Cybersecurity practitioners give back to the community by recording Youtube videos, interviewing in magazines, or creating podcasts— just like this one. However, books remain a fantastic method of delivering info and impacting lives that shouldn’t be forgotten with the rise of social media. Allan tallied it up and thus far, nine of his friends have written books. He has been approached about writing one himself, and he wanted to get the inside track on the process. George Finney, CISO at SMU, and Robert Pace, CISO at Invitation Homes, explain the ups and downs of writing books from a cyber perspective. This interview with George and Robert was recorded LIVE! at the CISO XC 2022 conference.
 
Timecoded Guide:
[00:00] Introducing the cybersecurity and the personal books George and Robert write
[08:28] Overcoming writing challenges in order to help others with your book
[15:16] Understanding the monetary gains and losses of book writing 
[23:59] Being purposeful, intentional, and useful with the book you write
[30:02] Advising potential writers on if they should write their book or not
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>
 
What made you choose books as your way to give back to the cyber community? 
There’s numerous ways to give back to the cybersecurity community, including more modern methods of online videos and social media posts. However, books offered George and Robert a means of expressing their feelings and beliefs about cyber and about life that felt unique and special to them. For George, writing books fulfills his dream of being a writer, a passion he’s had since he was a kid, and allows him to combine that dream with his passion for bettering the cybersecurity industry.
“My passion is really around cybersecurity. I really wanted to bring these two things (cybersecurity and writing) together in my life, and do something that I think only I can do, from my unique experiences, my unique perspective." — George Finney
 
What were the biggest challenges you faced while writing your book? 
Writing a book takes time and requires vulnerability. George and Robert are very familiar with those challenges. Facing these challenges often involves facing yourself, your wants, and your experiences. Robert especially felt challenged in writing his book because it was a personal story about losing his mother. Stepping out of his comfort zone to write about his personal life felt like a massive leap of faith, but he’s enjoyed impacting others with this story.
“Writing necessarily means that the time you dedicate to it is going to be spent in isolation. If you're spending 10 hours or 20, that's time you're not with your family, that's not time where you're going out, having fun. That's time you're on your own alone.” — George Finney
 
When you look at the time and effort that went into it, was writing a book worth it? 
As Allan shares, podcasting with the Cyber Ranch podcast has offered him an avenue of success, but book writing does not always pay off monetarily. George and Robert have found other ways of seeing the value in their work, but as George especially explains, there are a lot of costs associated with writing a book that many aspiring writers don’t consider. Marketing especially requires a high volume of costs that many don’t expect when writing their first book.
“Mine has not proven to be successful to where I can retire from the job, but there is a feeling of richness that you can get from helping folks along the way. That has been a very fulfilling point.” — Robert Pace
 
If somebody wants to write a book, what's the best piece of advice you have for them?
If you want to write a book, Robert and George genuinely believe you should go for it. A writer doesn’t have to know everything to write a book, but they do need to understand their audience and intentions with the book they want to author. Aspiring authors, according to Robert, need to be especially cautious of how pride can negatively impact the writing process. Don’t be afraid to ask for help, Robert says, but don’t let pride get in the way of accepting that help, especially from editors and other educated writers. 
“I will say when you want to write a book, remove your pride because it will get hurt if you keep it out there. Everyone is not going to like what you write. We're coming from a cyber perspective, we don't write like the guys that have majored in English.” — Robert Pace
-------------
Links:
Learn more about George Finney on <a href='https://www.linkedin.com/in/georgefinney/'>LinkedIn</a> and buy George’s books, <a href='https://www.amazon.com/dp/1626347352/ref=tsm_1_fb_lk'>Well Aware</a>, <a href='https://www.amazon.com/More-Magic-Wands-Transformative-Cybersecurity-ebook/dp/B01L4CIMHK'>No More Magic Wands</a>, and <a href='https://www.amazon.com/dp/1119884845/ref=tsm_1_fb_lk'>Project Zero Trust</a>
Keep up with Robert Pace on <a href='https://www.linkedin.com/in/robert-pace-04b7a452/'>LinkedIn</a> and buy Robert’s book, <a href='https://www.amazon.com/gp/product/B094YSYQX7/ref=x_gr_w_glide_sin?caller=Goodreads&callerLink=https%3A%2F%2Fwww.goodreads.com%2Fbook%2Fshow%2F42281086-i-understand-you-forgot-to-say-goodbye%3Ffrom_search%3Dtrue%26from_srp%3Dtrue%26qid%3Dpe7b1ViTOt%26rank%3D24&tag=x_gr_w_glide_sin-20'>I Understand… You Forgot to Say Goodbye.</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Cybersecurity practitioners give back to the community by recording Youtube videos, interviewing in magazines, or creating podcasts— just like this one. However, books remain a fantastic method of delivering info and impacting lives that shouldn’t be forgotten with the rise of social media. Allan tallied it up and thus far, nine of his friends have written books. He has been approached about writing one himself, and he wanted to get the inside track on the process. George Finney, CISO at SMU, and Robert Pace, CISO at Invitation Homes, explain the ups and downs of writing books from a cyber perspective. This interview with George and Robert was recorded LIVE! at the CISO XC 2022 conference.
 
Timecoded Guide:
[00:00] Introducing the cybersecurity and the personal books George and Robert write
[08:28] Overcoming writing challenges in order to help others with your book
[15:16] Understanding the monetary gains and losses of book writing 
[23:59] Being purposeful, intentional, and useful with the book you write
[30:02] Advising potential writers on if they should write their book or not
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>
 
What made you choose books as your way to give back to the cyber community? 
There’s numerous ways to give back to the cybersecurity community, including more modern methods of online videos and social media posts. However, books offered George and Robert a means of expressing their feelings and beliefs about cyber and about life that felt unique and special to them. For George, writing books fulfills his dream of being a writer, a passion he’s had since he was a kid, and allows him to combine that dream with his passion for bettering the cybersecurity industry.
“My passion is really around cybersecurity. I really wanted to bring these two things (cybersecurity and writing) together in my life, and do something that I think only I can do, from my unique experiences, my unique perspective." — George Finney
 
What were the biggest challenges you faced while writing your book? 
Writing a book takes time and requires vulnerability. George and Robert are very familiar with those challenges. Facing these challenges often involves facing yourself, your wants, and your experiences. Robert especially felt challenged in writing his book because it was a personal story about losing his mother. Stepping out of his comfort zone to write about his personal life felt like a massive leap of faith, but he’s enjoyed impacting others with this story.
“Writing necessarily means that the time you dedicate to it is going to be spent in isolation. If you're spending 10 hours or 20, that's time you're not with your family, that's not time where you're going out, having fun. That's time you're on your own alone.” — George Finney
 
When you look at the time and effort that went into it, was writing a book worth it? 
As Allan shares, podcasting with the Cyber Ranch podcast has offered him an avenue of success, but book writing does not always pay off monetarily. George and Robert have found other ways of seeing the value in their work, but as George especially explains, there are a lot of costs associated with writing a book that many aspiring writers don’t consider. Marketing especially requires a high volume of costs that many don’t expect when writing their first book.
“Mine has not proven to be successful to where I can retire from the job, but there is a feeling of richness that you can get from helping folks along the way. That has been a very fulfilling point.” — Robert Pace
 
If somebody wants to write a book, what's the best piece of advice you have for them?
If you want to write a book, Robert and George genuinely believe you should go for it. A writer doesn’t have to know everything to write a book, but they do need to understand their audience and intentions with the book they want to author. Aspiring authors, according to Robert, need to be especially cautious of how pride can negatively impact the writing process. Don’t be afraid to ask for help, Robert says, but don’t let pride get in the way of accepting that help, especially from editors and other educated writers. 
“I will say when you want to write a book, remove your pride because it will get hurt if you keep it out there. Everyone is not going to like what you write. We're coming from a cyber perspective, we don't write like the guys that have majored in English.” — Robert Pace
-------------
Links:
Learn more about George Finney on <a href='https://www.linkedin.com/in/georgefinney/'>LinkedIn</a> and buy George’s books, <a href='https://www.amazon.com/dp/1626347352/ref=tsm_1_fb_lk'>Well Aware</a>, <a href='https://www.amazon.com/More-Magic-Wands-Transformative-Cybersecurity-ebook/dp/B01L4CIMHK'>No More Magic Wands</a>, and <a href='https://www.amazon.com/dp/1119884845/ref=tsm_1_fb_lk'>Project Zero Trust</a>
Keep up with Robert Pace on <a href='https://www.linkedin.com/in/robert-pace-04b7a452/'>LinkedIn</a> and buy Robert’s book, <a href='https://www.amazon.com/gp/product/B094YSYQX7/ref=x_gr_w_glide_sin?caller=Goodreads&callerLink=https%3A%2F%2Fwww.goodreads.com%2Fbook%2Fshow%2F42281086-i-understand-you-forgot-to-say-goodbye%3Ffrom_search%3Dtrue%26from_srp%3Dtrue%26qid%3Dpe7b1ViTOt%26rank%3D24&tag=x_gr_w_glide_sin-20'>I Understand… You Forgot to Say Goodbye.</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/12487a8f-35d9-355d-9571-fe0af28f3f99

Cybersecurity practitioners give back to the community by recording Youtube videos, interviewing in magazines, or creating podcasts— just like this one. However, books remain a fantastic method of delivering info and impacting lives that shouldn’t be for...

When a CISO Writes a Book with George Finney & Robert Pace

Apple

Google

Spotify

Amazon

Ride the cyber trails with one CISO (Allan Alford) and a diverse group of friends and experts who bring a human perspective to cybersecurity.

Drew Simonis, CISO at Juniper Networks, discusses the debate of doing more by doing less. So often in cybersecurity, practitioners think they have to do it all and view themselves as the smartest people in the room. The fact of the matter is that none of us are the smartest in the room and we have to learn to trust each other. Drew believes a collaborative, trusting environment will bring us to a place of doing less and seeing better results because of it. 
Timecoded Guide:
[00:00] Introducing the foundations of Drew’s “do more by doing less” mindset
[07:03] Doing more by doing less, specifically in tech stack and GRC teams
[15:00] Revamping the cybersecurity and IT vendor ecosystem 
[20:43] Understanding consumer and CISO impact on the cyber vendor market
[32:34] Reshaping the command and control security mindset
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


How can security teams be more successful by enabling good decision making, versus trying to keep everyone from falling off a cliff?
The cybersecurity industry is stuck in a helicopter parent mindset, where practitioners don’t trust their colleagues in IT and feel the need to do the work for them. Drew explains that this is a low trust environment, where more work is created and no one thrives. If the industry works towards a high trust mindset, individuals are able to do their jobs and make decisions based on their knowledge, and even face normal consequences for their decisions, too. 
“[We think] we're the smartest people in the room. There's always this very dismissive, very condescending approach to our colleagues, who have very important jobs to do on their own. In a low trust culture, you get to the point where you have to be watching over everybody.”
 
How do vendors do more by doing less? How do they fit the trust and parenting model?
The bifurcation of the cybersecurity vendor system into cyber and IT has created more work for everyone involved, and has produced a lot of unideal results. With a lack of integrated solutions, organizations and departments suffer from simply not being able to have products that do everything they need them to do. There’s little cross-functionality and there’s often too many products happening at once to have one vendor making their intended impact.
“Why can't it all just work together? I think the whole notion of security as a buying center, separate from IT, created this opportunity for vendors to pursue a separate budget pot. In my opinion, it disincentivizes them from creating integrated solutions.”
 
What are we doing wrong as consumers that's encouraging this “do less by doing more” system instead of doing more by doing less? 
Sometimes, the only thing that can be done is starting over. The current system thrives off of an “us” vs “them” mindset and a business vs technology mentality, where trust is low and doing more results in actually doing less. Roles need to be rethought and reconsidered in cybersecurity organizations and executive leaders need to step out of the ivory tower of leadership to re-educate themselves and better understand their own roles.
“The whole separation of the cyber technologists from the IT technologists comes back to that trust issue as well. I can't trust IT to do the right things, I can't trust them to patch, so I've got to sit over here over their shoulder and scan.”
 
What's the revenue and business argument for everything we've discussed?
There’s always the pressure of revenue metrics and tangible results, especially if a process or role has to change within a cybersecurity team. How does doing more by doing less show up as a tangible result and outcome? It turns out, that all depends on transparency. Knowing the outcome that’s being looked for allows for a better understanding between practitioners and business leaders when the business argument for doing more by doing less has to be made.
“As CISO, I can't take your problem and try to make it my own and then solve it. I've got to trust you to solve it, and I've got to empower you, with the right tools, the right processes, the right policies, so that you have safe guidelines to solve that problem within.”
-------------
Links:
Learn more about Drew Simonis on <a href='https://www.linkedin.com/in/drew-simonis-4893311/'>LinkedIn</a>
Check out Juniper Networks on <a href='https://www.linkedin.com/company/juniper-networks/'>LinkedIn</a> and <a href='https://www.juniper.net'>the Juniper Networks website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Drew Simonis, CISO at Juniper Networks, discusses the debate of doing more by doing less. So often in cybersecurity, practitioners think they have to do it all and view themselves as the smartest people in the room. The fact of the matter is that none of us are the smartest in the room and we have to learn to trust each other. Drew believes a collaborative, trusting environment will bring us to a place of doing less and seeing better results because of it. 
Timecoded Guide:
[00:00] Introducing the foundations of Drew’s “do more by doing less” mindset
[07:03] Doing more by doing less, specifically in tech stack and GRC teams
[15:00] Revamping the cybersecurity and IT vendor ecosystem 
[20:43] Understanding consumer and CISO impact on the cyber vendor market
[32:34] Reshaping the command and control security mindset
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


How can security teams be more successful by enabling good decision making, versus trying to keep everyone from falling off a cliff?
The cybersecurity industry is stuck in a helicopter parent mindset, where practitioners don’t trust their colleagues in IT and feel the need to do the work for them. Drew explains that this is a low trust environment, where more work is created and no one thrives. If the industry works towards a high trust mindset, individuals are able to do their jobs and make decisions based on their knowledge, and even face normal consequences for their decisions, too. 
“[We think] we're the smartest people in the room. There's always this very dismissive, very condescending approach to our colleagues, who have very important jobs to do on their own. In a low trust culture, you get to the point where you have to be watching over everybody.”
 
How do vendors do more by doing less? How do they fit the trust and parenting model?
The bifurcation of the cybersecurity vendor system into cyber and IT has created more work for everyone involved, and has produced a lot of unideal results. With a lack of integrated solutions, organizations and departments suffer from simply not being able to have products that do everything they need them to do. There’s little cross-functionality and there’s often too many products happening at once to have one vendor making their intended impact.
“Why can't it all just work together? I think the whole notion of security as a buying center, separate from IT, created this opportunity for vendors to pursue a separate budget pot. In my opinion, it disincentivizes them from creating integrated solutions.”
 
What are we doing wrong as consumers that's encouraging this “do less by doing more” system instead of doing more by doing less? 
Sometimes, the only thing that can be done is starting over. The current system thrives off of an “us” vs “them” mindset and a business vs technology mentality, where trust is low and doing more results in actually doing less. Roles need to be rethought and reconsidered in cybersecurity organizations and executive leaders need to step out of the ivory tower of leadership to re-educate themselves and better understand their own roles.
“The whole separation of the cyber technologists from the IT technologists comes back to that trust issue as well. I can't trust IT to do the right things, I can't trust them to patch, so I've got to sit over here over their shoulder and scan.”
 
What's the revenue and business argument for everything we've discussed?
There’s always the pressure of revenue metrics and tangible results, especially if a process or role has to change within a cybersecurity team. How does doing more by doing less show up as a tangible result and outcome? It turns out, that all depends on transparency. Knowing the outcome that’s being looked for allows for a better understanding between practitioners and business leaders when the business argument for doing more by doing less has to be made.
“As CISO, I can't take your problem and try to make it my own and then solve it. I've got to trust you to solve it, and I've got to empower you, with the right tools, the right processes, the right policies, so that you have safe guidelines to solve that problem within.”
-------------
Links:
Learn more about Drew Simonis on <a href='https://www.linkedin.com/in/drew-simonis-4893311/'>LinkedIn</a>
Check out Juniper Networks on <a href='https://www.linkedin.com/company/juniper-networks/'>LinkedIn</a> and <a href='https://www.juniper.net'>the Juniper Networks website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/f52f0390-47f1-3a80-8f4e-00a78c1adf8e

Drew Simonis, CISO at Juniper Networks, discusses the debate of doing more by doing less. So often in cybersecurity, practitioners think they have to do it all and view themselves as the smartest people in the room. The fact of the matter is that none of...

Doing More by Doing Less with Drew Simonis

Sonja Hammond, Vice President & CISO at National Veterinary Associates, brings her love of animals and more importantly her love for security basics down to the Ranch this week. The buzz around new cyber technology and security protocols can easily warp our perspective on what’s most important for CISOs. Sonja spends some time in this episode explaining why cybersecurity organizations instead need to focus on simple tech and strong security processes and training protocols.
 
Timecoded Guide:
[00:00] Breaking down basics of people, process, and technology
[06:59] Where tech stack is failing us and how to keep the vendor community on hold
[10:31] Building a good GRC team with a focus on NIST CSF
[14:13] Training the right way for GRC and cyber professionals
[19:30] Understanding the end user and setting your cyber team up for success
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>
What does that mean to you, in cyber specifically, getting back to the basics?
Getting back to the basics is a common theme no matter your industry, but Sonja’s focus on it feels especially surprising when so much of the security world isn’t simple at all. Sonja explains throughout the episode that NVA strives for simple yet effective, not for something shocking or eye-catching. Especially considering Sonja’s work contains sensitive client data, she emphasizes that a basics-centric approach keeps the animals in NVA’s care and the people who love these animals safe. Although it may not be flashy, Sonja is proud of the well-oiled machine of her team and the security of their data.
“You have to get rid of your tech debt and bring your environment to current. You want modern, supportable technology. That's really key in order to keep everything secure.”
What's the opposite of your "get back to the basics" vision there?
Cybersecurity technology is often far from simple, but adding unnecessary bells and whistles only succeeds in further complicating things. Sonja’s back to the basics mindset encourages tools that cut out the unnecessary and strive for a streamlined approach. Sonja sees the appeal of a fun product to add to any protocols, but warns that fun rarely means secure. When there’s too much focus on the new and the shiny, that often means that focus is turned away from what’s most important: keeping data safe and preventing vulnerabilities from being exploited. 
“There are groups that are implementing some security tools that are shiny, new, and lots of fun, but they still have those basic security holes, so they get compromised.”
What are we doing right when it comes to the people in our organizations, and what aren’t we doing right?
Sonja is happy to separate NVA from the pack by explaining their focus on involving cybersecurity practitioners in the everyday operations of their organization. Many companies keep these roles separate, letting tech and cyber professionals remain in their own roles without context of what their end user might be experiencing on their end. Instead, NVA strives to put cybersecurity employees in the shoes of their end users and day-to-day employees, giving them further context around the people they impact and the roles they influence, as well as providing them further insight into potential security risks that might be slipping through the cracks of daily operations.
“Get the cybersecurity people exposed to what really happens in the day-to-day, because if they can walk in the end users’ shoes, then they can understand where there are security implications.”
For the people that are checking in the patients and taking them back, how much do they learn about security? 
It’s one thing to train security professionals in the day-to-day of an organization, and another to train other employees about the world of cybersecurity. To combat the often frustrating process of checking security compliance boxes, Sonja tries to change up training tactics with employees by sending playful videos and short informational emails. Keeping things short highly raises your chances of the content actually being read, Sonja explains, and it also limits the monotonous moments in the training process for employees who have very little experience in cyber protocols.
“We try to make it not quite so obvious that [our employees] are always getting training. We certainly do the traditional online CBT type stuff, to check the compliance boxes, but then we try to do some other things, like funny videos…Just simple things to remind them.”
-------------
Links:
Learn more about Sonja Hammond on <a href='https://www.linkedin.com/in/sonjahammond/'>LinkedIn</a>
Check out National Veterinary Associates on <a href='https://www.linkedin.com/company/national-veterinary-associates/'>LinkedIn</a> and <a href='https://nva.avature.net/careers/OriginStory'>the NVA website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sonja Hammond, Vice President & CISO at National Veterinary Associates, brings her love of animals and more importantly her love for security basics down to the Ranch this week. The buzz around new cyber technology and security protocols can easily warp our perspective on what’s most important for CISOs. Sonja spends some time in this episode explaining why cybersecurity organizations instead need to focus on simple tech and strong security processes and training protocols.
 
Timecoded Guide:
[00:00] Breaking down basics of people, process, and technology
[06:59] Where tech stack is failing us and how to keep the vendor community on hold
[10:31] Building a good GRC team with a focus on NIST CSF
[14:13] Training the right way for GRC and cyber professionals
[19:30] Understanding the end user and setting your cyber team up for success
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>
What does that mean to you, in cyber specifically, getting back to the basics?
Getting back to the basics is a common theme no matter your industry, but Sonja’s focus on it feels especially surprising when so much of the security world isn’t simple at all. Sonja explains throughout the episode that NVA strives for simple yet effective, not for something shocking or eye-catching. Especially considering Sonja’s work contains sensitive client data, she emphasizes that a basics-centric approach keeps the animals in NVA’s care and the people who love these animals safe. Although it may not be flashy, Sonja is proud of the well-oiled machine of her team and the security of their data.
“You have to get rid of your tech debt and bring your environment to current. You want modern, supportable technology. That's really key in order to keep everything secure.”
What's the opposite of your "get back to the basics" vision there?
Cybersecurity technology is often far from simple, but adding unnecessary bells and whistles only succeeds in further complicating things. Sonja’s back to the basics mindset encourages tools that cut out the unnecessary and strive for a streamlined approach. Sonja sees the appeal of a fun product to add to any protocols, but warns that fun rarely means secure. When there’s too much focus on the new and the shiny, that often means that focus is turned away from what’s most important: keeping data safe and preventing vulnerabilities from being exploited. 
“There are groups that are implementing some security tools that are shiny, new, and lots of fun, but they still have those basic security holes, so they get compromised.”
What are we doing right when it comes to the people in our organizations, and what aren’t we doing right?
Sonja is happy to separate NVA from the pack by explaining their focus on involving cybersecurity practitioners in the everyday operations of their organization. Many companies keep these roles separate, letting tech and cyber professionals remain in their own roles without context of what their end user might be experiencing on their end. Instead, NVA strives to put cybersecurity employees in the shoes of their end users and day-to-day employees, giving them further context around the people they impact and the roles they influence, as well as providing them further insight into potential security risks that might be slipping through the cracks of daily operations.
“Get the cybersecurity people exposed to what really happens in the day-to-day, because if they can walk in the end users’ shoes, then they can understand where there are security implications.”
For the people that are checking in the patients and taking them back, how much do they learn about security? 
It’s one thing to train security professionals in the day-to-day of an organization, and another to train other employees about the world of cybersecurity. To combat the often frustrating process of checking security compliance boxes, Sonja tries to change up training tactics with employees by sending playful videos and short informational emails. Keeping things short highly raises your chances of the content actually being read, Sonja explains, and it also limits the monotonous moments in the training process for employees who have very little experience in cyber protocols.
“We try to make it not quite so obvious that [our employees] are always getting training. We certainly do the traditional online CBT type stuff, to check the compliance boxes, but then we try to do some other things, like funny videos…Just simple things to remind them.”
-------------
Links:
Learn more about Sonja Hammond on <a href='https://www.linkedin.com/in/sonjahammond/'>LinkedIn</a>
Check out National Veterinary Associates on <a href='https://www.linkedin.com/company/national-veterinary-associates/'>LinkedIn</a> and <a href='https://nva.avature.net/careers/OriginStory'>the NVA website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/9860aeda-00e1-3f87-8853-1d8b7e33e1ad

Sonja Hammond, Vice President & CISO at National Veterinary Associates, brings her love of animals and more importantly her love for security basics down to the Ranch this week. The buzz around new cyber technology and security protocols can easily warp ...

Getting Back to the Basics with Sonja Hammond

Adrian Sanabria, Director of Product Management at Tenchi Security, arrives at the Ranch this week to debunk cyber myths and expose industry lies. Using his background running Security Weekly Labs at Cyber Risk Alliance, Adrian explains the lack of cohesive product testing happening in the cyber world, and delves into the research he’s done to get to the bottom of cyber’s most elusive statistics. Do 60% of small businesses go out of business after a breach? Adrian has an answer that just might surprise you. 
 
Timecoded Guide:
[00:00] Introducing Adrian and his journey with Cyber Risk Alliance
[06:47] Buying awards and lying about customers
[13:24] Finding the source of fake cyber statistics
[24:28] The lies of vulnerability management and security awareness training
[30:58] Explaining Adrian’s It’s Time to Kill the Pen Test talk 
[40:41] Creating a money-making concept for debunking cyber myths
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


Can you tell me about your product testing lab with Cyber Risk Alliance? 
We often hear the startup motto of “fake it ‘til you make it,” but Adrian wasn’t aware of how pervasive that concept was in cyber until he began his work with 451 Security. After encountering numerous professionals that expressed complaints and confusion with products on the market, Adrian wanted to break into the world of product testing— and the Security Weekly Labs were born. With a focus on external attack surface management and network vulnerability scanners, Adrian sought to find the truth behind the product vendors were selling him— and what he discovered strongly influenced his future. 
“When we talk about myths and lies, it's not just straight up lies, right? At some point, they're faking it till they make it, and they get to a point where it's just too late to turn back. And then, it starts to get a little bit more insidious.” 
 
Are vendors going far enough to fake customers and awards? 
Not only are vendors “faking it” in a startup sense, some vendors have gotten right to the point of lying about the awards they’ve received and the high profile customers they’ve worked with. Adrian explains that buying and lying about awards has become a common practice within the cyber world, where certain businesses have let the marketing of winning an award override the legitimacy of their own success. While some companies may ignorantly feel drawn in by meaningless awards, more insidious industry liars have already mastered pulling out their credit card to buy what they want to win
“You can actually even fill in the name of the category you want to win an award for, you can just make up your own category. You drop a credit card and they send you a trophy. Some of these fake awards even have award ceremonies.”
 
Where do these cybersecurity statistics come from, and how do we validate them?
60% of small businesses go out of business after a breach— but do they really? Adrian’s exposition of cyber lies leaves no stone unturned, even when it comes to mystery statistics. Where did these numbers come from, and why would millions of businesses be more impacted by security breaches than fraud? After interacting with statistics like this with a shocking frequency, Adrian has even taken to Twitter on numerous occasions to call out companies marketing with fake stats and reveal his own research findings. 
“​​There are people that have just hinged their reputations and their careers on some of these myths…And it's not that companies don't get hurt by breaches, but it benefits no one to make up stats, or to push this narrative.”
 
Is it time to kill the pen test? 
There’s a lot of things done in cyber that might not have a place for everyone. Pen testing is near the end of Adrian’s list, but he’s quick to point out that the pen test process needs to change. Unfortunately, the bulk of what any organization is paying for when they run a pen test are vulnerability scans and report paperwork. Explaining a concept he developed with his friend and co-founder Kyle at Savage Security, Adrian explains that the modern-day pen test needs to look more like purple teaming and focus on prioritizing what really needs to be fixed.
“A lot of companies have pen tests, because they don't know what else to do with their security budget. You could apply that more broadly. A lot of people have a security budget, and they buy what they see their peers buy and do what analysts tell them to do.”
-------------
Links:
Learn more about Adrian Sanabria on <a href='https://www.linkedin.com/in/adrian-sanabria/'>LinkedIn</a> and <a href='https://twitter.com/sawaba'>Twitter</a>
Check out Tenchi Security on <a href='https://www.linkedin.com/company/tenchisecurity/'>LinkedIn</a> and <a href='https://www.tenchisecurity.com'>the Tenchi Security website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Adrian Sanabria, Director of Product Management at Tenchi Security, arrives at the Ranch this week to debunk cyber myths and expose industry lies. Using his background running Security Weekly Labs at Cyber Risk Alliance, Adrian explains the lack of cohesive product testing happening in the cyber world, and delves into the research he’s done to get to the bottom of cyber’s most elusive statistics. Do 60% of small businesses go out of business after a breach? Adrian has an answer that just might surprise you. 
 
Timecoded Guide:
[00:00] Introducing Adrian and his journey with Cyber Risk Alliance
[06:47] Buying awards and lying about customers
[13:24] Finding the source of fake cyber statistics
[24:28] The lies of vulnerability management and security awareness training
[30:58] Explaining Adrian’s It’s Time to Kill the Pen Test talk 
[40:41] Creating a money-making concept for debunking cyber myths
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


Can you tell me about your product testing lab with Cyber Risk Alliance? 
We often hear the startup motto of “fake it ‘til you make it,” but Adrian wasn’t aware of how pervasive that concept was in cyber until he began his work with 451 Security. After encountering numerous professionals that expressed complaints and confusion with products on the market, Adrian wanted to break into the world of product testing— and the Security Weekly Labs were born. With a focus on external attack surface management and network vulnerability scanners, Adrian sought to find the truth behind the product vendors were selling him— and what he discovered strongly influenced his future. 
“When we talk about myths and lies, it's not just straight up lies, right? At some point, they're faking it till they make it, and they get to a point where it's just too late to turn back. And then, it starts to get a little bit more insidious.” 
 
Are vendors going far enough to fake customers and awards? 
Not only are vendors “faking it” in a startup sense, some vendors have gotten right to the point of lying about the awards they’ve received and the high profile customers they’ve worked with. Adrian explains that buying and lying about awards has become a common practice within the cyber world, where certain businesses have let the marketing of winning an award override the legitimacy of their own success. While some companies may ignorantly feel drawn in by meaningless awards, more insidious industry liars have already mastered pulling out their credit card to buy what they want to win
“You can actually even fill in the name of the category you want to win an award for, you can just make up your own category. You drop a credit card and they send you a trophy. Some of these fake awards even have award ceremonies.”
 
Where do these cybersecurity statistics come from, and how do we validate them?
60% of small businesses go out of business after a breach— but do they really? Adrian’s exposition of cyber lies leaves no stone unturned, even when it comes to mystery statistics. Where did these numbers come from, and why would millions of businesses be more impacted by security breaches than fraud? After interacting with statistics like this with a shocking frequency, Adrian has even taken to Twitter on numerous occasions to call out companies marketing with fake stats and reveal his own research findings. 
“​​There are people that have just hinged their reputations and their careers on some of these myths…And it's not that companies don't get hurt by breaches, but it benefits no one to make up stats, or to push this narrative.”
 
Is it time to kill the pen test? 
There’s a lot of things done in cyber that might not have a place for everyone. Pen testing is near the end of Adrian’s list, but he’s quick to point out that the pen test process needs to change. Unfortunately, the bulk of what any organization is paying for when they run a pen test are vulnerability scans and report paperwork. Explaining a concept he developed with his friend and co-founder Kyle at Savage Security, Adrian explains that the modern-day pen test needs to look more like purple teaming and focus on prioritizing what really needs to be fixed.
“A lot of companies have pen tests, because they don't know what else to do with their security budget. You could apply that more broadly. A lot of people have a security budget, and they buy what they see their peers buy and do what analysts tell them to do.”
-------------
Links:
Learn more about Adrian Sanabria on <a href='https://www.linkedin.com/in/adrian-sanabria/'>LinkedIn</a> and <a href='https://twitter.com/sawaba'>Twitter</a>
Check out Tenchi Security on <a href='https://www.linkedin.com/company/tenchisecurity/'>LinkedIn</a> and <a href='https://www.tenchisecurity.com'>the Tenchi Security website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/76511c75-eb9b-3202-badf-4b377f86fb6b

Adrian Sanabria, Director of Product Management at Tenchi Security, arrives at the Ranch this week to debunk cyber myths and expose industry lies. Using his background running Security Weekly Labs at Cyber Risk Alliance, Adrian explains the lack of cohes...

Debunking Cyber Myths with Adrian Sanabria

Adam Stone, Chief Privacy Officer at TrustMAPP, brings his decades of security and privacy knowledge to the Ranch this week to talk about the disciplines of security and privacy.  Where do they intersect?  What makes security professionals and privacy professionals different? And, maybe most important of all: How can these two disciplines work together within an organization without being perceived as useless regulatory headaches?


Timecoded Guide:
[00:00] Comparing and contrasting security and privacy responsibilities
[08:30] Privacy, GRC, and building trust with stakeholders
[15:28] Coordinated and cooperative efforts of security and privacy teams
[20:57] Security awareness training vs the lack of awareness of privacy
[27:26] Drawing the line with privacy laws for security professionals


Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


Where do privacy and security intersect? Where don’t they intersect?  
Privacy professionals need the security professionals within their organization to make privacy work and implement a certain protocol within a privacy policy. Although each group may want to draw division, there needs to be a healthy and divided dose of both privacy and security within a company, and they cannot just be handled by one person tagged in for both. The main reason this shared responsibility of privacy and security under one roof doesn’t work is the differences in priorities. While Adam points out that both seek to serve stakeholders, security professionals are protecting property with technology and privacy professionals are protecting individuals with processes.
“Information security professionals are in place to protect property. Namely, they are in place to protect the property of their sponsor, usually a corporation…The privacy professional is protecting the individual from the accesses of a corporation, or from a larger entity.”
 
What does an information security professional need to know about privacy?
Within the world of security, privacy regulations and laws are often seen as a headache. However, according to Adam, privacy is misunderstood by many security professionals, who group privacy policies with the same technical protocols they use throughout their work. Privacy is administrative and reliant on how someone behaves within their workplace. Although technology may aid in privacy policies, the steps companies have to go through to maintain privacy for their customers is dependent on individuals and on the ways they are able to enforce strict protective privacy protocols on these individuals.
“What security professionals need to understand about privacy is that many, if not most, of the solutions to privacy problems, are not technological. They are process. They are administrative.”
 
If security awareness training is a norm, why isn't there privacy awareness training? 
There are a lot of perceptions about privacy, and Adam admits that many of them are unfortunately negative. Between the headache of privacy law and the lack of privacy awareness within companies and organizations, what are people supposed to think about privacy? In Adam’s opinion, the perspective on privacy needs to shift and companies need to better understand that privacy is a customer service concern. Caring about how you market to someone, how you sell your wares, and the impact you have on your customers is a way to build trust with them and to provide them a higher quality of customer service, and all of that falls under the umbrella of privacy.
“In my view, [privacy awareness] is awareness of how you are communicating, how you are selling, how you are marketing, that potentially endangers the privacy of the individual.”
 
How do you keep up with the myriad of privacy laws that are constantly coming out and changing? 
Adam has heard from security and privacy professionals alike about the anxiety of changing privacy laws, but his answer to the concern is to point out that someone simply can’t keep up with these privacy law changes on their own. Whether relying on the International Association of Privacy Professionals, or IAPP, or calling in the counsel of a legal team or privacy lawyer, there are numerous resources available for privacy and security professionals to learn about privacy laws, study them, and come to the conclusion of where to draw the lines and what decisions to make about privacy policies.
“There’s a line to be drawn between interpreting and operationalizing statutes and regulations, versus interpreting a given statute or regulation for purposes of defending oneself in court. That is where we really need the expertise and the authority that a lawyer brings to the table.”
-------------
Links:
Learn more about Adam Stone on <a href='https://www.linkedin.com/in/adambstone/'>LinkedIn</a> and <a href='https://trustmapp.com/leadership/'>the TrustMAPP website</a>.
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Adam Stone, Chief Privacy Officer at TrustMAPP, brings his decades of security and privacy knowledge to the Ranch this week to talk about the disciplines of security and privacy.  Where do they intersect?  What makes security professionals and privacy professionals different? And, maybe most important of all: How can these two disciplines work together within an organization without being perceived as useless regulatory headaches?


Timecoded Guide:
[00:00] Comparing and contrasting security and privacy responsibilities
[08:30] Privacy, GRC, and building trust with stakeholders
[15:28] Coordinated and cooperative efforts of security and privacy teams
[20:57] Security awareness training vs the lack of awareness of privacy
[27:26] Drawing the line with privacy laws for security professionals


Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


Where do privacy and security intersect? Where don’t they intersect?  
Privacy professionals need the security professionals within their organization to make privacy work and implement a certain protocol within a privacy policy. Although each group may want to draw division, there needs to be a healthy and divided dose of both privacy and security within a company, and they cannot just be handled by one person tagged in for both. The main reason this shared responsibility of privacy and security under one roof doesn’t work is the differences in priorities. While Adam points out that both seek to serve stakeholders, security professionals are protecting property with technology and privacy professionals are protecting individuals with processes.
“Information security professionals are in place to protect property. Namely, they are in place to protect the property of their sponsor, usually a corporation…The privacy professional is protecting the individual from the accesses of a corporation, or from a larger entity.”
 
What does an information security professional need to know about privacy?
Within the world of security, privacy regulations and laws are often seen as a headache. However, according to Adam, privacy is misunderstood by many security professionals, who group privacy policies with the same technical protocols they use throughout their work. Privacy is administrative and reliant on how someone behaves within their workplace. Although technology may aid in privacy policies, the steps companies have to go through to maintain privacy for their customers is dependent on individuals and on the ways they are able to enforce strict protective privacy protocols on these individuals.
“What security professionals need to understand about privacy is that many, if not most, of the solutions to privacy problems, are not technological. They are process. They are administrative.”
 
If security awareness training is a norm, why isn't there privacy awareness training? 
There are a lot of perceptions about privacy, and Adam admits that many of them are unfortunately negative. Between the headache of privacy law and the lack of privacy awareness within companies and organizations, what are people supposed to think about privacy? In Adam’s opinion, the perspective on privacy needs to shift and companies need to better understand that privacy is a customer service concern. Caring about how you market to someone, how you sell your wares, and the impact you have on your customers is a way to build trust with them and to provide them a higher quality of customer service, and all of that falls under the umbrella of privacy.
“In my view, [privacy awareness] is awareness of how you are communicating, how you are selling, how you are marketing, that potentially endangers the privacy of the individual.”
 
How do you keep up with the myriad of privacy laws that are constantly coming out and changing? 
Adam has heard from security and privacy professionals alike about the anxiety of changing privacy laws, but his answer to the concern is to point out that someone simply can’t keep up with these privacy law changes on their own. Whether relying on the International Association of Privacy Professionals, or IAPP, or calling in the counsel of a legal team or privacy lawyer, there are numerous resources available for privacy and security professionals to learn about privacy laws, study them, and come to the conclusion of where to draw the lines and what decisions to make about privacy policies.
“There’s a line to be drawn between interpreting and operationalizing statutes and regulations, versus interpreting a given statute or regulation for purposes of defending oneself in court. That is where we really need the expertise and the authority that a lawyer brings to the table.”
-------------
Links:
Learn more about Adam Stone on <a href='https://www.linkedin.com/in/adambstone/'>LinkedIn</a> and <a href='https://trustmapp.com/leadership/'>the TrustMAPP website</a>.
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/a6c7d6c3-e120-3652-889d-40d267817348

Adam Stone, Chief Privacy Officer at TrustMAPP, brings his decades of security and privacy knowledge to the Ranch this week to talk about the disciplines of security and privacy.  Where do they intersect?  What makes security professionals and privacy pr...

Privacy Professionals & Regulatory Headaches with Adam Stone

Jerry Perullo, former CISO of the NYSE, former chairman of the board off the FS-ISAC, founder, professor, and host of the Life After CISO podcast, comes down to the Cyber Ranch to discuss the many roles he’s had throughout his career and the many highly unique opinions he has on the cyber industry. Together, Jerry and Allan break down what’s overrated in cybersecurity, from patching to dark web to vulnerability departments, and every detail and concept in between.
 
Timecoded Guide:
[01:53] Taking on a variety of roles in the cyber industry and breaking down which elements of cybersecurity are overrated
[08:48] Recognizing when encryption is needed and when it is overrated or overemphasized as something you need in cybersecurity
[15:43] Service-level agreement timelines, addressing critical risks, and engaging with the 80/20 rule
[24:17] Understanding when to separate data about different vulnerabilities and attacks, and when to report on them in the same conversation (i.e. board meetings)
[29:58] Other overrated elements of cybersecurity, such as IoCs, dark web, and, of course, what Jerry would change in cyber if he had a magic wand...


Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonius comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


Why is patching overrated?
While Jerry acknowledges the importance of patching in certain contexts, he also explains that it’s often overemphasized in its ability to provide cyber solutions. For patching to make an impact, the vulnerability has to be known and understood. In Jerry’s experience, patching doesn’t solve many of the problems in cybersecurity and can instead create a false sense of security, especially in the case of in-house coding errors. Although patching can create a long-term solution, you may only overcome that weakness for a moment and end up coming back to the same issue a few months later.
“When I say it's overrated is, first of all, patching is to address a known vulnerability in a piece of software, right? That means that the vulnerability has to already be out there, has to be profiled, has to be understood, and the manufacturer has to have actually created some kind of fix for it.”


What about encryption? Is that also overrated?
The idea of encryption comes from the idea of keeping information and vulnerabilities out of your enemies’ hands. However, too much focus on encryption blinds us to other issues and other tools that can be used against us. Although certain vulnerabilities around encryption are exploited, Jerry points out that you rarely, if ever, hear about the threats that we’re warned about when we’re sold on the concept and idea of encryption. With so many other ways to be hacked and exploited, Jerry says our focus on encryption keeps us in the dark about what the reality of online safety is. 
“In any event, we spend so much time worrying about encryption and encrypting things, and whether it's encryption at rest, or whether it's in transit, or anything else like that, that I think sometimes we blind ourselves, especially on internal tools.”


Are short SLAs (service level agreements) for addressing critical risk overrated?
In Jerry’s mind, the timeframe of your SLA doesn’t matter if you need a problem fixed immediately. Whether it’s a 48 hour turnaround, a 29 day, or a 364 day window, critical threats need immediate fixes and your service team should understand that. If the response to a necessary and urgent request is for your team to inquire about the SLA, you have a much bigger problem than the time it will take. Instead you have a toxic culture problem, something that cannot be fixed with simple tweaks to your SLA. 
“I always would just preach that you don't want to ever undermine your credibility. You don't want to bring weak sauce. Gotta be able to reproduce everything, have a video, all of that, and if you don't, then yeah, you people are gonna abuse your SLAs and push it to the edge.”


What’s your thoughts on departments with “vulnerability” in their name? 
Although Jerry has had vulnerability departments and teams in previous companies he’s worked with, adding vulnerability to a department name rarely has the impact beyond specifying that they run the vulnerability scanners. Beyond running the scanners, processing these results and reporting them is a completely different beast. Rarely is a vulnerability department able to process and report these results without making data ten times more complicated and time consuming for your board to understand. They’re tool-focused, it’s in their name, but it may not be what you really need when you’re assessing risk. 
“I think it's really important that you just speak about them all collectively, in a tool agnostic fashion. So, I feel the vuln scanner results, the bug bounty results, the attack service management results, the employees raising their hand and volunteering info…they need to be portrayed in parallel in one communication.”
-------------
Links:
Learn more about Jerry Perullo on <a href='https://www.linkedin.com/in/perullo/'>LinkedIn</a> and listen to his podcast <a href='https://rss.com/podcasts/lifeafterciso/'>#lifeafterCISO</a> 
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Jerry Perullo, former CISO of the NYSE, former chairman of the board off the FS-ISAC, founder, professor, and host of the Life After CISO podcast, comes down to the Cyber Ranch to discuss the many roles he’s had throughout his career and the many highly unique opinions he has on the cyber industry. Together, Jerry and Allan break down what’s overrated in cybersecurity, from patching to dark web to vulnerability departments, and every detail and concept in between.
 
Timecoded Guide:
[01:53] Taking on a variety of roles in the cyber industry and breaking down which elements of cybersecurity are overrated
[08:48] Recognizing when encryption is needed and when it is overrated or overemphasized as something you need in cybersecurity
[15:43] Service-level agreement timelines, addressing critical risks, and engaging with the 80/20 rule
[24:17] Understanding when to separate data about different vulnerabilities and attacks, and when to report on them in the same conversation (i.e. board meetings)
[29:58] Other overrated elements of cybersecurity, such as IoCs, dark web, and, of course, what Jerry would change in cyber if he had a magic wand...


Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonius comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>


Why is patching overrated?
While Jerry acknowledges the importance of patching in certain contexts, he also explains that it’s often overemphasized in its ability to provide cyber solutions. For patching to make an impact, the vulnerability has to be known and understood. In Jerry’s experience, patching doesn’t solve many of the problems in cybersecurity and can instead create a false sense of security, especially in the case of in-house coding errors. Although patching can create a long-term solution, you may only overcome that weakness for a moment and end up coming back to the same issue a few months later.
“When I say it's overrated is, first of all, patching is to address a known vulnerability in a piece of software, right? That means that the vulnerability has to already be out there, has to be profiled, has to be understood, and the manufacturer has to have actually created some kind of fix for it.”


What about encryption? Is that also overrated?
The idea of encryption comes from the idea of keeping information and vulnerabilities out of your enemies’ hands. However, too much focus on encryption blinds us to other issues and other tools that can be used against us. Although certain vulnerabilities around encryption are exploited, Jerry points out that you rarely, if ever, hear about the threats that we’re warned about when we’re sold on the concept and idea of encryption. With so many other ways to be hacked and exploited, Jerry says our focus on encryption keeps us in the dark about what the reality of online safety is. 
“In any event, we spend so much time worrying about encryption and encrypting things, and whether it's encryption at rest, or whether it's in transit, or anything else like that, that I think sometimes we blind ourselves, especially on internal tools.”


Are short SLAs (service level agreements) for addressing critical risk overrated?
In Jerry’s mind, the timeframe of your SLA doesn’t matter if you need a problem fixed immediately. Whether it’s a 48 hour turnaround, a 29 day, or a 364 day window, critical threats need immediate fixes and your service team should understand that. If the response to a necessary and urgent request is for your team to inquire about the SLA, you have a much bigger problem than the time it will take. Instead you have a toxic culture problem, something that cannot be fixed with simple tweaks to your SLA. 
“I always would just preach that you don't want to ever undermine your credibility. You don't want to bring weak sauce. Gotta be able to reproduce everything, have a video, all of that, and if you don't, then yeah, you people are gonna abuse your SLAs and push it to the edge.”


What’s your thoughts on departments with “vulnerability” in their name? 
Although Jerry has had vulnerability departments and teams in previous companies he’s worked with, adding vulnerability to a department name rarely has the impact beyond specifying that they run the vulnerability scanners. Beyond running the scanners, processing these results and reporting them is a completely different beast. Rarely is a vulnerability department able to process and report these results without making data ten times more complicated and time consuming for your board to understand. They’re tool-focused, it’s in their name, but it may not be what you really need when you’re assessing risk. 
“I think it's really important that you just speak about them all collectively, in a tool agnostic fashion. So, I feel the vuln scanner results, the bug bounty results, the attack service management results, the employees raising their hand and volunteering info…they need to be portrayed in parallel in one communication.”
-------------
Links:
Learn more about Jerry Perullo on <a href='https://www.linkedin.com/in/perullo/'>LinkedIn</a> and listen to his podcast <a href='https://rss.com/podcasts/lifeafterciso/'>#lifeafterCISO</a> 
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/b0f4ef2b-8023-3ebf-8ad8-e3aa787f0113

Jerry Perullo, former CISO of the NYSE, former chairman of the board off the FS-ISAC, founder, professor, and host of the Life After CISO podcast, comes down to the Cyber Ranch to discuss the many roles he’s had throughout his career and the many highly ...

The Overrated in Cybersecurity with Jerry Perullo

Tim Silverline, VP of Security at Gluware, joins host Allan Alford on the Ranch this week for a discussion about user awareness training and the latest and greatest (as well as not the greatest) methods around phishing simulations. Tim and Allan get into the nitty gritty of how your company can improve user awareness results through avoiding basic click-through models, considering advanced warning for certain training exercises, and understanding risk quantification when evaluating employee metrics.
 
Timecoded Guide:
[04:30] Running the right phishing simulation for your user base and gauging your results appropriately
[10:08] Pushing boundaries in the tactics used in phishing exercises and making employees pay attention more closely to their everyday emails 
[15:10] Calling out unlikely and unhelpful phishing strategies and simulations, including the harm of impersonating employees without any warning
[21:04] Realizing which methods of user awareness are no longer effective and shifting away from the mindset of just “checking the box” in these training exercises
[25:54] Changing security for the better with increased awareness and a better understanding around the value of risk exposure amongst employees
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>
 
What, to you, are the biggest highlights, the high points, the critical bits of user awareness training?
Tim has seen the good and the bad of user awareness training, and has found the best results for his users in interactive training sessions, especially when paired with gamification. Allan compares this method and approach to modern virtual escape room sessions, and Tim agrees that the more interactive and hands-on a training can be, the better the learning experience will be. Instead of framing our user awareness and phishing exercises around checking boxes for cyber insurance companies, we should be striving for active learning engagements that demonstrate the value of security to our users.
“After those trainings, users have come up to me and talked to me about how they weren't aware of this particular risk and hearing about it in a real-world use-case was very effective for them to really understand why it's important and why they should be behaving in a slightly different manner.”
 
If the users never fall prey to attacks, is there a reason to continue performing them? 
Hearing Tim talk about his success, Allan was curious about how he chooses to approach successful user bases. If someone isn’t falling for Tim’s phish, does he still see the need to perform these exercises? The short answer was yes, but Tim explains that user awareness training should be customized to the needs of a user base. Testing new employees is a must, along with refreshing successful users on their skills a few times a year. Additionally, scheduling out different exercises that hone in on different phishing simulations exposes employees to a variety of learning opportunities and encourages them to see this beyond just a yearly test where they might as well “get it over with.”
“If you've tested all your existing employees, and they haven't fallen or been susceptible to it, that doesn't mean that the next employee you hire is also going to be of that same mindset.”
 
What ineffective methods are there in security awareness?
Throughout the episode, Tim and Allan keep coming back to the simple fact that checking boxes no longer works. Having employees read or watch through videos and take “common sense” knowledge tests makes user awareness training a distracting activity that feels more like grunt work than a learning experience. While you never want to disrupt the workflow of your employees, stepping outside of the box with interactive activities that are explained in advance shows the value of these exercises to your users instead of making them feel that you’re yet again wasting their time with another gift card scam.
“I find that there's the typical thing a lot of people do to hit compliance, which is having their users watch videos, and answer questionnaires. My feeling is that most people just try to get that done. Their goal is really to get it completed, so they can check the box and their company stops bothering them to complete it.”
 
You are given a magic wand and you are told you can wave it and change any one thing in cybersecurity you want to change. What do you change?
There’s so much in cybersecurity that Tim and Allan would love to change, especially when we look at cutting edge approaches to user awareness training. However, Tim makes one thing clear: if he could change anything, he would change our mindset. Instead of seeing security as just someone’s job, we should encourage our users to see themselves as an instrumental part of their company’s security. When everyone concerns themselves with following the right protocols and caring about security beyond simulations, companies will find themselves in a much stronger, less vulnerable place.
“I think ultimately, a lot of the weaknesses inside of our organization are our users. If I could just increase the level of carefulness, or the level of interest that everybody has in keeping their own companies secure, I think we would overall improve the posture of all companies.”
-------------
Links:
Learn more about Tim Silverline on <a href='https://www.linkedin.com/in/timsilverline/'>LinkedIn</a> and <a href='https://gluware.com'>the Gluware website</a>. 
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Tim Silverline, VP of Security at Gluware, joins host Allan Alford on the Ranch this week for a discussion about user awareness training and the latest and greatest (as well as not the greatest) methods around phishing simulations. Tim and Allan get into the nitty gritty of how your company can improve user awareness results through avoiding basic click-through models, considering advanced warning for certain training exercises, and understanding risk quantification when evaluating employee metrics.
 
Timecoded Guide:
[04:30] Running the right phishing simulation for your user base and gauging your results appropriately
[10:08] Pushing boundaries in the tactics used in phishing exercises and making employees pay attention more closely to their everyday emails 
[15:10] Calling out unlikely and unhelpful phishing strategies and simulations, including the harm of impersonating employees without any warning
[21:04] Realizing which methods of user awareness are no longer effective and shifting away from the mindset of just “checking the box” in these training exercises
[25:54] Changing security for the better with increased awareness and a better understanding around the value of risk exposure amongst employees
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Manual asset inventory just doesn't cut it anymore. That's where Axonious comes in. Take control of security complexities by uncovering gaps in your organization. Sign up for a free walk through of the platform at <a href='http://axonius.com/Get-A-Tour'>Axonius.com/Get-A-Tour</a>
 
What, to you, are the biggest highlights, the high points, the critical bits of user awareness training?
Tim has seen the good and the bad of user awareness training, and has found the best results for his users in interactive training sessions, especially when paired with gamification. Allan compares this method and approach to modern virtual escape room sessions, and Tim agrees that the more interactive and hands-on a training can be, the better the learning experience will be. Instead of framing our user awareness and phishing exercises around checking boxes for cyber insurance companies, we should be striving for active learning engagements that demonstrate the value of security to our users.
“After those trainings, users have come up to me and talked to me about how they weren't aware of this particular risk and hearing about it in a real-world use-case was very effective for them to really understand why it's important and why they should be behaving in a slightly different manner.”
 
If the users never fall prey to attacks, is there a reason to continue performing them? 
Hearing Tim talk about his success, Allan was curious about how he chooses to approach successful user bases. If someone isn’t falling for Tim’s phish, does he still see the need to perform these exercises? The short answer was yes, but Tim explains that user awareness training should be customized to the needs of a user base. Testing new employees is a must, along with refreshing successful users on their skills a few times a year. Additionally, scheduling out different exercises that hone in on different phishing simulations exposes employees to a variety of learning opportunities and encourages them to see this beyond just a yearly test where they might as well “get it over with.”
“If you've tested all your existing employees, and they haven't fallen or been susceptible to it, that doesn't mean that the next employee you hire is also going to be of that same mindset.”
 
What ineffective methods are there in security awareness?
Throughout the episode, Tim and Allan keep coming back to the simple fact that checking boxes no longer works. Having employees read or watch through videos and take “common sense” knowledge tests makes user awareness training a distracting activity that feels more like grunt work than a learning experience. While you never want to disrupt the workflow of your employees, stepping outside of the box with interactive activities that are explained in advance shows the value of these exercises to your users instead of making them feel that you’re yet again wasting their time with another gift card scam.
“I find that there's the typical thing a lot of people do to hit compliance, which is having their users watch videos, and answer questionnaires. My feeling is that most people just try to get that done. Their goal is really to get it completed, so they can check the box and their company stops bothering them to complete it.”
 
You are given a magic wand and you are told you can wave it and change any one thing in cybersecurity you want to change. What do you change?
There’s so much in cybersecurity that Tim and Allan would love to change, especially when we look at cutting edge approaches to user awareness training. However, Tim makes one thing clear: if he could change anything, he would change our mindset. Instead of seeing security as just someone’s job, we should encourage our users to see themselves as an instrumental part of their company’s security. When everyone concerns themselves with following the right protocols and caring about security beyond simulations, companies will find themselves in a much stronger, less vulnerable place.
“I think ultimately, a lot of the weaknesses inside of our organization are our users. If I could just increase the level of carefulness, or the level of interest that everybody has in keeping their own companies secure, I think we would overall improve the posture of all companies.”
-------------
Links:
Learn more about Tim Silverline on <a href='https://www.linkedin.com/in/timsilverline/'>LinkedIn</a> and <a href='https://gluware.com'>the Gluware website</a>. 
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/c665a227-b7e8-3957-9d51-258b4326c65b

Tim Silverline, VP of Security at Gluware, joins host Allan Alford on the Ranch this week for a discussion about user awareness training and the latest and greatest (as well as not the greatest) methods around phishing simulations. Tim and Allan get into...

Better User Awareness Training with Tim Silverline

Allan invites a founder and an angel investor to the ranch this week to talk about how founders and angel investors really connect. Meet Sameer Sait, former CISO at Amazon Whole Foods and now founder of BalkanID, and John Stewart, former CISO at Cisco and investor at Talons Ventures. Together, these gentlemen offer a lot about both sides of the investment story, from evaluation to the decision to work together, and what a mutually beneficial founder and angel investor relationship looks like.
 
Timecoded Guide:
[01:23] Exploring John and Sameer’s backgrounds in cyber and how they developed their own unique founder-angel investor connection
[04:53] Understanding the triggering aspects that caused someone like John to become an angel investor in BalkanID and how BalkanID selected their investors
[08:20] Delving into the uniqueness of different founder-investor relationships and how John (vs other BalkanID investors) makes his impact on Sameer’s work as a founder
[13:30] Giving expert advice and explaining lessons learned in founding your first company and in investing in startups 
[22:12] Exploring how other experiences in life, outside of cybersecurity and investing, has informed John and Sameer’s work with BalkanID and with solving cyber issues
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>.
 
What inspired you to become a founder of BalkanID, Sameer?
As the former CISO of Amazon Whole Foods and an investor at numerous cybersecurity companies, Sameer has a great resume to show off. However, his work with BalkanID offered him the opportunity to be a founder, something that Sameer had never done before. When asked what inspired him to be a first-time founder, he tells us that he continuously encountered the same problems over and over again, and wasn’t seeing anyone coming up with the right solution. Continuing to move forward with so much at stake with this issue of entitlements felt like a missed opportunity, and with the right investors and co-founders on his side, BalkanID was born.
“I knew that we could do better, right? And I knew the existing solutions were not scaling. And I think the last inspiration was really finding the right co-founders to go at this with. That was the biggest inspiration of all.” - Sameer Sait
 
John, what were the triggering factors that made you decide to invest in BalkanID? 
Just like Sameer, John has some incredible experience to show off in the tech world and in the investment world. But why BalkanID? A simple answer would be the connection between these two men, having met numerous times throughout their careers, developing a strong working relationship. However, John sees so much potential in BalkanID and in Sameer beyond just their work friendship. John believes that you don’t invest in tech, you invest in people, and the qualities he sees in Sameer as a founder and a leader in the tech world excites him and he felt he could lend his expertise to BalkanID in a beneficial way.
“Sameer is very self-aware. These things matter. He knows what he knows, he knows what he doesn't know, he's comfortable bringing in people that complement his skills and make a stronger team around him. In the end, that's why I say you bet on people, not on tech.” - John Stewart
 
What advice do you have for potential investors looking to get involved in startups, John?
Being an investor isn’t always easy, and John has made some mistakes that taught him the hard way about how to be a good investor. With a hands-on approach and now tons of projects under his belt, John is asked to give some advice to future investors. A hugely important piece of advice from John is to know your founder, know their wants and needs, and to see ahead of what their future holds. You’re an investor, but it is their company, and you have to be aligned in order to produce a mutually beneficial relationship. 
“As an investor, I follow out and look for all of those things. I look at how optionality is, how CEOs think, how many chances they have, what directions could they go. Are they strategically capable of looking beyond today's decision and thinking about what might happen in the future?” - John Stewart
 
Sameer, what advice would you give fellow founders?
Despite his experiences at other companies, BalkanID is Sameer’s first founding experience so far. His biggest lesson to date? Not getting caught up in the buzz and the hype. BalkanID’s approach to their audience and their product has been to focus on their customer and work backwards to find their problem and their ideal solution. This takes time, and it’s easy to fall into the trap of comparing your revenue, launches, products, and marketing tactics of other companies. This only hurts your brand in the long-run because you’ll no longer be focused on your customer’s problem. 
“As an early stage, first-time entrepreneur, a part of me would get nervous. ‘Oh, my God, look what's happening out there. Oh, we're so slow.’ I think of taking a step back and saying, ‘Well, we are on our journey,’ right? We have supporters, we have backers, we have a real problem we're solving. The fact that other people want to solve the same problem is validation that it's a real problem.” - Sameer Sait
-------------
Links:
Stay in touch with Sameer Sait on <a href='https://www.linkedin.com/in/sameersait/'>LinkedIn</a> and <a href='https://www.balkan.id/about'>the BalkanID website.</a>
Stay in touch with John Stewart on <a href='https://www.linkedin.com/in/john-stewart-ba32a5195/'>LinkedIn</a>.
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Allan invites a founder and an angel investor to the ranch this week to talk about how founders and angel investors really connect. Meet Sameer Sait, former CISO at Amazon Whole Foods and now founder of BalkanID, and John Stewart, former CISO at Cisco and investor at Talons Ventures. Together, these gentlemen offer a lot about both sides of the investment story, from evaluation to the decision to work together, and what a mutually beneficial founder and angel investor relationship looks like.
 
Timecoded Guide:
[01:23] Exploring John and Sameer’s backgrounds in cyber and how they developed their own unique founder-angel investor connection
[04:53] Understanding the triggering aspects that caused someone like John to become an angel investor in BalkanID and how BalkanID selected their investors
[08:20] Delving into the uniqueness of different founder-investor relationships and how John (vs other BalkanID investors) makes his impact on Sameer’s work as a founder
[13:30] Giving expert advice and explaining lessons learned in founding your first company and in investing in startups 
[22:12] Exploring how other experiences in life, outside of cybersecurity and investing, has informed John and Sameer’s work with BalkanID and with solving cyber issues
 
Sponsor Links:
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>.
 
What inspired you to become a founder of BalkanID, Sameer?
As the former CISO of Amazon Whole Foods and an investor at numerous cybersecurity companies, Sameer has a great resume to show off. However, his work with BalkanID offered him the opportunity to be a founder, something that Sameer had never done before. When asked what inspired him to be a first-time founder, he tells us that he continuously encountered the same problems over and over again, and wasn’t seeing anyone coming up with the right solution. Continuing to move forward with so much at stake with this issue of entitlements felt like a missed opportunity, and with the right investors and co-founders on his side, BalkanID was born.
“I knew that we could do better, right? And I knew the existing solutions were not scaling. And I think the last inspiration was really finding the right co-founders to go at this with. That was the biggest inspiration of all.” - Sameer Sait
 
John, what were the triggering factors that made you decide to invest in BalkanID? 
Just like Sameer, John has some incredible experience to show off in the tech world and in the investment world. But why BalkanID? A simple answer would be the connection between these two men, having met numerous times throughout their careers, developing a strong working relationship. However, John sees so much potential in BalkanID and in Sameer beyond just their work friendship. John believes that you don’t invest in tech, you invest in people, and the qualities he sees in Sameer as a founder and a leader in the tech world excites him and he felt he could lend his expertise to BalkanID in a beneficial way.
“Sameer is very self-aware. These things matter. He knows what he knows, he knows what he doesn't know, he's comfortable bringing in people that complement his skills and make a stronger team around him. In the end, that's why I say you bet on people, not on tech.” - John Stewart
 
What advice do you have for potential investors looking to get involved in startups, John?
Being an investor isn’t always easy, and John has made some mistakes that taught him the hard way about how to be a good investor. With a hands-on approach and now tons of projects under his belt, John is asked to give some advice to future investors. A hugely important piece of advice from John is to know your founder, know their wants and needs, and to see ahead of what their future holds. You’re an investor, but it is their company, and you have to be aligned in order to produce a mutually beneficial relationship. 
“As an investor, I follow out and look for all of those things. I look at how optionality is, how CEOs think, how many chances they have, what directions could they go. Are they strategically capable of looking beyond today's decision and thinking about what might happen in the future?” - John Stewart
 
Sameer, what advice would you give fellow founders?
Despite his experiences at other companies, BalkanID is Sameer’s first founding experience so far. His biggest lesson to date? Not getting caught up in the buzz and the hype. BalkanID’s approach to their audience and their product has been to focus on their customer and work backwards to find their problem and their ideal solution. This takes time, and it’s easy to fall into the trap of comparing your revenue, launches, products, and marketing tactics of other companies. This only hurts your brand in the long-run because you’ll no longer be focused on your customer’s problem. 
“As an early stage, first-time entrepreneur, a part of me would get nervous. ‘Oh, my God, look what's happening out there. Oh, we're so slow.’ I think of taking a step back and saying, ‘Well, we are on our journey,’ right? We have supporters, we have backers, we have a real problem we're solving. The fact that other people want to solve the same problem is validation that it's a real problem.” - Sameer Sait
-------------
Links:
Stay in touch with Sameer Sait on <a href='https://www.linkedin.com/in/sameersait/'>LinkedIn</a> and <a href='https://www.balkan.id/about'>the BalkanID website.</a>
Stay in touch with John Stewart on <a href='https://www.linkedin.com/in/john-stewart-ba32a5195/'>LinkedIn</a>.
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/5a894ed4-1e9e-3ab2-81c9-29cb2bbcc69b

Allan invites a founder and an angel investor to the ranch this week to talk about how founders and angel investors really connect. Meet Sameer Sait, former CISO at Amazon Whole Foods and now founder of BalkanID, and John Stewart, former CISO at Cisco an...

The Founder-Angel Investor Connection with Sameer Sait & John Stewart

“When people come to Security and tell you everything they are doing, that’s a real win.” - James Allan-McLean 
 
Allan is joined by James Allan-McLean, Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military, to talk about his ‘Open Door Security’ method and the benefits of transparent, no-strings-attached approach to security. In this episode, Allan and James take a deep dive into this methodology and address questions such as: 
    -What is Open Door Security?
    -What does a successful Open Door Security program look like?
    -How to go about tackling security implications within your org 
    -The philosophy behind James’ ‘handrail’ metaphor
Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>
Guest Bio:
James is a highly effective and motivated information security leader with extensive experience in a range of sectors. He is a Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military.
Links:
Stay in touch with James Allan-McLean on <a href='https://www.linkedin.com/in/james-a-0a691756/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

“When people come to Security and tell you everything they are doing, that’s a real win.” - James Allan-McLean 
 
Allan is joined by James Allan-McLean, Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military, to talk about his ‘Open Door Security’ method and the benefits of transparent, no-strings-attached approach to security. In this episode, Allan and James take a deep dive into this methodology and address questions such as: 
    -What is Open Door Security?
    -What does a successful Open Door Security program look like?
    -How to go about tackling security implications within your org 
    -The philosophy behind James’ ‘handrail’ metaphor
Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>
Guest Bio:
James is a highly effective and motivated information security leader with extensive experience in a range of sectors. He is a Group CISO at Soletanche Freyssinet and former Information Security Manager within the British military.
Links:
Stay in touch with James Allan-McLean on <a href='https://www.linkedin.com/in/james-a-0a691756/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/a839084f-f767-3f0e-90a5-9589dbb6a2d7

“When people come to Security and tell you everything they are doing, that’s a real win.” - James Allan-McLean 
 
Allan is joined by James Allan-McLean, Group CISO at Soletanche Freyssinet and former Information Security Manager within the British milita...

Open Door Security w/ James Allan-McLean

Allan is joined by Chris Hughes, CISO & Co-founder at Aquia and adjunct professor at UMGC, to talk about all things DevSecOps (Development, Security and Operations). They explore the DevSecOps phrase itself, as well as why security should be treated as an integral component and not a separate entity. In this episode, Allan and Chris take a deep dive into the subject and bring clarity to questions, such as: 
    -What roles help achieve security in DevOps?
    -What are the cultural barriers to implementing secure DevOps?
    -What are some common mistakes as well as best tips?
Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>
Guest Bio:
Chris Hughes is a proven Cloud/Cybersecurity leader with nearly 20 years of experience in both the Federal and commercial industries. Chris has a dynamic skill set, with a blend of IT, Cyber/Cloud Security and DevSecOps experience. He enjoys working across interdisciplinary teams to solve complex organizational and industry-wide problems to achieve technological transformation securely. 
Additional Resources:
Google SLSA framework: <a href='https://slsa.dev/'>https://slsa.dev/
</a>CSCRM – NIST Appendix F : <a href='https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdf'>https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdf</a>Open SSF – OSS Mobilization Plan: <a href='https://8112310.fs1.hubspotusercontent-na1.net/hubfs/8112310/OpenSSF/White%20House%20OSS%20Mobilization%20Plan.pdf?hsCtaTracking=3b79d59d-e8d3-4c69-a67b-6b87b325313c%7C7a1a8b01-65ae-4bac-b97c-071dac09a2d8'>https://8112310.fs1.hubspotusercontent-na1.net/hubfs/8112310/OpenSSF/White%20House%20OSS%20Mobilization%20Plan.pdf?hsCtaTracking=3b79d59d-e8d3-4c69-a67b-6b87b325313c%7C7a1a8b01-65ae-4bac-b97c-071dac09a2d8</a>
Sounil/Andy Debate: <a href='https://www.securityweek.com/video-civil-discourse-sboms'>https://www.securityweek.com/video-civil-discourse-sboms</a>
Links:
Stay in touch with Chris Hughes on <a href='https://www.linkedin.com/in/chris-h-97680442/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/19bbe205-2108-3581-aea3-d190c4005c5d

Allan is joined by Chris Hughes, CISO & Co-founder at Aquia and adjunct professor at UMGC, to talk about all things DevSecOps (Development, Security and Operations). They explore the DevSecOps phrase itself, as well as why security should be treated as a...

DevSecOps w/ Chris Hughes

Andy Ellis, CISO at Orca Security, is back for part 2 of this series on Board Reporting Metrics. In Episode 1, Andy and host Allan Alford addressed some of the most common questions posed by the board and shared their perspective on what the board needs to know from a cybersecurity standpoint. In this episode, they continue the conversation by fielding questions from LinkedIn on topics such as:
    -Vulnerability and threat hunting metrics
    -Top 3 metrics to report to the board and why
    -Breach reporting implications and much more! 
Check out part 1 of Board Reporting Metrics <a href='https://hackervalley.com/cyberranch/board-reporting-metrics-pt.-1-w-andy-ellis'>here</a>

Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>

Guest Bio:
Andy Ellis is a visionary technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. A graduate of MIT and former US Air Force officer, Andy designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business. In his twenty year tenure, Andy led Akamai’s information security team from a single individual to a 90+ person team, over 40% of whom were women. In running Akamai’s security program, Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs, Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision making.

Additional Links:
Stay in touch with Andy Ellis on <a href='https://www.linkedin.com/in/csoandy/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/dbbc062d-160a-36ef-a76d-471f5ffe6917

Andy Ellis, CISO at Orca Security, is back for part 2 of this series on Board Reporting Metrics. In Episode 1, Andy and host Allan Alford addressed some of the most common questions posed by the board and shared their perspective on what the board needs ...

Board Reporting Metrics Pt. 2 w/ Andy Ellis

In this episode, Allan is joined by the CISO at Orca Security, Andy Ellis, to share his thoughts on board reporting metrics. What does the board need to know from a cybersecurity perspective? One of the questions is often: “Are we secure?” Is that even the right question? How much should you talk about compliance? Do you speak of IT assets? What about speaking to specific controls? Listen to this episode to hear the common questions posed by the board and how to answer them with metrics. In some cases, it is teaching them to ask different questions. This episode is a master class in board communication in cybersecurity, and the conversation went into such depth that a Part 2 is already being planned.
Check out Andy’s previous episode <a href='https://hackervalley.com/cyberranch/clever-hiring-practices-w-andy-ellis/'>here</a>
Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>
Guest Bio:
Andy Ellis is a visionary technology and business executive with deep expertise in security, managing risk, and leading an inclusive culture. A graduate of MIT and former US Air Force officer, Andy designed, built, and brought to market many of Akamai’s security products, leading the Fortune 1000 company from its start as a content delivery network into an industry powerhouse with a billion-dollar dedicated cybersecurity business. In his twenty year tenure, Andy led Akamai’s information security team from a single individual to a 90+ person team, over 40% of whom were women. In running Akamai’s security program, Andy designed systems, governed risk management, implemented policy, and supported go-to-market functions. Widely respected across the cybersecurity industry for his pragmatic approach to aligning security and business needs, Andy regularly speaks and writes on cybersecurity, leadership, diversity & inclusion, and decision making.

Additional Links:
Stay in touch with Andy Ellis on <a href='https://www.linkedin.com/in/csoandy/'>LinkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/52b33edc-10b0-3323-a108-270fec43ce4a

In this episode, Allan is joined by the CISO at Orca Security, Andy Ellis, to share his thoughts on board reporting metrics. What does the board need to know from a cybersecurity perspective? One of the questions is often: “Are we secure?” Is that even t...

Board Reporting Metrics Pt. 1 w/ Andy Ellis

“Having a seat at the table doesn’t mean getting your way all the time. It means having a seat and I think that is very important to understand.” - Brent Deterding 
In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CISOs can earn and keep their seat at the executive table. Brent was a fan of the <a href='https://hackervalley.com/cyberranch/learned-helplessness-in-cybersecurity-w-steve-mancini/'>Learned Helplessness</a> episode of The Cyber Ranch Podcast with Steve Mancini, and furthered the conversation as it relates to the often espoused topic of CISOs needing a seat at “the table.” Brent discusses the power of shifting your mindset, how lack of confidence has created a cycle of self sabotaging, and ways we can collectively improve our current standing.
 
Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>
 
Guest Bio:
Brent is an Executive CISO whose mission is to enable Afni and its global workforce to support their customers securely and confidently. Prior to being a CISO, for over 20 years, he was a security practitioner with a security vendor specializing in threat detection, incident response, and security strategy. His efforts helped hundreds of organizations detect, respond to, and mitigate attacks.
 
Additional Links:
Stay in touch with Brent Deterding on <a href='https://www.linkedin.com/in/brent-deterding/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

“Having a seat at the table doesn’t mean getting your way all the time. It means having a seat and I think that is very important to understand.” - Brent Deterding 
In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CISOs can earn and keep their seat at the executive table. Brent was a fan of the <a href='https://hackervalley.com/cyberranch/learned-helplessness-in-cybersecurity-w-steve-mancini/'>Learned Helplessness</a> episode of The Cyber Ranch Podcast with Steve Mancini, and furthered the conversation as it relates to the often espoused topic of CISOs needing a seat at “the table.” Brent discusses the power of shifting your mindset, how lack of confidence has created a cycle of self sabotaging, and ways we can collectively improve our current standing.
 
Sponsor Links: 
Thank you to our sponsor Axonius for bringing this episode to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at <a href='http://axonius.com/simone'>axonius.com/simone</a>
 
Guest Bio:
Brent is an Executive CISO whose mission is to enable Afni and its global workforce to support their customers securely and confidently. Prior to being a CISO, for over 20 years, he was a security practitioner with a security vendor specializing in threat detection, incident response, and security strategy. His efforts helped hundreds of organizations detect, respond to, and mitigate attacks.
 
Additional Links:
Stay in touch with Brent Deterding on <a href='https://www.linkedin.com/in/brent-deterding/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/773c19f2-2c91-3715-8e94-3d57bd20cc7d

“Having a seat at the table doesn’t mean getting your way all the time. It means having a seat and I think that is very important to understand.” - Brent Deterding 
In this episode, Allan is joined by the CISO at Afni, Brent Deterding, to explore how CIS...

Getting a Seat at “The Table” w/ Brent Deterding

“Knowing what’s in your software, in your organization, can help you quickly determine if you are impacted by a new vulnerability.” - Chris Castaldo 
In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software Bills of Materials (SBOMs) and their potential implications and use. Chris explains the concept and purpose of SBOMs, his tips for signing and securing SBOMs in terms of the CI/CD pipeline, and his thoughts on SBOMs being a roadmap for “bad guys.” Lastly, he shares advice on managing and understanding contracts. 
Listen to Chris Castado’s previous Cyber Ranch episode <a href='https://hackervalley.com/cyberranch/business-oriented-security-w-chris-castaldo/'>here</a> and be sure to grab a copy of his <a href='https://www.amazon.com/Start-Up-Secure-Cybersecurity-Company-Founding/dp/1119700736'>book</a>! 
 
Guest Bio:
Chris Castaldo is the author of “Start-up Secure: Baking Cybersecurity into your Company from Founding to Exit”. He is an experienced and industry recognized CISO with over 20 years of experience in cybersecurity. Chris is an expert in building cybersecurity programs from the ground up and specializes in applying cybersecurity in start-ups from seed to exit. He is also a Visiting Fellow at the National Security Institute (NSI) at George Mason University's Antonin Scalia Law School.
 
Links:
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>
Stay in touch with Chris Castaldo on <a href='https://www.linkedin.com/in/chriscastaldo/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

“Knowing what’s in your software, in your organization, can help you quickly determine if you are impacted by a new vulnerability.” - Chris Castaldo 
In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software Bills of Materials (SBOMs) and their potential implications and use. Chris explains the concept and purpose of SBOMs, his tips for signing and securing SBOMs in terms of the CI/CD pipeline, and his thoughts on SBOMs being a roadmap for “bad guys.” Lastly, he shares advice on managing and understanding contracts. 
Listen to Chris Castado’s previous Cyber Ranch episode <a href='https://hackervalley.com/cyberranch/business-oriented-security-w-chris-castaldo/'>here</a> and be sure to grab a copy of his <a href='https://www.amazon.com/Start-Up-Secure-Cybersecurity-Company-Founding/dp/1119700736'>book</a>! 
 
Guest Bio:
Chris Castaldo is the author of “Start-up Secure: Baking Cybersecurity into your Company from Founding to Exit”. He is an experienced and industry recognized CISO with over 20 years of experience in cybersecurity. Chris is an expert in building cybersecurity programs from the ground up and specializes in applying cybersecurity in start-ups from seed to exit. He is also a Visiting Fellow at the National Security Institute (NSI) at George Mason University's Antonin Scalia Law School.
 
Links:
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>
Stay in touch with Chris Castaldo on <a href='https://www.linkedin.com/in/chriscastaldo/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/3ac2d715-9f22-3a45-a52c-9a685ea72056

“Knowing what’s in your software, in your organization, can help you quickly determine if you are impacted by a new vulnerability.” - Chris Castaldo 
In this episode, Allan is joined by author and CISO, Chris Castaldo, to share his knowledge on Software ...

All About SBOMs w/ Chris Castaldo

What would you do if you could build your security program from scratch? 
In this episode, Allan is joined by the Head of Security at Fleet, Guillaume Ross, to talk about his time building out an innovative and out-of-the-box security program and the steps he took to make it all happen. Guillaume walks us through how he developed and maintained a serverless, container based environment, his tips for securing PCs and Macs within a serverless environment, and how to establish department and business buy-in and overall cooperation. Lastly, he details steps to ensure resilience in an ‘everything as code’ security model. 
Some of what he builds might seem obvious – other parts will genuinely surprise you! 
 
Guest Bio:
Guillaume Ross is the Head of Security at Fleet Device Management. He likes securing organizations, clouds, products and more, by refusing to implement the same things that have been tried and failed thousands of times already.
 
Links:
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>
Stay in touch with Guillaume Ross on <a href='https://www.linkedin.com/in/guillaumeross/'>LinkedIn</a> and <a href='https://twitter.com/gepeto42'>Twitter</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a> 
Continue this conversation on our <a href='https://discord.com/invite/avaeNEprYG'>Discord</a>
Listen to more from the<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>

thecyberranchpodcast.podbean.com/4f45ab9d-ffe2-3903-917e-66e842d301f5

What would you do if you could build your security program from scratch? 
In this episode, Allan is joined by the Head of Security at Fleet, Guillaume Ross, to talk about his time building out an innovative and out-of-the-box security program and the ste...

Total Greenfield Innovation w/ Guillaume Ross

What are the security implications of cryptocurrency and NFTs and what do we need to know in order to transact safely? In this episode, Allan is joined by the Chief Security Officer at Kraken, Nick Percoco, to talk about securing the cryptocurrency and NFT spaces. Allan and Nick reflect on the events of the Mt. Gox bitcoin breach of 2013, address some of the most common misconceptions about crypto assets, and explore the biggest security challenges users and retail investors face when navigating the space. Lastly, Nick considers what cybersecurity lessons can be drawn from the security practices within the cryptocurrency ecosystem.
 
Guest Bio:
Nicholas Percoco has more than 25 years of security & technology experience, and is the Chief Security Officer at Kraken - a global digital asset exchange - where he is responsible for Security, IT, Technical Project Management, Operational Resiliency and Engineering.
 
Links:
Stay in touch with Nick Percoco on <a href='https://www.linkedin.com/in/c7five/'>LinkedIn </a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/fcf339ab-9b26-3065-98a3-b78d7e56f30c

What are the security implications of cryptocurrency and NFTs and what do we need to know in order to transact safely? In this episode, Allan is joined by the Chief Security Officer at Kraken, Nick Percoco, to talk about securing the cryptocurrency and N...

Securing Cryptocurrency and NFTs w/ Nick Percoco

Allan is joined by the Vice President of Security at Code42, Tommy Todd, to talk about how the tech stack can “play well with others”. In this episode, Tommy takes a deep dive into exploring how APIs and automation can help solve our needs in cybersecurity – from incident response to the tech stack. The two discuss how to evaluate security products during a Proof Of Concept (POC) for integration capabilities and tips on addressing ROI concerns.
 
Guest Bio:
Tommy Todd has over 20 years of cybersecurity experience, primarily focused on data privacy and data protection strategies. Prior to Code42, he served in security roles at Symantec, Ionic Security, and Optiv as well as many other firms. Throughout his career, he has acted as a leader, mentor, engineer, architect, and consultant to solve difficult data protection challenges. 
 
Links:
Stay in touch with Tommy Todd on <a href='https://www.linkedin.com/in/tommy-todd/'>LinkedIn </a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/1af359b3-b2d7-34ca-a0b4-a5c097838f74

Allan is joined by the Vice President of Security at Code42, Tommy Todd, to talk about how the tech stack can “play well with others”. In this episode, Tommy takes a deep dive into exploring how APIs and automation can help solve our needs in cybersecuri...

”Playing Well With Others” - The Tech Stack w/ Tommy Todd

Allan is joined by the founder and CEO of Living Security, Ashley Rose, to speak about her experiences as a female entrepreneur and leader in a male dominated industry. She details the story behind her non-traditional route into cybersecurity and how she leverages her unique skills and vision to disrupt and transform the community. Ashley shares how she overcomes bias and business challenges in the field as well as the inspiration behind her creative marketing strategies. Lastly, the two highlight the lack of diversity and representation in the space and give advice to young entrepreneurs and females in, and breaking into, cybersecurity. 
 
Guest Bio:
As the CEO of Living Security, Ashley has been the driving force behind the company’s rapid growth. Since its founding in 2017, Living Security has raised more than $20 million for growth and product development and accelerated revenue growth for three consecutive years. Ashley is also continually working to build a diverse and inclusive organization around the belief that the team should reflect the community at large.
 
Links:
Stay in touch with Ashley Rose on <a href='https://www.linkedin.com/in/ashley-m-rose/'>LinkedIn </a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/50021aa0-04b9-338f-b001-2fd1190c7453

Allan is joined by the founder and CEO of Living Security, Ashley Rose, to speak about her experiences as a female entrepreneur and leader in a male dominated industry. She details the story behind her non-traditional route into cybersecurity and how she...

Thriving In A Male Dominated Industry w/ Ashley Rose

This episode of the Cyber Ranch Podcast was recorded LIVE on stage at the CISO 360 Conference in New York City, hosted by Pulse Conferences. Nick Vigier, a seasoned CISO and former CIO, joins Allan in addressing the elephant in the room: Why don’t CISOs and CIOs don’t get along?
Nick draws on his experience in both positions to share his unique perspective on the CISO and CIO relationship. In this episode, Allan and Nick highlight the operating differences between the two positions and explore the opposing interests that exist around topics such as budgets and reporting structure. Lastly, Nick shares why engaging in empathetic conversations around metrics, business impact, and risk management is the ultimate key to a more harmonious relationship.
 
Guest Bio:
Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization. 
 
Links 
Stay in touch with Nick Vigier on <a href='https://www.linkedin.com/in/nickvigier/'>LinkedIn </a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/199e62d4-67d2-39ad-98fd-84d45051a988

This episode of the Cyber Ranch Podcast was recorded LIVE on stage at the CISO 360 Conference in New York City, hosted by Pulse Conferences. Nick Vigier, a seasoned CISO and former CIO, joins Allan in addressing the elephant in the room: Why don’t CISOs ...

Why CISOs and CIOs Don’t Get Along w/ Nick Vigier

This topic couldn’t be more relevant given recent events in the security community. Allan Alford is joined by Steve Mancini, CISO at Eclypsium, to have a refreshing conversation about the negative messaging, thinking, and tropes in cybersecurity - not just the stuff that the press says about us, or even the stuff we say about each other - but the self-defeating stuff we think and say to ourselves.
Steve addresses the reinforcement of negative catchphrases and how it affects the psyche of the community and explores how burnout is creating a culture of sleepless nights and masochistic badges of honor. Lastly, they emphasize the importance of empathy and support within the community and remind us that humans are our greatest asset, not our weakest links.


Guest Bio:
Steve Mancini is the CISO at Eclypsium, former Deputy CISO at Cylance, and an advisory board member for several cyber companies.


Links:
Stay in touch with Steve Mancini on <a href='https://www.linkedin.com/in/sharkey/'>LinkedIn </a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/b9492a0d-7372-3e57-a352-333e8b979f70

This topic couldn’t be more relevant given recent events in the security community. Allan Alford is joined by Steve Mancini, CISO at Eclypsium, to have a refreshing conversation about the negative messaging, thinking, and tropes in cybersecurity - not ju...

Learned Helplessness in Cybersecurity w/ Steve Mancini

There are numerous personality tests available to help identify personality traits, but many of them have very little scientific validity or reliability.  Such tests often aspire to explain what you are good at and what you are bad at, and miss the mark. In this episode, Allan is joined by his friend and owner of Rising Tide Security, Nick Vigier, to explore CliftonStrengths – a personality measurement that focuses less on ability, and more upon your predilections - what energizes you, and what and drains you - and with a pretty good degree of scientific validity and reliability. Nick and Allan explore what makes CliftonStrengths different from the other personality assessments and how Nick leverages that information to better understand his team and colleagues, and to help folks find the right role in cybersecurity. The two sit down to dissect Allan’s own assessment results to identify his top 5 energizers, as well as his top energy drainers. And lastly, Nick shares why he favors the idea of personality development plans vs professional development plans in the workplace. 
 
Guest Bio:
Nick Vigier is the Owner of Rising Tide Security and former CISO at ID.me, DigitalOcean, and former CIO at Gemini. Nick is a technology and security leader focused on innovation to drive business results. In his 18 years of security leadership, he has focused on building high performance teams to ensure security is a business driver rather than a cost center. His focus on all areas of security ranging from physical security to risk management through to application security, infrastructure security, and operations gives him a unique perspective on how security can positively impact an organization. 
 
Links:
Stay in touch with Nick Vigier on <a href='https://www.linkedin.com/in/paolasaibene/'>LinkedIn </a>and <a href='https://twitter.com/CISO_Nick'>Twitter</a>. Take the CliftonStrengths assessment <a href='https://www.gallup.com/cliftonstrengths/en/home.aspx?utm_source=google&utm_medium=cpc&utm_campaign=us_strengths_branded_cs_ecom&utm_term=cliftonstrengths&gclid=Cj0KCQjw5-WRBhCKARIsAAId9FnZDII_9TDf3ZyERu5TSrFQzXn5ceXDJrmFn4oqIDlEdEcn78mKkWkaAt2gEALw_wcB'>here</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/f7e33ef7-366f-3659-8469-be065ab3145d

There are numerous personality tests available to help identify personality traits, but many of them have very little scientific validity or reliability.  Such tests often aspire to explain what you are good at and what you are bad at, and miss the mark....

Leveraging Employee Strengths for Cyber Roles w/ Nick Vigier

In the episode, Allan is joined by the Principal at Teknion Data Solutions, Paola Saibene, to bring clarity to an often misunderstood topic: data governance. Paola helps to distinguish the difference between data governance and data management, examines the intersection between data ethics and cybersecurity, and explores the best methodology for applying risk frameworks. Lastly, she takes time to express the importance of being people focused and “humanizing” cybersecurity.
 
Guest Bio:
Paola Saibene is the Principal at Teknion Data Solutions, Former CISO, CEO, VP of Enterprise Risk Management, Data Privacy Officer, Strategy Officer, CTO, and CIO.  


Links:
Stay in touch with Paola Saibene on <a href='https://www.linkedin.com/in/paolasaibene/'>LinkedIn </a> 
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/bd09f984-bbe6-3e0a-ac3d-678023a285bc

In the episode, Allan is joined by the Principal at Teknion Data Solutions, Paola Saibene, to bring clarity to an often misunderstood topic: data governance. Paola helps to distinguish the difference between data governance and data management, examines ...

A Full Data Approach w/ Paola Saibene

With a looming skills/people gap in cybersecurity and retention at an all time low, it begs the question: Where is everyone? In this episode, Allan Alford and guest Jessie Bolton sit down to discuss the elusive “Great Resignation” and how it is affecting the cybersecurity community. Tune in to get the answers to the questions we are all asking ourselves, like: why are people resigning, how has the pandemic shifted our perspectives on work and boundary setting, how is the “great resignation” impacting security organizations, and how can we attempt to solve this issue?
 
Links:
Follow Jessie Bolton on <a href='https://www.linkedin.com/in/cyberworkforcepartner/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/38e89125-5743-3dd8-ae3c-08233d477def

With a looming skills/people gap in cybersecurity and retention at an all time low, it begs the question: Where is everyone? In this episode, Allan Alford and guest Jessie Bolton sit down to discuss the elusive “Great Resignation” and how it is affecting...

The Great Resignation & Cybersecurity w/ Jessie Bolton

In this episode, Allan is joined by the President at National Security Corporation, Navy veteran, and host of the CISO Tradecraft podcast, G. Mark Hardy. This show takes a fascinating dive into the origins of data risk management, measurement, and quantification. G Mark explores the stories and advice given from some of the greatest leaders in this space – whose advice still rings true today. 
 
Key Takeaways:
01:52  G Mark’s bio
06:43  FIPS-65 - the “grandaddy” of risk management
11:34  The ALE method, explained!
14:35  Oldies, but STILL goodies 
18:12  A stroll down risk management memory lane
28:56  Revering “the greats”
37:22  What do you value and what’s your currency? 
 
Links:
Stay in touch with G. Mark Hardy on <a href='https://www.linkedin.com/in/gmarkhardy/'>LinkedIn </a> 
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/5eb1d7b9-79c3-3d44-9918-47539ddfa204

In this episode, Allan is joined by the President at National Security Corporation, Navy veteran, and host of the CISO Tradecraft podcast, G. Mark Hardy. This show takes a fascinating dive into the origins of data risk management, measurement, and quanti...

How Old is Data Risk Management? w/ G. Mark Hardy

In this episode of The Cyber Ranch Podcast, Allan is joined by the CISO at Real Time Resolutions, Randy Potts. The two sit down to have a refreshing and raw conversation about the caretaking, responsibility, and code of ethics for CISOs - or lack thereof, and how to get back in touch with our “why” and mission. 
 
Disclaimer: This episode briefly mentions pornography and gambling within an important and relevant context, and has therefore been categorized as explicit. 
 
Key Takeaways:
01:43  Randy’s bio
03:08  Caring for “the people”
09:08  Stewards and custodians of data
14:10  Servant leadership
16:57  CISOs as caretakers
18:53  Doing the right thing
21:18  CISO code of conduct - or lack thereof
24:55  How do we fix this? 
29:06  It’s nice to be nice
 
Links:
Stay in touch with Randy Potts on <a href='https://www.linkedin.com/in/randolphp/'>LinkedIn </a> 
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at<a href='https://www.axonius.com/'> Axonis</a>

In this episode of The Cyber Ranch Podcast, Allan is joined by the CISO at Real Time Resolutions, Randy Potts. The two sit down to have a refreshing and raw conversation about the caretaking, responsibility, and code of ethics for CISOs - or lack thereof, and how to get back in touch with our “why” and mission. 
 
Disclaimer: This episode briefly mentions pornography and gambling within an important and relevant context, and has therefore been categorized as explicit. 
 
Key Takeaways:
01:43  Randy’s bio
03:08  Caring for “the people”
09:08  Stewards and custodians of data
14:10  Servant leadership
16:57  CISOs as caretakers
18:53  Doing the right thing
21:18  CISO code of conduct - or lack thereof
24:55  How do we fix this? 
29:06  It’s nice to be nice
 
Links:
Stay in touch with Randy Potts on <a href='https://www.linkedin.com/in/randolphp/'>LinkedIn </a> 
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at<a href='https://www.axonius.com/'> Axonis</a>

thecyberranchpodcast.podbean.com/29eeeb09-a164-3246-9efb-d1b23eb3ef12

In this episode of The Cyber Ranch Podcast, Allan is joined by the CISO at Real Time Resolutions, Randy Potts. The two sit down to have a refreshing and raw conversation about the caretaking, responsibility, and code of ethics for CISOs - or lack thereof...

CISOs as Caretakers w/ Randy Potts

In this episode, Allan is joined by David Belanger, CISO at Maxor National Pharmacy, to talk about the challenges of breaking into cybersecurity. David discusses the importance of establishing mentor/mentee relationships in the community, why building a personal brand and expanding your network is a must when finding work, and tips for newcomers looking to break into the field. Lastly, the two touch on the power of visualization and staying humble throughout your career journey.
 
Key Takeaways: 
01:27  Bio & CISO life
02:57  Let’s define Mentor/Mentee
04:21  What makes cybersecurity mentorship unique?
07:10  Developing a long & short-term strategy 
13:16  Mentors are essential
18:05  Formal vs. organic mentorships
22:10  Get out of your comfort zone
25:55  Advice for newcomers
30:15  Visualizing your success
32:00  Staying humble
 
Links: 
Stay in touch with David Belanger on <a href='https://www.linkedin.com/in/dbelanger1/'>LinkedIn </a> 
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at<a href='https://www.axonius.com/'> Axonius</a>

thecyberranchpodcast.podbean.com/b93ea66b-8c4a-3397-9fb1-befbc6e250da

In this episode, Allan is joined by David Belanger, CISO at Maxor National Pharmacy, to talk about the challenges of breaking into cybersecurity. David discusses the importance of establishing mentor/mentee relationships in the community, why building a ...

Cyber Mentoring w/ David Belanger

In this episode, Allan invites Mark Butler, an Advisory CISO at TRACE3, to talk about tech stack rationalization and how to get the most out of your technology investment. Mark shares advice on everything from how to properly analyze, identify, and consolidate your tools, both in the stack and cloud environment, to coaching your application specialists on embracing change. 
 
Key Takeaways
01:10  Bio
02:36  What is tech stack rationalization?
03:46  Where to get started
06:20  Evaluation - a 3 prong approach
08:08  The security architecture alignment
10:51  What about contractual obligations?
13:18  The “best of breed” strategy 
17:37  Rationalizing the cloud 
21:00  Data analysis - tooling, extraction, metrics
25:24  The 3rd party tool conundrum 
27:50  The future of cloud rationalization 
29:40  How to resolve tech overlap?
32:19  Embracing change
34:37  Mark’s advice on emotional intelligence
 
 
Stay in touch with Mark Butler on <a href='https://www.linkedin.com/in/markabutler/'>LinkedIn</a>  
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'>Axonius</a>

thecyberranchpodcast.podbean.com/b1f801c3-7c4b-364d-894b-145b078d9932

In this episode, Allan invites Mark Butler, an Advisory CISO at TRACE3, to talk about tech stack rationalization and how to get the most out of your technology investment. Mark shares advice on everything from how to properly analyze, identify, and conso...

Rationalizing the Tech Stack w/ Mark Butler

In this episode, Allan is joined LIVE on stage at FutureCon Dallas 2022 by U.S Bank Senior Cloud Penetration Tester, co-author of The Pen Tester Blueprint, podcast host, and college instructor, Phillip Wylie. Phillip journeys into his past to share how he went from pro wrestler to pentester, gives writing advice to future authors in the field, explores the art of pentesting, and the best starter certifications for pentesters. Lastly, Phillip explores the best advice he’s ever received and the dangers of burnout. 
 
Key takeaways: 
01:27  Phillip's origin story - wrestling men and bears
03:04  The Pwn School Project
04:47  The Hacker Factory Podcast
06:55  Always a way to cyber
10:18  An opportunity to write
14:08  The Art of Pentesting
17:19  Getting square on terminology
24:42  The limitless child
27:25  The skinny on certs
30:23  Mentors
35:06  Back in the pentesting lab
37:14  When does threat modeling factor?
43:50  Coloring in purple
 
Follow Phillip Wylie on<a href='https://www.linkedin.com/in/phillipwylie/'> LinkedIn</a> and<a href='https://twitter.com/PhillipWylie'> Twitter</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'>Axonius</a>

In this episode, Allan is joined LIVE on stage at FutureCon Dallas 2022 by U.S Bank Senior Cloud Penetration Tester, co-author of The Pen Tester Blueprint, podcast host, and college instructor, Phillip Wylie. Phillip journeys into his past to share how he went from pro wrestler to pentester, gives writing advice to future authors in the field, explores the art of pentesting, and the best starter certifications for pentesters. Lastly, Phillip explores the best advice he’s ever received and the dangers of burnout. 
 
Key takeaways: 
01:27  Phillip's origin story - wrestling men and bears
03:04  The Pwn School Project
04:47  The Hacker Factory Podcast
06:55  Always a way to cyber
10:18  An opportunity to write
14:08  The Art of Pentesting
17:19  Getting square on terminology
24:42  The limitless child
27:25  The skinny on certs
30:23  Mentors
35:06  Back in the pentesting lab
37:14  When does threat modeling factor?
43:50  Coloring in purple
 
Follow Phillip Wylie on<a href='https://www.linkedin.com/in/phillipwylie/'> LinkedIn</a> and<a href='https://twitter.com/PhillipWylie'> Twitter</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'>Axonius</a>

thecyberranchpodcast.podbean.com/a283875d-07bc-38e3-ba16-dfdc364f9b93

In this episode, Allan is joined LIVE on stage at FutureCon Dallas 2022 by U.S Bank Senior Cloud Penetration Tester, co-author of The Pen Tester Blueprint, podcast host, and college instructor, Phillip Wylie. Phillip journeys into his past to share how h...

Penetration Testing Programs LIVE w/ Phillip Wylie

Allan is joined by Yaron Levi, CISO at Dolby, to talk about the SOC and why we are going about it all wrong. Allan and Yaron identify and examine the three main areas of concern: the data, the analyst, the analysis – and how to improve upon them. Lastly, Yaron shares his thoughts on what steps and approaches need to be taken in order to successfully accomplish the SOC’s goal.  
 
Key Takeaways:
01:35  Bio
02:36  What are we doing wrong in the SOC?
06:54  Hypothesizing
11:22  How much gets left out when we make a hypothesis?
13:42  Anti-fragility & business outcomes
16:30  Business objective + threat model example
21:09  Lead with the why/ downstream applications
27:06  What outside influence has helped you inside cyber?
 
Learn more about Yaron on <a href='https://twitter.com/0xL3v1'>Twitter</a> and  <a href='https://www.linkedin.com/in/yaronrl/'>LinkedIn</a>
Follow<a href='https://allanalford.com/'> Allan Alford</a> on<a href='https://linkedin.com/in/allanalford'> LinkedIn</a> and<a href='https://twitter.com/AllanAlfordinTX'> Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the<a href='https://store.hackervalley.com/'> Hacker Valley Store</a>
Learn more about<a href='https://hackervalley.com/'> Hacker Valley Studio</a> and<a href='https://hackervalley.com/cyberranch'> The Cyber Ranch Podcast</a>
Sponsored by our good friends at<a href='https://www.axonius.com/'> Axonius </a>

thecyberranchpodcast.podbean.com/35b7fa74-5f1d-3210-9ff6-0b5bad2185bf

Allan is joined by Yaron Levi, CISO at Dolby, to talk about the SOC and why we are going about it all wrong. Allan and Yaron identify and examine the three main areas of concern: the data, the analyst, the analysis – and how to improve upon them. Lastly,...

What We’re Doing Wrong in the SOC w/ Yaron Levi

Allan is joined by Rafal Los, industry innovator, strategist, and personality. His career spans 20+ years while working inside companies from the Fortune 10 to a firm of less than 10. Additionally, Rafal is a founder and host of the Down the Security Rabbithole Podcast - an industry podcast delivering a weekly take on cybersecurity since 2011. Join Allan and Rafal as they discuss cyber security centers of excellence, metrics, marketing and acceptance in this conversation between two friends.
 
Key Takeaways:
01:56 Bio
04:27 Goals for Cybersecurity Center of Excellence (CoE)
06:44 How do you birth a Cybersecurity CoE?
09:45 Selling your service
15:18 Cost - who pays in the end and how?
17:10 Getting management on board
24:22 It’s not all about cost – but it is.
26:37 Metrics
31:05 Quality metrics
34:33 Your mess for less
38:02 What is something outside cyber that helps on the inside?
 
Links:
Follow <a href='https://allanalford.com/'>Allan</a> on <a href='https://www.linkedin.com/in/allanalford/'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Follow Rafal Los on <a href='https://www.linkedin.com/in/rmlos/'>LinkedIn</a> and <a href='https://twitter.com/Wh1t3Rabbit?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor'>Twitter</a>
Check out his <a href='http://podcast.wh1t3rabbit.net/'>podcast</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://axonius.com/'>Axonius</a>

thecyberranchpodcast.podbean.com/e44bce5f-2d2b-3df2-bfa9-7f2066fdf57f

Allan is joined by Rafal Los, industry innovator, strategist, and personality. His career spans 20+ years while working inside companies from the Fortune 10 to a firm of less than 10. Additionally, Rafal is a founder and host of the Down the Security Rab...

Cybersecurity Centers of Excellence w/ Rafal Los

Join Allan as he discusses investing in cybersecurity startups with the perfect guest for the subject: Kathy Wang, CISO at Very Good Security, investor at Silicon Valley CISO Investments, investor at Firebolt Ventures, and former founder as well!
Allan and Kathy talk about investment goals, the process from start to finish, how to get started, the buy-in costs, returns, what to expect, partnering, etc.
Join them as they dive into this fascinating topic:
DISCLAIMER: NOBODY ON THIS SHOW IS A FINANCIAL ADVISOR OR PLANNER, AND NOTHING SAID ON THIS SHOW CONSTITUTES FINANCIAL ADVICE. OPINIONS EXPRESSED ON THIS SHOW ARE JUST THAT – OPINIONS – AND YOU SHOULD NOT USE THEM TO CONDUCT YOUR FINANCIAL AFFAIRS. CONSULT A LICENSED EXPERT INSTEAD OF US!
 
Key Takeaways:
02:14 Bio
02:54 Getting into cyber security investing
05:28 Spotting good investments
09:13 What’s the process?
15:15 Ranging investments | partnerships
22:35 29 no's and 1 yes – is that reality?
26:20 Seeking investment? Start here.
29:31 Be willing to work with other people
30:57 What is something from outside of infosec that helped you in infosec?
 
Links:
Follow Kathy Wang on <a href='https://www.linkedin.com/in/kathywang/'>LinkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'>Axonius</a>

thecyberranchpodcast.podbean.com/e7943b6e-91d1-36c1-bcae-ad4c4934a31a

Join Allan as he discusses investing in cybersecurity startups with the perfect guest for the subject: Kathy Wang, CISO at Very Good Security, investor at Silicon Valley CISO Investments, investor at Firebolt Ventures, and former founder as well!
Allan a...

Investing in Cybersecurity Startups w/ Kathy Wang

In this special episode, Allan invites a few familiar voices back to the show, conducts a countdown of his Top 5 most popular shows, and reviews some of the most common guest responses. Lastly, Allan issues some important thank you's and shares a few comments and feedback from the listeners.
 
Highlights:
Top 3 guest answers to "What keeps you going in cybersecurity?"
Top 3 guest answers to "What surprises you the most in cybersecurity?"
Top 5 shows by download
 
Visits from:
Tim Rohrbaugh, CISO - Jet Blue
Chris Cochran & Ron Eddings - Hacker Valley Media
Drew Brown, who has held many security leadership roles and who is an avid user of the FAIR methodology of risk measurement
Richard Seiersen, former CISO, famed champion of measuring risk, and author of "The Metrics Manifesto: Confronting Security with Data"
Accidental CISO of Twitter fame
 
THANK YOU to all of our listeners, Hacker Valley Media, our fantastic guests, and to everyone who helped get us to 50 shows!!!
 
Links:
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.axonius.com/'>Axonius</a>

thecyberranchpodcast.podbean.com/8f1ca171-0553-38ec-93ee-f6ffe06660ef

In this special episode, Allan invites a few familiar voices back to the show, conducts a countdown of his Top 5 most popular shows, and reviews some of the most common guest responses. Lastly, Allan issues some important thank you's and shares a few com...

50th Episode Special w/ Many Guests

Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minimum Viable security, tactical frameworks, the challenges with large frameworks, and the challenges of competing frameworks.
This show was recorded after happy hour and the audience and participants both imbibed.  It's a rowdy show and features some explicit content.
 
Key Takeaways:
0:00 Allan’s holiday greeting
0:39 Allan introduces the live show, guests and issues a disclaimer about naughty language
2:02 Chris Roberts on Minimum Viable Security
2:42 Cecil on his love/hate relationship with compliance and the need for weighting controls
4:25 Allan proposes “tactical frameworks”
5:38 Chris challenges the crowd on their asset management successes
7:43 Allan introduces “See it, manage it, secure it.” (Which he flagrantly stole from Steve Williams @ NTT DATA Services)
8:53 Cecil says: data discovery comes before DLP
10:17 Chris challenges Allan’s idea that MFA should “just happen” in order to capture at least 90% of ransomware threats
12:07 Cecil proposes a compromise – 30% of controls meet a higher CMMI requirement than the 70%
13:48 Chris says even the 30% are not even being met in most environments
14:56 Allan’s full proposal on a tactical framework (that includes Chris’ emphasis on asset management)
16:07 Chris states that we have to agree on the subset frameworks in order to achieve success.  Diverse frameworks actually harm the industry.
17:56 Chris challenges the crowd to hire interns and those new to the industry
20:02 Allan misattributes the total control count in NIST CSF.  We mentioned whiskey, right?
21:35 Barring regulated environments, Allan doubles down on his tactical framework idea
22:13 Chris says we must challenge the authors of all these frameworks
22:50 Allan points out that frameworks are implicitly behind the fast pace of the industry after going through committee
23:53 Chris criticizes the notion that compliance = security
24:57 Insurance carriers insist now upon framework compliance and are getting smarter
26:53 Chris says full compliance with a framework even still is useful only as a point in time exercise
28:22 We have to simplify compliance
28:59 Allan proposes SBOM, CMMC-like maturity awareness, and the shared responsibility model as the solution to the compliance problem
30:57 Chris says that will take ten years to sort out
31:49 Chris says “take the money out of compliance”
35:37 Cecil talks about self-attestation and standards that are needed on auditing processes
 36:41 Allan says frameworks exist in the first place with the goal of getting secure
37:14 Chris disagrees and states (using naughty metaphors) that frameworks compete out of hubris
38:26 An audience member suggests “trust but verify” as the reason frameworks exist in the first place
41:24 Cecil deconstructs the practicality of shared responsibility, extending it into the business
43:28 Chris proposes working with insurance companies to create a consolidated or tactical framework
 
Links:
Chris Roberts - <a href='https://www.linkedin.com/in/sidragon1/'>LinkedIn</a>
Cecil Pineda - <a href='https://www.linkedin.com/in/ceciltheciso/'>LinkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
 
Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

thecyberranchpodcast.podbean.com/0f8c289d-c52a-3ddf-841b-516c714fea63

Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minim...

Minimum Viable Security w/ Chris Roberts & Cecil Pineda: EXPLICIT CONTENT

In this episode, Allan is joined by Marnie Wilking, CISO at Wayfair. Marnie has directed Information Security and multi-discipline Risk Management Programs for more than 15 years --  providing a unique set of skills and experience to manage operational risks and improve risk management among diverse businesses. Join Allan and Marnie as they define organizational resilience, discuss its goals and enablers, and analyze the COVID pandemic through its lens.
 
Key Takeaways:
01:26  Bio
03:42  Organizational resilience
06:40  COVID benefits; business enabling?
09:47  Building hybrid work environments
11:11  Virtual offices and home fatigue
17:14  Bullets dodged in organizational resilience
20:51  Tabletop exercises
27:16  Office conflicts and mailing troubles
30:38  Communication in resilience
32:29  What surprises Marnie in cyber security?
 
Links:
Learn more about Marnie on <a href='https://www.linkedin.com/in/marnie-huss-wilking/'>LinkedIn</a> and <a href='https://www.crunchbase.com/person/marnie-wilking'>Crunchbase</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

thecyberranchpodcast.podbean.com/fc0f63d8-5f57-3d3c-a999-a378a7163c64

In this episode, Allan is joined by Marnie Wilking, CISO at Wayfair. Marnie has directed Information Security and multi-discipline Risk Management Programs for more than 15 years --  providing a unique set of skills and experience to manage operational r...

Organizational Resilience w/ Marnie Wilking

Welcome to another live show of the Cyber Ranch! Allan is joined by Dan Doggendorf, a creative cybersecurity leader with a passion for simplicity, efficiency, accountability, common sense, and honesty. The duo discusses the ins and outs of being a VCISO, how one walks the path and what the industry can do to make this role better. This show was conducted at the Cybersecurity Conference 9 (CSC 9) conducted by the North Texas Chapter of ISSA. All proceeds from the event went directly to scholarships for the Collin College cybersecurity program.
 
Key Takeaways:
 
01:47 - Bio
02:33 - vCISO life
04:18 - The path to an independent contractor
07:46 - Should you specialize?
10:46 - Strategizing experience in cyber security
14:26 - Challenges of being a CISO & vCISO
19:04 - Staying connected as a vCISO
23:17 - Victories as a vCISO                       
27:06 - The bad times and mistakes made as a vCISO
29:52 - What should change for vCISOs?
30:51 - Advice for future vCISOs
34:09 - What surprises Dan in cyber security?
 
Links:
Learn more about Dan on <a href='https://www.zintro.com/profile/dan-doggendorf'>Zintro</a> and <a href='https://www.linkedin.com/in/dandoggendorf'>LInkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

thecyberranchpodcast.podbean.com/4840d042-a512-3bc4-816e-808e0264a653

Welcome to another live show of the Cyber Ranch! Allan is joined by Dan Doggendorf, a creative cybersecurity leader with a passion for simplicity, efficiency, accountability, common sense, and honesty. The duo discusses the ins and outs of being a VCISO,...

The vCISO Life w/ Dan Doggendorf

This week, Allan is joined by Frederick Lee aka “Flee”, Chief Security Officer and Head of IT at Gusto, Jeff Man, host of Security & Compliance Weekly, and notorious infosec curmudgeon, and by Kat Valentine, Security and Compliance Weekly co-host.  A few weeks ago Allan appeared on their show to discuss “GRC: ‘What?’ and ‘So What?’.  In that episode, found <a href='https://securityweekly.com/shows/governance-risk-compliance-so-what-part-1-allan-alford-scw-94/'>here</a>, they take a deep dive into GRC in terms of understanding is purpose and value.
In this crossover episode, the group continues the conversation to talk about “GRC: ‘Now what?’ (The cultural impact and implementation, risk register, achieving actionable results and much more).
Join Allan and the Security & Compliance Weekly team as they dive into overcoming cultural barriers, a continued conversation on the order of priority (“RGC” vs. “GRC”, for example), and enlisting allies in the business.
 
Key Takeaways:
2:20 Implementing GRC culturally – Flee's take
4:13 Jeff’s take
6:16 Kat’s take
10:43 The CISO – Turning compliance data into actionable results – Jeff’s take as an assessor
13:56 Kat’s take as an assessor
15:41 Flee’s take as a CISO
21:13 Understanding perspectives from all parties
28:10 Sharing problems upstream/Audits vs. Assessments
34:48 Flee’s take on “governance vs. doctrine”
37:43 Risk register – training for self sufficiency
42:40 Get in touch!
 
Links:
Check out <a href='https://securityweekly.com/category-shows/security-and-compliance-weekly/'>Security and Compliance Weekly</a>!
Follow Flee on <a href='https://www.linkedin.com/in/fredrickdlee/'>LinkedIn</a> and <a href='https://twitter.com/fredrickl'>Twitter</a>
Follow Jeff Man on <a href='https://www.linkedin.com/in/jeffreyeman/'>LinkedIn</a> and <a href='https://twitter.com/mrjeffman'>Twitter</a>
Follow Kat Valentine on <a href='https://www.linkedin.com/in/kjvalentine/'>LinkedIn</a>
Follow Allan Alford on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/allanalfordintx'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

thecyberranchpodcast.podbean.com/2b2a7234-4f6c-39c2-8220-d93454bd4256

This week, Allan is joined by Frederick Lee aka “Flee”, Chief Security Officer and Head of IT at Gusto, Jeff Man, host of Security & Compliance Weekly, and notorious infosec curmudgeon, and by Kat Valentine, Security and Compliance Weekly co-host.  A few...

GRC: ”Now What?” w/ Security & Compliance Weekly

CISOs complain on social media about bad marketing – when they are targeted inappropriately, or with messages that don’t resonate, or with messages that outright lie. This week Allan Alford decides to hear from the other side, and invites his two favorite CMOs to the show. Julie O’Brien, CMO at AttackIQ, and Nathan Burke, CMO at Axonious, sit down with Allan to send a message to cyber security professionals about the vital role marketing plays in the industry, what is good marketing and bad marking, and how marketing affects all of our careers more than we know. Hear different perspective on topics like buzzwords, cold calls, and the difference between good and bad marketing practices. Backed up with proven experience, this episode is packed with useful info for all cyber practitioners and aspiring practitioners.
 
 Key Takeaways:
02:00 Julie Bio
03:13 Nathan Bio        
04:00 Standing out as a marketer
10:15 Emphasizing what you don’t do as a company, rather than what you do
15:56 A message to CISO’s - Julie
23:00 Nathan’s message to CISO’s
25:55 Allan touches on why innovation occurs on the vendor side
27:45 Buzzwords
33:50 What surprises Nathan and Julie in cyber security?
Links:
Learn more about Nathan on <a href='https://www.linkedin.com/in/nathanwburke/'>LinkedIn</a> and <a href='https://twitter.com/nathanwburke'>Twitter</a>
Check out Julie on <a href='https://www.linkedin.com/in/obrienjuliea/'>LinkedIn</a> and <a href='https://twitter.com/julieaobrien'>Twitter</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

thecyberranchpodcast.podbean.com/63902291-53bf-3154-a2a3-335fdcd9e867

CISOs complain on social media about bad marketing – when they are targeted inappropriately, or with messages that don’t resonate, or with messages that outright lie. This week Allan Alford decides to hear from the other side, and invites his two favorit...

The CMO‘s Perspective w/ Nathan Burke and Julie O‘Brien

Brian Castagna (CISO at Seven Bridges - a genomics company) is a CISO with a proven track record of successfully building information security programs at cloud technology companies. He is on a mission to humanize the new work environment - our own home. Join Allan and Brian as they touch on transitioning from an office environment, both mentally and physically, hiring remotely, work/life balance and much more.
 
Key Takeaways:
01:33 Bio
02:22 Remote work
03:00 Hiring a remote workforce
10:50 What’s the human side of working from home?
17:38 Transitioning from work to home
19:54 Mental transitioning
21:00 Collaboration & strategy
24:30 Layering the human back in
27:19 What surprises you in cyber?
 
Learn more about Brian on <a href='https://www.linkedin.com/in/brian-castagna-1890544/'>LinkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

thecyberranchpodcast.podbean.com/05aed4d2-d8e6-3400-92b9-5c8f3c32b1c3

Brian Castagna (CISO at Seven Bridges - a genomics company) is a CISO with a proven track record of successfully building information security programs at cloud technology companies. He is on a mission to humanize the new work environment - our own home....

Practical Working (And Hiring!) from Home w/ Brian Castagna

This week, Allan is joined by some serious heavy hitters in cyber. Richard Struse (Director for the Center for Threat-Informed Defense at MITRE Engenuity), Jonathan Baker (Director of Research & Development, Center for Threat-Informed Defense at MITRE Enginuity), and Jonathan Reiber (Sr. Director for Cybersecurity Strategy and Policy @ AttackIQ). The four are here to have a conversation about CISA's new BOD that outlines 290 key vulnerabilities that require focus, the coincidental mapping of the CVE database to MITRE ATT&ACK, and the implications for all of us.  Of special note is the fact that ATT&CK is already mapped to NIST SP 800-53, meaning that we now have an opportunity to move bi-directionally from a threat-informed defense or to start with a framework and back into vulnerabilities. The implications for our industry are huge.
They also discuss briefly an overview of the bi-partisan work in both the Executive and Legislative branches to further cybersecurity interests and the release of CMMC v 2.0. This show is packed.
 
Key Takeaways:
01:58 Backgrounds
04:02 CISA – BOD 22-01, highlighting the key 290 known vulnerabilities
07:45 Helping organizations prioritize vulnerabilities
11:31 Starting with either framework or threats: Which is better?
14:18 Seeing through the politics - What is actually happening behind the scenes?
19:07 Developing the mapping
23:54 Since the invention of CVE
26:14 CMMC v 2.0
29:37 How do we change the game?
31:09 Getting a large organization to agree with vulnerability prioritization
 
Links:
Follow Richard Struse on <a href='https://www.linkedin.com/in/richard-struse/'>LinkedIn</a>
Keep up with Jon Baker on <a href='https://www.linkedin.com/in/jonathanobaker/'>LinkedIn</a>
Follow Jonathan Reiber on <a href='https://www.linkedin.com/in/jonathan-reiber-0141158/'>LinkedIn</a> & his <a href='https://www.jonathanreiber.com/'>website</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/show/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://attackiq.com/'>Attack IQ</a>

thecyberranchpodcast.podbean.com/0b60e28f-c60c-38a0-85e7-3ca959527a1c

This week, Allan is joined by some serious heavy hitters in cyber. Richard Struse (Director for the Center for Threat-Informed Defense at MITRE Engenuity), Jonathan Baker (Director of Research & Development, Center for Threat-Informed Defense at MITRE En...

Threat-Informed Defense, CISA, CVEs and ATT&CK w/ MITRE Engenuity

Mustapha Kebbeh, CISO at Brinks and heavy-hitter in the Dallas/Fort Worth Cyber community, joins Allan again this week as they cover a topic Mustapha noted was absent so far in the series…  Namely, “What is a day in the life of a CISO?” Mustapha and Allan get into details of what they do and don’t do, what their teams do and don’t do, what bits are boring, what bits are surprising, and what bits are the most fun. Join them as they talk about real situations and practical solutions while describing the very best and worst parts of the job.
Key Takeaways:
01:41                     Bio
03:00                     A day in the life of a CISO - examples from the last 3 weeks
07:30                     Being a CISO in a company that knows its risk appetite
11:49                     Product Security
13:53                     The most surprising part about being a CISO
15:33                     The most boring part
22:30                     The most fun part
26:08                     What do you wish you could do as a CISO?
29:42                     Mustapha shares what surprises him the most in cyber security
 
Links:
Learn more about Mustapha on <a href='https://www.linkedin.com/in/mustaphakebbeh/'>LinkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

thecyberranchpodcast.podbean.com/5330ece5-22c3-309a-b79e-3ea99b9562e9

Mustapha Kebbeh, CISO at Brinks and heavy-hitter in the Dallas/Fort Worth Cyber community, joins Allan again this week as they cover a topic Mustapha noted was absent so far in the series…  Namely, “What is a day in the life of a CISO?” Mustapha and Alla...

A Day in the Life of Two CISOs w/ Mustapha Kebbeh

Omar Khawaja is an experienced CISO with a strong technical background, who managed to find some very creative ways to manage his security program that go against his engineering instincts. Join Allan and Omar as they discuss why trust-based security is the more suitable option to have a fundamentally better security program and team.  Hear why Omar and Allan believe that investing in people will pay far more dividends than the latest tech tool.  And more importantly, gain some very practical and concrete tips for managing and measuring your security program.
 
Key Takeaways:
01:19                     Bio
03:26                     What is wrong with tech-centric security?
06:00                     Using tech tools as nothing more, and using them appropriately
12:22                     Trust, then risk, then control
14:30                     Customer first, always
19:02                     Helping foster a trust-centric culture
28:40                     Culture = mindset = best measurable quality
29:33                     What surprises Omar in cyber security?
32:50                     The “change agent network”
 
Links:
Learn more about Omar on <a href='https://twitter.com/smallersecurity'>Twitter</a> and <a href='https://www.linkedin.com/in/smallersecurity/'>LInkedIn</a>
Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

thecyberranchpodcast.podbean.com/3bfc38ce-1041-3638-b5d8-9e5c0fbe4ccb

Omar Khawaja is an experienced CISO with a strong technical background, who managed to find some very creative ways to manage his security program that go against his engineering instincts. Join Allan and Omar as they discuss why trust-based security is ...

Practical Trust-Centric Security w/ Omar Khawaja

Allan is joined this week by Emilio Escobar, CISO at Data Dog and former VP of Information Security at Hulu. He is also a long-term developer of Ettercap, a comprehensive suite for man-in-the-middle attacks.
Like many of us, Emilio started his journey in infosec as a hacker kid, exploring the world through modems and BBSs. Emilio is not a security vendor CISO, but is a CISO for a company that is in the supply chain for many other companies. He has to balance internal and external duties as a result.
Come listen as Allan and Emilio discuss the B2B CISO life, the skills required, business alignment, facing customers, and how all of these skills just might define "the modern CISO".
And, yes, they even tackle the age-old question, "How technical should a CISO be?"
 
Key Takeaways:
01:27 Bio
03:10 Security questionnaires and interactions
05:49 Is there a fix to solving vendor risk?
07:17 Utilizing machines for questionnaires
09:33 Leveraging skills
12:50 How technical should a CISO be?
18:01 Understanding other roles in the business
23:48 Balancing internal and external customers
28:17 What surprises you the most in cybersecurity?
 
Links:
Learn more about Emilio on <a href='https://www.linkedin.com/in/emilioesc/'>LinkedIn</a>, and <a href='https://twitter.com/eaescob'>Twitter</a>, and learn about <a href='https://www.ettercap-project.org/'>Ettercap</a>
Follow <a href='https://allanalford.com'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

Allan is joined this week by Emilio Escobar, CISO at Data Dog and former VP of Information Security at Hulu. He is also a long-term developer of Ettercap, a comprehensive suite for man-in-the-middle attacks.
Like many of us, Emilio started his journey in...

CISO in the Supply Chain w/ Emilio Escobar

Allan is joined by Sounil Yu, one of cybersecurity's most well-known contributors. Sounil has a long history in cybersecurity, and is also the inventor of The Cyber Defense Matrix and the DIE Triad.
Sounil and Allan discuss cyber resilience and contrast it with "antifragility", a notion introduced by Nassim Nicholas Taleb. Sounil argues that in cybersecurity, antifragility should be the goal, and not resilience.
Antifragility allows for stronger data protection, as it does not just survive stresses and attacks, but actually encourages them. Sounil explains how antifragility also neatly dovetails with his DIE (Distributed, Immutable, Ephermeral) Triad of data protection, which he contrasts with the CIA (Confidentiality, Intregrity, Avaiability) Triad in the context of the "pets vs. cattle" model.
Join Allan as he learns a great deal in a short amount of time from Sounil...
 
Key Takeaways:
01:23 Bio
02:20 Cyber Defense Matrix
03:10 Is cyber resilience the wrong idea?
04:17 Backups do not equal resilience
05:58 What is antifragility?
09:31 The DIE Triad
14:32 Pets vs. Cattle
18:12 Practical implementation?
20:40 Focusing on recovery
24:28 The Barbell Strategy
27:58 What surprises you in cyber security?

Links:
Learn more about Sounil on <a href='https://www.linkedin.com/in/sounil/'>LinkedIn</a>, and <a href='https://twitter.com/sounilyu'>Twitter</a>, and learn about the <a href='https://cyberdefensematrix.com/'>Cyber Defense Matrix</a>
Follow <a href='https://allanalford.com'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

Allan is joined by Sounil Yu, one of cybersecurity's most well-known contributors. Sounil has a long history in cybersecurity, and is also the inventor of The Cyber Defense Matrix and the DIE Triad.
Sounil and Allan discuss cyber resilience and contrast ...

Is Resilience Even the Goal? Antifragility w/ Sounil Yu

Allan's guest this week is Erik Bloch. Erik Bloch is a cyber security leader, influencer, and pioneer. He currently sits as Senior Director of Detection and Response at Sprinklr, but has held many rolls in cybersecurity, including being a product manager for SIEM products more than once. 

This last point is relevant, because it makes it even more surprising that Erik is convinced that the SOC's utility has passed... 

Join Allan and Erik as they dive deep into why he thinks SOC is failing, the alternatives, what it takes to make an impactful change in incident response, and who to aim it towards. 

This conversation began when Allan read Erik's article on LinkedIn, “RIP SOC. Hello D-IR". 

Key Takeaways: 

01:16 Bio 
02:18 Erik’s article: why is SOC failing? 
05:01 What is the alternative? 
07:29 Implementing fundamentals where it counts 
10:15 Cloud Integration 
17:45 Cloud agnostic tooling solution 
23:27 The inevitability of a one-stop solution 
27:20 Targeting the right audience 
28:17 What surprises Erik in cyber security? 
30:24 Letting go is not easy 

Links: 

Learn more about Erik on <a href='https://www.linkedin.com/in/erikbloch/'>LinkedIn</a>, and <a href='https://twitter.com/ejbloch'>Twitter</a>, and read his <a href='https://www.linkedin.com/pulse/rip-soc-hello-d-ir-erik-bloch/'>LinkedIn article</a>
Follow <a href='https://allanalford.com'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>
Purchase a Cyber Ranch Podcast T-Shirt at the <a href='https://store.hackervalley.com/'>Hacker Valley Store</a>
Learn more about <a href='https://hackervalley.com'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>
Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

Allan's guest this week is Erik Bloch. Erik Bloch is a cyber security leader, influencer, and pioneer. He currently sits as Senior Director of Detection and Response at Sprinklr, but has held many rolls in cybersecurity, including being a product manager...

Is the SOC Dead? w/ Erik Bloch

Allan's guest is Samara Williams, Manager of Threat Operations at Cardinal Health, speaker, advocate and passionate member of the threat intelligence community.



Samara broke into cyber via a rotational program, sampling many cyber jobs at many cyber companies in a short order - a fantastic start in cyber that turbocharged her maturity and experience. She quickly developed a passion for threat intelligence, and has worked in that space ever since.



Join Samara and Allan for a deep dive into threat intel, its pros and cons, its value, and its potential...



Key Takeaways:



01:28 Bio


02:56 The love/hate relationship with threat intel: yay or nay?


06:07 The steps to threat intel – breaking it dow


15:14 How threat intel can help bridge tactical & operational Practices


19:57 Having a successful SOC program


22:18 Managing the unknown and practicing the fundamentals


26:17 Making a case for prioritizing threat intel


27:55 What surprises Samara in cyber security?



Links:



Learn more about Samara on <a href='https://www.linkedin.com/in/samara-r-williams-%F0%9F%94%B8%EF%B8%8F-9aa24247/'>LinkedIn</a>, and check out her <a href='https://www.ted.com/talks/samara_williams_k33p_y0ur_hit_s_fe'>TedX talk</a>

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

Allan's guest is Samara Williams, Manager of Threat Operations at Cardinal Health, speaker, advocate and passionate member of the threat intelligence community.

Samara broke into cyber via a rotational program, sampling many cyber jobs at many cyber com...

The Value of Threat Intelligence w/ Samara Williams

This week, Allan is joined by Bryan Hurd. Bryan is a multi-talented cyber security professional who has founded and operated programs dating back to the early nineties. Currently Chief of Office for Stroz Friedberg (AON Cyber), he started his career in NCIS, founding the Navy’s first ever cyber counterintelligence program in 1993.



Join Bryan and Allan for a masterclass on ransomware, incident response, and preparedness. Having both consulted on ransomware situations many times, they offer a wealth of practical tips, do’s, don’ts, and gotchas. You can also hear their perspectives on the roles and processes in taking appropriate action when crisis hits.



This is a longer than usual episode, but that is because it is filled with practical advice based on a great deal of experience.



Key Takeaways:



01:20Bio


02:58Is ransomware still the #1 threat to an organization?


07:30Having your incident response team ready and prepared


12:16The roles, processes, and fundamentals of incident response


22:57Modern ransomware extortion components


25:01Encryption & decryption – dealing both strategically


27:10Using software provided by attackers


30:18Response as an executive – being transparent


35:02Public communications


38:41What surprises Bryan in cyber security?



Links:



Learn more about Bryan on <a href='https://www.linkedin.com/in/bryanhurd/'>LinkedIn</a> and on <a href='https://twitter.com/bryan_e_hurd'>Twitter</a>

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

This week, Allan is joined by Bryan Hurd. Bryan is a multi-talented cyber security professional who has founded and operated programs dating back to the early nineties. Currently Chief of Office for Stroz Friedberg (AON Cyber), he started his career in N...

Practical Realities of Ransomware Management w/ Bryan Hurd

In this episode Allan interviews his friend Sameer Sait, former CISO at Amazon, Forcepoint and Arrow Electronics, who joins Allan for a discussion about WHY we measure risk.



It is about more than just asking for money. (And who are you actually asking money from? Hint: It is not the Board).



How does risk measurement change in the beginning of the CISO’s journey vs. later when the program is more mature?



What is the goal of good risk metrics? What is the role of cyber insurance in all this? What about business traction and cooperation with other department’s goals and objectives?



And finally, how does measuring risk affect disposition or risk?



Key Takeaways:



01:20 Sammer's bio


02:30 Asking for money - it's not from the Board


05:58 Measuring risk: inside-out vs. outside-in


11:20 Approaching management with an objective, not a story


12:38 Working with your team, as a team


14:12 The effects of measuring risk


18:36Analyzing the priorities and their consequences


24:36 Good governance vs. good management


26:22 Transference, remediation, and acceptance


30:57 What surprise Sameer in cybersecurity?



Links:



Learn more about Sameer on <a href='https://www.linkedin.com/in/sameersait/'>LinkedIn</a>

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

In this episode Allan interviews his friend Sameer Sait, former CISO at Amazon, Forcepoint and Arrow Electronics, who joins Allan for a discussion about WHY we measure risk.

It is about more than just asking for money.  (And who are you actually asking ...

WHY We Measure Risk w/ Sameer Sait

Host Allan Alford interviews his friend Helen Patton, advisory CISO at Cisco, and former CISO at Ohio State University. Helen and Allan discuss the career path of the CISO – specifically what comes after the CISO role has been fulfilled - and how there is not a clear path defined for the post-CISO career.



Allan and Helen discuss several models for post-CISO life that they themselves have explored, and that other CISO friends have as well, such as: shifting back and forth from CISO to vendor, shifting back and forth between CISO and advisory CISO roles at VC’s and other entities, becoming CIOs or CTOs, etc.



Helen explains how there is no clearly defined path for a post-CISO life, how no mentors are available to aid with that transition, but also how CISOs can decide to simply change their roles as a CISO. She explains a little bit more about her advisory CISO life and the internal and emotional differences between it and a conventional practitioner CISO role.



Key Takeaways:



0:26 – Intro


1:12 – Helen briefly explains about her background in cyber and about her day job.


2:55 – Helen explains what is the post-CISO life?


5:54 – What are Helen’s thoughts on the different roles of CISOS?


9:21 – How many people are changing from CISO to a consultancy role?


11:04 – Has Helen seen anyone making such transitions and being successful over time?


12:48 – Hypothetically what would happen if there was a major technology shift, but a CISO wasn’t there to supervise it due to being in a non-practitioner role at the time. Would she be missing out on it on critical CISO skills?


15:12 – Helen explains a little bit more about her advisory CISO life.


18:07 – What happens when Helen gets approached by startups who want feedback? Does she see them as competition? Are they up for having conversations with her?


20:47 – Can a CISO become a CEO?


22:37 – Who should the CISO be reporting to and why?


25:34 – What other post-CISO activities are there for CISOS that may not be a fulltime role, such as boards, teaching, writing, speaking?


28:32 – What surprises Helen the most in cyber security?



Links:



Learn more about <a href='https://www.cisohelen.com/'>Helen</a> on <a href='https://www.linkedin.com/in/helenpatton/'>LinkedIn</a> and <a href='https://twitter.com/cisohelen'>Twitter</a>

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sponsored by our good friends at <a href='https://www.uptycs.com/'>Uptycs</a>

Host Allan Alford interviews his friend Helen Patton, advisory CISO at Cisco, and former CISO at Ohio State University. Helen and Allan discuss the career path of the CISO – specifically what comes after the CISO role has been fulfilled - and how there i...

Cyber Ranch

Latest Episodes