December 22, 2021
by Cyber Ranch
Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minimum Viable security, tactical frameworks, the challenges with large frameworks, and the challenges of competing frameworks.
This show was recorded after happy hour and the audience and participants both imbibed. It's a rowdy show and features some explicit content.
0:00 Allan’s holiday greeting
0:39 Allan introduces the live show, guests and issues a disclaimer about naughty language
2:02 Chris Roberts on Minimum Viable Security
2:42 Cecil on his love/hate relationship with compliance and the need for weighting controls
4:25 Allan proposes “tactical frameworks”
5:38 Chris challenges the crowd on their asset management successes
7:43 Allan introduces “See it, manage it, secure it.” (Which he flagrantly stole from Steve Williams @ NTT DATA Services)
8:53 Cecil says: data discovery comes before DLP
10:17 Chris challenges Allan’s idea that MFA should “just happen” in order to capture at least 90% of ransomware threats
12:07 Cecil proposes a compromise – 30% of controls meet a higher CMMI requirement than the 70%
13:48 Chris says even the 30% are not even being met in most environments
14:56 Allan’s full proposal on a tactical framework (that includes Chris’ emphasis on asset management)
16:07 Chris states that we have to agree on the subset frameworks in order to achieve success. Diverse frameworks actually harm the industry.
17:56 Chris challenges the crowd to hire interns and those new to the industry
20:02 Allan misattributes the total control count in NIST CSF. We mentioned whiskey, right?
21:35 Barring regulated environments, Allan doubles down on his tactical framework idea
22:13 Chris says we must challenge the authors of all these frameworks
22:50 Allan points out that frameworks are implicitly behind the fast pace of the industry after going through committee
23:53 Chris criticizes the notion that compliance = security
24:57 Insurance carriers insist now upon framework compliance and are getting smarter
26:53 Chris says full compliance with a framework even still is useful only as a point in time exercise
28:22 We have to simplify compliance
28:59 Allan proposes SBOM, CMMC-like maturity awareness, and the shared responsibility model as the solution to the compliance problem
30:57 Chris says that will take ten years to sort out
31:49 Chris says “take the money out of compliance”
35:37 Cecil talks about self-attestation and standards that are needed on auditing processes
36:41 Allan says frameworks exist in the first place with the goal of getting secure
37:14 Chris disagrees and states (using naughty metaphors) that frameworks compete out of hubris
38:26 An audience member suggests “trust but verify” as the reason frameworks exist in the first place
41:24 Cecil deconstructs the practicality of shared responsibility, extending it into the business
43:28 Chris proposes working with insurance companies to create a consolidated or tactical framework
Chris Roberts - LinkedIn
Cecil Pineda - LinkedIn
Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store
Sponsored by our good friends at AttackIQ
Joining Allan today are two folks who are passionate about leadership – not just practicing good leadership, but instilling good leadership in future generations. Joey Rachid is CISO in the ecommerce and financial services industry, is on advisory b...
This week Allan is joined by Nipun Gupta, and industry veteran who has been a consultant, practitioner, vendor, advisor and investor. The topic is "What are we really protecting in cyber?" and the nuances of that question are explored in depth - as w...
This week, Allan is joined by Peter Schawacker, CEO @ Nearshore Cyber, former CISO, advisor to MSPs, etc. Another one of Allan's illustrious guests with 25 years in cyber. (https://www.linkedin.com/in/schawacker/). The topic started as all that th...
This episode is jam-packed with wisdom that is delivered at a rapid pace. Some folks will find themselves rewinding and taking notes. Luis Valenzuela, Director of Data Loss Prevention and Data Governance at InComm Payments, joins Allan Alford to ta...
To celebrate the 100th episode, Allan decided to let the audience participate in the show. 21 people called in and answered a wide variety of questions about cybersecurity. It is a fantastic show and it is very fun to hear all the different perspec...
This is another "'E' for explicit" show as this one is another LIVE! show from the CISO XC conference in Dallas-Fort Worth. Why the 'E'? Because halfway through Allan Alford's conversation with Andy Ellis (CISO at Orca, Operating Partner at YL Ventu...
In this episode, Allan Alford plays Devil's advocate - challenging the practitioner community to refute the idea that we should quit trying to make the organization care and simply make suggestions and accept the organization's level of risk toleranc...
Scott Schindler, veteran CISO, vCISO, and adjunct professor joins Allan at the ranch to talk about how to build, strengthen, participate in, contribute to and benefit from a cybersecurity community. Allan chose Scott for this show because of his incr...
Dan Holden, a 20+ year industry veteran, former vendor, and current CISO at Big Commerce joins Allan Alford at the ranch to talk about the BIG picture. Join them on this wild trail ride that goes as far back as the Monroe Doctrine of 1823, the pre-c...
This week Allan Alford is joined by Duane Gran, Director of Information Security at Converge Technology Solutions to discuss three different aspects of the CISO craft -- and to offer practical, concrete guidance on how to achieve the right outcomes: ...