The Cyber Ranch Podcast

How has the "think of us as an insurance policy" model worked for you in getting your cyber agenda met? Has "The risk costs X and we only cost Y!" model worked for you? What models have you found that have worked, and have you ever considered Corporate Social Responsibility as a model to consider? Drew Simonis is Allan Alford's new co-host and on this week's show he brings these questions to the table along with a history lesson about capitalism and a contrast between shareholder focus and stakeholder focus. It's a wild, philosophical ride. Saddle up! Available here or wherever you get your podcasts: https://lnkd.in/gydqYCP7 #informationsecurity #cybersecurity #infosec #ciso

What the heck are ASPM (Application Security Posture Management) and CTEM (Continuous Threat & Exposure Management)? What do they promise, and what do they deliver? Both involve DevOps in the classic sense of Devs and Ops needing to come together quickly and accurately to manage security issues in a way that does not waste time for either the DevOps gang OR the security gang. By now, y'all should know that we here at the 'Ranch don't endorse the term 'DevSecOps' because, well, Sec should be integral, not a separate call-out. And most definitely do most shops need an overhaul on process, roles, gates, etc. when it comes to DevOps. But a powerful tool that can reduce the wasted time and cut back on the stupid that results from being blind and/or overloaded is a valuable, valuable thing. Listen to this week's episode where Allan Alford is joined by Tomer Schwartz from Dazz to tackle this topic and get into some tooling conversations as well. The two talk about: * Gartner alphabet soup * Noise to signal ratios * Single panes (pains?) of glass * Is there an actual and useful place for AI in all this? * UVM - How is it related? Is it dead? Was it absorbed? Is it alive and separate? Available here, or wherever you get your podcasts: https://lnkd.in/gAKAyzM6 Thanks to Dazz for letting us borrow Tomer Schwartz, and for sponsoring this episode! https://dazz.io if you want to learn more about them. #informationsecurity #cybersecurity #infosec #ciso

21 Questions - unique questions asked of 10 guests LIVE! at RSA. the answers are VERY compelling. This week's The Cyber Ranch Podcast is a good one! It's Part 1 of 2, and features the following folks and questions: Dr. Deanna Caputo “How do you measure and articulate risk to the business?” “People, process or technology?” Carlos Guerrero “How do we foster community in cybersecurity?” Elliott Franklin “Governance, Risk Management, and Compliance – Which of the three is most important?” “What does progress look like in cybersecurity?” Corey Bodzin “With regards to AI & LLM, what is the impact to infrastructure?” Evgeniy Kharam “How integral is Identity & Access Management to the cybersecurity mission?” “How well is traditional DLP technology meeting its mission and what else can we do?” Gary Hayslip “What does RSA mean to you?” Kelly Shortridge “What does progress mean to you in cybersecurity?” “What is the end goal of cybersecurity?” George Kamide & George A. “What are you getting out of RSA?” Kevin Jackson “What are we doing wrong in cybersecurity?” Give it a listen here, or wherever you get your podcasts: ************ https://lnkd.in/g4XNfiN6 ************* Sponsored by my dear friends at Semperis, whose AD/Entra ID security and recovery solutions should be looked at by all AD/Entra ID users... Y'all be good now! #informationsecurity #cybersecurity #infosec #ciso

Our Top 5 Most Popular Episodes by Listenership: 5 - Geopolitics, APTs and Cybersecurity with Dan Holden: https://lnkd.in/gbRvW9bt 4 - Board Reporting Metrics Pt. 2 w/ Andy Ellis: https://lnkd.in/gWBfdUkc 3 - Tired Topics in Cybersecurity - Part One with Rich Mason and Michael Santarcangelo: https://lnkd.in/g-c2q_4E 2 - Can We Even Measure Risk? with Andy Ellis and Chris Roberts - EXPLICIT (Chris uses some naughty language): https://lnkd.in/g5BxpTzK 1 - Board Reporting Metrics Pt. 1 w/ Andy Ellis: https://lnkd.in/gTUHZHrA #informationsecurity #cybersecurity #infosec #ciso

Guess which is higher: the number of exploits above the OS or the number below the OS? You probably guessed wrong. We sure did! See the below graphic for an "Aha!" moment. CPUs, BIOS, Firmware, embedded old, old versions of Linux, FPGAs, UEFI, PXE... Allan Alford invited Yuriy Bulygin, CEO at Eclypsium, Inc., to this week's episode oto talk about all the problems that lurk below the OS and what we can do about them. DISCLAIMER: Allan is Eclypsium's CISO. We asked Yuriy to be on the show, not the other way around. Yuriy is a subject matter expert, as you will see when you give the show a listen! We cover: - The history of CPU exploits (Fun lessons for me!) - Unauthorized code in chips in network gear - The various hacks available at this layer - The role of SBOM in all this - The open source CHIPSEC project, which is a super cool way to help defend against this stuff. Check it out here, or wherever you get your podcasts: https://lnkd.in/gWEHG6Hf #informationsecurity #cybersecurity #infosec #ciso

What are the rules about vendors on the show? 1. They have to add value where even practitioners might not be able to. 2. They CANNOT sell! Adam Bateman over at Push Security came out this week and DELIVERED! LinkedIn, you helped fuel this show too! https://lnkd.in/gWEHG6Hf Adam is CEO and Co-Founder at Push Security, based in the UK. Adam started off as a red teamer himself, and then went on to build and lead the detection and response division of another firm that specialized in state-sponsored attacks! Adam came up in the world of offensive security, and it shows in his thinking. He co-founded Push to protect SaaS-native companies, whose data resides in a bazillion places, protected by a bazillion identities. Or maybe just by SSO. But probably a mix. ½ a bazillion known SaaS apps using SSO and another ½ a bazillion using who knows what identity methods? Questions Allan Alford asks Adam, based partly on an earlier thread here on LinkedIn: * In one sense, vulnerable Internet-facing credentials have ALWAYS been a problem. In other words, Identity is not the new perimeter, but is a rather old one. What are your thoughts? * What is happening in the wild? What do the attacks actually look like? * Allan Alford Consulting subscribes to over twenty SaaS applications, and Allan is literally a one-man company. How many SaaS apps are used by the average enterprise? What percentage of those are in the SSO fold? This is truly scary. * How do we get everything behind SSO? How do we get SSO locked down and secure? * What’s our best possible world? Everything behind SSO with a Yubikey? Next best is everything behind SSO with Smartphone MFA app? * Back to this perimeter thing: J. David Christensen, CISSP agrees with the idea that identity is not a new perimeter. He says it has always been THE perimeter! Jamir F. agreed. Robert Mitchell points out that if and identity provider can be compromised, then identity is the M&M defense after all (hard shell, soft center). Our friend Abhishek Singh says authZ and authN combine to form Zero Trust. Once you have zero trust, he says, like it or lump it, identity becomes the attack surface. What are your thoughts on that formula? We found it to be a rather tidy summation, as did our other friend Dan Holden. Thoughts? * Lastly, when we talk identity, we always feel the need to point out that humans are just some of the identities crawling our digital world. Are the solutions we’re crafting for humans using SaaS also good for machine accounts? Application accounts? API-to-API connections? Sponsored by our good friends at Push Security - check then out at: https://lnkd.in/gmTh7U4s #informationsecurity #cybersecurity #infosec #ciso

Thanks freely given to all our listeners!