOC CMM: A Game-Changing Tool
• 02:29 Evaluating SOC Maturity and Capability
• 06:04 Benefits and Implementation of SOC CMM
• 07:56 Understanding SOC Assessments
• 08:55 Deep Dive into SOC CMM Domains
• 12:42 Benefits and Flexibility of SOC CMM
• 14:40 Real-World Application and Conclusion

Today, CISO Tradecraft hosts a 5 minute discussion to talk about reflection.  The concept is Roses, Buds, and Thorns.  It’s an exercise designed to identify opportunities to make positive change.

• Roses- What’s working
• Buds - What are new ideas
• Thorns- What do we need to stop

If you would like to learn more please check out the article from MITRE

We would love to hear your feedback here.

Thank you, CISO Tradecraft

In this riveting episode of CISO Tradecraft, host G Mark Hardy welcomes back Richard Thieme, a thought leader in cybersecurity and technology, almost three years after his last appearance. Richard delves into the necessity of thinking like a hacker, provides insights into the AI singularity, and discusses the ethical and societal implications of emerging technologies. The conversation also touches on Richard's extensive body of work, including his books and views on cyber warfare, disinformation, and ethical decision-making. Tune in for a thought-provoking discussion that challenges conventional wisdom and explores the interconnectedness of technology, consciousness, and our future.

Big Thanks to our Sponsor CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

Link to Richard’s home page (and links to Amazon for his books): 

            https://thiemeworks.com/

Link to the book, The Ending of Time:

            https://store.kfa.org/products/the-ending-of-time-new-edition

Transcripts: https://docs.google.com/document/d/1Q7CJkF7Spji2iAbV_mYEyYHnKWobzo6N

Chapters 

• 00:00 Introduction and Guest Announcement
• 00:56 Upcoming Cybersecurity Event: CruiseCon
• 01:41 Welcoming Back Richard Thieme
• 02:06 Reflecting on Past Discussions
• 02:59 The Necessity for Thinking Like a Hacker
• 03:10 Exploring Richard Thieme's Books
• 08:25 Understanding AI and Its Implications
• 18:28 Soft Power and Global Influence
• 24:01 The Power of Fiction in Revealing Truth
• 24:37 Ethical Frameworks Post 9/11
• 26:12 The Role of Empathy in Intelligence Work
• 26:37 The Blurring Line Between Fact and Fiction
• 29:52 The Isolation of Intelligence Work
• 31:18 The Interconnectedness of Everything
• 33:36 Exploring Remote Viewing and Consciousness
• 36:50 The Rise of AI and Ethical Considerations
• 39:43 The Evolution of Technology and Society
• 45:07 Final Thoughts and Reflections

In this episode of CISO Tradecraft, host G Mark Hardy delves into the critical subject of vulnerability management for cybersecurity leaders. The discussion begins with defining the scope and importance of vulnerability management, referencing Park Foreman's comprehensive approach beyond mere patching, to include identification, classification, prioritization, remediation, and mitigation of software vulnerabilities. Hardy emphasizes the necessity of a strategic vulnerability management program to prevent exploitations by bad actors, illustrating how vulnerabilities are exploited using tools like ExploitDB, Metasploit, and Shodan. He advises on deploying a variety of scanning tools to uncover different types of vulnerabilities across operating systems, middleware applications, and application libraries. Highlighting the importance of prioritization, Hardy suggests focusing on internet-facing and high-severity vulnerabilities first and discusses establishing service level agreements for timely patching. He also covers optimizing the patching process, the significance of accurate metrics in measuring program effectiveness, and the power of gamification and executive buy-in to enhance security culture. To augment the listener's knowledge and toolkit, Hardy recommends further resources, including OWASP TASM and books on effective vulnerability management.

Transcripts: https://docs.google.com/document/d/13P8KsbTOZ6b7A7HDngk9Ek9FcS1JpQij

OWASP Threat and Safeguard Matrix - https://owasp.org/www-project-threat-and-safeguard-matrix/

Effective Vulnerability Management - https://www.amazon.com/Effective-Vulnerability-Management-Vulnerable-Ecosystem/dp/1394221207

Chapters

• 00:00 Introduction
• 00:56 Understanding Vulnerability Management
• 02:15 How Bad Actors Exploit Vulnerabilities
• 04:26 Building a Comprehensive Vulnerability Management Program
• 08:10 Prioritizing and Remediation of Vulnerabilities
• 13:09 Optimizing the Patching Process
• 15:28 Measuring and Improving Vulnerability Management Effectiveness
• 18:28 Gamifying Vulnerability Management for Better Results
• 20:38 Securing Executive Buy-In for Enhanced Security
• 21:15 Conclusion and Further Resources

Special Thanks to our podcast sponsor, NowSecure.  On this episode, Brian Reed (Chief Mobility Officer at NowSecure) stops in to provide a world class education on Mobile Application Security.  It's incredible to think that 70% of internet traffic is coming over mobile devices.  Most of this traffic occurs via mobile applications so we need to understand mobile application security testing, before attackers show us how important it is. This episode will help you understand:

• What should you be doing to secure your mobile applications?
• Why managing a mobile device doesn't secure your application layer?
• How should you vet your mobile applications according to recommendations from OWASP

References:

• NowSecure Academy provides free mobile application security training and certificate programs- https://academy.nowsecure.com/  Mobile app growth trends and security issues in the news-  https://www.nowsecure.com/mobile-app-breach-news/ 
• Snapshot of the current risk profile for mobile apps in your industry- https://mobilerisktracker.nowsecure.com/
• App Defense Alliance https://appdefensealliance.dev/ 
• Google Play Data Safety- https://blog.google/products/google-play/data-safety/  
• OWASP CycloneDX- https://owasp.org/www-project-cyclonedx/ 
• OWASP MASVS- https://github.com/OWASP/owasp-masvs 

Are You Ready To Win Your First CISO role? Apply these techniques into your resume and interview process so both recruiters and hiring managers will offer you the job.  This show focuses on:

1. Highlighting the Different Types of CISO Roles
2. Showing how to progress from a Senior Director Role into a Fortune 100 CISO
3. Resume Tricks and Tips that get you noticed by recruiters
4. How to have a great interview with a recruiter
5. What Hiring Managers want to see from CISOs during their interviews

Please note the full show transcript can be found here https://docs.google.com/document/d/18Feg4eXbezHVPiNQ9qO6Pdht3P0eQ5nn

In this episode, you can hear from Dr. Neal Krawetz, creator of Hacker Factor and FotoForensics. Neal's a long-time security practitioner who shares some fascinating insights in terms of how to identify potential bad actors early on (think reconnaissance interception), techniques for detecting bots and malicious entities, and ways to protect your team members from misattributed fake blog entries.

This episode provides a deep dive into Static Application Security Testing (SAST) tools.  Learn how they work, why they don't work as well as you think they will in certain use cases, and find some novel ways apply them to your organization.  Special thanks to John Steven for coming on the show to share his expertise.  

Special thanks to our sponsor Praetorian for supporting this episode.

https://www.praetorian.com/

Full Transcripts - https://docs.google.com/document/d/1zoA70k78IjqyJky-2u7_-i2jlWke8_cb

Chapters:

• 00:00 Introduction
• 02:51 Source Code Analyzers
• 04:22 The three bears of Static Analysis
• 06:01 Do Linters work Better?
• 08:00 The Value of Full Programming Analysis Tools over Linters
• 11:30 The Impact of a Developer's Analysis on a Developer Environment
• 13:05 SAST Testing
• 15:47 OWASP Benchmarking
• 19:13 The First Static Analysis Tools
• 20:53 Can you break up that worry about Automated Testing?
• 22:44 Using Static Analysis for Defect Discovery
• 24:18 Using Static Analysis to Improve Web Security
• 31:37 Using Static Analysis to Drive Cloud Security
• 33:15 The Second Thing to Look Out for When Choosing a Static Analysis Tool
• 34:55 Using Static Analysis to Build a Vulnerability Management Practice
• 37:35 Can you use Static Analysis to Find Insider Threat?

On this episode of CISO Tradecraft you can learn how to build relationships of trust with other executives by demonstrating executive skill & cyber security expertise.  You can learn what to say to each of the following executives to build common ground and meaningful work: 

• CFO
• Legal
• Marketing
• Business Units
• CEO
• CIO
• HR

Note Robin Dreeke mentions 5 keys to building goals.: 

1. Learn… about their priorities, goals, and objectives.
2. Place… theirs ahead of yours
3. Allow them to talk…. suspend your own need to talk.
4. Seek their thoughts and opinions.
5. Ego suspension!!! Validate them unconditionally and non-judgmentally for who they are as a human being.

During this week's Monday Morning Email, CISO Tradecraft answers the question on how to craft a winning resume to land your first CISO role.

InfoGraphic

On this Episode we will explore DevOps as a topic and discuss why you need to care as a CISO.  Key discussions include:

1. What are the key principles behind DevOps?
2. What benefits does security see from DevOps?
3. What is a CI/CD pipeline?
4. What are common types of DevOps tools that I need to understand as a CISO?
5. Where does DevSecOps fit in?

6. What are 4 types of Application Security Testing tools we see in DevOps Pipelines?

7. What are 3 common ways to make DevOps / DevSecOps go viral in any organization?

Chapters

• 00:00 Introduction
• 04:56 DevOps - What are your thoughts?
• 08:57 Microsoft Super Patch Tuesday
• 13:03 DevOps - What's it all about?
• 14:22 What is CALMS (Culture, Automation, Lean, Measuring, & Sharing)
• 26:32 CI/CD
• 32:12 Containers & DevOps
• 33:45 Where does security fit in?
• 36:26 Application Security Testing
• 41:54 DevOps & DevSecOps - What are the tools?

In this episode of CISO Tradecraft, we debunk seven common lies pervasive in the cybersecurity industry. From the fallacy of achieving a complete inventory before moving onto other controls, the misconception about the accuracy of AppSec tools, to the fear of being viewed as a cost center - we delve deep into these misconceptions, elucidating their roots and impacts. We also discuss how ISO and FAIR, audits and certifications, risk assessments, and mandatory cyber incident reporting may not always be as straightforward as they seem. The episode is not only an eye-opener but also provides insightful guidance on how to navigate these misconceptions and enhance the effectiveness of your cybersecurity measures.

CloudGoat EC2 SSRF- https://rhinosecuritylabs.com/cloud-security/cloudgoat-aws-scenario-ec2_ssrf/

OWASP Benchmark - https://owasp.org/www-project-benchmark/

Transcripts - https://docs.google.com/document/d/1yZZ4TLlC2sRfwPV7bQmar7LY4xk2HcIo

Chapters

• 00:12 Introduction
• 00:56 The Lie of Accurate Inventory
• 05:29 The Lie of Accurate Risk Assessment
• 08:41 The Lie of Shifting Left in DevSecOps
• 13:45 The Lie of Certifications Ensuring Security
• 18:33 The Lie of Reporting Cyber Incidents in 72 Hours
• 20:44 The Lie of Accurate Application Security Tools
• 22:07 The Lie of Cybersecurity Not Being a Cost Center
• 24:44 Conclusion and Recap of Cybersecurity Lies 

The ability to persuade others is a core tradecraft for every CISO.  This podcast discusses the most common styles of executive decision making (Charismatics, Thinkers, Skeptics, Followers, and Controllers).  After listening to this podcast, you will understand how to more effectively tailor your message to best influence each style of executive. 

If you would like to learn more about this topic, we strongly recommend you read the Harvard Business Review article, “Change the Way You Persuade”, by Gary A. Williams and Robert B. Miller

https://hbr.org/2002/05/change-the-way-you-persuade

Chapters

• 00:00 Introductions
• 03:04 How to Persuade a Charismatic Leader
• 06:49 How do you use Visual Aids to Help Thinkers
• 10:39 What approaches do you take with Skeptics?
• 15:47 How do we overcome Skeptics?
• 17:24 Are Followers Leaders?
• 20:58 Can we do a Pilot Program?
• 22:59 Strategic Tools to be more Successful in your Career
• 24:47 Do you have any experiences with Controllers?
• 28:03 How to use your Egos and their Past Experiences to your Advantage
• 31:06 The Pointy Haired Boss
• 36:35 How to Adapt a Leader's Style

To become an effective CISO you need influence skills.  On this episode we explore Robert Cialdini's book, "Influence" and discuss the psychology of persuasion.  We will explore 6 key areas of influence:

• Liking- If people like you - because they sense that you like them, or because of things you have in common - they're more apt to say yes to you
• Reciprocity- People tend to return favors.  If you help people, they'll help you.  If you behave in a certain way (cooperatively, for example), they'll respond in kind
• Social Proof- People will do things that they see other people doing- especially if those people seem similar to them
• Commitment and Consistency- People want to be consistent, or at least to appear to be.  If they make a public, voluntary commitment, they'll try to follow through 
• Authority- People defer to experts and to those in positions of authority (and typically underestimate their tendency to do so)
• Scarcity- People value things more if they perceive them to be scarce

If you would like to more on this topic, then we recommend you read Cialdini's work:

Website https://www.influenceatwork.com/principles-of-persuasion/

Book https://www.amazon.com/Influence-Psychology-Persuasion-Robert-Cialdini/dp/006124189X

Chapters

• 00:00 Introduction
• 03:21 The Principles of Persuasion
• 05:27 How to be a Great Speaker and Get People to Like You
• 09:01 How to Win Friends and Influence People
• 13:45 How does a Mint Influence your Tipping?
• 15:04 Doing a Favor for Someone is a Good Thing
• 17:29 The Concept of Social Proof is Security
• 21:34 How to Defend against Audits
• 26:15 Getting Small Commitments Out of People Early On
• 29:20 The Importance of Consistency in Influencing
• 34:12 The Six Principles of Persuasion
• 38:57 Is there a Scarcity of Time?
• 43:13 The Six Chaldini Factors Recap

In this episode of CISO Tradecraft, we delve into the evolving landscape of cybersecurity regulations. From data incident notifications to required contract language, we uncover common trends and compliance challenges. Learn how to prepare, adapt, and network within your industry to stay ahead. Tune in for insights and tips!

Thanks again to our Sponsors for supporting this episode:

• Risk3Sixty: Check out Risk3Sixty's weekly thought leadership webinars and downloadable resources at https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser
• CPrime: Today's "CISO Tradecraft" is sponsored by Cprime, offering advanced tech training for exceptional teams. Experience hands-on, lab-driven classes in just two days, enhancing your skills for immediate on-the-job impact. Discover our sought-after three-day Microsoft PowerBI training, empowering you to craft dashboards, integrate data, and perform swift statistical analysis. Visit Cprime.com/train, use code 'cprimepod' for 15% off, and elevate your expertise!

References

• AuditScripts: https://www.auditscripts.com/free-resources/critical-security-controls/
• Secure Controls Framework: https://securecontrolsframework.com/scf-download/

Transcripts https://docs.google.com/document/d/1RplLpZCMw8foLu9oqkZs1_A2aIbYk1Xo/

Chapters

• 00:00 Introduction
• 04:28 Meeting Cybersecurity Controls and Understanding Applicable Regulations
• 11:28 Ensuring Compliance with Laws and Regulations
• 15:42 Handling Regulatory Change: Mapping Controls & Tracking Requirements
• 22:02 Navigating Regulatory Changes and Ensuring Compliance

Have you ever wondered how to negotiate your best CISO compensation package?  On this episode, we invite Michael Piacente from Hitch Partners to discuss important parts of the compensation packages.  Examples include but are not limited to: - Base Salary,

• Bonuses (Annual, Relocation, & Hiring)
• Reserve Stock Units
• Annual Leave
• Title (VP or SVP)
• Directors & Officers Insurance
• Accelerated Vesting Clauses
• Severance Agreements

You can learn more about CISO compensations by Googling any of the following compensation surveys

• Hitch Partners CISO Compensation and Organizational Structure Survey Report: https://www.hitchpartners.com/ciso-security-leadership-survey-results-23
• Heidrick & Struggles Global Chief Information Officer Survey: https://www.heidrick.com/en/insights/...
• IANS CISO Compensation and Budget Benchmark Study: https://www.iansresearch.com/ciso-com...

Full Transcripts: https://docs.google.com/document/d/1e...

Chapters:

• 00:00 Introduction
• 01:58 What's the Difference?
• 06:50 The Three-Legged Stool (Base Salary, Bonuses, & RSUs)
• 11:44 Is there a signing bonus?
• 13:56 What's the difference between RSUs & Options?
• 18:52 Private Companies - What's the Value of the Offer?
• 22:04 Double Triggers in Private Companies
• 26:38 Should you counter an offer?
• 28:17 Corporate Liability Insurance
• 29:50 Do you want to be extended on the Director and Officer Insurance Policy?
• 32:56 How to negotiate a severance agreement
• 36:00 Compensation Survey Reports

One of the most important activities a CISO must perform is presenting high quality presentations to the Board of Directors.  Listen and learn from Demetrios Lazarikos (Laz) and G Mark Hardy as they discuss what CISOs are putting in their decks and how best to answer the board's questions. 

Special thanks to our sponsor Risk3Sixty for supporting this episode. Risk3sixty has created a presentation template that helps you structure your thoughts while telling a compelling story about where you want your security program to go. Download it today for free at: https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook

References

• RSAC ESAF Download: https://www.rsaconference.com/rsac-programs/executive-security-action-forum
• NACD 2023 Directors Handbook: https://www.nacdonline.org/insights/publications.cfm?ItemNumber=74777
• Blue Lava: https://bluelava.io/cybersecurity-board-reporting/

Transcripts: https://docs.google.com/document/d/1juM8MQUEtAZEDp1HpzkPdNw-D11O3ofq

Chapters

• 00:00 Introduction
• 05:17 The Importance of External Audits in Managing Risk
• 06:48 How to Help Your Business of Revenue Protection Reduce Risk
• 11:15 How to be a Successful CISO
• 12:52 How to Measure the Threat to Your Environment
• 15:04 How to Prepare for Cyber Threats and Incidents
• 18:49 The Importance of Understanding the Business's Critical Assets
• 22:28 OSINT and CSIRT.global Tools and Technologies
• 25:14 Building a Matrix of Good Intention, Bad Behavior, and Access Management
• 28:10 How to Create an Incident Response Plan
• 30:20 How to Keep Your Board of Directors Informed of Cybersecurity Incidents
• 31:50 How to Keep Track of the Latest Cyber Threats Coming Around the Corner
• 34:11 How to Achieve Cyber Insurance Coverage
• 37:06 Cyber Liability Insurance: A Necessary Component of Running Your Business in 2023
• 39:22 How to Measure the Effectiveness of a Company's Cybersecurity Program
• 40:54 The Importance of Business Alignment

Making things cheaper, faster, and better is the key to gaining competitive advantage. If you can gain a competitive advantage in cyber, then you will reduce risk to the business and protect key revenue streams. This episode discusses the three ways of DevOps and how you can use them to improve information security. 

The three ways of DevOps consist of:

• The First Way: Principles of Flow
• The Second Way: Principles of Feedback
• The Third Way: Principles of Continuous Learning

If you would like to learn more about the three ways of DevOps, G Mark Hardy and Ross Young invite you to read The Phoenix Project by Gene Kim

https://www.amazon.com/Phoenix-Project-DevOps-Helping-Business/dp/0988262592

In this episode of CISO Tradecraft, host G Mark Hardy is joined by special guest Rick Howard, Chief Security Officer, Chief Analyst and Senior Fellow at CyberWire. Rick shares his insights on first principles in cybersecurity, discussing how these form the foundations of any cybersecurity strategy. He emphasizes the importance of understanding materiality and integrating the concept of time bound risk assessment to achieve a resilient cybersecurity environment. The episode also delves into the value of Fermi estimates and Bayes algorithm for risk calculation. Amid humor and personal anecdotes, Rick and Mark also reflect on their experiences during 9/11. Rick introduces his book, 'Cybersecurity First Principles', elucidating the rationale behind its conception.

Link to the Cybersecurity First Principles Book: https://www.amazon.com/Cybersecurity-First-Principles-Strategy-Tactics/dp/B0CBVSX2H2/?&_encoding=UTF8&tag=-0-0-20&linkCode=ur2&linkId=1b3010fb678a109743f1fb564eb6d0fc&camp=1789&creative=9325

Transcripts: https://docs.google.com/document/d/1y8JPSzpmqDMd-1PZ-MWSqOuxgFTDVvre

Chapters

• 00:00 Introduction
• 02:00 Guest's Career Journey and Achievements
• 08:49 Discussion on Cybersecurity First Principles
• 15:27 Understanding Materiality in Cybersecurity
• 21:56 The Gap Between Security Teams and Business Leaders
• 22:21 The Importance of Speaking the Language of Business
• 23:03 The Art of the Elevator Pitch
• 24:04 The Impact of Cybersecurity on Business Value
• 25:10 The Importance of a Clear Cybersecurity Strategy
• 26:04 The Value of Business Fluency in Cybersecurity
• 27:44 The Role of Risk Calculation in Cybersecurity
• 29:41 The Power of Estimation in Risk Management
• 30:33 The Importance of Understanding Business Imperatives
• 41:25 The Role of Culture and Risk Appetite in Cybersecurity
• 45:39 The First Principle of Cybersecurity

On this episode we discuss the four key roles Boards play in cybersecurity.

1. Setting the company's vision and risk strategy
2. Reviewing assessment results
3. Evaluating management cyber risk stance
4. Approving risk management plans

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts - https://docs.google.com/document/d/1jarCcQYioT59jtIrppH4xZqyAy4Vn_tB/

Chapters

• 00:00 Introduction
• 01:36 What is a Board of Directors and what do they do?
• 09:33 FFIEC requirements for Boards
• 16:51 Establishing an Information Security Culture
• 19:08 Vision and Risk Appetite
• 22:00 Reviewing Cyber Assessments
• 25:09 Are we secure?
• 32:44 Castle Walls and Attacks
• 33:37 Getting your budget requests approved
• 37:10 Using use or loose money and reserved funding

On this episode of CISO Tradecraft, you will hear about the most prominent Cyber Security Laws and Regulations:

• The Health Insurance Portability and Accountability Act (HIPAA) advocates the security and privacy of personal health information
  • Administrative Safeguards
  • Physical Safeguards
  • Technical Safeguards
• The Sarbanes-Oxley Act (SOX) is designed to provide transparency on anything that could cause material impact to the financials of a company
  • Cyber Risk Assessment
  • Identify Disclosure Controls and Policies
  • Implementing Cyber Security Controls Using a Reliable Framework (NIST CSF / ISO 27001)
  • Monitor and Test SOX Controls
• The Gramm Leach Bliley Act (GLBA) requires Financial Institutions to protect Personally Identifiable Information (PII) 
• The Federal Information Security Management Act (FISMA) requires executive agencies in the federal government to address cyber security concerns
  • Plan for security
  • Assign responsibility
  • Periodically review security controls on systems
  • Authorize systems to Operate
• The Payment Card Industry Data Security Standards (PCI-DSS) is a framework required to protect payment card information
• The General Data Protection Regulation (GDPR) - Data Compliance and Privacy law for European citizens
  • Consent
  • Data Minimization
  • Individual Rights
• The California Consumer Protection Act (CCPA) - Data Compliance and Privacy law for California residents.  This law provides Californians the right to know what data is collected or sold, the right to access data, the ability to request its deletion, and the ability to opt out of it being collected or sold.
• The Cybersecurity Maturity Model Certification (CMMC)- combines various cybersecurity standards and best practices and maps these controls and processes across maturity levels for Department of Defense contractors.

This special episode features Mark Egan (Former CIO of Symantec as well as VMWare).  Mark discusses what he looks for during interviews with CISOs, what executives need to demonstrate during their first 90 days to be successful, and how he helps the next generation of cyber professionals at Merritt College.

Three Questions to ask during any interview:

1. What do you like best about this role?
2. What are the most challenging pieces of this role?
3. What does success look like for this role one year into the future?

Five Step Plan for New CISOs:

1. Start with an assessment of the current “As-Is” IT architecture
2. Perform Business Requirements Analysis (What are the strategic objectives, tactical issues, and business environment).
3. Design of the Future “To Be” IT architecture (application architecture, organization architecture, network architecture, infrastructure architecture)
4. Gap Analysis = (Future - Present).  This is the most important step as you need to determine a good list of alternatives for management.  Talk to consultants and peers in other companies to see how you can come up with a wide range of solutions.
5. Options to Bridge the Gaps = (Cost, Time, & Business Environment).  Present management with alternative approaches for transforming the organization.  Remember speak in business terms and specify ways that align with business objectives.  In terms of cyber it might be Ensuring Financially Significant Applications don’t have operational disruption, ensuring revenue and brand protection by securing internet facing applications, meeting compliance and regulatory concerns, etc.

Merritt College Overview Link

Volunteer to Help Merritt College Link

Contact Merritt College Link

Mark Egan LinkedIn Profile Link

Join G Mark Hardy in this episode of the CISO Tradecraft podcast where he details how cyber protects revenue. He clarifies how cybersecurity is seen as a cost center by most organizations, but stresses how it can become a protector of business profits. Concepts like Operational Resilience Framework (ORF) Version 2 by the Global Resilience Federation are discussed in depth. Hardy also outlines seven steps from ORF to operational resilience including implementing industry-recognized frameworks, understanding the organization's role in the ecosystem, defining viable service levels, and more. 

Link to the ORF - https://www.grf.org/orf

Transcripts - https://docs.google.com/document/d/1ckYj-UKDa-wlOVbalWvXOdEO4OYgjO0i

Chapters

• 00:12 Introduction
• 01:47 Introduction to Operational Resilience Framework
• 02:38 Understanding Resilience and Antifragility
• 03:32 Common Cybersecurity Attacks and How to Anticipate Them 06:22 Building Resilience in Cybersecurity
• 09:43 Operational Resilience Framework: Steps and Principles
• 17:50 Preserving Datasets and Implementing Recovery Processes
• 20:18 Evaluating and Testing Your Disaster Recovery Plan
• 21:11 Recap of Operational Resilience Framework Steps
• 22:04 CISO Tradecraft Services and Closing Remarks

Gamification is a superpower that CISOs can use to change the culture of an organization.  On this episode of CISO Tradecraft we discuss how to use gamification concepts as a CISO. 

What’s in a Game?

• Objective
• Rules
• Challenge/Competition
• Randomness or unpredictability
• Designed for fun and sometimes learning

What Makes a Game Fun?

• Challenge requires reasonable level of difficulty
• Fantasy compelling setting for game action; temporary suspension of reality
• Curiosity random events so that play is not completely deterministic
• Control learners are confronted with choices

What’s in a Learning Game?

• Active participation
• Immediate feedback
• Dynamic interaction
• Competition
• Novelty
• Goal direction

5 Gamification Concepts

1. Leaderboards
2. Badges & Achievements
3. Levels & Progression
4. Unlockables
5. Virtual Economy

4 Player Types

1. Killers are players motivated by leader boards and ranks.  These players focus on winning and peer to peer competition. Their focus is on acting on other players.
2. Achievers are players motivated by achievements and points.  These players focus on achieving present goals quickly and completely.  Their focus is on acting on the world.  
3. Socializers are players motivated by friends lists, chat, and news feeds.  These players focus on socializing and developing a network of friends. Their focus is on interacting with players
4. Explorers are players motivated by hidden content and levels.  These players focus on exploring and discovering the unknown.  Their focus is on interacting with the world.

References:

https://www.chaostheorygames.com/blog/serious-games-guide-everything-you-need-to-know-in-2021 

https://www.chaostheorygames.com/blog/what-is-gamification-2020-definition

https://directivecommunication.net/the-ultimate-guide-to-work-gamification/

https://yukaichou.com/gamificationnews/4-dominant-applications-of-gamification/

https://medium.com/@chow0531/actionable-gamification-fbe27f6cb2d6

https://www.capgemini.com/2020/06/gamification/

https://insights.lytho.com/translation-fails-advertising

http://timboileau.wordpress.com 

https://www.amazon.com/dp/1451611064/?coliid=I2J1XHCOBD5476&colid=2CQEH5MGKB5YX&psc=1&ref_=lv_ov_lig_dp_it 

Infographic:

How do we frame an executive discussion so we can structure and present information in a way that effectively engages and aligns with the needs and interests of the executive audience?  On this episode we answer that question by discussing the 8 important elements of framing a discussion with executives:

1. Clearly define the objective
2. Start with the big picture
3. Identify key issues
4. Highlight impacts and benefits
5. Use visually compelling data and metrics
6. Be able to anticipate questions and concerns
7. Provide actionable recommendations
8. Seek alignment with existing perspectives of the organization

Special thanks to our sponsor Risk3Sixty for supporting this episode.  Be sure to check their Security Budget & Business Case Template: https://risk3sixty.com/whitepaper/security-budget-template/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=budget

Full Transcripts: https://docs.google.com/document/d/1vhLmqEAy-yQ01ZY1y8Nf7y-u_swTYCm8

Chapters

• 00:00 Introduction
• 02:42 How should we frame an executive discussion?
• 05:30 Start with the Bottom Line Up Front (BLUF)
• 07:11 1) Clearly Define the Objective
• 08:13 2) Start with the Big Picture
• 09:46 3) Identify Key Issues
• 10:47 4) Highlight Impact and Benefits
• 12:17 5) Use Visually Compelling Data and Metrics
• 13:07 6) Be able to Anticipate Questions and Concerns
• 15:06 7) Provide Actionable Recommendations
• 17:35 8) Seek Alignment with Existing Perspectives of the Organization

If you use email, this episode is for you.  Attackers leverage email for ransomware, Business Email Compromise (BEC), account takeover, and other threats that can be reduced with effective technical controls (as well as user education.)

These three tools all involve placing simple entries in your DNS records.  To work effectively, the recipient also needs to be checking entries.  They are:

• SPF = sender policy framework; designates only mail from designated IP address(es) or mail server(s) are valid.  For example:  v=spf1 include:spf.protection.outlook.com 
• DKIM = domain keys identified mail; advertises a public key that can be used to validate all mail sent was signed with corresponding private key.  For example:  v=DKIM1\; k=rsa\; 0123456789ABCDEF…
• DMARC = domain-based message authentication, reporting, and conformance; establishes policy of what recipient should do when message fails an SPF or DKIM check.  For example:  v=DMARC1; p='quarantine'

Check your settings at MXToolbox

Learn DMARC Link

Implementing these protections require a small amount of work but can yield outsized benefits.  In addition to allowing recipients of your mail to validate SPF, DKIM, and DMARC, ensure your incoming mail is checked for conformance as well, labeling, quarantining, or rejecting any that fail.

Lastly, blocking top-level domains (TLDs) with which you do not do business can significantly improve your security by short-circuiting many ransomware, command-and-control, and malware URLs that will be unable to resolve through your DNS.  Get the latest list from IANA

Great Background Reading from Australian Signals Directorate Link

Email Authenticity 101 Link

Special Thanks to our podcast Sponsor, CyberGRX

On today’s episode, we bring in Scott Fairbrother to help tackle key questions with Third Party Risk Management:

• How do you identify which vendors pose the highest risk to your business?
• How do you see which vendor’s security controls protect against threats? 
• How do you validate their risk profiles by scanning, dark web monitoring or other techniques to correlate what attackers are seeing and acting upon?
• Do you have an understanding of how to improve risk mitigation in your third-party ecosystem?

Also please subscribe to to the CISO Tradecraft LinkedIn Page to get more relevant content

In this episode of CISO Tradecraft, host G Mark Hardy interviews JP Bourget about the security data pipeline and how modernizing SOC ingest can improve efficiency and outcomes. Featuring discussions on cybersecurity leadership, API integrations, and the role of AI and advanced model learning in future data lake architectures. They discuss how vendor policies can impact data accessibility. They also reflect on their shared Buffalo roots and because their professional journeys. Tune in for valuable insights from top cybersecurity experts.

Transcripts: https://docs.google.com/document/d/1evI2JTGg7S_Hjaf0sV-Nk_i0oiv8XNAr 

Chapters

• 00:00 Introduction
• 00:50 Guest's Background and Journey
• 05:27 Discussion on Security Data Pipeline
• 07:19 Introduction to SOAR
• 08:01 Benefits and Challenges of SOAR
• 12:40 Guest's Current Work and Company
• 14:04 Security Data Pipeline Modernization
• 22:20 Discussion on Vendor Integration
• 29:09 Security Pipeline Approach and AI
• 38:03 Closing Thoughts and Future Directions

References

• https://en.wikipedia.org/wiki/Penetration_test
• https://partner-security.withgoogle.com/docs/pentest_guidelines#assessment-methodology
• https://owasp.org/www-project-web-security-testing-guide/latest/3-The_OWASP_Testing_Framework/1-Penetration_Testing_Methodologies
• https://www.pcisecuritystandards.org/documents/Penetration_Testing_Guidance_March_2015.pdf 
• https://pentest-standard.readthedocs.io/en/latest/
• https://www.isecom.org/OSSTMM.3.pdf
• https://s2.security/the-mage-platform/
• https://bishopfox.com/platform
• https://www.pentera.io/
• https://www.youtube.com/watch?v=g3yROAs-oAc 

****************************

Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cyber security leader.  My name is G. Mark Hardy, and today we're going to explore a number of things a CISO needs to know about pentesting.  As always, please follow us on LinkedIn, and make sure you subscribe so you can always get the latest updates.

Now to get a good understanding of pentesting we are going over the basics every CISO needs to understand.  

• What is it
• Where are good places to order it
• What should I look for in a penetration testing provider
• What does a penetration testing provider need to provide
• What’s changing on this going forward

First of all, let's talk about what a pentest is NOT.  It is not a simple vulnerability scan.  That's something you can do yourself with any number of publicly available tools.  However, performing a vulnerability scan, and then acting on remediating what you find, is an important prerequisite for a pentest.  Why pay hundreds of dollars per hour for someone to point out what you can find yourself in your bunny slippers sipping a latte?

Now let’s start with providing a definition of a penetration test.  According to Wikipedia a penetration test or pentest is an authorized simulated cyber-attack on a computer system performed to evaluate the security of a system.  It’s really designed to show weaknesses in a system that can be exploited.  Let’s think of things we want to test.  It can be a website, an API, a mobile application, an endpoint, a firewall, etc.  There’s really a lot of things you can test, but the thing to remember is you have to prioritize what has the highest likelihood or largest impact to cause the company harm.  You need to focus on high likelihood and impact because professional penetration tests are not cheap.  Usually, they will usually cost between $10,000-$30,000 but if you have a complex system, it’s not unheard of to go up to $100,000.  As a CISO you need to be able to defend this expenditure of resources.  So, you will usually define a clear standard that our company will perform penetration tests on customer facing applications, PCI applications, and Financially Significant Application or SOX applications once per year.

My friend John Strand, who founded Black Hills Information Security, pointed out in a recent webcast that sometimes you, the client, may not know what you mean by the term pentest.  Sometimes clients want just a vulnerability scan, or sometimes an external scan of vulnerabilities to identify risk, or sometimes a compromise assessment where a tester has access to a workstation and tries to work laterally, or sometimes a red team where a tester acts like a threat actor and tries to bypass controls, or a collaborative effort involving both red teams and blue teams to document gaps and to help defenders do their job better.  He goes on to state that your pentest objective should be to "provide evidence of the effectiveness of current defensive mechanisms and attack detection methodologies."

Please do not confuse a penetration test with a Red Team exercise.  A red team exercise just wants to accomplish an objective like steal data from an application.  A penetration test wants to enumerate vulnerabilities in a scoped target system so the developer can patch and remediate.  It’s a subtle difference but consider that a red team only needs to find one vulnerability to declare success, whereas a penetration test keeps going to help identify potentially exploitable vulnerabilities.  Now, is a pentest about finding ALL vulnerabilities?  I would say no – there are vulnerabilities that might require a disproportionate amount of resources to exploit for little or no value – something with a CVSS score of 4.0 or the like.  Those can often be left unpatched without consequence – the cost of remediating may exceed the value of the risk avoided.  There really is a “good enough” standard of risk, and that is called “acceptable risk.”  So, when scoping a pentest or reviewing results, make sure that any findings are both relevant and make economic sense to remediate.

Let’s take the example that you want to perform a web application pentest on your public website so you can fix the vulnerabilities before the bad actors find them.  The first question you should consider is do you want an internal or an external penetration test.  Well, the classic answer of "it depends" is appropriate.  If this website is something of a service that you are selling to other companies, then chances are those companies are going to ask you for things like an ISO 27001 certification or SOC 2 Type 2 Report and both of those standards require, you guessed it, a penetration Test.  In this case your company would be expected to document a pentest performed by an external provider.  Now if your company has a website that is selling direct to a consumer, then chances are you don’t have the same level of requirement for an external pentest.  So, you may be able to just perform an internal penetration test performed by your company’s employees.

I'd be remiss if I didn't mention the Center for Internet Security Critical Controls, formerly know as the SANS Top 20.  The current version, eight, has 18 controls that are listed in order of importance, and they include pentesting.  What is the priority of pentesting, you may ask?  #18 of 18 -- dead last.  Now, that doesn't mean pentests are not valuable, or not useful, or even not important.  What it does mean is that pentests come at the end of building your security framework and implementing controls.  Starting with a pentest makes no sense IMHO, although compliance-oriented organizations probably do this more often than they should.  That approach makes the pen testers job one of filtering through noise -- there are probably a TON of vulnerabilities and weaknesses that should have been remediated in advance and could have been with very little effort.  Think of a pentest as a final exam if you will.  Otherwise, it's an expensive way to populate your security to-do list.

OK let’s say we want to have an external penetration test and we have the 10-30K on hand to pay an external vendor.  Remember this, a penetration test is only as good as the conductor of the penetration test.  Cyber is a very unregulated industry which means it can be tricky to know who is qualified.  Compare this to the medical industry.  If you go to a hospital, you will generally get referred to a Medical Doctor or Physician.  This is usually someone who has a degree such as a MD or DO which proves their competency.  They will also have a license from the state to practice medicine legally.  Contrast this to the cyber security industry.  There is no requirement for a degree to practice Cyber in the workforce.  Also, there is no license issued by the state to practice cyber or develop software applications.  Therefore, you need to look for relevant Cyber certifications to demonstrate competency to perform a Penetration Test.  There’s a number of penetration testing certifications such as the Certified Ethical Hacker or CEH, Global Information Assurance Certification or GIAC GPEN or GWAP, and the Offensive Security Certified Professional or OSCP.

We strongly recommend anyone performing an actual penetration test have an OSCP.  This certification is difficult to pass.  A cyber professional must be able to perform an actual penetration test and produce a detailed report to get the actual certification.  This is exactly what you want in a pentester, which is why we are big fans of this certification.  This certification is a lot more complicated than remembering a bunch of textbook answers and filling in a multiple-choice test.  Do yourself a favor and ask for individuals performing penetration tests at your company to possess this certification.  It may mean your penetration tests cost more, but it’s a really good way to set a bar of qualified folks who can perform quality penetration tests to secure your company.

Now you have money, and you know you want to look for penetration tests from companies that have skilled cyber professionals with years of experience and an OSCP.  What companies should you look at?  Usually, we see three types of penetration testing companies.  Companies that use their existing auditors to perform penetration tests – firms like KPMG, EY, PWC, or Deloitte (The Big 4 1/2).  This is expensive but it’s easy to get them approved since most large companies already have contracts with at least one of these companies.  The second type of company that we see are large penetration testing companies.  Companies like Bishop Fox, Black Hills Information Security, NCC Group, and TrustedSec, focus largely on penetration testing and don't extend into other areas like financial auditing.  They have at least 50+ penetration testers with experience from places like the CIA, NSA, and other large tech companies.  Note they are often highly acclaimed so there is often a waitlist of a few months before you can get added as a new client.  Finally, there are boutique shops that specialize in particular areas.  For example, you might want to hire a company that specializes in testing mobile applications, Salesforce environments, embedded devices, or APIs.  This is a more specialized skill and a bit harder to find so you have to find a relevant vendor.  Remember if someone can pass the OSCP it means they know how to test and usually have a background in Web Application Penetration testing.  Attacking a Web application means being an expert in using a tool like Burp Suite to look for OWASP Top 10 attacks like SQL injection or Cross Site Scripting.  This is a very different set of skills from someone who can hack a Vehicle Controller Area Network (CAN) bus or John Deere Tractor that requires reverse engineering and C++ coding.

Once you pick your vendor and successfully negotiate a master license agreement be sure to check that you are continuing to get the talent you expect.  It’s common for the first penetration test to have skilled testers but over time to have a vendor replace staff with cheaper labor who might not have the OSCP or same level of experience that you expect.  Don’t let this happen to your company and review the labor and contract requirements in a recurring fashion.

Alright, let’s imagine you have a highly skilled vendor who meets these requirements.  How should they perform a penetration test?  Well, if you are looking for a quality penetration testing guide, we recommend following the one used by Google.  Google, whose parent company is called Alphabet, has publicly shared their penetration testing guidelines and we have attached a link to it in our show notes.  It’s a great read so please take a look.  Now Google recommends that a good penetration test report should clearly follow an assessment methodology during the assessment.  Usually, penetration testers will follow an industry recognized standard like the OWASP Web Security Testing Guide, the OWASP Mobile Security Testing Guide, the OWASP Firmware Security Testing Guide, the PCI DSS Penetration Testing Guide, The Penetration Testing Execution Standard, or the OSSTMM which stands for The Open Source Security Testing Methodology Manual.  These assessment methodologies can be used to show that extensive evaluation was done, and a multitude of steps/attacks were carried out.  They can also standardize the documentation of findings.  Here you will want a list showing risk severity level, impact from a business/technical perspective, clear concise steps to reproduce the finding, screenshots showing evidence of the finding, and recommendations on how to resolve the finding.  This will allow you to build a quality penetration test that you can reuse in an organization to improve your understanding of technical risks.  

If I can get good penetration tests today, perhaps we should think about how penetration testing is changing in the future?  The answer is automation.  Now we have had automated vulnerability management tools for decades.  But please don’t think that running a Dynamic Application Security Testing Tool or DAST such as Web Inspect is the same thing as performing a full penetration test.  A penetration test usually takes about a month of work from a trained professional which is quite different from a 30-minute scan.  As a cyber industry we are starting to see innovative Penetration Testing companies build out Continuous and Automated Penetration Testing tooling.  Examples of this include Bishop Fox’s Cosmos, Pentera’s Automated Security Validation Platform, and Stage 2 Security Voodoo and Mage tooling.  Each of these companies are producing some really interesting tools and we think they will be a strong complement to penetration tests performed by actual teams.  This means that companies can perform more tests on more applications.  The other major advantage with these tools is repeatability.  Usually, a penetration test is a point in time assessment.  For example, once a year you schedule a penetration test on your application.  That means if a month later if you make changes, updates, or patches to your application then there can easily be new vulnerabilities introduced which were never assessed by your penetration test.  So having a continuous solution to identify common vulnerabilities is important because you always want to find your vulnerabilities first before bad actors.

Here’s one final tip.  Don’t rely on a single penetration testing company.  Remember we discussed that a penetration testing company is only as good as the tester and the toolbox.  So, try changing out the company who tests the same application each year.  For example, perhaps you have contracts with Bishop Fox, Stage 2 Security, and Black Hill Information Security where each company performs a number of penetration tests for your company each year.  You can alternate which company scans which application.  Therefore, have Bishop Fox perform a pentest of your public website in 2022, then Stage 2 Security test it in 2023, then Black Hills test it in 2024.  Every penetration tester looks for something different and they will bring different skills to the test.  If you leverage this methodology of changing penetration testing vendors each cycle, then you will get more findings which allows you to remediate and lower risk.  It allows you to know if a penetration testing vendor’s pricing is out of the norm.  You can cancel or renegotiate one contract if a penetration testing vendor wants to double their prices.  And watch the news -- even security companies have problems, and if a firm's best pentesters all leave to join a startup, that loss of talent may impact the quality of your report.

Thank you for listening to CISO Tradecraft, and we hope you have found this episode valuable in your security leadership journey.  As always, we encourage you to follow us on LinkedIn, and help us out by letting your podcast provider know you value this show.  This is your host, G. Mark Hardy, and until next time, stay safe.

This episode features Lee Kushner discussing various topics, including negotiating skills, the importance of degrees in the cybersecurity field, the need for diversity in the industry, challenges faced by cybersecurity professionals, starting a career in cybersecurity, and the value of technical skills. The conversation emphasizes the need for individuals to acquire technical skills, such as coding and networking, as they are in high demand and can differentiate them in the job market. It also mentions the importance of understanding the industry and its composition when seeking employment in cybersecurity.

Special thanks to our sponsor Risk3Sixty for supporting this episode. Be sure to check their weekly thought leadership, webinars, and downloadable resources like budget and assessment templates at: https://risk3sixty.com/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=sponser

Transcripts: https://docs.google.com/document/d/11askuaFcV_jYov2FklkbZXxVN3JSNu6y/

Chapters

• 00:00 Introduction
• 07:56 The Importance of Professional First Mindset in the Staffing Industry
• 09:33 The Importance of Perception in a Staffing Environment
• 11:36 The Role of the Research Professional in a Hiring Process
• 16:03 How to Overcome Barriers in the Recruitment Process
• 18:09 The Importance of Education in Executive Search
• 20:41 The Importance of Diversity in Cyber Talent
• 25:25 How to Get a Job in Cyber Security
• 27:48 The Importance of a Technical Foundation in Careers
• 32:08 How to Become a Cybersecurity Professional
• 34:06 The Future of Cybersecurity Career Paths
• 35:56 The Future of Security
• 41:24 How to Get in Touch With Your Clients

In this episode of CISO Tradecraft, G Mark Hardy and Hasan Eksi from CyberNow Labs continue the discussion about the vital skills needed for an effective incident responder within a Security Operations Center (SOC). The skills highlighted in this episode include: incident triage, incident response frameworks, communication, collaboration, documentation, memory analysis, incident containment and eradication, scripting and automation, cloud security, and crisis management.

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/
• Adlumin - https://adlumin.com/

Hasan Eksi's LinkedIn Profile: https://www.linkedin.com/in/eksihasan/

Transcripts: https://docs.google.com/document/d/1rWixzKgf_unanPlnoL6dt8qpEsbZj9lv

Chapters 

• 00:00 Introduction and Recap of the 10 Previous Skills
• 02:25 Skill #11) Incident Triage
• 04:21 Skill #12) Incident Response Frameworks
• 07:09 Skill #13) Communication
• 09:38 Skill #14) Collaboration
• 14:58 Skill #15) Documentation
• 19:35 Skill #16) Memory Analysis
• 22:36 Skill #17) Incident Containment and Eradication
• 25:31 Skill #18) Scripting and Automation
• 28:53 Skill #19) Cloud Security
• 31:10 Skill #20) Crisis Management
• 33:58 Recap of 20 SOC Skills and Conclusion

Would you actually like to learn about what Zero Trust is without a bunch of marketing jargon?  On this week's episode G Mark Hardy and Ross Young provide a thoughtful discussion on Zero Trust from NIST and Microsoft:

• Microsoft's Zero Trust Principles
  • Verify Explicitly
  • Use Least Privileged Access
  • Assume Breach

• NIST 800-207 Seven Tenets of Zero Trust
  1. All data sources and computing services are considered resources
  2. All communication is secured regardless of network location
  3. Access to individual enterprise resources is granted on a per-session basis
  4. Access to resources is determined by dynamic policy
  5. The enterprise monitors and measures the integrity and security posture of all owned and associated assets
  6. All resource authentication and authorization are dynamic and strictly enforced before access is allowed
  7. The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communication and uses it to improve its security posture

• Six Foundational Elements of Zero Trust
  1. Identities
  2. Devices
  3. Applications
  4. Data
  5. Infrastructure
  6. Networks

On this episode of CISO Tradecraft, you can learn how to build an Application Security program.

1.  Start with Key Questions for
   • Security
   • IT Operations
   • Application Development/Engineering Groups
2. Identify Key Activities
   • Asset Discovery
   • Asset Risk Prioritization
   • Mapping Assets Against Compliance Requirements
   • Setting up a Communications Plan
3. Perform Application Security Testing Activities
   • SAST
   • DAST
   • Vulnerability Scanners
   • Software Composition Analysis
   • Secrets Scanning
   • Cloud Security Scanning
4. Measure and Improve Current Vulnerability Posture through metrics
   • The number of vulnerabilities present in an application
   • The time to fix vulnerabilities
   • The remediation rate of vulnerabilities
   • The time vulnerabilities remain open
   • Defect Density - number of vulnerabilities per server

We also recommend reading the Microsoft Security Developer Life Cycle Practices Link

For more great ideas on setting up an application security program please read this amazing guide from WhiteHat Security Link

If you would like to improve cloud security scanning by automating Infrastructure as Code checks, then please check out Indeni CloudRail Link

In this episode of CISO Tradecraft, host G. Mark Hardy discusses seven critical issues facing the cybersecurity industry, offering a detailed analysis of each problem along with counterarguments. The concerns range from the lack of a unified cybersecurity license, the inefficiency and resource waste caused by auditors, to the need for a federal data privacy law. Hardy emphasizes the importance of evaluating policies, prioritizing effective controls, and examining current industry practices. He challenges the audience to think about solutions and encourages sharing opinions and additional concerns, aiming to foster a deeper understanding and improvement within the field of cybersecurity.

Transcripts: https://docs.google.com/document/d/1H_kTbCG8n5f_d1ZHNr1QxsXf82xb08cG

Chapters

• 00:00 Introduction
• 01:28 Introducing the Seven Broken Things in Cybersecurity
• 02:00 1. The Lack of a Unified Cybersecurity License
• 06:53 2. The Problem with Cybersecurity Auditors
• 10:09 3. The Issue with Treating All Controls as High Priority
• 14:12 4. The Obsession with New Cybersecurity Tools
• 19:23 5. Misplaced Accountability in Cybersecurity
• 22:38 6. Rethinking Degree Requirements for Cybersecurity Jobs
• 26:49 7. The Need for Federal Data Privacy Laws
• 30:53 Closing Thoughts and Call to Action

On this episode of CISO Tradecraft, we focus on the Password Security and how it's evolving.  Tune in to learn about:

• Why do we need passwords
• Ways consumers login and authenticate
• How bad actors attack passwords
• How long does it take to break passwords
• Different types of MFA 
• The future of passwords with conditional access policies

Infographic:

References:

• https://danielmiessler.com/blog/not-all-mfa-is-equal-and-the-differences-matter-a-lot/ 
• https://www.hivesystems.io/blog/are-your-passwords-in-the-green?utm_source=tabletext 
• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps
• https://en.wikipedia.org/wiki/RockYou
• https://cisotradecraft.podbean.com/e/ciso-tradecraft-active-directory-is-active-with-attacks/
• https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match

Join us at the heart of Hacker Summer Camp for insights into the cybersecurity world! Discover the art of asking powerful questions that can change your career and impact others. Learn how CISOs assess cyber solutions and how startups can win their attention. Uncover the secrets of building connections and value through meaningful inquiries. Don't miss this episode featuring expert advice on navigating the cybersecurity landscape.

Special Thanks to our Sponsors:

• The Chertoff Group: https://www.chertoffgroup.com
• CPrime: At work, bridging the gap between risk management, IT security, and departments like finance, product, and development can be daunting. Enter Cprime, specializing in harmonious integration through secure code training, DevSecOps implementation, and zero trust practices. We streamline, optimize, and drive innovation, empowering continuous security ops. Transform risk management at Cprime.com/train and use code 'cprimepod' for 15% off training. Unleash potential with us!

Transcripts: https://docs.google.com/document/d/1qf9kH9a5rPlK8zaOWXGAp0-E6p7PNNuT/

Chapters

• 00:00 Introduction
• 01:49 How to Get More Sales at Blackhat
• 05:57 How to Differentiate Yourself From the Competition
• 10:05 How to Solve a Priority Problem
• 16:07 How to Achieve Bigger Goals Through Accelerating Teamwork
• 18:13 How to Find a CISO Job
• 20:30 How to follow a Rich Dad's Advice
• 22:59 How to Create an Opportunity Not Just for Yourself, but for Others
• 24:18 How to Create Value for Others
• 26:20 How to Provide Value to Others
• 28:21 The Power of Open-Ended Questions as a CISO
• 32:33 How to Ask Powerful Questions

Most organizations generate revenue by hosting online transactions.  Cryptography is a key enabler to securing online transactions in untrusted spaces.  Therefore it's important for CISOs to understand how it works.  This episode discusses the fundamentals of cryptography:

• What are the requirements for cryptography?
• How long has cryptography been around?
• Are there differences between legacy and modern cryptography?
• Differences between symmetric and asymmetric encryption
• Common use of encryption at rest
• Encryption in transit

Learn the language of the board with Andrew Chrostowski. In this episode we discuss the 3 major risk categories of opportunity risk, cybersecurity risk and complex systems. We highlight intentional deficit and what to do about it. Finally, don't miss the part where we talk about the time for a digital strategy is past. What is needed today is a comprehensive strategy for a world of digital opportunities and existential cyber risks.

Big thanks to our sponsor:

Risk3Sixty - https://risk3sixty.com/iso-27001-certification/

Transcripts https://docs.google.com/document/d/15PnB1gYwt7vj-wRE4ABuEWxvB-H96rp0

Chapters

• 00:00 Introduction
• 04:22 Communication is a Requirement
• 09:34 How does cyber create value?
• 11:30 Culture and Operational Excellence
• 16:51 How does growth strategy align with cyber?
• 22:30 Intention Deficit Disorder
• 26:48 Accountability Loops
• 28:39 What's the evolution for a digital strategy?
• 32:02 Sharpen your axe
• 36:40 Digital Directors Network & Qualified Technical Experts

Sometimes you just need structure to the madness. Christopher Crowley stops by to talk about methodologies that can help security organizations. Come and see why you need them, how we get the scientific method wrong in cyber, and how to leverage a CIA analytical methodology that can help you. There's a lot more to check out so tune in.

Analysis of Competing Hypothesis https://www.cia.gov/static/9a5f1162fd0932c29bfed1c030edf4ae/Pyschology-of-Intelligence-Analysis.pdf

Christopher Crowley's Company https://montance.com/ 

Full Transcripts: https://docs.google.com/document/d/1P4MI02fIw3y_u8RhLVDbB3iu0o7e27Fr

Chapters

• 00:00 Introduction
• 02:30 The Morris Worm and the Internet
• 04:17 The Future of Cybersecurity
• 06:41 How to setup a shared drive for multitasking
• 10:26 The Evolution of Career Paths
• 12:02 The Importance of Methodology in Problem Solving
• 14:16 The Importance of Hypothesis in Cybersecurity
• 19:58 MITRE ATT&CK® Framework: A Two Dimensional Array
• 21:54 The Importance of a Foregone Conclusion Methodology
• 23:29 The Disruptor's Role in Hypothesis Brainstorming
• 25:18 The Importance of Resilience in Leadership
• 27:45 Methodologies and Threat Hunting
• 29:21 The Importance of Information Bias in Threat Hunting
• 34:31 How to Sort Hypothesis in a Spreadsheet
• 37:22 The Importance of Refining the Matrix
• 40:34 How to Automate Analysis of Competing Hypothesis

This episode of CISO Tradecraft, hosted by G Mark Hardy, features special guest Debbie Gordon. The discussion focuses on the critical role of Security Operations Centers (SOCs) in an organization's cybersecurity efforts, emphasizing the importance of personnel, skill development, and maintaining a high-performing team. It covers the essential aspects of building and managing a successful SOC, from hiring and retaining skilled incident responders to measuring their performance and productivity. The conversation also explores the benefits of simulation-based training with CloudRange Cyber, highlighting how such training can improve job satisfaction, reduce incident response times, and help organizations meet regulatory requirements. Through this in-depth discussion, listeners gain insights into best practices for enhancing their organization's cybersecurity posture and developing key skill sets to defend against evolving cyber threats.

Cloud Range Cyber: https://www.cloudrangecyber.com/

Transcripts: https://docs.google.com/document/d/18ILhpOgHIFokMrkDAYaIEHK-f9hoy63u 

Chapters

• 00:00 Introduction
• 01:04 The Indispensable Role of Security Operations Centers (SOCs)
• 02:07 Building an Effective SOC: Starting with People
• 03:04 Measuring Productivity and Performance in Your SOC
• 05:36 The Importance of Continuous Training and Simulation in Cybersecurity
• 09:00 Debbie Gordon on the Evolution of Cyber Training
• 11:54 Developing Cybersecurity Talent: The Importance of Simulation Training
• 14:46 The Critical Role of People in Cybersecurity
• 21:57 The Impact of Regulations on Cybersecurity Practices
• 24:36 The Importance of Proactive Cybersecurity Training
• 26:26 Redefining Cybersecurity Roles and Training Approaches
• 30:08 Leveraging Cyber Ranges for Real-World Cybersecurity Training
• 36:03 Evaluating and Enhancing Cybersecurity Skills and Team Dynamics
• 37:49 Maximizing Cybersecurity Training ROI and Employee Engagement
• 41:40 Exploring CloudRange Cyber's Training Solutions
• 43:28 Conclusion: The Future of Cybersecurity Training

Would you like to hear a master class on what Technology professionals need to know about startups?  On this episode Bob Cousins stops by to share his knowledge and experience on working in technology companies, dealing with founders, and partnering with venture capitalists.  Listen and learn more about:

• What should a technology professional know about venture capital and dealing with venture capitalists?
• What is the role of marketing?
• What do engineers get wrong with helping businesses create profitable growth?
• What is the value of a product?

Subscribe to the CISO Tradecraft LinkedIn Page

Imagine if you could get 1% better every day at something and do this for an entire year. Well, that's 365 days. And you go, okay, fine. 1%. 1%. That's going to be like 3.65%, right? No, because it compounds. And if you go ahead and open up your calculator and you take 1.01 and you raise it to the 365th power you're going to get 37.78. On today's show we have Andy Ellis discuss ways to get 1% better as a leader.

Thanks to our two sponsors for this episode.

1) Prelude: https://www.preludesecurity.com/

2) Risk3Sixty - Risk3Sixty is cyber security technology and consulting firm that works with high-growth technology firms to help leaders build, manage and certify security, privacy, and compliance programs. They publish weekly thought leadership, webinars, and downloadable resources like budget and assessment templates. https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=ebook 

1% Leadership Book: https://www.amazon.com/1-Leadership-Master-Improvements-Leaders-ebook/dp/B0B8YXJ2H1?&_encoding=UTF8&tag=cisotradecr05-20&linkCode=ur2&linkId=51e35f5bdcbe65e448e03d779143278c&camp=1789&creative=9325

Transcripts: https://docs.google.com/document/d/1Ul9N9cw579JMB_e7Vlk91_JpYxOBXQmx/

Chapters:

• 00:00 Introduction
• 02:09 Andy's career in cyber
• 04:04 The Butterfly Effect
• 06:06 How to Be 1% More Efficient at Cyber
• 09:01 The Importance of Uncloneability
• 10:57 The Importance of Personal Improvement in Leadership
• 14:21 The Importance of Commitment
• 16:10 The Importance of Feedback
• 20:23 Planning for a Sudden Change in Your Environment
• 26:51 How to Create Safety for Cyber Professionals
• 29:01 How to Face Adversity with Grace
• 30:36 The Importance of Culture in Email Security
• 32:11 The Importance of Delegation
• 33:55 Delegating vs Dumping
• 36:02 How to Reduce the Energy Cost of Inclusion
• 40:18 The Importance of Diversity in Organizations
• 42:07 Don't Borrow Evil
• 44:17 How to Build a Relationship with Business Leaders
• 46:49 How to Stop Hurting Your Team

Has bad governance given you trauma, boring committees, and long speeches on irrelevant issues?  Today we are going to overcome that by talking about what good governance looks like.  We bring on the former CISO of Amazon Whole Foods (Sameer Sait) to discuss his lessons learned as a CISO.  We also highlight key topics of good governance found in the Cyber Security Profile from the Cyber Risk Institute. Cyber Risk Institute - Cyber Security Profile https://cyberriskinstitute.org/the-profile/ Full Transcripts: https://docs.google.com/document/d/1vBM6A0utvhRFMA04wzrZvR8ktNwYo-li

Chapters

• 00:00 Introduction
• 03:10 Good Governances is a Good Thing, Right?
• 05:08 Cyber Strategy & Framework
• 06:43 Is NIST the Same as ISO?
• 08:40 How to Convince the Executive Leadership Team to Buy In
• 11:19 The CEO's Challenge is Taking Measured Risk
• 20:05 Is there a Cybersecurity Policy
• 22:32 Culture eats Policy for Lunch
• 24:14 The Role of the CISO
• 27:52 How do you Convince the Leadership Team that you need extra resources
• 29:51 How do you Measure Cybersecurity?
• 32:22 How do we communicate Risk Findings to Senior Management
• 36:07 Are you Aligning with the Audit Committee

In this episode of CISO Tradecraft we have a detailed conversation with Hasan Eksi from CyberNow Labs. G Mark and Hasan discuss the top 20 skills required by incident responders, covering the first 10 in part 1 of this series. The discussion ranges from understanding cybersecurity fundamentals to incident detection, threat intelligence, and malware analysis. This episode aims to enhance listeners' understanding of incident response, its significance, the skills required, and strategies for effective training.

Big Thanks to our Sponsor

• Adlumin - https://adlumin.com/

Hasan Eksi's LinkedIn Profile: https://www.linkedin.com/in/eksihasan/

Transcripts: https://docs.google.com/document/d/1lE9Tz-um1II2aNX4JU-bQ-BND7fPNteE/

Chapters

• 00:00 Introduction
• 14:15 Skill 1) IT/Cyber Fundamentals
• 17:17 Skill 2) Incident Detection
• 18:34 Skill 3) Threat Intelligence
• 20:11 Skill 4) Cybersecurity Tools
• 24:12 Skill 5) Network Analysis
• 25:55 Skill 6) Endpoint Analysis
• 28:33 Skill 7) Log Analysis
• 32:41 Skill 8) Malware Analysis
• 35:20 Skill 9) Forensics
• 38:30 Skill 10) Vulnerability Assessment

One of the most common questions that we get asked on CISO Tradecraft is what do I need to learn to be a good CISO?  After a lot of reflection, CISO Tradecraft put together a Top 10 List of CISO knowledge domains that we believe are the core skills which produce really good CISOs.  This episode is a continuation from the previous episode and will go over the 6th -10th knowledge areas.

1. Product Security focuses on ensuring developers write secure code
2. Defensive Technologies focuses on creating multiple layers of defenses in an organization to protect against a multitude of attacks
3. Detection & Response Capabilities is about creating mechanisms to identify how attackers might circumvent your organization’s defensive technologies
4. Laws, Regulations, & Oversight is about ensuring compliance with appropriate laws and regulations
5. Enabling Technologies is about enabling businesses to create digital transformation
6. Risk Management is about effectively identifying what are the biggest risks to the company, what's the likelihood and magnitude of a potential attack, and how to estimate the cost of remediation
7. Governance is about understanding what technology your organization uses so you can effectively manage it through a process
8. Identity & Access Management is about limiting the scope of an attacker who could cause harm to your organization
9. Business Management & Leadership is an essential skill for executives to lead and influence others
10. Security Culture is about building an organization where the entire company becomes resilient

https://github.com/cisotradecraft/podcast

Infographic:

In the second half of the discussion about secure developer training programs, G Mark Hardy and Scott Russo delve deeper into how to engineer an effective cybersecurity course. They discuss the importance and impact of automation and shifting left, the customization needed for different programming languages and practices, and the role of gamification in engagement and learning. The conversation also touches upon anticipating secular trends, compliance with privacy and data protection regulations, different leaning styles and preferences, and effective strategies to enhance courses based on participant feedback. Scott highlights the lasting impacts and future implications of secure developer training, especially with the advent of generative AI in code generation.

ISACA Event (10 Jan 2024) With G Mark Hardy - https://www.cisotradecraft.com/isaca

Transcripts: https://docs.google.com/document/d/1zr09gVpJuZMUMmF9Y-Kc0DOy-1gH0cx-

Chapters

• 00:00 Introduction
• 01:08 Importance of Ongoing Support and Mentorship
• 01:46 The Role of Community in Training
• 03:03 Hands-on Exercises and Practical Experience
• 06:01 Success Stories and Testimonials
• 08:29 Incorporating Security Trends into Training
• 11:08 Balancing Security with Developer Productivity
• 18:17 Teaching Secure Coding Practices in Different Languages
• 20:27 Engaging and Motivating Participants
• 22:51 Promoting the Program: Engaging and Fun
• 23:37 Accommodating Different Learning Styles
• 24:16 Catering to Self-Paced Learners
• 26:19 Addressing Proficiency Levels and Remediation
• 28:55 Compliance with Privacy and Data Protection Regulations
• 30:48 Breaking Down Complex Security Concepts
• 32:05 Creating a Culture of Security Awareness
• 33:25 Partnerships and Collaborations in Secure Development
• 35:10 Feedback and Improvement of the Program
• 36:12 Cost Considerations for Secure Developer Training
• 39:20 Tracking Participants' Progress and Completion Rates
• 41:23 Trends in Secure Developer Training
• 43:42 Final Thoughts on Secure Developer Training

Chances are your organization has information that someone else wants.  If it's another nation state, their methods may not be friendly or even legal.  In this episode we address assessing risk, known "bad" actors, information targets, exfiltration, cyber security models, what the federal government is doing for contractors, and response strategies.  Listen now so you don't become a statistic later.

References:

https://www.fbi.gov/file-repository/china-exec-summary-risk-to-corporate-america-2019.pdf

https://nhglobalpartners.com/made-in-china-2025/

https://www.cybintsolutions.com/cyber-security-facts-stats/

http://www.secretservice.gov/ntac/final_it_sector_2008_0109.pdf

http://www.secretservice.gov/ntac/final_government_sector2008_0109.pdf

CIS Controls v8.0, Center for Internet Security, May 2021, https://www.cisecurity.org

https://owasp.org/www-project-threat-and-safeguard-matrix/

https://www.acq.osd.mil/cmmc/about-us.html

Every leader needs to know how to lead and manage a team.  On this episode G Mark Hardy and Ross Young share tradecraft on team building.

• Pitfalls to team building with becoming a hero
• Organizational Maturity Models (Levels 1-5)
• Tuckman Teaming Model (Forming, Storming, Norming, and Performing)
• Leadership Styles (Telling, Selling, Participating, & Delegating)
• Aligning your Team and Regaining former employees

Our career has been growing like crazy with an estimated 3.5 million unfilled cybersecurity jobs within the next few years.  More certs, more quals, more money, right?  The sky’s the limit.  But what if we’re wrong?  AI, machine learning, security-by-design, outsourcing, and H-1B programs may put huge downward pressure on future job opportunities (and pay) in this country.  Of course, we don’t WANT this, but shouldn’t a wise professional prepare for possibilities?  [We did a ton of research looking at facts, figures, industry trends, and possible futures that might have us thinking that 2022 may have been “the good old days.”  No gloom-and-doom here; just an objective look with a fresh perspective, you know, just in case.]

On this episode,  we talk about the four types of skills you need to demonstrate in your career to climb through the ranks: (Technical Skills, Management Skills, Leadership Skills, & Political Skills)

We also highlight 6 crucial areas to improve your political skills

1. Social Astuteness - You need to get your cues right.  Socially astute managers are well-versed in social interaction.  In social settings they accurately assess their own behavior as well as that of others.  Their strong powers of discernment and high self-awareness contribute to their political effectiveness.
2. Interpersonal Influence - Managers who are effective influencers have good rapport with others and build strong interpersonal relationships.  They also tend to have a better understanding of broader situations and better judgment about when to assert themselves.
3. Networking Ability - Skilled networkers build friendships and working relationships by garnering support, negotiating, and managing conflict.  They know when to call on others and are seen as willing to reciprocate.
4. Apparent Sincerity - Be sincere.  Politically skilled individuals display high levels of integrity, authenticity, sincerity, and genuineness.  They really are--and also are viewed as--honest, open, and forthright, inspiring trust and confidence.
5. Think before you speak - Politically skilled managers are careful about expressing feelings.  They think about the timing and presentation of what they have to say.
6. Manage up and down - Leaders need to skillfully manage up by communicating with their bosses and keeping higher-ups informed.  But this can become a double-edged sword; research shows that the people who are most skilled at managing up tend not to invest enough energy in building and leading their teams.  True political skill involves relationships with teammates and direct reports as well as higher-ups.

References:

• https://www.ckju.net/en/blog/6-behaviors-characterize-politically-skilled-individuals-organizations-how-learn-them/32148

• https://en.wikipedia.org/wiki/Terry_Tate:_Office_Linebacker

• https://hbr.org/2017/04/the-4-types-of-organizational-politics

• https://www.forbes.com/2010/05/25/office-politics-psychology-leadership-managing-ccl.html
• Ferris, G. R., Davidson, S. L., & Perrewe, P. L. (2005). Political skill at work: impact on work effectiveness. Mountain View, Calif. : Davies-Black Pub
• Ferris, G. R., Treadway, D. C., Kolodinsky, R. W., Hochwarter, W. A., Kacmar, C. J., Douglas, C., & Frink, D. D. (2005). Development and Validation of the Political Skill Inventory. Journal of Management, 31(1), 126-152. doi: 10.1177/0149206304271386

• Ferris, G. R., Berkson, H. M., Kaplan, D. M., Gilmore, D. C., Buckley, M. R., Hochwarter, W. A., et al. 1999. Development and initial validation of the political skill inventory. Paper presented at the 59th annual national meeting of the Academy of Management, Chicago.

Infographic: 

In this episode of "CISO Tradecraft," G. Mark Hardy defines the role of a CISO and discusses the Top 10 responsibilities of a Chief Information Security Officer

Full Transcript: https://docs.google.com/document/d/1J_sCMkqEeIB7pUY4KmjCiS1sz7t6LX2F

Chapters

• 00:00 Introduction
• 01:25 Defining the Role of the CISO
• 04:43 1) Developing and implementing a cybersecurity strategy
• 07:27 2) Overseeing the organization's cybersecurity key programs and initiatives
• 08:20 3) Ensuring that the organization's cybersecurity policies and procedures are up-to-date and in compliance
• 10:44 4) Collaborating with other departments and teams
• 12:06 5) Developing and implementing a cybersecurity budget
• 14:21 6) Maintaining a high level of awareness about emerging cybersecurity threats, vulnerabilities, and technologies
• 15:29 7) Building and maintaining relationships with external partners and networking groups
• 18:07 8) Providing education, guidance, and support to the organization's employees
• 21:34 9) Leading and managing a team of cybersecurity professionals
• 24:10 10) Conducting regular risk assessments

Would you like to know more about Ransomware?  On this episode of CISO Tradecraft, G Mark Hardy and Ross Young provide an in-depth discussion on Ransomware.  Key discussions include:

• What is ransomware?
• Why does it work?
• Ransomware Types (Client-Side, Server-Side, & Hybrid)
  • How each of these enter a target environment
• Ransomware Incidents
• The Economics of Ransomware
• How is Ransomware Evolving?
• Why Ransomware continues to work :(
• Ethical Issues to consider before paying
• Ransomware Defenses

Please subscribe to the CISO Tradecraft LinkedIn Group to get even more great content

CISA Ransomware Guide Link

Have you ever wanted to get a legal perspective on cybersecurity?  On this episode of CISO Tradecraft, Evan Wolff stops by to discuss terms such as legal disclaimers, negligence, due care, and others.  He also provides important insights on how to structure your cyber policies, respond to regulators/auditors, and partner with general council.  Please enjoy. 

Full Transcripts:  https://docs.google.com/document/d/1hbqB5GQfQsi0egPVdOtdfYEwLA3-1Jnh

Chapters

• 00:00 Introductions
• 01:52 The Attorney Client Privilege
• 04:49 What's the Difference Between a Discovery Order and an Attorney Client Privilege
• 06:30 CISO Disclaimer
• 09:23 Security Is a Component of Government Contracts
• 11:59 What are the Borders Between Information Security and Legal Risk
• 15:31 Cyber Security - Is there a Standard of Care?
• 18:11 Do you have a Reasonable Best Effort?
• 21:27 CMMC 2.0
• 26:22 Is your Privacy Policy going to expire?
• 28:30 What is Reasonable Assurance?
• 33:41 Advice for Partnering with the General Counsel

Special Thanks to our podcast Sponsor, Varonis.  Please check out Varonis's Webpage to learn more about their custom data security solutions and ransomware protection software. 

On this episode Brian Vecci (Field CTO of Varonis) stops by CISO Tradecraft to discuss all things Data Security.  He highlights the top 3 things every CISO needs to balance with regards to data security (Productivity, Convenience, and Security).  He also discusses the most important security questions we need to understand:

• What is Data Security and how does it fit into Data Protection?
• How do we understand where our company’s data resides?
• How do we know if our data is exposed?
• How do we reduce the risk of data exposure without harming the business?

Enjoy the show and please share it with others.  Also don't forget to follow the LinkedIn CISO Tradecraft Page to get more great content.

As a cyber executive you should expect disaster and disruption.  When these unfortunate events occur, you can protect the business by maintaining critical business functions, ensuring employees are able to access an alternate work facility, and providing vital records to perform business functions.

The secret to accomplishing these objectives can be found in three important documents.  Those being a Business Continuity Plan, Disaster Recovery Plan, & a Business Impact Analysis.  Enjoy the show as we walk you through them.

FEMA BCP Example https://arlingtonva.s3.amazonaws.com/wp-content/uploads/2019/08/COOP-Template-Business-Continuity.pdf

IBM Disaster Recovery Plan

https://www.ibm.com/docs/en/i/7.1?topic=system-example-disaster-recovery-plan

Fire Drills https://en.wikipedia.org/wiki/Fire_drill

Business Impact Analysis https://www.ready.gov/sites/default/files/2020-03/business-impact-analysis-worksheet.pdf

Infographic:

On this episode of CISO Tradecraft, we feature Helen Patton.

Helen shares many of her career experiences working across JP Morgan, The Ohio State University, and now Cisco.  

-Is technical acumen needed for CISOs?

-Surviving organizational politics

(34:45) Helen discusses The Fab 5 Security Outcomes study.

Volume 1 Study - Link 

Volume 2 Study - Link

Are you worried about cyber threats and data breaches? Do you want to build a strong cybersecurity program to protect your organization? Look no further! In this episode of CISO Tradecraft, G Mark Hardy and Debbie Gordon discuss the three dimensions of an effective Information Security Management System: Policy, Practice, and Proof. G Mark emphasizes the importance of having a proper cybersecurity policy that references information security controls or outcome-driven statements. However, it's not enough to have policies on paper; organizations need to practice what's on paper to be prepared for cyber events. This is where ranges come in. Ranges are a full replica of an enterprise network with real tools, traffic, and malware. They allow teams to practice detecting and responding to attacks in a safe environment. Debbie Gordon, founder of Cloud Range, explains how ranges can help organizations accelerate experience and reduce risk in cybersecurity. She emphasizes the importance of educating an organization's user base to become the first and last lines of defense against cyber threats. By training non-technical executives to spot suspicious activity and bring it to the attention of the security team, organizations can minimize the damage caused by phishing attacks, ransomware, and other cyber threats. Gordon also highlights the importance of team training in cybersecurity because it's not just about individual skills, but also about how teams work together to respond to threats. By practicing together in a range environment, organizations can improve their processes, handoffs, and speed in detecting and responding to attacks.

Special thanks to our sponsor Cloud Range Cyber for supporting this episode.

Website: www.cloudrangecyber.com

Email: info@cloudrangecyber.com

Full Transcripts: https://docs.google.com/document/d/1yWenwauzfAiQYafFW0Iew33vbzvlO2BO

Chapters

• 00:00 Polished Security Programs need Policy, Practice, and Proof
• 00:54 Policy
• 02:47 Practice
• 03:44 Proof
• 04:28 How to Apply the Concepts of Ranges to Help Organizations
• 06:05 The importance of Experiential Learning
• 07:48 The Importance of following Procedures
• 12:12 The Benefits of Team Training for Cyber Ranges
• 15:33 The Importance of Muscle Memory
• 20:22 How to Maximize Your Investment in Cybersecurity (KPIs & Measurable Results)
• 24:33 The Advantages of using the MITRE ATT&CK® Framework
• 27:41 The Advantages of Following ISO Standards
• 31:36 How to Improve your Cloud Range Exercises
• 33:22 How to use Cognitive Aptitude Assessments for Workforce Development
• 37:44 How to level the Playing field for Cyber Talent
• 39:39 The Importance of Degrees in Cyber Security
• 41:03 Making the CISO's job easier

Special thanks to Jeff Gouge for sharing his thoughts on consolidating vulnerability management.  We also thank our sponsor Nucleus Security for supporting this episode.

Consistently tracking and prioritizing vulnerabilities is a difficult problem.  This episode talks about it in detail and helps you increase your understanding in:

• Various application security scanning tools (SAST, DAST, SCA, Container, IoT, Secret Scanners, Cloud Security Scans, ...) and why companies need so many
• How CVSS base scores are actually calculated so you can understand its strengths and weaknesses
• How Threat Intelligence Data improves CVSS scoring
  • Knowing which vulnerabilities are being actively exploited by bad actors through the CISA Known Exploited Vulnerabilities Catalog
  • Knowing with vulnerabilities are being exploited in your industry or organization
  • Knowing how the Exploit Prediction Scoring System (EPSS) can predict which vulnerabilities will be exploited soon
• Learning about the Stakeholder-Specific Vulnerability Categorization Guide (SSVC)

Note a Full Transcript of this podcast can be found here:

https://docs.google.com/document/d/1dWDS8rd-iscZuZ28U27IBuPPfrlFAV69/

This episode is sponsored by Varonis.  You can learn more on how to reduce your ransomware radius by performing a free ransomware readiness assessment Link

This episode of CISO Tradecraft has Sounil Yu talk about his new book, "Cyber Defense Matrix: The Essential Guide to Navigating the Cybersecurity Landscape". Sounil reviews the Cyber Defense Matrix in depth.  We discuss how the Cyber Defense Matrix can be used for: 

• Capturing & Organizing Measurements & Metrics
• Developing a Cyber Security Roadmap
• Gaining Greater Situational & Structural Awareness
• Understanding Organizational Responsibilities & Handoffs
• Rationalizing Technologies & Finding Investment Opportunities
• Deciphering the Latest Industry Buzzword

You can purchase Sounil's new book here Link

In this special Halloween episode of CISO Tradecraft, host G Mark Hardy delves into the lurking dangers of Shadow IT and Zombie IT within organizations. Learn about the origins, risks, and impacts of these hidden threats, and discover proactive measures that CISOs can implement to safeguard their IT ecosystems. Strategies discussed include rigorous asset management, automation, and comprehensive compliance reviews. Tune in for insights to foster a secure, compliant, and efficient IT environment, and don't miss out on an exclusive opportunity to join a cybersecurity conference aboard a luxury cruise.

Big Thanks to our Sponsor

CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

Transcripts: https://docs.google.com/document/d/1lh-TQhaSOIA2rITaXgTaqugl7FRGevnn

Chapters 

• 00:00 Introduction to Shadow IT and Zombie IT
• 02:14 Defining Shadow IT
• 04:58 Risks of Shadow IT
• 07:29 Introduction to Zombie IT
• 09:35 Risks of Zombie IT
• 11:25 Shadows vs Zombies
• 11:25 Comparing Shadow IT and Zombie IT
• 19:11 Lifecycle Management Strategies
• 19:56 Summarizing the Threats and Solutions
• 22:32 Final Thoughts and Call to Action

Are you looking for ways to protect your most valuable asset? In this episode, G Mark Hardy argues that our most valuable asset is our family, not the crown jewels or critical assets of a corporation. He emphasizes the importance of managing money, having an emergency fund, obtaining life insurance, building retirement savings, protecting against credit card fraud, and creating a plan for your children's digital life.  

Special thanks to our sponsor Risk3Sixty for supporting this episode. You can learn more about them from the Risk3Sixty Website: https://tinyurl.com/yc4xv7bj

Full Transcript:  https://docs.google.com/document/d/1vVASHmOV7n7Js0luDF1kWBF3qoytDnTy

Chapters

• 00:00 Introduction
• 02:01 How to Manage Your Money
• 05:54 The Millionaire Next Door
• 10:28 How to Diversity your Investments
• 12:35 The Importance of Paying Yourself First
• 15:41 How to Buy Paper I Bonds for Yourself
• 17:39 How to Choose the Right Life Insurance for You
• 21:28 The Cost of Life Insurance
• 23:12 The Importance of Retirement Savings
• 26:51 How to Optimize Your Retirement Income
• 28:47 How to Protect Yourself From Credit Card Fraud
• 30:40 How to Manage Your Credit
• 33:34 How to Avoid a Data Breach
• 35:44 How to Manage Your Passwords Effectively
• 37:36 How to Protect Your Children from the Risks of Online Content
• 41:23 How to Get Out of Dodge Quickly

In this episode of CISO Tradecraft, host G Mark Hardy discusses the findings of the 2024 Verizon Data Breach Investigations Report (DBIR), covering over 10,000 breaches. Beginning with a brief history of the DBIR's inception in 2008, Hardy highlights the evolution of cyber threats, such as the significance of patching vulnerabilities and the predominance of hacking and malware. The report identifies the top methods bad actors use for exploiting companies, including attacking VPNs, desktop sharing software, web applications, conducting phishing, and stealing credentials, emphasizing the growing sophistication of attacks facilitated by technology like ChatGPT for phishing and deepfake tech for social engineering. The episode touches on various cybersecurity measures, the omnipresence of multi-factor authentication (MFA) as a necessity rather than a best practice, and the surge in denial-of-service (DDoS) attacks. Hardy also discusses generative AI's role in enhancing social engineering attacks and the potential impact of deepfake content on elections and corporate reputations. Listeners are encouraged to download the DBIR for a deeper dive into its findings.

Transcripts: https://docs.google.com/document/d/1HYHukTHr6uL6khGncR_YUJVOhikedjSE 

Chapters

• 00:00 Welcome to CISO Tradecraft
• 00:35 Celebrating Milestones and Offering Services
• 01:39 Diving into the Verizon Data Breach Investigations Report
• 04:22 Top Attack Methods: VPNs and Desktop Sharing Software Vulnerabilities
• 09:24 The Rise of Phishing and Credential Theft
• 19:43 Advanced Threats: Deepfakes and Generative AI
• 23:23 Closing Thoughts and Recommendations

This episode of CISO Tradecraft discusses CMMC.  The Cybersecurity Maturity Model Certification (CMMC), is the US government response to the massive amounts of defense-related information compromised over the years from contractors and third parties.  The program will be mandatory for all defense contractors by 2025, and has the potential to expand to the entire Federal government, affecting every entity that sells to Uncle Sam.  CMMC has five levels of progressively more rigorous certification with up to 171 controls based on acquisition regulations, NIST standards, and Federal information processing standards. In addition, there will be an entire ecosystem of trainers, consultants, assessors, and the organizations that support them.  We'll cover those in enough detail so that you can decide if expanding your career skill set into CMMC might make sense.

Learn how to unlock financial success with key strategies by Logan Jackson from Ray Capital Advisors.  Logan highlights how to set clear goals, choose the right asset class, diversify your portfolio for stability and growth, build a well-diversified investment portfolio to create wealth and mitigate risk, take control of your financial future through retirement planning and goal setting, & leverage tax loss harvesting. He also discusses how to prioritize tax planning, understand the impact of behavioral finance, seek professional money management, navigate conflicts of interest in financial planning, and discover hidden wealth advisors for personalized guidance.

Special thanks to our sponsor Risk3Sixty for supporting this episode.  Be sure to check their Security Program Maturity Presentation for CISOs: https://risk3sixty.com/whitepaper/security-program-maturity-presentation-template-for-cisos/?utm_source=cisotradecraft&utm_medium=podcast&utm_campaign=2023-ct&utm_term=1week&utm_content=template

Also if you would like to contact Logan Jackson please use his contact page at: https://www.raycapitaladvisors.com/ 

Full Transcripts: https://docs.google.com/document/d/1DLXnE5PTm4tDbONRSBarMa-1T8aduztf

Chapters

• 00:00 Introduction
• 02:37 The Importance of Financial Goal Setting
• 06:48 How to Choose the Right Asset Class for Your Family
• 11:17 How to Diversify Your Portfolio
• 12:56 How to Build a Diversified Investment Portfolio
• 15:22 How to Diversify a Portfolio and Build Wealth
• 19:48 How to Take Risk Off the Table
• 22:47 The Importance of Diversifying Your Portfolio
• 24:13 The Importance of Retirement Planning
• 28:56 The Importance of Goal Setting
• 30:35 The Importance of Tax Planning
• 33:10 How to Maximize Your Tax Implications in Taxable Investment Accounts
• 35:20 How to Use Tax Loss Harvesting to Avoid Tax Losses
• 39:51 The Importance of Behavioral Finance in Investing
• 43:39 The Importance of Professional Money Management
• 45:55 The Conflicts of Interest in Financial Planning
• 47:50 How to Find a Hidden Wealth Advisor

CISOs often encounter situations where everyone has a different opinion, it's a high stakes decision, and emotions are running high.  These situations create crucial conversations opportunities where a CISO needs to be effective.  This podcast discusses how to turn disagreement into dialogue, surface any subject, and make it safe to discuss. Please listen as G Mark Hardy and Ross Young discuss the 8 step process from the book, "Crucial Conversations."

1. Get Unstuck 
2. Start With Heart
3. Master My Stories
4. State My Path
5. Learn To Look
6. Make IT Safe
7. Explore Others' Path
8. Move To Action

We recommend you visit the following Crucial Conversations Website to learn more https://www.vitalsmarts.com/crucial-conversations-training/

The Crucial Conversation Book can be found on Amazon https://www.amazon.com/dp/0071771328/ref=cm_sw_em_r_mt_dp_0Cj3FbY9KA429

Chapters

• 00:00 Introduction
• 02:13 How to have crucial conversations
• 06:14 How to make better decisions
• 09:54 The dangers of talking about business
• 14:26 The importance of clarifying what you really want
• 17:51 The importance of mutual respect
• 25:18 How to achieve a shared goal
• 29:11 How to partner together to stop terrorism
• 33:13 How to create a mutual purpose
• 37:08 How to speak your mind in a safe environment
• 40:52 The importance of being vulnerable
• 51:56 The importance of listening to people
• 54:56 How to be a successful CISO

Don't let Bobby the Intern cause havoc in your network. On this episode of CISO Tradecraft, G Mark Hardy discusses the importance of training new hires in cybersecurity to create a strong security culture within an organization. The focus is on shaping employees' behavior and beliefs to enhance the overall cybersecurity posture.

Special Thanks to our Two Sponsors:

1) The Chertoff Group: www.chertoffgroup.com

2) Prelude: https://www.preludesecurity.com/ 

Transcripts: https://docs.google.com/document/d/1Z4ftmqZdUMkxD6ATRRLp0EmO_DVluQ4n

Chapters

• 00:00 Introduction
• 03:57 How to Build a Security Culture
• 07:19 The Importance of a Good Username and Password
• 11:24 How to Use MFA to Protect Your Brand
• 12:50 How to Teach Your Employees About Phishing
• 17:07 How to Deal with External Email Addresses
• 20:30 How to Avoid a Business Email Compromise
• 22:42 How to Protect Your Website from Attackers
• 24:40 How to Secure Your Applications
• 26:46 The Importance of Threat Modeling
• 30:48 QR Codes and How to Use Them Effectively
• 32:34 Delaying Desktop Patches
• 34:36 How to Teach Your New Hires About Security
• 36:30 How to Orient Your New Employees

In this joint episode of the Security Break podcast and CISO Tradecraft podcast, hosts from both platforms come together to discuss a variety of current cybersecurity topics. They delve into the challenge of filtering relevant information in the cybersecurity sphere, elaborate on different interpretations of the same news based on the reader's background, and share a detailed analysis on specific cybersecurity news stories. The discussion covers topics such as the implications of data sharing without user consent by major wireless providers and the fines imposed by the FCC, the significance of increasing bug bounty payouts by tech companies like Google, and a comprehensive look at how edge devices are exploited by hackers to create botnets for various cyberattacks. The conversation addresses the complexity of the cybersecurity landscape, including how different actors with varied objectives can simultaneously compromise the same devices, making it difficult to attribute attacks and protect networks effectively.

Transcripts: https://docs.google.com/document/d/1GtFIWtDf_DSIIgs_7CizcnAHGnFTTrs5

Chapters

• 00:00 Welcome to a Special Joint Episode: Security Break & CISO Tradecraft
• 01:27 The Challenge of Filtering Cybersecurity Information
• 04:23 Exploring the FCC's Fine on Wireless Providers for Privacy Breaches
• 06:41 The Complex Landscape of Data Privacy Regulations
• 16:00 The Economics of Data Breaches and Regulatory Fines
• 24:23 Bug Bounties and the Value of Security Research
• 33:21 Exploring the Economics of Cybersecurity
• 33:50 The Lucrative World of Bug Bounties
• 34:38 The Impact of Security Vulnerabilities on Businesses
• 35:50 Navigating the Complex Landscape of Cybersecurity
• 36:22 The Ethical Dilemma of Selling Exploit Information
• 37:32 Understanding the Market Dynamics of Cybersecurity
• 38:00 Focusing on Android Application Security
• 38:34 The Importance of Targeting in Cybersecurity Efforts
• 42:33 Exploring the Threat Landscape of Edge Devices
• 46:37 The Challenge of Securing Outdated Technology
• 49:28 The Role of Cybersecurity in Modern Warfare
• 53:15 Strategies for Enhancing Cybersecurity Defenses
• 01:05:25 Concluding Thoughts on Cybersecurity Challenges

On this episode, David London and Adam Isles from the Chertoff Group stop by to discuss emerging risk topics such as AI, Supply Chain Attacks, and the new SEC regulations. Stick around and learn the tradecraft to better protect your company.

Special Thanks to our Sponsors:

• The Chertoff Group: https://www.chertoffgroup.com.Note you can read more about their thoughts on AI here: https://www.chertoffgroup.com/managing-ai-risks/
• Prelude: https://www.preludesecurity.com/
• CPrime: At work, bridging the gap between risk management, IT security, and departments like finance, product, and development can be daunting. Enter Cprime, specializing in harmonious integration through secure code training, DevSecOps implementation, and zero trust practices. We streamline, optimize, and drive innovation, empowering continuous security ops. Transform risk management at Cprime.com/train and use code 'cprimepod' for 15% off training. Unleash potential with us!

Transcripts: https://docs.google.com/document/d/1tW0kOYCURXgRF-z7UqeQGga0zAkwGuZ9/

Chapters

• 00:00 Introduction
• 02:33 The SEC's Final Rule on Cybersecurity Disclosure
• 05:29 What is a Material Incident?
• 07:13 The Commission's Final Rule on Board Engagement in Cybersecurity Risk
• 10:03 The Four Day Rule for Incident Reporting
• 12:46 The Implications of the New Role of the CISO
• 15:46 The Ticking Clock on Disclosure
• 18:31 SolarWinds and the Software Chain Security Exposure
• 19:53 The Role of the Software Bill of Materials (SBOM) in the Software Supply Chain Security Challenges
• 21:29 The Rise of the SBOM
• 23:16 The Rise of Expectations in the U.S. Government
• 25:02 The Future of Software Security
• 27:22 The Progress of the CMMC Program
• 29:59 The SEC Disclosure Requirements: What to Expect From Your Board
• 31:57 How to Reduce Complexity in Your Software Development Lifecycle
• 34:05 How AI is Impacting Our Business and Cyber
• 37:32 How to Measure and Manage Cyber Risks Effectively
• 39:57 The SEC's Final Rule on Disclosure

In this episode of CISO Tradecraft, host G Mark Hardy delves into the complex intersection of ethics and artificial intelligence. The discussion covers the seven stages of AI, from rule-based systems to the potential future of artificial superintelligence. G Mark explores ethical frameworks, such as rights-based ethics, justice and fairness, utilitarianism, common good, and virtue ethics, and applies them to AI development and usage. The episode also highlights ethical dilemmas, including privacy concerns, bias, transparency, accountability, and the impacts of AI on societal norms and employment. Learn about the potential dangers of AI and how to implement and control AI systems ethically in your organization. 

Transcripts: https://docs.google.com/document/d/10AhefqdhkT0PrEbh8qBZVn9wWS6wABO6

Chapters

• 00:00 Introduction to CISO Tradecraft
• 01:01 Stages of Artificial Intelligence
• 03:33 Ethical Implications of AI
• 05:24 Business Models and Data Security
• 13:52 Ethical Frameworks Explained
• 23:18 AI and Human Behavior
• 25:44 The TikTok Feedback Loop and Digital Addiction
• 26:54 AI's Unpredictable Capabilities
• 28:25 The Ethical Dilemmas of AI
• 30:57 Generative AI and Its Implications
• 42:10 The Role of Government and Society in AI Regulation
• 45:49 Conclusion and Ethical Considerations

Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cybersecurity leader.  My name is G. Mark Hardy, and today's episode is about how to better mentor your people (and in doing so, improve yourself as well.)  Mentoring is an important part of being a leader, and I would venture that most listeners have achieved their current level of success with the insights of a mentor, along with a lot of hard work.  Today we're going to give you a template for creating a personal development plan you can use with your team.  I also want to introduce you to a booklet that I keep on my desk.  It was written in 1899.  Do you have any idea what it might be?  Well, keep listening and you'll find out, and you may end up getting yourself a copy of your own.

Let's take a moment to hear from today's sponsor Obsidian Security.

Career success rarely happens independently -- it usually involves multiple milestones, promotions, and sometimes moves.  But success shouldn't be a secret.  As Tony Robbins said, "success leaves clues."  One of the best ways to achieve personal or professional success, or indeed help others do the same, is through mentoring and sponsorship.  But the right person rarely shows up at our doorstep offering us the key to the future -- we have to go out and make that relationship happen.  Today we're going to talk about mentors, protégés, sponsors, and that little booklet that has a repeatable secret for success.

Let's start with what is a mentor - the dictionary definition is "an experienced and trusted adviser."  My definition is it's a person with more experience and WISDOM who is willing to provide guidance to someone else -- a protégé.  Notice I didn't say anything about careers -- you can have a spiritual mentor, an academic mentor, and if you're a new grandparent you want to pass along some tips to help raise your grandkids.  You may also hear the term "mentee" instead of protégé -- I see that used from time to time, but it makes me think of those big slow sea creatures that keep getting run over by speedboats.

Let's talk about the who, what, when, why, and how of being a mentor.  The WHO part is someone with experience and wisdom willing to share insights.  Insights about WHAT, at least as far as we're concerned today, is usually career-related -- what jobs or assignments may be best, what personal characteristics are important, whom should you meet and why.

The WHEN portion of mentoring is usually a condition of the type of relationship.  A traditional one-on-one mentor relationship may be established formally or informally.  We established a program at work where those willing to offer advice could volunteer as a mentor and those seeking advice could request the assistance of a mentor.  I was asked by our most senior technical security expert if I would serve as his mentor -- an assignment which I was pleased to accept, and we held mentoring sessions quarterly.  Of course, we worked together more frequently than that, but those sessions were specifically about what he could learn from me as a mentor, and what I could do to structure his experiences to help with his personal and career growth.  [Irish whiskey story]

The WHY can be either because there is a mentorship program at your organization (and if there isn't one, do your homework and consider proposing one) or because someone reached out and requested assistance.  Mentoring is not like doing the dishes where anyone can do a competent job.  It requires empathy, communication skills, wisdom, and time commitment.  I'm at the point in my life and career where I actively try to help others who are not as old as I am.  Many times, that's appreciated, but some people seem to prefer to make all of their own mistakes and resist the effort.  Oh, well.  As my Latin teacher used to say, "suum quique" -- to each their own.

Finally, the HOW.  Mentors should prioritize their sessions by preparing in advance and setting aside time without interruptions.  Establish an agenda based upon specific requirements -- not just what the protégé wants but what the mentor believes he needs.  Martina Bretous published an article on HubSpot where she points out ten ways to be an amazing mentor:

1. Understand what you want out of the relationship.
2. Set expectations together in the very beginning.
3. Take a genuine interest in your mentee as a person.
4. Build trust.
5. Know when to give advice.
6. Don’t assume anything about your mentee – ask.
7. Share your journey.
8. Celebrate their achievements.
9. Seek out resources to help your mentee grow.
10. Be sure you have the bandwidth.

In summary, if you want to be a mentor and seek out the right people in whom to invest your time, here's a short checklist.  Look for protégés with a strong work ethic -- people who have built a reputation of delivering on time on budget.  Select only those people of the proper character -- you don't want to be teaching a sociopath how to take over the organization.  And you'll find you work better with others who share similar values.  If you value hard work, honesty, humility, and perseverance, look for those characteristics, or at least the potential to develop those characteristics, in your potential mentee.  We all know how hard it is to change ourselves.  Think about how much harder it is to change someone else.  In the end, you're just showing the way and it's up to the other person to take the appropriate actions, but you want to build a winning record of successful mentorships -- it doesn't help your own career if you're viewed as the incubator of failure.

As listeners of this show, you are likely in a position to be a mentor.  But that doesn't mean you can't benefit from having a mentor yourself.  Let's look at the who, what, when, why, and how of being a protégé.  The WHO is someone who can gain insight from a relationship with someone farther along in a given path.  Mentees may be assigned a mentor relationship, or they may seek out that relationship on their own.  Both are valid paths, and even if a formal program exists it's often up to the mentee to select from available mentors.  It doesn't always work the other way around [Navy mentor story.]

The WHAT is the reason for participating in this type of relationship.  Usually, it's to gain insight into career and professional goals, but as I mentioned earlier, it can be about most anything where you could learn from someone who's not in the role of a teacher or supervisor.

WHEN should you seek the advice of a mentor?  Well, there's probably never a time NOT to seek advice, but if you're heads-down in a long project that you enjoy or find yourself in a position where you're content and soon winding down your career, then I suppose you're fine going it alone.  Otherwise, after you've been in a position for a year or so and you've figured out your current role and how you fit in, that might be a suitable time to start looking for a mentor.

I think the WHY is obvious, but let's address it.  No one knows everything, but someone usually knows what you need.  Seeking a mentor is a rational way of gaining insights that can help move your career along.

And HOW do you become a protégé?  You need to a-s-k to g-e-t.  Potential mentors are usually busy people -- they don't go looking for more things to add to an already overwhelming calendar.  That said, the saying "if you want something done, give it to a busy person" is often true, because busy people are in the business of making things happen.  If your organization offers a mentorship program, jump at the opportunity.  Just make sure that the person with whom you are paired has the time, the expertise, and the interest to help you in your career.

When searching for a mentor, remember that you should have a clear goal in mind.  "Hey, I need a mentor" isn't very specific, and the Mr. Rodger's "won't you be my mentor?" isn't very compelling.  Rather, start with a specific objective.  For example, it could be, "how do I become fully qualified to become a first-line manager?" or "what does this organization look for when selecting a C-level executive?"  Once you have your goal, you can start your search, but remember that you need to stay professional.  You're not seeking a drinking buddy -- a mentor rarely is a peer (although technically I have heard of peer-to-peer mentoring, but that runs the risk of the parable of the two blind men who both fall into a ditch.)  You want someone with relevant knowledge and experience.  And ideally first develop a working relationship before you pop the question.  A busy mentor will feel more comfortable working with a known quantity than being left to wonder if this person represents a reputational risk.

Let's turn our conversation now to sponsors.

Executive coach May Busch recommends forming a career board of directors to advance your career.  She points out that you need both mentors and sponsors -- sponsors are those in your organization with sufficient clout to put you into key assignments and can advocate behind closed doors for your career advancement.  Wow -- sounds great; where do I sign up?  The issue is that you typically can't recruit sponsors; they come looking for you.  Like a mentee, a "sponsee" represents potential risk to sponsors -- they are putting their own credibility with peers on the line by advocating for you.  If you crash and burn, you both lose.

Like any sales effort, you shouldn't put all of your eggs in a single basket, so if you want to identify a potential sponsor, look for a couple of candidates.  Now, where you work there may be exactly one person who controls the vertical and the horizontal, but in most matrixed organizations, there is a range of opportunities to find advocacy.  Find out who is senior enough to influence the decisions that can affect your career and also whether they are "in on things" to ensure that recommendations move you in the right direction.  There are people who continue to serve past their key roles -- often called "emeritus" as an honorary title, but they probably aren't keeping up with the details.  Look for someone who is still actively "in the game."  And, like finding a mentor, you must identify a natural link between their business interests and your interests.  Now, the intersection of all these criteria might yield exactly zero people, and if so, it's up to you to figure out your own way forward.  But if you do identify potential sponsors, you need to attract their attention.  But how?

Your potential sponsors need to see you in action.  Find ways to deliver executive presentations where they are present or participate in working groups and let the quality of your work differentiate you from peers.  Circulate innovative ideas that represent a step forward for your organization.  The result of these efforts should be to get you noticed.  Note also that you can do this for members of your team.  You may want to sponsor them for bigger and better things but don't have the organizational capital to make it happen on your own initiative.  By placing your best people in front of these more powerful decision-makers, you can facilitate their sponsorship when one of them decides this person should be going places.

Now, it's not just about performance.  During COVID, most of us got comfortable working in bunny slippers from home, but that's not going to differentiate you to a potential sponsor.  If you want to convince executives that you're C-level material, then you need to consistently look the part.  Check your appearance.  Do you look like the other executives in your organization?  I spent 30 years in the military, so part of that "look" was proper grooming, a pressed neat uniform, and being physically fit.  I remember my last semiannual physical fitness test -- I scored 295 out of 300 points and the young Sailor taking scores remarked, "not bad for an old man."  But looking the part is important if you are going to be present yourself as a leader.  [story at CNL -- overweight memorandum.]  Now, I suppose if you work in a dot com startup and the founders all wear t-shirts and jeans every day, then wearing a three-piece suit is not going to help.  But find a way to align with the organization's senior leadership culture so that you don't look like an outsider, which translates into risk.

Make sure your office space isn't full of junk and clutter and your home background on Zoom calls looks like a professional office space (or at least blur out the background.)  Better yet, use a corporate-logo themed background which says, "I'm on the team."

Okay, so let's say you've done all this and are now looking like you just came out of casting for The West Wing and you're sufficiently visible to senior executives.  Beyond looking the part, you need to act the part.  Sit up straight in meetings; don't fiddle with your phone when executives are in the room, no matter how boring the conversation may be at that moment.  I remember back in 2000 when I was working at a startup, our CEO nearly lost our biggest client because she couldn't put down her Blackberry when we were briefing the client's head of security.  He was a retired Navy captain and remarked to me privately (as a fellow Navy officer) how offended he was that this person couldn't be bothered to put down that phone for half an hour and focus on the conversation.  Better yet?  There is a superpower that few people have but you could master if you're a phone addict -- leave your phone on your desk when you go to a meeting.  That's right -- separate yourself from your "life support unit."  Now, in some circumstances you feel you need it because, "what if they ask who's available for a meeting next week and I don't have my calendar?"  Bring your laptop or tablet instead, and only consult it when you're asked something that needs looking up to answer.  Remember, even a CEO doesn't get a pass on distractions when your biggest client is in the room.

In addition to looking the part and acting the part, you need to deliver.  Make sure your work is exceptional and error-free.  At the Pentagon we had a term -- "finished staff work."  It means that what you turn in is correct, complete, and free of grammatical or typographical errors EVERY TIME.  That's a tough discipline.  I was a computer science and mathematics major at Northwestern, and there was nothing I wanted to avoid more than an English composition or writing class -- after all, I was going to be a technologist.  Years later when I joined the staff of Booz|Allen, I saw the importance of mastering a professional writing style.  As a consultant, you live or die by the pen -- how well you write proposals and deliverables.  As I became more senior in both my civilian as well as my military career, I kept improving that ability to write well.  

A small but powerful book you should own and master is Strunk and White's The Elements of Style.  It's the most succinct summary of writing rules I've read -- think of it as a syntax guide to the English language.  Granted, some of these conventions are considered quaint or even obsolete -- the Oxford comma and two spaces after a sentence, but I still write that way.  There's no reason if you can write a program that will compile (or if you're a Python programmer, not throw a Syntax Error) that you cannot write English with the same consistency.

May Busch points out that there are four mistakes you can make that will ruin your attempts to attract a sponsor.  One, which seems obvious, is that you're perceived as lacking potential.  Note I said "perceived."  I think all of us have slightly inflated expectations of ourselves -- that's called a healthy ego, but let's face it:  some people are rightly classified as low potential, high achievers -- they work really hard to achieve mediocre results.  "But I do consistently outstanding work at my current job!"  Okay, I'll give you that.  But remember -- we're talking about getting a sponsor for the NEXT job, and if you're not virtue signaling that you can perform at the next level, then a wise boss is likely to leave you where you are -- delivering consistently outstanding work.  Remember my four-phase career model:  technical, management, leadership, political?  You can often move easily within one of those phases without sponsorship, but to get to the next level usually requires something or someone external to yourself.

The second disqualifier is to be seen as "selectively motivated," meaning you only put forth full effort at the last minute.  It's somewhat of a synonym for a procrastinator -- many of us know there's nothing like the last minute to make sure things get done.  Sure, there are important things that are urgent, but if your MO is to goof off until just before a deadline and then rush out a finished product, that calls into question your long-term reliability for more responsible assignments.

The third disqualifier is lack of self-confidence.  If you present yourself as hesitant and uncertain, you do not inspire confidence.  "Do you think, umm, maybe we might possibly consider doing this?" is not as reassuring as, "Here's what we're going to do."  I'm not advocating for arrogancy here; but if you secretly worry about imposter syndrome or a belief that you're not as good as others perceive you to be, then that's likely to leak out in your words and actions and cause potential sponsors to pause.

The fourth way you can discourage a potential sponsor is to be inappropriate.  You say and do the wrong things at the wrong time to the wrong people.  You put your feet up on the conference table or make inappropriate or even offensive jokes when no one was looking for that type of input.  Walking up a senior executive and saying, "won't you be my sponsor?" is another example.  It's fine for Mr. Rodgers to ask, "won't you be my neighbor?" but as you know by now, you have to become the one who attracts attention, not demands it.

One of the best ways to help others move forward is to show them an example of what represents success.  I mentioned earlier the booklet that sits on my desk -- have you figured out what it might be?  It's "A Message to Garcia" written by Elbert Hubbard, the founder of the Roycrofters in East Aurora NY.  Hubbard was a writer, publisher, artist, and philosopher, who wrote that he sat down and penned this essay after dinner in under an hour.  What started as article in his magazine grew rapidly.  After receiving requests for a thousand copies of that issue, he inquired as to the reason.  "It's the stuff about Garcia."  The New York Central Railroad reprinted over one million copies in booklet form.  The Director of Russian Railways was in New York, was so impressed that when he returned to Moscow, ensured a translated copy was given to every railroad employee in Russia.  Every Russian soldier in the Russo-Japanese war had a copy, and when the Japanese officials noted Russian prisoners of war all carried it, they concluded it must be a good thing, translated it into their language and gave copies to every employee of the Japanese government.  By December 1913, over forty million copies of A Message to Garcia had been printed.  Tragically, Hubbard died on the 7th of May 1915 as a passenger onboard RMS Lusitania, which was torpedoed by a German U-boat.  I have a number of his publications, but this is the one that I reread the most.  It's not that long -- less than fifteen hundred words, and if you haven't heard it before, you should, and if you have heard it before and you're like me, you'll want to hear it again.  Remember, the context is 1899.  Here is…

A Message to Garcia By Elbert Hubbard

In all this Cuban business there is one man stands out on the horizon of my memory like Mars at perihelion. When war broke out between Spain and the United States, it was very necessary to communicate quickly with the leader of the Insurgents. Garcia was somewhere in the mountain vastness of Cuba- no one knew where. No mail nor telegraph message could reach him. The President must secure his cooperation, and quickly.

What to do!

Some one said to the President, "There’s a fellow by the name of Rowan will find Garcia for you, if anybody can."

Rowan was sent for and given a letter to be delivered to Garcia. How "the fellow by the name of Rowan" took the letter, sealed it up in an oil-skin pouch, strapped it over his heart, in four days landed by night off the coast of Cuba from an open boat, disappeared into the jungle, and in three weeks came out on the other side of the Island, having traversed a hostile country on foot, and delivered his letter to Garcia, are things I have no special desire now to tell in detail. The point I wish to make is this: McKinley gave Rowan a letter to be delivered to Garcia; Rowan took the letter and did not ask, "Where is he at?" By the Eternal! there is a man whose form should be cast in deathless bronze and the statue placed in every college of the land. It is not book-learning young men need, nor instruction about this and that, but a stiffening of the vertebrae which will cause them to be loyal to a trust, to act promptly, concentrate their energies: do the thing- "Carry a message to Garcia!" General Garcia is dead now, but there are other Garcias.

No man, who has endeavored to carry out an enterprise where many hands were needed, but has been well nigh appalled at times by the imbecility of the average man- the inability or unwillingness to concentrate on a thing and do it. Slip-shod assistance, foolish inattention, dowdy indifference, and half-hearted work seem the rule; and no man succeeds, unless by hook or crook, or threat, he forces or bribes other men to assist him; or mayhap, God in His goodness performs a miracle, and sends him an Angel of Light for an assistant. You, reader, put this matter to a test: You are sitting now in your office- six clerks are within call. Summon any one and make this request: "Please look in the encyclopedia and make a brief memorandum for me concerning the life of Correggio". Will the clerk quietly say, "Yes, sir," and go do the task?

On your life, he will not. He will look at you out of a fishy eye and ask one or more of the following questions: 

 Who was he?

 Which encyclopedia?

 Where is the encyclopedia?

 Was I hired for that?

 Don’t you mean Bismarck?

 What’s the matter with Charlie doing it?

 Is he dead?

 Is there any hurry?

 Shan’t I bring you the book and let you look it up yourself?

 What do you want to know for?

And I will lay you ten to one that after you have answered the questions, and explained how to find the information, and why you want it, the clerk will go off and get one of the other clerks to help him try to find Garcia- and then come back and tell you there is no such man. Of course I may lose my bet, but according to the Law of Average, I will not.

Now if you are wise you will not bother to explain to your "assistant" that Correggio is indexed under the C’s, not in the K’s, but you will smile sweetly and say, "Never mind," and go look it up yourself.

And this incapacity for independent action, this moral stupidity, this infirmity of the will, this unwillingness to cheerfully catch hold and lift, are the things that put pure Socialism so far into the future. If men will not act for themselves, what will they do when the benefit of their effort is for all? A first-mate with knotted club seems necessary; and the dread of getting "the bounce" Saturday night, holds many a worker to his place. Advertise for a stenographer, and nine out of ten who apply, can neither spell nor punctuate- and do not think it necessary to.

Can such a one write a letter to Garcia?

"You see that bookkeeper," said the foreman to me in a large factory.

"Yes, what about him?"

"Well he’s a fine accountant, but if I’d send him up town on an errand, he might accomplish the errand all right, and on the other hand, might stop at four saloons on the way, and when he got to Main Street, would forget what he had been sent for."

Can such a man be entrusted to carry a message to Garcia?

We have recently been hearing much maudlin sympathy expressed for the "downtrodden denizen of the sweat-shop" and the "homeless wanderer searching for honest employment," and with it all often go many hard words for the men in power.

Nothing is said about the employer who grows old before his time in a vain attempt to get frowsy ne’er-do-wells to do intelligent work; and his long patient striving with "help" that does nothing but loaf when his back is turned. In every store and factory there is a constant weeding-out process going on. The employer is constantly sending away "help" that have shown their incapacity to further the interests of the business, and others are being taken on. No matter how good times are, this sorting continues, only if times are hard and work is scarce, the sorting is done finer- but out and forever out, the incompetent and unworthy go. It is the survival of the fittest. Self-interest prompts every employer to keep the best- those who can carry a message to Garcia.

I know one man of really brilliant parts who has not the ability to manage a business of his own, and yet who is absolutely worthless to any one else, because he carries with him constantly the insane suspicion that his employer is oppressing, or intending to oppress him. He cannot give orders; and he will not receive them. Should a message be given him to take to Garcia, his answer would probably be, "Take it yourself."

Tonight this man walks the streets looking for work, the wind whistling through his threadbare coat. No one who knows him dare employ him, for he is a regular fire-brand of discontent. He is impervious to reason, and the only thing that can impress him is the toe of a thick-soled No. 9 boot.

Of course I know that one so morally deformed is no less to be pitied than a physical cripple; but in our pitying, let us drop a tear, too, for the men who are striving to carry on a great enterprise, whose working hours are not limited by the whistle, and whose hair is fast turning white through the struggle to hold in line dowdy indifference, slip-shod imbecility, and the heartless ingratitude, which, but for their enterprise, would be both hungry and homeless.

Have I put the matter too strongly? Possibly I have; but when all the world has gone a-slumming I wish to speak a word of sympathy for the man who succeeds -- the man who, against great odds has directed the efforts of others, and having succeeded, finds there’s nothing in it: nothing but bare board and clothes. I have carried a dinner pail and worked for day’s wages, and I have also been an employer of labor, and I know there is something to be said on both sides. There is no excellence, per se, in poverty; rags are no recommendation; and all employers are not rapacious and high-handed, any more than all poor men are virtuous.

My heart goes out to the man who does his work when the "boss" is away, as well as when he is at home. And the man who, when given a letter for Garcia, quietly take the missive, without asking any idiotic questions, and with no lurking intention of chucking it into the nearest sewer, or of doing aught else but deliver it, never gets "laid off," nor has to go on a strike for higher wages. Civilization is one long anxious search for just such individuals. Anything such a man asks shall be granted; his kind is so rare that no employer can afford to let him go. He is wanted in every city, town and village- in every office, shop, store and factory. The world cries out for such: he is needed, and needed badly- the man who can carry a message to Garcia.

-THE END- 

In 2009 as president of the Association of the United States Navy, I wrote a short article entitled "A New Message to Garcia."  There I called out the actions of a Sailor who went above and beyond what was expected without even being asked.  I hope he went on to bigger and better things because he had the right stuff.

Let's put all of this together.  One of the best ways to formalize mentoring is to create a written performance development plan.  We've included a sample template in the show notes.  This is a way to memorialize conversations with SMART goals -- you remember, specific, measurable, achievable, relevant, and time-bound?  If you are a mentor, you can use this as a template for your counseling sessions.  If you are a mentee and there is no template in your organization, feel free to introduce this to your mentor -- you're showing initiative and creating potential value for more people than just yourself.

By putting goals in writing, they experience a magical transformation.  It was Napoleon Hill who wrote that "a goal is a dream with a deadline."  Until you write it down, it's easy to find other things that seem more important or urgent at the moment.  In addition, a written set of goals offers accountability -- it's a commitment between mentor and mentee that can be honored like a contract.

Start with the manager's organizational priorities and goals that provide a context for the session.  For example, if you are in the cybersecurity organization, these could be things such as, "create a cyber vigilant organization," "enable cybersecurity controls and compliance," and "safeguard the organization against major threats."  Each of these could have subgoals that get into a little more detail -- awareness training for users, secure coding training for developers, establishing a governance structure around cyber risk.  This requires inside knowledge, and if the mentor is within the same organization, it shouldn't be too difficult to ascertain.  In addition, if the mentor is the supervisor, then even better -- this shows how the protégé's goals fit in with the boss's vision of what should happen.  Better to find out early on that an idea isn't practical then to spend a year working on it only to find out it will never be implemented.

Next, the protégé lists individual development goals.  Not too many, especially if you are meeting quarterly.  Two or three may be sufficient.  If there are too many things to work on, the natural tendency is to go for those that are easiest, which may not be the ones that are the most important.  Next comes the BHAG -- the big, hairy, audacious goal -- the one that will represent a signature accomplishment.  Chances are, this won't happen in a month or a quarter, but it's perfectly reasonable for an annual cycle to align with performance reviews to specify a stretch goal.  And by doing it in writing and knowing someone is holding accountability, it's more likely to happen.

When it comes to making progress, actions can be separated into experiences, relationships, and learning.  Most of our progress is done through experience, so list multiple experiences that one expects to accomplish before the next session.  It can be part of a larger goal -- work on the team deploying a SIEM or complete a particular phase of a larger project.  This is where the majority of the accountability will reside -- did you complete what you set out to do?  It's helpful to be a bit aspirational, but this isn't another set of stretch goals.

List at least two relationship improvement opportunities -- these can be key relationships or even potential sponsors.  For example, it could include the head of a particular business unit that has specific security requirements -- that meeting would help address those concerns and provide an opportunity for the person seeking visibility.

Lastly, include learning opportunities.  Not all of us are going to school full-time, but we all should be working on self-improvement.  For example, you might set a goal to complete the next course in your degree program or take the exam that grants a particular certification.

What you have is a template for action and professional growth.  The action comes from the accountability of a written document, and the growth comes from the joint goal-setting that takes place under the guidance of a mentor.  Don't just file it away with the rest of your paperwork -- put it where you'll see it every day and challenge yourself to check off another accomplishment by week's end.  By encouraging this culture of accomplishment, you'll significantly increase the probability of success.

Inside the front cover of my Garcia booklet is a short essay entitled "Initiative."  Let me leave you with this as a final thought:

The world bestows its big prizes, both in money and in honors, for but one thing. And that is Initiative.

What is Initiative?

I’ll tell you: it is doing the right thing without being told.

But next to doing the thing without being told is to do it when you are told once. That is to say, carry the Message to Garcia: those who can carry a message get high honors, but their pay is not always in proportion.

Next, there are those who never do a thing until they are told twice; such get no honors and small pay.

Next, there are those who do the right thing only when necessity kicks them from behind, and these get indifference instead of honors, and a pittance for pay. This kind spends most of its time polishing a bench with a hard-luck story.

Then, still lower down in the scale than this, we have fellow who will not do the right thing even when some one goes along to show him how and stays to see that he does it; he is always out of job, and receives the contempt he deserves, unless he happens to have a rich Pa, in which case Destiny patiently awaits around a corner with a stuffed club.

To which class do you belong?

Thank you for listening to CISO Tradecraft; we hope you've found this show valuable.  If you learned something that you like, please help us by leaving us a 5-star review on your favorite podcast platform -- those ratings really help us reach other security leaders.  The more CISOs we can help, the more businesses we can protect.  This is your host, G. Mark Hardy.  Thanks again for listening and stay safe out there.

References:

• https://blog.hubspot.com/marketing/mentor-tips-positive-impact
• https://www.businessnewsdaily.com/6248-how-to-find-mentor.html
• https://www.businessnewsdaily.com/3504-how-to-mentor.html
• https://maybusch.com/career-board-of-directors-advance-career/
• https://maybusch.com/find-sponsor/
• https://www.amazon.com/Elements-Style-4th-William-Strunk/dp/0205313426?&_encoding=UTF8&tag=-0-0-20&linkCode=ur2
• https://www.nato.int/nrdc-it/about/message_to_garcia.pdf
• https://gmarkhardy.com/Navy_Articles/NRA-0909%20A%20New%20Message%20to%20Garcia.pdf

Example: Individual Performance Plan

Name: ________________________________ Date:  ________________

Leadership's Cyber Priorities and Goals

1.       Create a Cyber Vigilant Organization

• Cyber Awareness Training, Secure Developer Training, and Proper Risk Approval and Governance

2.       Enable Compliance, Controls, and Cyber Security 

• Controls (IT General Controls & SOX), Audits, and Cyber Maturity Frameworks (ISO 27001, NIST CSF, or FFIEC)

3.       Safeguard the Business against Key Threats

• Phishing and Ransomware, Software Vulnerabilities, and Third-Party Risks

Individual Development Goals

1. Goal:
2. Goal:

Signature Accomplishment

•  My Big Goal is to accomplish …

Actions I am taking this year (How)

•  Experiences (70%)
  • Experience 1
  • Experience 2
  • Experience 3
  • …

Relationships (20%)

• Relationship Improvement Opportunity 1
• Relationship Improvement Opportunity 2

Learning (10%)

• Learning Opportunity

Support Needed from My Manager

• I need help with …

Have you ever heard someone say our firewalls block this type of attack?  In this episode, you can increase your understanding of firewalls so it won’t just be another buzzword.  6 Basic categories of firewalls that we discuss on the show include:  

1. Packet Filters focus on IP and port blocking 
2. Stateful Inspection Firewall looks at active connections and consider context
3. Network Address Translation Firewalls tools that allow private networks to connect to public ones and create secure enclaves
4. Proxy Servers classify web traffic into topics that might be allowed or not allowed
5. Web Application Firewalls block Web Application Attacks (SQL Injection,Cross Site Scripting, …)
6. Next Generation Firewalls that try to do everything.

References - sitereview.bluecoat.com

Infographics:

Winn Schwartau is a well-recognized icon in the cybersecurity community, and also a dear friend for over 25 years.  Always one to stir the pot and offer radical ideas (many of which come true), we discuss Hacker Jeopardy, INFOWARCON, his books "Pearl Harbor Dot Com", "Time-Based Security", and his magnum opus "Analog Security."  We speculate on the future of our industry with respect to quantum and probabilistic computing, and after hanging up his pen, looks like he's doing a Tom Brady and writing one more amazing book. **Warning Adult Language**

Winn's Website Link

In this episode of CISO Tradecraft, host G Mark Hardy explores the top 10 cybersecurity predictions for 2025. From the rise of AI influencers to new standards in encryption, Hardy discusses significant trends and changes expected in the cybersecurity landscape. The episode delves into topics such as branding, application security, browser-based security, and post-quantum cryptography, aiming to prepare listeners for future challenges and advancements in the field.

Big Thanks to our Sponsor

CruiseCon - https://cruisecon.com/

CruiseCon Discount Code: CISOTRADECRAFT10

Team8 Fixing AppSec Paper - https://bunny-wp-pullzone-pqzn4foj9c.b-cdn.net/wp-content/uploads/2024/11/Fixing-AppSec-Paper.pdf

Terraform and Open Policy Agent Example - https://spacelift.io/blog/terraform-best-practices#8-introduce-policy-as-code

Transcripts - https://docs.google.com/document/d/1u6B2PrkJ1D14d9HjQQHSg7Fan3M6n4dy

Chapters

• 01:19 1) AI Influencers become normalized
• 03:17 2) The Importance of Production Quality in Branding
• 05:19 3) Google and Apple Collaboration for Enhanced Security
• 06:28 4) Consolidation in Application Security and Vulnerability Management
• 08:36 5) The Rise of Models Committees
• 09:09 6) Formalizing the CISO Role
• 11:03 7) Exclusive CISO Retreats: The New Trend
• 12:12 8) Automating Cybersecurity Tasks with Agentic AI
• 13:10 9) Browser-Based Security Solutions
• 14:22 10) Post-Quantum Cryptography: Preparing for the Future

In this episode of CISO Tradecraft, host G Mark Hardy explores the challenges and misconceptions facing the next generation of cybersecurity professionals. The discussion covers the myth of a talent shortage, the shortcomings of current educational and certification programs, and the significance of aligning curricula with real-world needs. Hardy emphasizes the importance of hands-on experience, developing soft skills, and fostering continuous learning. The episode also highlights strategies for retaining talent, promoting internal training, and creating leadership opportunities to cultivate a skilled and satisfied cybersecurity workforce.

Transcripts: https://docs.google.com/document/d/12fI2efHXuHR4dS3cu7P0UIBCtjBdgREI

Chapters

• 00:00 Introduction to the Cybersecurity Talent Crisis
• 00:40 Debunking the Talent Shortage Myth
• 02:23 The Real Talent Gap: Mid-Career Professionals
• 03:04 Outsourcing and Its Impact on Entry-Level Jobs
• 08:29 Challenges in Cybersecurity Education
• 16:13 The Importance of Practical Skills Over Theory
• 23:52 The Importance of Writing Skills
• 25:10 Continuous Learning and Self-Investment
• 26:07 Performance and Career Progression
• 28:40 Mentorship and Onboarding
• 29:51 Training and Development Challenges
• 32:32 Retention Strategies
• 33:44 Engaging Junior Employees
• 39:07 Technology and Innovation
• 40:54 Conclusion and Final Thoughts

In this episode of CISO Tradecraft, host G Mark Hardy is joined by special guest Snehal Antani, co-founder of Horizon3.AI, to discuss the crucial interplay between offensive and defensive cybersecurity tactics. They explore the technical aspects of how observing attacker behavior can enhance defensive strategies, why traditional point-in-time pen testing may be insufficient, and how autonomous pen testing can offer continuous, scalable solutions. The conversation delves into Snehal’s extensive experience, the importance of readiness over compliance, and the future of cybersecurity tools designed with humans out of the loop. Tune in to learn how to elevate your cybersecurity posture in a rapidly evolving threat landscape.

Horizon3 - https://www.horizon3.ai

Snehal Antani - https://www.linkedin.com/in/snehalantani/

Transcripts: https://docs.google.com/document/d/1IFSQ8Uoca3I7TLqNHMkvm2X-RHk8SWpo

Chapters:

• 00:00 Introduction and Guest Welcome
• 01:43 Background and Experience of Snehal Antani
• 03:09 Challenges and Limitations of Traditional Pen Testing
• 14:47 The Future of Pen Testing: Autonomous Systems
• 23:10 Leveraging Data for Cybersecurity Insights
• 24:02 Expanding the Attack Surface: Cloud and Supply Chain
• 24:46 Third-Party Risk Management Evolution
• 44:37 Future of Cyber Warfare: Algorithms vs. Humans

Join host G Mark Hardy as he dives deep into the complexities of compliance and reporting, featuring special guests Brian Bradley and Josh Williams from FedShark. Discover a unique and streamlined approach to compliance using FedShark's innovative tools and AI-assisted systems. Learn about their exclusive offers for CISO Tradecraft listeners, including free downloads and discounted pre-assessment tools. Topics covered include CMMC, HIPAA, PCI, and more. Whether you're part of the Defense Industrial Base or dealing with multiple compliance frameworks, this episode is packed with practical advice to make your compliance journey smoother and more effective.

Thanks to our podcast sponsor, Fedshark

CISO Traderaft Promo & Link to CMMC White Papers: https://fedshark.com/ciso

RapidAssess: https://fedshark.com/rapid-assess

Company website: https://fedshark.com

FedShark Blog: https://fedshark.com/blog

Schedule a Demo: https://fedshark.com/contact-us

LinkedIn Matt Beaghley: https://www.linkedin.com/in/mbeaghley/

LinkedIn Brian Bradley: https://www.linkedin.com/in/brian-bradley-97a82668/

Chapters 

• 00:00 Introduction and Special Offer
• 03:18 Meet the Experts: Brian and Josh
• 06:49 Challenges in Compliance
• 16:23 Understanding CMMC
• 29:02 Understanding Scope in Compliance
• 30:22 Introducing the AI-Enhanced Compliance Solution
• 31:24 Streamlining Interviews and Documentation
• 42:19 Final Thoughts and Recommendations

This episode is sponsored by Indeni.  

On this episode of CISO Tradecraft, G Mark Hardy discusses with Yoni Leitersdorf (CEO and CISO of Indeni) the risks which can occur in a cloud environment after it has been provisioned. Essentially it's quite common for organizations to change their cloud environment from what was declared in a Terraform or Cloud Formation Script.  These unapproved cloud changes or Cloud Drift often create harmful misconfigurations and have the potential to create data loss events.

The podcast discusses the pros and cons of two key approaches to solve the Cloud Drift problem:

1. Static Security Testing in a build pipeline
2. Runtime Inventory Approaches 

The podcast features Yoni Leitersdorf.  Yoni founded a company (Indeni) to address Cloud Drift and discusses the business point of view of why this is a critical concern for the business.  If you would like to learn more about what Yoni is working on please check out Indeni

Yoni Leitersdorf can also be found on: LinkedIn

Twitter

One of the most common questions that we get asked on CISO Tradecraft is what do I need to learn to be a good CISO?  After a lot of reflection, CISO Tradecraft has put together a Top 10 List of CISO knowledge domains that we believe are the core skills which produce really good CISOs.  This episode will go over just the first 5 knowledge areas with the remaining five on a future episode.

1. Product Security focuses on ensuring developers write secure code
2. Defensive Technologies focuses on creating multiple layers of defenses in an organization to protect against a multitude of attacks
3. Detection & Response Capabilities is about creating mechanisms to identify how attackers might circumvent your organization’s defensive technologies
4. Laws, Regulations, & Oversight is about ensuring compliance with appropriate laws and regulations
5. Enabling Technologies is about enabling businesses to create digital transformation

https://github.com/cisotradecraft/podcast

This episode of CISO Tradecraft dives deep into the New York Department of Financial Services Cybersecurity Regulation, known as Part 500. Hosted by G Mark Hardy, the podcast outlines the significance of this regulation for financial services companies and beyond. Hardy emphasizes that Part 500 serves as a high-level framework applicable not just in New York or the financial sector but across various industries globally due to its comprehensive cybersecurity requirements. The discussion includes an overview of the regulation's history, amendments to enhance governance and incident response, and a detailed analysis of key sections such as multi-factor authentication, audit trails, access privilege management, and incident response. Additionally, the need for written policies, designating a Chief Information Security Officer (CISO), and ensuring adequate resources for implementing a cybersecurity program are highlighted. The podcast also offers guidance on how to approach certain regulatory mandates, emphasizing the importance of teamwork between CISOs, legal teams, and executive management to comply with and benefit from the regulation's requirements.

AuditScripts: https://www.auditscripts.com/free-resources/critical-security-controls/

NYDFS: https://www.dfs.ny.gov/industry_guidance/cybersecurity 

Transcripts: https://docs.google.com/document/d/1CWrhNjHXG1rePtOQT-iHyhed2jfBaZud

Chapters

• 00:00 Introduction
• 00:35 Why Part 500 Matters Beyond New York
• 01:48 The Evolution of Financial Cybersecurity Regulations
• 03:20 Understanding Part 500: Definitions and Amendments
• 08:44 The Importance of Multi-Factor Authentication
• 14:33 Navigating the Complexities of Cybersecurity Regulations
• 20:23 The Critical Role of Asset Management and Access Privileges 25:37 The Essentials of Application Security and Risk Assessment
• 31:11 Incident Response and Business Continuity Management
• 32:36 Concluding Thoughts on NYDFS Cybersecurity Regulation

On this episode we talk about the differences between Gamification and Game-Based Learning. We think you will enjoy hearing how Game-Based learning gets folks into the flow and creates novel training that resonates.  We also have a great discussion on how games can be applicable for Board Members and Techies.  You just need to get the right type of game for the right audience and let the magic happen.

Big Thanks to our Sponsors

• Haiku - https://www.haikuinc.io/
• Risk3Sixty - https://risk3sixty.com/whitepaper/

Transcripts

• https://docs.google.com/document/d/1XmkMO7eJR3yAnXJPOCTaA5J9sakk639Q

Prefer to watch on YouTube?

• https://www.youtube.com/watch?v=45eViHH_ktA 

Chapters

• 00:00 Introduction
• 03:38 What is Game-Based Learning?
• 07:55 Training Board of Directors
• 10:18 Gamification vs Game-Based Learning
• 14:30 Do Your Duties
• 21:09 Delaware Fiduciary Duties
• 22:54 Building a Forge
• 26:11 Tailored Game Types
• 33:35 Teaching Girl Scouts Linux Commands
• 40:17 Retaining Your Best People

On this episode of CISO Tradecraft, Anton Chuvakin talks about Logging, Security Information & Event Management (SIEM) tooling, and Cloud Security.  Anton share’s fantastic points of view on:

• How moving to the cloud is like moving to a space station (13:44)
• How you may be one IAM mistake away from a breach (20:05)
• How a SIEM is a logging based approach, whereas EDRs require agents at endpoints.  This becomes really interesting when cloud solutions don’t have an endpoint to install an agent (26:53)
• Why you don’t want an on premises SIEM (32:35)
• The 3 AM Test - Should you wake someone up for this alert at 3 AM (39:24)

Join G. Mark Hardy in Torremolinos, Spain, for a deep dive into the security of Generative AI. This episode of CISO Tradecraft explores the basics of generative AI, including large language models like ChatGPT, and discusses the key risks and mitigation strategies for securing AI tools in the workplace. G. Mark provides real-world examples, insights into the industry's major players, and practical steps for CISOs to balance innovation with security. Discover how to protect sensitive data, manage AI-driven hallucinations, and ensure compliance through effective governance and ethical guidelines. Plus, get a glimpse into the future of AI vulnerabilities and solutions in the ever-evolving tech landscape.

References

OWASP Top 10 LLM Risks https://genai.owasp.org/

Gartner CARE Standard - https://www.gartner.com/en/documents/3980890

• Make sure your controls work consistently over time (Consistency)
• Make sure your controls meet the business needs (Adequacy)
• Make sure your controls are appropriate and fair (Reasonableness)
• Make sure your controls produce the desire outcome (Effectiveness)

Transcripts: https://docs.google.com/document/d/1V2ar7JBO503MN0RZcH7Q7VBkQUW9MYk6

Chapters

• 00:00 Introduction from Spain
• 00:42 Understanding Generative AI
• 03:25 Major Players in Generative AI
• 05:02 Risks of Generative AI
• 15:14 Mitigating Generative AI Risks
• 18:23 Implementing Solutions
• 24:09 Conclusion and Call to Action

In this episode, we take a deep dive into that four-letter word RISK. Risk is measurable uncertainty. As a component of Governance, Risk, and Compliance (GRC), risk management is an important part of a security leader's responsibility. Risk assessment is conducted for a number of reasons, and measuring risk is an important component of effectively overseeing our IT investments. We'll look at NIST and ISO standards for risk, and define the different types of risk assessments. And, because there is risk inherent in many endeavors, this episode will be continued in a part 2, because we didn't allow for the risk of running over with this much great information.

Have you ever thought about what does it mean to say there has been a material incident? How is materiality determined? What is the history of how that term has been defined by U.S. Regulators. Listen to today's show and increase your CISO Tradecraft

Big Thanks to our Sponsors

• Risk3Sixty - https://risk3sixty.com/whitepaper/
• CPRIME - For those valuing leadership, policy, and governance in tech risk and security, Cprime is here to help. Enhance your skills with our training and workshops, ensuring effective policy design and strategy alignment. As a tech coaching firm, Cprime offers classes for teams and executives on security analytics and risk management. Led by a Cprime expert, align expectations, prioritize, and map tools for robust governance across your tech portfolio. Upgrade risk management at www.cprime.com/train and use code 'cprimepod' for 15% off training. Elevate your approach!

Transcripts https://docs.google.com/document/d/1h7IBZI27ZOg4nxec2fCBmrX0c-0O15Zr 

Link to FAIR-MAM

https://www.fairinstitute.org/resources/fair-mam

Chapters

• 00:00 Introduction
• 02:16 What is the concept of material?
• 07:08 Investors increasingly seek information
• 11:21 Title 17 of the US Code Part 242
• 17:38 Backup and Recovery that is Resilient and Geographically Diverse
• 22:10 The New SEC requirements
• 26:38 Reporting Cyber Incidents
• 31:40 FAIR-MAM

In this episode of CISO Tradecraft, hosts G Mark Hardy and guests Jeff Majka and Andrew Dutton discuss the vital role of competitive threat intelligence in cybersecurity. They explore how Security Bulldog's AI-powered platform helps enterprise cybersecurity teams efficiently remediate vulnerabilities by processing vast quantities of data, thereby saving time and enhancing productivity. The conversation covers the importance of diverse threat intelligence sources, including open-source intelligence and insider threat awareness, and the strategic value of AI in analyzing and prioritizing data to manage cybersecurity risks effectively. The discussion also touches on the challenges and potentials of AI in cybersecurity, including the risks of data poisoning and the ongoing battle between offensive and defensive cyber operations.

The Security Bulldog: https://securitybulldog.com/contact/

Transcripts: https://docs.google.com/document/d/1D6yVMAxv16XWtRXalI5g-ZdepEMYmQCe

Chapters

• 00:00 Introduction
• 00:56 Introducing the Experts: Insights from the Field
• 02:43 Unpacking Cybersecurity Intelligence: Definitions and Importance
• 04:02 Exploring Cyber Threat Intelligence (CTI): Applications and Strategies
• 13:11 The Role of AI in Enhancing Cybersecurity Efforts
• 16:43 Navigating the Complex Landscape of Cyber Threats and Defenses
• 19:07 The Future of AI in Cybersecurity: A Balancing Act
• 22:33 Exploring AI's Role in Cybersecurity
• 22:50 The Practical Application of AI in Cybersecurity
• 25:08 Challenges and Trust Issues with AI in Cybersecurity
• 26:52 Managing AI's Risks and Ensuring Reliability
• 31:00 The Evolution and Impact of AI Tools in Cyber Threat Intelligence
• 34:45 Choosing the Right AI Solution for Cybersecurity Needs
• 37:27 The Business Case for AI in Cybersecurity
• 41:22 Final Thoughts and the Future of AI in Cybersecurity

On this episode of CISO Tradecraft we feature Robin Dreeke from People Formula.  Robin was the former head of the FBI Counterintelligence Behavioral Analysis Program and has an amazing background in learning how individuals think, build trust, and communicate.  Robin highlights 4 Pillars of Communicating:

1. Seek the thoughts and opinions of others
2. Talk in terms of priorities, pain points, and challenges of others
3. Use Nonjudgmental validation (ie seek to understand others without judging)
4. Empower others with choice and give them cause and effect of each choice

To learn more about Robin's way of thinking you can check out his podcast and books:

• Forged By Trust Podcast
• Sizing People Up 
• The Code of Trust 
• It's Not All About Me

• The People Formula Workbook 2.0: Communication Style Inventory

   

🔥 Hackers Beware! Cyber Deception is Changing the Game 🔥

In this must-hear episode of CISO Tradecraft, we expose a mind-blowing cybersecurity strategy that flips the script on attackers. Instead of waiting to be breached, cyber deception technology tricks hackers into revealing themselves—before they can do real damage. 🚨🎭

Imagine laying digital traps—fake credentials, bogus systems, and irresistible bait—that lead cybercriminals straight into a controlled maze where every move they make is tracked.

Early threat detection? ✅

Real-time attacker intel? ✅

Fewer false positives? ✅

🎙️ Featuring deception tech guru Yuriy Gatupov, we break down:

✅ How deception tech works & why it’s a game-changer

✅ How to expose and track hackers in real time

✅ How to prove ROI and make the case for your org Cyber deception isn’t just defense—it’s offense against cyber threats. Are you ready to fight back? Listen now!

Big thanks to our Sponsors

ThreatLocker - https://hubs.ly/Q02_HRGK0 

CruiseCon - https://cruisecon.com/

Contact Yuriy Gatupov -  info@labyrinth.tech 

Yuri's LinkedIn - https://www.linkedin.com/in/yuriy-gatupov-373155281/ 

Transcripts: https://docs.google.com/document/d/1oyQzCBRoPLbDOCOCypJMGGXxcPI5w75o 

Chapters 

• 02:05 History of Cyber Deception
• 04:57 Advantages of Deception Technology
• 06:57 Engagement and Detection Strategies
• 10:18 How Deception Technology Works
• 16:13 Attack Scenarios and Detection
• 24:09 Decoys and Deception: A New Paradigm
• 24:56 Real-World Success Stories
• 33:30 Deception in OT and SCADA Systems
• 37:38 Calculating ROI for Deception Technologies

In this episode of CISO Tradecraft, host G. Mark Hardy sits down with Bill Dougherty, CISO of Omada Health, to discuss a groundbreaking threat model called 'Includes No Dirt'. This comprehensive model integrates security, privacy, and compliance considerations, aiming to streamline and enhance threat modeling processes. The conversation covers the origin and principles of the model, its applicability across different sectors, and the essential aspects of threat modeling. Listeners are also treated to insights on handling third-party risks and adapting to emerging AI challenges. The episode provides practical advice for cybersecurity leaders looking to effectively manage and mitigate risks while reducing redundancy.

Big Thanks to our Sponsors:

ZeroPath - https://zeropath.com/

CruiseCon - Use code CISOTRADECRAFT10 at https://cruisecon.com/ for 10% off registration!

The No DIRT Threat Model can be found here: http://www.includesnodirt.com/nodirt.pdf

Transcripts: https://docs.google.com/document/d/1vWq4Zx7pzM_B65W933m8_TE0fLKaUw3X

Chapters

• 03:27 The Genesis of Includes No Dirt
• 05:05 Combining Security, Privacy, and Compliance
• 07:24 Implementing the No Dirt Model
• 11:42 Scoring and Evaluating Risks
• 17:41 Third-Party Risk Management
• 25:49 Evaluating SaaS Requests Based on Risk
• 27:55 Adapting Threat Models for AI
• 31:24 Principles of Minimum Necessary Data
• 33:42 General Applicability of Security Principles
• 35:12 Includes No Dirt: A Comprehensive Threat Model
• 40:15 Final Thoughts and Recommendations

Identity is the New Perimeter.  On this episode of CISO Tradecraft you will increase your understanding of Identity and Access Management.  Key topics include:

• Audit Trail
• Authentication
• Authorization
• Identity Compromise
• Least Privilege
• Microsegmentation
• Multi Factor Authentication (MFA)
• Privileged Access/Account Management (PAM)
• Role Based Access Control (RBAC)
• Single Sign On (SSO)

When you first start a cybersecurity job, or hire someone into a cybersecurity job, there is a window of opportunity to see things with a new perspective.  In this episode, we’re privileged to share ideas with Rebecca Mossman, a successful cybersecurity leader who has led successfully a number of teams in her career.  We’ll examine relationships, stakeholders, setting priorities, communication, and knowing when to call something “done” and move on to the next task.

Special Thanks to our podcast sponsor, Obsidian Security.  

We are really excited to share today’s show on SaaS Security Posture Management.  Please note we have Ben Johnson stopping by the show so please stick around and enjoy.  First let’s go back to the basics:

Today most companies have already begun their journey to the cloud.  If you are in the midst of a cloud transformation, you should ask yourself three important questions:  

1. How many clouds are we in?
2. What data are we sending to the cloud to help the business?
3. How do we know the cloud environments we are using are properly configured?

Let’s walk through each of these questions to understand the cyber risks we need to communicate to the business as well as focus on one Cloud type that might be forecasting a major event.  First let’s look at the first question.  

How many clouds are we in?  It’s pretty common to find organizations still host data in on premises data centers.  This data is also likely backed up to a second location just in case a disaster event occurs and knocks out the main location.  Example if you live in Florida you can expect a hurricane.  When this happens you might expect the data center to lose power and internet connectivity.  Therefore it’s smart to have a backup location somewhere else that would be unlikely to be impacted by the same regional event.  We can think of our primary data center and our backup data center as an On-Premises cloud.  Therefore it’s the first cloud that we encounter.  

The second cloud we are likely to encounter is external.  Most organizations have made the shift to using Cloud Computing Service providers such as Amazon Web Services, Azure, Google Cloud Platform, or Alibaba.  Each of these cloud providers has a multitude of offerings designed to help organizations reduce the need to host IT services on premises.  Now if you are using both on-premises and a cloud computing provider such as AWS, congratulations you are in what is known as a hybrid cloud environment.  If you use multiple cloud computing providers such as AWS and Azure then you are in a multi-cloud environment.  Notice the difference between terms.  Hybrid cloud means you host on premises and use an external cloud provider, whereas multi-cloud means you use multiple external cloud providers.  If you are using a Common Cloud platform like AWS, Azure, or GCP then you can look into a Gartner Magic Quadrant category known as Cloud Workload Protection Platforms.  Here you might encounter vendors like Palo Alto Prisma Cloud, Wiz, or Orca who will provide you with recommendations for your cloud configuration settings.

So let’s say your organization uses on premises and AWS but not Azure or GCP.  Does that mean you only have two clouds?  Probably not.  You see there’s one more type of cloud hosted service that you need to understand how to defend.  The most common cloud model organizations leverage is Software as a Service commonly pronounced as (SaaS). Frankly we don’t hear about SaaS security being discussed much which is why we are doing a deep dive on its security in this episode.  We think there's a real danger of SaaS clouds turning from a nice cloud that gently cools down a hot summer day into a severe weather storm that can cause an event.  So let’s look at SaaS Security in more depth.  

SaaS refers to cloud hosted solutions whereby vendors maintain most everything.  They run the application, they host the data, they host runtime environments, middleware, operating systems, virtualization technologies, servers, storage, and networking.  It can be a huge win to run SaaS solutions since it minimizes the need to have IT staff running all of these IT services.  Example: Hiring HVAC folks to ensure we have proper heating and cooling for servers on premises won’t add new sales revenue to the business.  

Now that you understand why SaaS is important you should ask yourself.  How many external SaaS providers are we sending sensitive data to?  Every company is different but most can expect to find dozens to hundreds of SaaS based solutions.  Examples of external SaaS solutions commonly encountered by most businesses include: 

• Service Now or Jira in use as a ticketing service, 
• Salesforce for customer relationship management
• Workday for HR information
• G Suite or Microsoft Office 365 in use to send emails and create important documents
• Github as a source code repository for developers
• Zoom for virtual teleconferences
• Slack for instant messaging like conversations
• Okta for Identity and Access Management

Once you build out an inventory of your third parties hosted SaaS solutions, you need to understand the second question.  What kind of data is being sent to each service?  Most likely it’s sensitive data.  Customer PII and PCI data might be stored in Salesforce, Diversity or Medical information for employees is stored in Workday, Sensitive Algorithms and proprietary software code is stored in GitHub, etc.  OK so if it is data that we care about then we need to ensure it doesn’t get into the wrong hands.  We need to understand why we care about SaaS based security which is commonly known as SaaS Security Posture Management.  Let’s consider the 4 major benefits of adopting this type of service.  

1. Detection of Account Compromise.  Today bad actors use man in the middle attacks to trick users to give their passwords and MFA tokens to them.  These attacks also provide the session cookie credentials that allow a website to know a user has already been authenticated.  If attackers replay these session cookie credentials there’s no malware on the endpoints.  This means that Antivirus and EDR tools don’t have the telemetry they need to detect account compromise.  Therefore, you need log data from the SaaS providers to see anomalous activity such as changing IP addresses on the application.  Note we talked about this attack in much more detail on episode 87 From Hunt Team to Hunter with Bryce Kunze.  
2. In addition to detecting account compromises, we see that SaaS security posture management solutions also improve detection times and response capabilities.  Let’s just say that someone in your organization has their login credentials to Office 365 publicly available on the dark web.  So a bad actor finds those credentials and logs into your Office 365 environment.  Next the bad actor begins downloading every sensitive file and folder they can find.  Do you have a solution that monitors Office 365 activity for Data Loss Prevention?  If not, then you are probably going to miss that data breach.  So be sure to implement solutions that both log and monitor your SaaS providers so you can improve your SaaS incident detection and response capabilities.
3. A third benefit we have seen is improvements to configuration and compliance.  You can think of news articles where companies were publicly shamed when they lost sensitive data by leaving it in a Public Amazon S3 bucket when it should have been private.  Similarly there are settings by most SaaS solutions that need to be configured properly.  The truth is many of these settings are not secure by default.  So if you are not looking at your SaaS configurations then access to sensitive data can become a real issue.  Here’s an all too common scenario.  Let’s say your company hires an intern to write a custom Salesforce page that shows customer documents containing PII.  The new intern releases updates to that webpage every two weeks.  Unfortunately the intern was never trained on all of the Salesforce best practices and creates a misconfiguration that allows customer invoices to be discovered by other customers.  How long would this vulnerability be in production before it’s detected by a bad actor?  If you think the answer is < 90 days, then performing yearly penetration tests is probably too slow to address the brand damage your company is likely to incur.  You need to implement a control that finds vulnerabilities in hours or days not months.  This control might notify you of compliance drift in real time when your Salesforce configuration stopped meeting a CIS benchmark.  Now you could pay a penetration testing provider thousands of dollars each week to continually assess your Salesforce environment, but that would become too cost prohibitive.  So focus on being proactive by switching from manual processes such as penetration testing to things that can be automated via tooling
4. The fourth major benefit that we observe is proper access and privilege management. Here’s one example.  For critical business applications you often need to enforce least privilege and prevent the harm that one person can cause.  Therefore, it’s common to require two or more people to perform a function.  Example: One developer writes the new code for a customer facing website, another developer reviews the code to detect if there’s any major bugs or glaring issues that might cause brand damage.  Having a solution that helps mitigate privilege creep ensures that developers don’t increase their access.  Another example of the importance to proper access management occurs when bad employees are fired.  When a bad employee is fired, then the company needs to immediately remove their access to sensitive data and applications.  This is pretty easy when you control access via a Single Sign On solution.  Just disable their account in one place.  However many SaaS providers don’t integrate with SSO/SAML.  Additionally the SaaS website is generally internet accessible so people can work from home even if they are not on a corporate VPN.  Therefore it’s common to encounter scenarios where bad employees are fired and their account access isn’t removed in a timely manner.  The manager probably doesn’t remember the 15 SaaS accounts they granted to an employee over a 3 year time frame.  When fired employees are terminated and access isn’t removed you can generally expect an audit finding, especially if it’s on a SOX application.  

OK so now that we talked about the 4 major drivers of SaaS Security Posture Management (detection of account compromise, improved detection and response times, improvements to configuration and compliance, and proper access and privilege management) let’s learn from our guest who can tell us some best practices with implementation.

Now I’m excited to introduce today’s guest:  Ben Johnson Live Interview

Well thanks again for taking time to listen to our show today.  We hoped you learning about the various clouds we are in (On Premises, Cloud Computing Vendors, and SaaS), Understanding the new Gartner Magic Quadrant category known as SaaS Security Posture Management.  So if you want to improve your company’s ability on SaaS based services to:

1. detect account compromise, 
2. improve detection and response times, 
3. improve configuration and compliance, and 
4. proper access and privilege management 

Remember if you liked today’s show please take the 5 seconds to leave us a 5 star review with your podcast provider.  Thanks again for your time and Stay Safe out there.

Have you ever just met someone that was so interesting that you just sat and gave them your full attention?  On this episode of CISO Tradecraft, we have Bill Cheswick come on the show.  Bill talks about his 50 years in computing.  From working with the pioneers of Unix at Bell Labs, inventing network visualization techniques for the DoD, and creating the early best practices in firewalls and perimeter defenses.  He was also the first person to co-author a book on Internet Security.  So listen in and enjoy. Also special thanks to our sponsor, Obsidian Security.  You can learn more about them at: https://www.obsidiansecurity.com/sspm/

Welcome to another episode of CISO Tradecraft with your host, G. Mark Hardy! In this episode, we dive into how CISOs can drive the profitable growth of their company's products and services. Breaking the traditional view of security as a cost center, Mark illustrates ways CISOs can support business objectives like customer outreach, service enablement, operational resilience, and cost reduction. Tune in for insightful strategies to improve your impact as a cybersecurity leader and a sneak peek at our upcoming CISO training class! If you would like to learn more about our class, drop us a comment: https://www.cisotradecraft.com/comment

Transcripts: https://docs.google.com/document/d/19SDBdQSTLc58sP5ynwzhuedNHzk7QPKj

Chapters

• 00:00 Introduction to Profitable Growth for CISOs
• 01:16 Understanding Profit and Business Objectives
• 03:24 Enhancing Customer Experience through Cybersecurity
• 08:51 Service Enablement and Upselling Strategies
• 11:39 Ensuring Operational Resilience
• 13:36 Cost Reduction and Efficiency Improvements
• 18:31 Recap and Final Thoughts
• 19:10 Exciting Announcement: CISO Training Course

On this episode of CISO Tradecraft we are going to talk about various Access Control & Authentication technologies.

Access Control Methodologies:

• Mandatory Access Control or (MAC)
• Discretionary Access Control or (DAC)
• Role Based Access Control or (RBAC)
• Privileged Access Management or (PAM)
• Rule Based Access Control
• Attribute Based Policy Control (ABAC) or Policy Based Access Control (PBAC)

Authentication Types:

• Password-based authentication
• Certificate-based authentication
• Token-based authentication
• Biometric authentication
• Two-factor Authentication (2FA)
• Multi-Factor Authentication (MFA)
• Location-based authentication
• Computer recognition authentication
• Completely Automated Public Turing Test to Tell Computers & Humans Apart (CAPTCHA)
• Single Sign On (SSO)
• Risk Based authentication

References

• https://riskbasedauthentication.org/
• https://blog.identityautomation.com/what-is-risk-based-authentication-types-of-authentication-methods
• https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures 
• https://www.n-able.com/blog/network-authentication-methods 
• https://www.getgenea.com/blog/types-of-access-control/ 
• https://www.twingate.com/blog/access-control-models/ 
• https://csrc.nist.gov/glossary/term/authentication 
• https://csrc.nist.gov/glossary/term/authorization 
• https://www.techtarget.com/searchsecurity/definition/access-control 

Special Thanks to our podcast Sponsor, Prevailion.

Some of the best C-level executives start in the technical ranks.  This episode features Nate Warfield, CTO of Prevailion, who differentiated himself by creating the CTI-League.com to assist healthcare companies with ransomware.  We'll cover some of that organization, how Nate got his first C-level job, and some lessons learned you might appreciate in your own CISO journey.

To learn more about Cyber Adversary Intelligence, please check out Prevailion who sponsored this episode.

Show Notes

Hello, and welcome to another episode of CISO Tradecraft -- the podcast that provides you with the information, knowledge, and wisdom to be a more effective cyber security leader.  My name is G. Mark Hardy, and today we're going to offer tips and tools for briefing your executive leadership team, including the four major topics that you need to cover.  As always, please follow us on LinkedIn, and make sure you subscribe so you can always get the latest updates.

Imagine you have been in your role as the Chief Information Security Officer for a while and it is now time to perform your annual brief to the Executive Leadership Team.  What should you talk about?  How do you give high level strategic presentations in a way that provides value to executives like the CEO, the CIO, the CFO, and the Chief Legal Officer?

• Story about Kim Jones at Vantiv – things have changed

Let's first talk about how you make someone satisfied -- in this case your executives.

Fredrick Herzberg (1923-2000) introduced Motivator-Hygiene theory, which was somewhat like Maslow's hierarchy of needs, but focused more on work, not life in general.

What a hygiene factor basically means is people will be dissatisfied if something is NOT there but won't be motivated if that thing IS there, e.g., toilet paper in employee bathroom.

Or, said more concisely, satisfaction and dissatisfaction are not opposites.  The opposite of Satisfaction is No Satisfaction.  The opposite of Dissatisfaction is No Dissatisfaction.

According to Herzberg, the factors leading to job satisfaction are "separate and distinct from those that lead to job dissatisfaction."

For example, if you have a hostile work environment, giving someone a promotion will not make him or her satisfied.

So, what makes someone satisfied or dissatisfied?

• Achievement
• Recognition
• The work itself
• Responsibility
• Advancement
• Growth

• Company policies
• Supervision
• Relationship with supervisor and peers
• Work conditions
• Salary
• Status
• Security

So, what will make a board member satisfied?  Today, cyber security IS a board-level concern.  In the past, IT really was only an issue if something didn't work right – a hygiene problem.  If we learn from Herzberg, we may not be able to make the board satisfied with the state of IT security, but we can try to ensure they are not dissatisfied.  Hopefully you now have context for what might otherwise be considered splitting hairs on terminology – essentially, we want our executive audience to not think negatively of your IT security program and how you lead it.

Remember, boards of directors generally come from a non-IT backgrounds .  According to the 2021 U.S. Spencer Stuart Board Index, of the nearly 500 independent directors who joined S&P 500 boards in 2021, less than 4% have experience leading cybersecurity, IT, software engineering, or data analytics teams.  And that 4% is mostly confined to tech-centric companies or businesses facing regulatory scrutiny.

So, there is essentially a mismatch between a board member's background and a CISO's background.  That extends to your choice of language and terminology as well.  Never go geeky with your executives – unless you have the rare situation where your entire leadership team are all IT savvy.  Otherwise, you will tune them out by talking about bits and bytes and packets and statistics.

Instead, communicate by telling stories – show how other companies in similar industries have encountered security issues and what they did about them (either successfully or unsuccessfully).  Show how your cybersecurity initiatives and efforts reduce multiple forms of risk:  financial risk, reputational risk, regulatory risk, legal risk, operational risk, and strategic risk.  You can show that the threat landscape has changed – nation states and organized crime has supplanted lone hackers and disgruntled employees as the major threats  .  Regulatory environment changes such as the California Consumer Privacy Act (CCPA) and ultimately the follow-on legislation from 49 other states will impact strategic business planning.  Show your board how to avoid running afoul of these emerging requirements.  And, of course, there is the ever-present threat of ransomware, which has evolved from denial-of-access attacks to loss of customer and internal data confidentiality.  That threat requires top-level policy and response plans in advance of an incident -- it's too late to be making things up as you go along.

Now, before we go into the Four Major Topics executives need to hear (after all, that's what I promised at the beginning of the show), let's ask, "Why are we briefing executives on our cyber program?"  Any company that is publicly traded falls under the scope of the Securities and Exchange Commission or SEC.

The SEC has published Cybersecurity Guidance that offers suggestions for investment companies and investment advisors.  They recommend investment firms "create a strategy that is designed to prevent, detect, and respond to cybersecurity threats".

The creation of a security strategy and education of employees on the strategy is at the core of what CISOs do.  So, a translation of the SEC's guidance is to hire a CISO, have that individual create and execute a cybersecurity strategy.  In fact, the SEC's quote above calls out three of the Five Functions of the NIST Cybersecurity Framework which are: (1) identify, (2) protect (prevent), (3) detect, (4) respond, and (5) recover.

Our second question is, how often should we be updating the Executive leadership team?  Since the SEC requires companies to disclose risks in their 10-K statements on a yearly basis then you should be briefing cyber updates to the Executive Leadership team at least on an annual basis.  We recommend quarterly or semi-annual updates to give more touch points on important topics.  You can draw parallels to quarterly financial statements.

Let's say the Risk Committee chaired by the CEO has agreed to hear the status of the Cyber Program twice a year.  What should we brief the executive leadership team?

Let's look at what's required by law.

The State of New York requires financial services organizations to follow New York Department of Financial Services (NYDFS) regulations.  Section 500.04 provides additional information about CISOs.  It states:

Each Covered Entity shall designate a qualified individual responsible for overseeing and implementing the Covered Entity's cybersecurity program and enforcing its cybersecurity policy (for purposes of this Part, "Chief Information Security Officer" or "CISO").

The regulations also state:

The CISO of each Covered Entity shall report in writing at least annually to the Covered Entity's board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a Senior Officer of the Covered Entity responsible for the Covered Entity's cybersecurity program. The CISO shall report on the Covered Entity's cybersecurity program and material cybersecurity risks.

These types of requirements aren't confined to Wall Street.  The Bermuda Monetary Authority requires insurance companies to follow their Cyber Risk Management Code of Conduct.  It states that:

The board of directors and senior management team must have oversight of cyber risks. The board of directors must approve a cyber risk policy document at least on an annual basis.

So, both the State of New York and the Bermuda Monetary Authority want CISOs to provide risk management and perform at least yearly reporting on material cyber security risks.  Many more regulatory bodies do; these are just offered as examples.

If you are going to function effectively as a leader, you should find some way to create a win-win from most any situation.  You likely have a regulatory requirement to brief your board or leadership on a periodic basis.  That's fine.  But have you ever asked yourself, what do I want in return?

Hmm.

What you want is for your board to set the security culture from the top.  Boards hold senior leadership (think C-level executives) accountable, and you want the board to ensure the CEO makes cybersecurity a priority for the organization.  ISO 27001 has a nice tool – the Information Security Management System (ISMS) Policy Statement – which is senior leadership's declaration of the importance of cybersecurity within the organization.

One example I found is that of GS1 India, a standards organization that helps Indian industry align with global best practices.  Their ISMS Policy statement begins with:

The Management of GS1 India recognizes the importance of developing and implementing an Information Security Management System (ISMS) and considers security of information and related assets as fundamental for the successful business operation. Therefore, GS1 India is committed towards securing the Confidentiality, Integrity, and availability of information for the day-to-day business and operations.

If you can get a formal declaration of support from the top, your job is going to be a whole lot better.  Otherwise, you might just end up being the Chief Scapegoat Officer.

Now let's define the four things that an executive leadership team should hear from their security leader that will convey the message that you have a handle on your scope of authority and are executing your responsibilities correctly.  Those four focuses are:

1. Cyber Risks and Responses
2. Cyber Metrics
3. A Cyber Roadmap that Identifies High Profile Programs and Projects
4. Cyber Maturity Assessment

Let's dig in.  With respect to "cyber risks and responses," create a slide for executives that shows the top cyber risks.  Examples may include things like ransomware, business email compromise, phishing attacks, supply chain attacks, third party compromise, and data privacy issues.

As a practical matter when briefing cyber risks, never just share a risk and walk away.  Executives hate that.  Be sure to talk about what you are doing as a CISO to mitigate this risk.  Usually in Risk Meetings executives look for a few things about any risk.

• What is it?
• What is the likelihood of it to occur?
• What is the impact if it does occur?
• What are we doing about it?
• How much does it cost to fix?

However, this isn't a risk approval meeting where we need to go into that level of detail.  So, let's keep our cyber risk reporting at an executive level by identifying our top three to five material risks and showing our cyber responses to each risk.

For example, if you believe phishing is your number one cyber risk, then highlight it and talk about how you have created a phishing education program that lowers click rates and increases phishing reporting to the Cyber Incident Response Team.  When phishing attacks are reported, your team has a Service Level Agreement (SLA) to respond to phishing reports within four hours to minimize any potential harm.  You can also highlight that your organization also has email protection tools in place such as Proofpoint that stopped thousands of phishing attacks during the last quarter.

In summary you are acknowledging that your company has Cyber Risks which can harm the organization.  You are protecting the organization the best you can given the resources available to your team.  If someone doesn't like your four-hour SLA, then you might offer up that you could decrease the response time to a one-hour SLA if you had one additional headcount.  This creates a business decision to give you additional headcount, which is a great discussion to have.

Once you have talked about the top three to five risks your organization faces, we recommend talking about key metrics to measure the Cyber Program.  You could call these the metrics that matter.  Essentially, they are tactical metrics that you measure month to month because they show risks that could result in major cyber-attacks.  Our favorite place for metrics that matter is the OWASP Threat and Safeguard Matrix or TaSM (pronounced like Tasmanian Devil).  Please note we have a link to it in our show notes.  Please, please, please read about the OWASP Threat and Safeguard Matrix.  It's a short five-minute read, and you will be glad that you did.

What does the Threat and Safeguard Matrix teach us about cyber metrics?  It says all good metrics show a status, a trend, and a goal.

• Status shows where we are right now
• Trends show if the project, program, or company is getting better or worse
• Goals show the end state so we know when we are done and if we should be happy with our current progress

The OWASP Threat and Safeguard Matrix then categorizes cyber metrics into four major areas:  technology, people, process, and environment.

• Technology-based metrics show things like how fast we are patching devices and how well are our servers and laptops configured.  Think about it, if you have servers that are internet-facing which are not patched then it's just a matter of time until bad actors will cause your company (and you) a really bad day.  This isn't something that you can wait on.  So, your organization needs to continually track progress and burn these numbers down as quickly as possible.  So, let's do something about it.  Start by looking at your company's security policy that defines the patch timelines for high and critical vulnerabilities.  It might say something such as we require critical vulnerabilities to be patched in 15 days and high vulnerabilities to be patched in 30 days.  From that security policy you create a Service Level Agreement for the IT department to meet.  So, you measure the percentage of your servers that have zero high and critical vulnerabilities greater than that 15 or 30-day window.  Yeah, it's going to look terrible in the beginning when your IT department shows that only 30% of its servers are patched according to the enterprise service level agreements.  But transparency brings reform.  When the CIO sees that these metrics are routinely being briefed to the CEO and executive leadership team, then things will change.  The CIO will say "not on my watch" and usually lead the IT team to make the changes needed to improve patching.
• Another metric category we see from the OWASP TaSM is People.  When we think about cyber threats to people we usually think about phishing.  So, during your monthly phishing exercises record your click rates and your reporting rates.  Since each phishing exercise is different you should benchmark your organization against other organizations who took the same phishing exercise.  You can say we had 5% click-through compared to our industry vertical that scored 7%.  If you are doing better than your peers, then you can show you are following best practices and meeting the legal term of due care.  These metrics might lower your cyber insurance costs.  These metrics could also be extremely helpful if your company were sued as a result of a data breach that begin with successful phishing attacks.  So, measure them each month and make good progress.
• The third metric category is Process-based metrics.  Here you can monitor things like your third-party risks by looking at your processes that track how many of your third parties pass a review, have active ISO 27001 or SOC 2 Type 2 reports, and have recently passed penetration tests.  Another process you might look at is what percentage of your critical applications performed adequately during both a Disaster Recovery exercise and a Business Continuity Plan exercise.  These metrics are helpful during Sarbanes-Oxley (SOX) attestations and other regulatory reviews.
• The fourth and last metric category defined by the OWASP TaSM is Environment-based metrics.  This refers to things outside of your organization that you don't control.  Even though you don't control them they can have a substantial impact on your organization.  You can think of countries passing new cyber or data privacy laws, regulators asking for new information and compliance activities, and malicious actors and fraudsters taking interest in your company all as examples of environment-based factors.  Please don't confuse environmental factors with saving the Earth.  This is not the context you are looking for.  Environment metrics could be used to show how many legitimate phishing attacks your organization stopped when someone reported a phishing attack, and the Incident Response Team confirmed it wasn't a false positive.  Note these are actual phishing attacks not phishing exercises.  This is an important metric because it shows that despite email protection tools in place, things got passed it.  If you notice a 500% increase in confirmed phishing attacks you might need to buy additional tooling to interdict them.  Another metric you might look at is how many reported help-desk tickets your organization responded to that were caused by a cyber incident.  These types of metrics can help inform management just how big the malicious attacker threat is and can be used by you to justify additional resources.

Well, that's a good overview on Cyber Metrics that you can look at each month, but we still have two more categories to go over in our cyber update.  Remember if you want to learn more on cyber metrics, please look at the OWASP Threat and Safeguard Matrix.

The third broad category of slides to include in your board deck is A Cyber Roadmap that Identifies High Profile Programs and Projects.  Executives want to see the big picture on how you are evolving the program.  So, show them a roadmap that says over the next three years here is the big picture.

For example, in 2022 we are focusing on improving ransomware defenses by enhancing our backup and data recovery process.  We will also improve our ability to prevent malware execution in our environment by adding new Windows group policies.

In 2023, we will shift our focus towards improving our website security.  We will be launching a bug bounty program that allows smart and ethical hackers to find vulnerabilities in our websites before malicious actors do.  We will be upgrading our Web Application Firewall after we finish our three-year contract with our current vendor.  We will also be adding a botnet protection tool to our internet-facing websites given the recent attacks we have been experiencing.

In 2024, we will then shift our focus to improving our software development process.  We will be purchasing a tool to gamify secure software development amongst developers.  This should lower the cost of vulnerability management.  We will also be building custom courses in house that teach developers our company's requirements to build, test, and retire applications correctly.

When you present this type of Cyber Roadmap you might show a single slide with a Gantt chart view of when high profile projects occur with the executive summary of the points previously mentioned.

The last major category is a Cyber Maturity Assessment.  Essentially you want something that independently measures the effectiveness of the entire Cyber Program.  For example, many organizations use the NIST Cybersecurity Framework, ISO 27001, the FFIEC Cyber Assessment Tool, or HiTrust to benchmark their program.  Consider hiring an independent auditing company to measure your organization's security maturity.  You will get something that says here's the top fifteen domains of cyber security.  Today, on a scale of one to five, your organization measures between a two and four on most of the domains.  Most companies in your same industry benchmark are at a level three compliance so you are currently underperforming vs your peers in four domains.  You can take that independent assessment and say we really want to improve all level two scoring opportunities to be at least a three.  This can be something you show in a spider graph or radar chart.  You can show the top five activities needed to improve these measurements and provide timelines for when those will be fixed.  This shows the executive leadership team that security is never perfect, how you benchmark against your peers, and provides them with the same confidence that they would get from an audit to confirm you are working effectively.

So, let's summarize.

We talked about Herzberg's hygiene factors, things that aren't perceived as satisfactory when present but are dissatisfactory when absent.  Remember, satisfaction and dissatisfaction are not opposites.  The opposite of dissatisfaction is no dissatisfaction.

That helps us understand that when briefing management, we will not be able to delight them with the overall state of our cybersecurity program, but we can cause them not to worry about it.  Focus on risk reduction, and how your program is helping your organization work toward that goal.

We talked about why we need to brief management and how often.  Different regulations require executive teams to articulate a cybersecurity strategy and empower the appropriate individuals to execute it.  In addition, most rules require at least annual security briefings; you may want to strive for more frequent meetings to keep your leadership team well-informed.

Your goal is to have your board set the security culture from the top and hold C-level executives accountable for funding and maintaining cybersecurity initiatives.

We covered the four things you should include in your executive briefings:  cyber risks and responses, cyber metrics, a cyber roadmap that identifies high-profile programs and projects, and a cyber maturity assessment.

By addressing risk in multiple forms, showing that you can measure and track your progress toward your security goals, that you have a solid plan for the next couple of years, and that you can demonstrate your maturity relative to peer companies, you will go a long way toward keeping your board happy, or more precisely, not unhappy.

Lastly, don't forget to look up the OWASP TaSM model.  It's a really useful tool for mapping threat categories to the NIST cybersecurity framework and showing where you may have gaps in your program (represented by blank cells in the matrix.)  The link to that is in our show notes.

Well, we hope that you have enjoyed today's episode on Updating the Executive Leadership team on the Cyber Program and we thank you again for listening to us at CISO Tradecraft.  Please leave us a review (hopefully five stars) if you enjoyed this podcast and share us with your peers on LinkedIn.  We would love to help others with their cyber tradecraft.

Thanks again and until next time, stay safe.

References

• https://www.mindtools.com/pages/article/herzberg-motivators-hygiene-factors.htm 

• https://threataware.com/a-cisos-guide-to-cybersecurity-briefings-to-the-board/ 

• https://www.spencerstuart.com/-/media/2021/october/ssbi2021/us-spencer-stuart-board-index-2021.pdf

• https://www.spencerstuart.com/research-and-insight/cybersecurity-and-the-board 

• https://www.sec.gov/investment/im-guidance-2015-02.pdf 

• https://piregcompliance.com/ciso-as-a-service/what-regulations-require-the-designation-of-a-chief-information-security-officer-ciso/ 

• https://proteuscyber.com/privacy-database/ny-dfs-section-50004-chief-information-security-officer 

• https://www.bma.bm/viewPDF/documents/2020-10-06-09-27-29-Insurance-Sector-Cyber-Risk-Management-Code-of-Conduct.pdf 

• https://www.gs1india.org/media/isms-policy-statement.pdf 

• https://owasp.org/www-project-threat-and-safeguard-matrix/