[05-11-23] Join us tomorrow for “Hacking Security Culture”

Join us tomorrow for “Hacking Security Culture”

May 11, 2023

CISO Series

Super Cyber Fridays!

Join us TOMORROW, Friday [05-12-23], for "Hacking Security Culture"

Hacking Security Culture

Join us Friday, February 03, 2023, for “Hacking Security Culture: An hour of critical discussion on motivating the entire organization to always be thinking conscientiously about security.”

It all begins at 1 PM ET/10 AM PT on Friday, May 12, 2023 with guests Austin Wolf, staff information security analyst, Code42 and Brad Kroll, third party risk manager, Best Buy. We'll have fun conversation and games, plus at the end of the hour (2 PM ET/11 AM PT) we'll do our meetup.

Thanks to our Super Cyber Friday sponsor, Code42

Code42

Defense in Depth

Successful Cloud Security

Successful Cloud Security

What are the moves we should be making in the cloud to improve our security? What constitutes a good cloud security posture?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Andy Ellis, operating partner, YL Ventures. We welcome our sponsored guest Yoav Alon, CTO, Orca Security.

We tackled a very broad topic in this episode. I asked on LinkedIn, "What is just one successful move you’ve made in your cloud security efforts?" Given this question and the variety of answers, I'll subtitle this episode “The Whitman's Sampler of Cloud Security Initiatives.” 

Related to this episode, please also check out Steve Prentice's article, "23 Beliefs About Cloud Security That Are Just Not True (Anymore)."

Give cloud the same treatment as all your other security governance policies. It sounds rather basic, you just need to treat your cloud like you treat your security program overall. "Establish security governance. Treat your cloud services according to sound and good security principles. Manage them through their life cycle with the help of your security governance process,” said Henrik Parkkinen, Onevinn AB. The reason you do this, noted J. David Christensen, CISO, PlanSource is "cloud governance helps minimize sprawl that can lead to unknown risks."

In the cloud, the issue is all about identity and access. Again, seems basic, but geez this is where we see all the problems with cloud breaches. "Cloud Identity and Access Management, no matter how many security controls you have in place for your cloud environment, improperly defined IAM can be exploited to overcome most if not all of them,” said Christensen of PlanSource. Jonathan Waldrop of Insight Global suggests, "Perform periodic access and permission reviews. Account and permission sprawl is a real challenge and presents a huge security risk." Our guest, Yoav Alon sees this as not enough and could just be an exhausting exercise. Instead, look to solve the systemic problem of account and permission sprawl rather than periodic check-ins.

Be cloud specific in your security program and risk framework. Stu Hirst, CISO of Trustpilot, suggested you ask yourself, “What are the highest impact risks to our cloud environments and what controls/guardrails are currently in place (and are they monitored/alerted on). That gave us the ‘why’ when it came to the delivery of improvements. Without it, it's just chipping away at issues.” "Build a dedicated cloud SOC,” said Jerich Beason, CISO for Commercial Bank and Capital One Software at Capital One. “The tools, skills and playbooks are different in cloud environments and separating the traditional SOC from the cloud SOC makes each function more effectively."

Know what tools you already have at your disposal. "Utilize native tools where they're already available. GitHub, AWS, and other services you may already be paying for have many native capabilities that can move the needle on security and quality," said Jared White of Sente Security. That’s why it’s valuable to get the training, often free, the cloud service providers offer.

Please listen to the full episode on your favorite podcast app, or over on our blog where you can read the full transcript. If you’re not already subscribed to the Defense in Depth podcast, please go ahead and subscribe now.

Thanks to our podcast sponsor, Orca Security

Orca Security

LIVE!

 Cyber Security Headlines - Week in Review 

Make sure you 

 to join the LIVE "Week In Review" this Friday for 

Cyber Security Headlines 

with CISO Series reporter Richard Stroffolino. We do it this and every Friday at 3:30 PM ET/12:30 PM PT for a short 20-minute discussion of the week's cyber news. Our guest will be Paul Connelly, former CISO, HCA Healthcare.

Thanks to this week's headlines sponsor, Trend Micro

Trend Micro

Cyber chatter from around the web...

Jump in on these conversations 

"Is Your SIEM Really Ingesting DNS Data?" (

)

"If you’re in any type of leadership position:

1) What are your overall thoughts on failure and 

2) How do you feel about the phrase 'Failure is not an option'?" (

)

"How does clicking a phishing link automatically compromise you?" (

)

Coming Up On Super Cyber Friday...

Coming up in the weeks ahead on Super Cyber Friday we have:

  • [05-12-23] Hacking Security Culture

  • [05-19-23] Hacking the Software Supply Chain

  • [06-02-23] Hacking the Future of Risk Management

and register for them all now!

Thank you!

Thank you for supporting CISO Series and all our programming  

We love all kinds of support: listening, watching, contributions, What's Worse?! scenarios, telling your friends, sharing in social media, and most of all we love our sponsors!

Everything is available at cisoseries.com.

Interested in sponsorship, contact me, David Spark.