Adopting Zero Trust

In our final preview episode of GRC Uncensored, we explore a particularly bipolar debate: do you need a GRC tool to manage compliance, or will spreadsheets suffice?After this, we will be back to our regularly produced AZT episodes. The last episodes of our pilot for GRC Uncensored can be found on your favorite podcast app or newsletter on Substack. Hosted on Acast. See acast.com/privacy for more information.

Welcome back to Adopting Zero Trust! In this episode, hosts Elliot Volkman and Neal Dennis are joined by Rob Allen, Chief Product Officer of ThreatLocker, to dive deep into the operationalization of Zero Trust. Despite covering various aspects over three seasons, this crucial topic is addressed thoroughly.They explore pre-adoption preparation, aligning organizational actions, and the importance of education in security. Additionally, the conversation highlights the 'assume breach' perspective and how concepts like default deny and least privilege are essential. With real-world examples and anecdotes, they provide actionable insights on implementing Zero Trust strategies effectively. Tune in to learn about the foundational steps necessary to transition into a Zero Trust environment.This is the first of a three-part mini-series, so stay tuned as we explore more aspects of how to prepare your organization for adopting a Zero Trust strategy. Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 12: Could the overturning of Chevron Deference impact cybersecurity and privacy regulations?Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.Welcome back to Adopting Zero Trust or AZT. In our latest episode, we assembled a distinguished panel to dig into a timely topic affecting the cybersecurity landscape but has the fog of war wrapped around it. Today’s conversation centered around the recent developments in cybersecurity regulations and their potential impacts, ignited by the Supreme Court overturning Chevron Deference. This, of course, has other potential impacts on all regulation types enforced and shaped by federal agencies, but our focus is, of course, on cybersecurity, privacy, and AI.The PanelWe welcome back Ilona Cohen, Chief Legal and Policy Officer at HackerOne, who joined us last year to discuss the National Cybersecurity Strategy. Ilona is also the former General Counsel for OMB. We are also joined by the GRC meme king, Troy Fine, the Director of SOC and ISO Assurance Services at Gills Norton. Beyond the memes, Troy takes a practical perspective on regulations and acts as our voice for those who may be most immediately impacted.Key TakeawaysChevron Deference overturned: The Supreme Court's decision removes the requirement for courts to defer to federal agencies' interpretations of ambiguous statutes and now relies on the courts.Increased regulatory uncertainty: This ruling may lead to more challenges to existing and future regulations, potentially affecting cybersecurity and AI policies.State vs. Federal regulation: The uncertainty at the federal level might prompt states to act more quickly on issues like AI and cybersecurity, potentially creating a patchwork of regulations.Impact on AI regulation: With about 40 federal bills addressing AI in the pipeline, the ruling could complicate the process of creating comprehensive federal AI regulations.Cybersecurity implications: Existing and proposed cybersecurity regulations, such as the Cyber Incident Reporting for Critical Infrastructure Act, may face new challenges.Business concerns: While some business organizations applauded the ruling, the resulting regulatory uncertainty could be problematic for companies trying to plan and comply with regulations.Expertise concerns: There are worries that courts may lack the technical expertise to make decisions on complex technological issues like AI without deferring to agency experts.Potential for innovation: The regulatory uncertainty might create a wild west period for AI, potentially fostering innovation before more stringent regulations are imposed.Self-regulation importance: In the absence of clear federal regulations, industry self-regulation initiatives may become more significant, especially in rapidly evolving fields like AI. Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 10: Elliot chat’s with Vivek Ramachandran of SquareX about his approach to tackling the impossible: Social engineering.Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.For nearly three decades, social engineering, particularly phishing, has been one of the most impactful and financially draining cyber threats. Between security awareness training, email security gateways, generative AI, enterprise browsers, and a slew of other tech like EDRs and XDRs, social engineering has yet to be thoroughly thwarted. The reason for that is straightforward enough: social engineering is a psychological threat, not just a technological one.In our last round of interviews from RSA, we chatted with Vivek Ramachandran, the founder of SquareX, who is attempting to tackle the challenge. Vivek also walks us through a more realistic perspective of how threat actors use generative AI today, which goes beyond the more unique what-if scenarios we’ve seen in headlines in the past two years.Key TakeawaysSocial engineering and phishing attacks remain a significant threat, and everyone can be a target. The sophistication of these attacks has increased due to advances in AI.AI can craft messages that sound remarkably like someone the recipient knows, enabling rapid scalability.Social media platforms are becoming common channels for launching phishing attacks. Attackers exploit the trust that users place in these platforms and their contacts.Vivek Ramachandran's company, SquareX, deploys a browser extension that can attribute attacks and detect and block them in real-time, providing valuable information to the enterprise.Traditional technologies like Secure Web Gateways (SWG) have matured, and attackers can easily bypass them.Enterprise browsers solve the problem for a small niche group of websites but have adoption friction due to the inconvenience of having a dedicated browser. Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 8: AZT and Dr. Zero Trust have a crossover episode where we chat with reps from MITRE and OWASP about challenges associated with emerging threats.Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.Every few weeks, and occasionally every few days, we hear report of a new novel technique or zero day. Those headlines often create an unnecessary level of fear for organizations, but battle-worn cybersecurity professionals know just because it’s on a headline doesn’t necessarily mean it will impact their environment. That is because emerging threats are just that, new and novel. While zero day threats can be interesting and something to be aware of, most threat actors stick to tried and true methods.But how do we identify what is most impactful to our security posture, attack surface, or insert your other buzzy term? Threat intelligence and the collective defense. And for that, it’s time to introduce our two very equipped guests to navigate this conversation and our guest moderator:This week on AZT, we have representatives from OWASP and MITRE, with Dr Zero Trust leading the charge.The GuestsSpecial Guest ModeratorDr. Chase Cunningham - Dr. Zero Trust and Vice President of Security Market Research for G2Avi Douglen - Chair of the Global Board of Directors for the OWASP Foundation and Founder and CEO of Bounce Security.Avi is a security architect and software developer, leading development teams in building secure products for over 20 years. As a systems developer and security consultant, over the years Avi has amassed much technical knowledge and understanding of the enterprise security needs at the business level. Avi currently serves on the OWASP Global Board of Directors, and leads the Israel chapter. He is the founder and leader of the the popular AppSecIL security conference, the OWASP Threat Modeling Project, and co-authored the Threat Modeling Manifesto. He is a community moderator on Security StackExchange, and a frequent speaker at industry conferences, recent ones can be seen here.Stanley Barr - Senior Principcal Cyber Researcher for MITREDr. Stanley Barr is a three time graduate of University of Massachusetts Lowell. He has a BS in Information Sciences, an MS in Mathematics, and a PhD in Computer Science. He has coauthored published papers in malware analysis, barrier coverage problems, expert systems for network security, and robotic manufacturing. He has spoken at MILCOM, RSA, Bsides Boston, and Defcon. He has been a panelist for conferences. Panels topics have included fighting through real world computer network attacks from both external and internal threats. Currently, he is a Senior Principal Scientist at The MITRE Corporation, a not-for-profit corporation that manages six federally funded research and development centers (FFRDCs).Key TakeawaysEmerging threats are interesting, but threat modeling and understanding how systems work to identify potential issues is more impactfulAI can pose a threat due to its ability to remember and tailor information, as well as its scalability.The panel emphasized that basic security hygiene is often overlooked, such as enabling 2FA on all accounts.The OWASP Top 10 most common attack vectors are still a significant concern, but they should not be the only focus.The panel argued that responsibility for security breaches should extend beyond the CISO to the entire board and engineering organization.Cybersecurity is a people-centric challenge, and relying on people not to make mistakes is not a sustainable strategy.There is value in investing in proper security measures, as it can save organizations money in the long run. Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 6: Two seasoned cybersecurity professionals, Bryan Willett and Kris Lovejoy, shed light on the dilemma organizations face when hit by ransomware: Should they pay the ransom or not?Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.Ransomware: To Pay or Not to Pay? It’s an easy question, and we all have the same ideal answer, but how often does life throw us simplicity? Rarely.This week on Adopting Zero Trust, we continue our conversation that looked at the role cyber insurance plays in organizations and drill into one of the most challenging topics associated with it: Ransomware. And, because this is a heavy subject, we brought in two heavy hitters from past episodes to share their perspectives, Kris Lovejoy and Brian WillettTL;DRPaying ransomware ransoms is a complex decision that depends on various factors, such as the potential impact on the organization's services or employees.Having robust and tested backups is crucial in a ransomware situation, but organizations must be prepared for scenarios where ransomware affects backups.Cyber insurance can help mitigate the financial impact of ransomware attacks, but organizations should be cautious and consider all the potential outcomes.Avoiding ransomware attacks requires a proactive approach, which includes implementing hardening standards, good practices around vulnerability management, enforcing compliance on systems, and having good identity protection.AI holds promise in the cybersecurity sector, but its role in ransomware attacks is still in its infancy. Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 4: Forrester Principal Research Analyst on Zero Trust, David Holmes, shares his perspective on the current and future state of Zero Trust.Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.Zero Trust is a concept, a strategy, a philosophy, and, for some poor souls, a solution you can buy (it’s not). Through our three seasons, we have heard about MVPs, learned from the godfather of Zero Trust, been aided by Dr Zero Trust, and even heard from current and former federal officials about their stance on the concept. However, we have yet to touch on the current an future state of Zero Trust, and for that, we look to Forrester Principal Research Analyst on Zero Trust, David Holmes.Prior to joining Forrester, David spent a decade researching, writing, and speaking about cybersecurity topics for network and application security vendors. Before entering the cybersecurity space, he was a C/C++ software developer specializing in authentication and authorization, network protocols, and cryptography. So you could say he knows a thing or two about the subject at hand.TL;DRHolmes explains that Zero Trust's core principles remain unchanged: all networks are untrusted, least privilege access is enforced, and everything is inspected and monitored.The COVID-19 pandemic has accelerated the adoption of Zero Trust as organizations were forced to work remotely and faced VPN overloads.David shares his perspective on the current and future state of Zero Trust, as well as areas he would like to see the vendor market seek to solve.The biggest example of successful Zero Trust implementation is Google. Since implementing Zero Trust, no major breaches have been reported.In addition to Google, there is a smaller organization that successfully implemented Zero Trust using existing tools, indicating that Zero Trust can be achieved without significant financial investment.However, achieving full Zero Trust is a journey rather than a destination, similar to cybersecurity itself. It's an ongoing process of adaptation and improvement. Hosted on Acast. See acast.com/privacy for more information.

Season 3, Episode 2: In our conversation with Energy Solution’s CIO David Weisong we chat about how new processes, technology, and budgets are formed. Catch this episode on YouTube, Apple, Spotify, Amazon, or Google. You can read the show notes here.It’s a mystery as old as time: the cybersecurity and technology budget and acquisition strategy. How are they formed? How are these projects prioritized? How are internal teams proposing changes and asking for new dollars (and likely not getting them)? This week, we chat with someone at the heart of the matter for their business who walks us through how they build their security and information roadmap, or in what I lovingly call: quit bugging the C-suite.David Weisong is the CIO for Energy Solutions and has a background in software development, DevOps, and managing IT functions, which makes him the perfect candidate to properly discuss the ins and outs of cybersecurity and IT roadmaps. Hosted on Acast. See acast.com/privacy for more information.