December 22, 2021

Minimum Viable Security w/ Chris Roberts & Cecil Pineda: EXPLICIT CONTENT

by Cyber Ranch

Listen Now

00:00:00

Show Notes

Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minimum Viable security, tactical frameworks, the challenges with large frameworks, and the challenges of competing frameworks.

This show was recorded after happy hour and the audience and participants both imbibed.  It's a rowdy show and features some explicit content.

 

Key Takeaways:

0:00 Allan’s holiday greeting

0:39 Allan introduces the live show, guests and issues a disclaimer about naughty language

2:02 Chris Roberts on Minimum Viable Security

2:42 Cecil on his love/hate relationship with compliance and the need for weighting controls

4:25 Allan proposes “tactical frameworks”

5:38 Chris challenges the crowd on their asset management successes

7:43 Allan introduces “See it, manage it, secure it.” (Which he flagrantly stole from Steve Williams @ NTT DATA Services)

8:53 Cecil says: data discovery comes before DLP

10:17 Chris challenges Allan’s idea that MFA should “just happen” in order to capture at least 90% of ransomware threats

12:07 Cecil proposes a compromise – 30% of controls meet a higher CMMI requirement than the 70%

13:48 Chris says even the 30% are not even being met in most environments

14:56 Allan’s full proposal on a tactical framework (that includes Chris’ emphasis on asset management)

16:07 Chris states that we have to agree on the subset frameworks in order to achieve success.  Diverse frameworks actually harm the industry.

17:56 Chris challenges the crowd to hire interns and those new to the industry

20:02 Allan misattributes the total control count in NIST CSF.  We mentioned whiskey, right?

21:35 Barring regulated environments, Allan doubles down on his tactical framework idea

22:13 Chris says we must challenge the authors of all these frameworks

22:50 Allan points out that frameworks are implicitly behind the fast pace of the industry after going through committee

23:53 Chris criticizes the notion that compliance = security

24:57 Insurance carriers insist now upon framework compliance and are getting smarter

26:53 Chris says full compliance with a framework even still is useful only as a point in time exercise

28:22 We have to simplify compliance

28:59 Allan proposes SBOM, CMMC-like maturity awareness, and the shared responsibility model as the solution to the compliance problem

30:57 Chris says that will take ten years to sort out

31:49 Chris says “take the money out of compliance”

35:37 Cecil talks about self-attestation and standards that are needed on auditing processes

 36:41 Allan says frameworks exist in the first place with the goal of getting secure

37:14 Chris disagrees and states (using naughty metaphors) that frameworks compete out of hubris

38:26 An audience member suggests “trust but verify” as the reason frameworks exist in the first place

41:24 Cecil deconstructs the practicality of shared responsibility, extending it into the business

43:28 Chris proposes working with insurance companies to create a consolidated or tactical framework

 

Links:

Chris Roberts - LinkedIn

Cecil Pineda - LinkedIn

Follow Allan Alford on LinkedIn and Twitter

Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store

Learn more about Hacker Valley Studio and The Cyber Ranch Podcast

 

Sponsored by our good friends at AttackIQ

Read more

Recent Episodes

November 29, 2023
by Cyber Ranch

Allan takes the show on the road again, this time at his all-time favorite conference: CISO XC! He asks a unique question of each guest, who represent a great deal of breadth in our industry: Dave Belanger, CISO at Bestow Insurance - What is the most...

November 22, 2023
by Cyber Ranch

Howdy, y'all!  Allan is taking this week off to spend time with family and to give thanks for all the wonderful things in his life - including y'all! For those who don't track it, there is no Cyber Ranch Podcast four times  a year: American Thanksgiv...

November 15, 2023
by Cyber Ranch

Warning, there might be some naughty language in this one! The challenge was issued!!!! Allan teamed up with TWO other podcasts to take on the insufferable marketing that floods the cybersecurity industry in the month of October! Who won??? "Won"? Th...

November 8, 2023
by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  Our guest today is Evan Wolff, partner at Crowell & Moring, and Allan's favorite cyber attorney.  Evan has led and managed 100s of investigations including cybersecurity, data breach, insider...

November 1, 2023
by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  That’s Tim Rohrbaugh, Founder/Principal at DefaultDenySec, former CISO for JetBlue Airways, advisor, investor: yup!  Another Cyber Ranch guest with an awesome history!  Tim and Allan were chattin...

October 25, 2023
by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  We're joined today by Jacqueline (AKA “Jack”) Powell, CISO at Allianz Life and former Deputy CISO at Hanes.  She has also consulted, and has worked at Chevron, General Dynamics, and SACI.  Jack h...

October 18, 2023
by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  That’s Kymberlee Price, strategic security consultant, Black Hat content review board member, former Sr. Director of Product Security at New Relic, former Principal Security Manager at Microsoft ...

October 11, 2023
by Cyber Ranch

Chris Tillett is a well-known figure in our industry.  He is in product management and R&D at Palo Alto Networks.  He is also a great guy, funny, and can wield the snark quite well.  He is the perfect foil for Allan Alford as the two of them take...

September 27, 2023
by Cyber Ranch

Howdy, y’all, and welcome to The Cyber Ranch Podcast!  Joining Allan this week is Ron Nissim, CEO @ Entitle.  Yes, this is one of our rare shows with a vendor as a guest.  Why?  Because in this case, the vendor was more highly informed than any of Al...

September 20, 2023
by Cyber Ranch

Allan is joined by AJ Grotto: William J. Perry International Security Fellow and Founding Director of the Program on Geopolitics, Technology and Governance at Stanford University.  He also serves as the faculty lead for the cyber policy specializatio...