CISO Tradecraft®

#128 - How do CISOs spend their time?

In this episode of "CISO Tradecraft," G. Mark Hardy defines the role of a CISO and discusses the Top 10 responsibilities of a Chief Information Security Officer
Full Transcript: https://docs.google.com/document/d/1J_sCMkqEeIB7pUY4KmjCiS1sz7t6LX2F
Chapters
00:00 Introduction
01:25 Defining the Role of the CISO
04:43 1) Developing and implementing a cybersecurity strategy
07:27 2) Overseeing the organization's cybersecurity key programs and initiatives
08:20 3) Ensuring that the organization's cybersecurity policies and procedures are up-to-date and in compliance
10:44 4) Collaborating with other departments and teams
12:06 5) Developing and implementing a cybersecurity budget
14:21 6) Maintaining a high level of awareness about emerging cybersecurity threats, vulnerabilities, and technologies
15:29 7) Building and maintaining relationships with external partners and networking groups
18:07 8) Providing education, guidance, and support to the organization's employees
21:34 9) Leading and managing a team of cybersecurity professionals
24:10 10) Conducting regular risk assessments

#127 - How to Stop Bad Guys from Staying on Your Network (with Kevin Fiscus)

In this episode of CISO Tradecraft, G Mark Hardy and guest Kevin Fiscus discuss the challenges of cybersecurity and the importance of prioritizing security decisions. Fiscus emphasizes the need for effective protective controls and detection measures, as well as the limitations of protective controls and the importance of detection. He suggests a "Detection Oriented Security Architecture" (DOSA) that includes high-fidelity, low-noise detection, automated response, and continuous monitoring. Fiscus also discusses the concept of cyber deception and proposes a new approach to cybersecurity that involves redirecting attackers to a decoy environment.
Kevin Fiscus: https://www.linkedin.com/in/kevinbfiscus/
Full Transcripts: https://docs.google.com/document/d/1zIph4r5u8UtuhsMSmIyi90bCtV52xnHv
Chapters
00:00 Introduction
04:55 The Average Time to Identify Bad Actors is 28-207 days
07:11 Why Protective Controls Don't Always Work
08:32 Protective Controls Create Resistance
10:34 The Cost of Detecting Bad Guys on Your Network
12:40 The Effects of Resistance on Protective Controls
15:56 The Problem with False Positive Alerts
20:08 How to Define Bad Guy Activity with 100% Accuracy
22:09 The Four Components of Security
24:14 Four Components of Detection Oriented Security Architecture (DOSA)
26:17 Differentiating between Monitoring & Alerting
27:13 High Fidelity and Low Fidelity Alerts 
33:06 Setting a Squelch for Radios
31:37 How to Deal with False Negatives
33:56 The Importance of Non Production Resources in Detection
37:56 How to Use Cyber Trapping to Deceive an Attacker
42:54 The Role of Environment Variability in Deception
47:08 Blowing Sunshine at Attackers

#126 - ChatGPT & Generative AI (with Konstantinos Sgantzos)

Have you heard about the latest trends in Generative Artificial Intelligence (GAI)? Listen to this episode of CISO Tradecraft to learn from Konstantinos Sgantzos and G Mark Hardy as they talk about the potential risks of GAI and how it generates new content.
Show Notes with Links: https://docs.google.com/document/d/10eCg3L00GgnHmze14g_JUkBbfHEdGZ8HW0eAGMk4PPE
Chapters
00:00 Introduction
01:37 The Future of Generative Artificial Intelligence (GAI)
06:08 The Implications of Hallucination in Generative AI
09:06 Hallucination Trivia Test for Large Language Models
10:48 The Consequences of Using Generative AI Models
12:39 The Importance of Education in Cybersecurity
14:45 The Future of Generative AI
16:17 The Importance of Understanding Large Language Models
19:47 The Differences Between Eliza and Machine Learning
24:26 How to Armorize Generative AI
29:39 The Future of Programming
31:23 The Future of Machines
33:53 The Future of Technology
37:52 The Future of CISOs
40:25 The Future of Generative AI

#125 - Cyber Ranges (with Debbie Gordon)

Are you worried about cyber threats and data breaches? Do you want to build a strong cybersecurity program to protect your organization? Look no further! In this episode of CISO Tradecraft, G Mark Hardy and Debbie Gordon discuss the three dimensions of an effective Information Security Management System: Policy, Practice, and Proof. G Mark emphasizes the importance of having a proper cybersecurity policy that references information security controls or outcome-driven statements. However, it's not enough to have policies on paper; organizations need to practice what's on paper to be prepared for cyber events. This is where ranges come in. Ranges are a full replica of an enterprise network with real tools, traffic, and malware. They allow teams to practice detecting and responding to attacks in a safe environment. Debbie Gordon, founder of Cloud Range, explains how ranges can help organizations accelerate experience and reduce risk in cybersecurity. She emphasizes the importance of educating an organization's user base to become the first and last lines of defense against cyber threats. By training non-technical executives to spot suspicious activity and bring it to the attention of the security team, organizations can minimize the damage caused by phishing attacks, ransomware, and other cyber threats. Gordon also highlights the importance of team training in cybersecurity because it's not just about individual skills, but also about how teams work together to respond to threats. By practicing together in a range environment, organizations can improve their processes, handoffs, and speed in detecting and responding to attacks.
Special thanks to our sponsor Cloud Range Cyber for supporting this episode.
Website: www.cloudrangecyber.com
Email: info@cloudrangecyber.com
Full Transcripts: https://docs.google.com/document/d/1yWenwauzfAiQYafFW0Iew33vbzvlO2BO
Chapters
00:00 Polished Security Programs need Policy, Practice, and Proof
00:54 Policy
02:47 Practice
03:44 Proof
04:28 How to Apply the Concepts of Ranges to Help Organizations
06:05 The importance of Experiential Learning
07:48 The Importance of following Procedures
12:12 The Benefits of Team Training for Cyber Ranges
15:33 The Importance of Muscle Memory
20:22 How to Maximize Your Investment in Cybersecurity (KPIs & Measurable Results)
24:33 The Advantages of using the MITRE ATT&CK® Framework
27:41 The Advantages of Following ISO Standards
31:36 How to Improve your Cloud Range Exercises
33:22 How to use Cognitive Aptitude Assessments for Workforce Development
37:44 How to level the Playing field for Cyber Talent
39:39 The Importance of Degrees in Cyber Security
41:03 Making the CISO's job easier

#124 - Simple, Easy, & Cheap Cybersecurity Measures (with Brent Deterding)

Are you concerned about the security of your data? If so, you're in luck, because we have an incredible episode that has Brent Deterding discuss how to implement simple, easy, and cheap cybersecurity measures. 
One of the key takeaways from the episode is the importance of understanding, managing, and mitigating the risk of critical data being exposed, altered, or denied. Brent Deterding shares his top four tips for CISOs, which include implementing multi-factor authentication, device posture management, endpoint detection and response, and external patching. He emphasizes the importance of keeping things simple, easy, and cheap.
Overall, the episode emphasizes the importance of taking a proactive approach to cybersecurity and being prepared for potential cyber threats. Brett Dietrich shares his approach to reducing risk for his company when negotiating with underwriters.  Remember significant risk reduction is simple, easy, and cheap, so don't wait to implement these tools and strategies.
10 Immutable Laws of Security: https://learn.microsoft.com/en-us/security/zero-trust/ten-laws-of-security
Transcripts: https://docs.google.com/document/d/1eP7F8pD3kcrbja2sfSwSKGnJ-ADHviUt
Chapters:
00:00 Introduction
02:05 How to Protect Your Organization's Critical Data
01:43 Scenario of Protecting a Small Company
08:01 The 10 Immutable Laws of Security
14:26 Tips for CISOs
15:30 Simple, Easy, & Cheap is a Technology State
19:00 How Much Do You Care About Phishing Problems?
20:46 How to a be successful at RSA?
26:00 How to Enable the Business without Reducing Friction?
28:37 How to Adopt the Australian Essential 8
31:06 Team Platform vs Best of Bread
33:00 Those with a fear of vendor lock-in are retired
36:36 How to Save Money on Cyber Insurance
38:27 How to implement the Four Hills Strategy (MFA, EDR, Device Posture Management, & Patch Management)
40:57 How to Negotiate Effectively With Insurance Companies
42:48: Getting Material Risk Reduction is Simple, Easy, and Cheap

#123 - Accepted Cyber Strategy (with Branden Newman)

In this episode of "CISO Tradecraft," G Mark Hardy discusses how to build an effective cyber strategy that executives will appreciate. He breaks down the four questions (Who, What, Why, and How) that need to be answered to create a successful strategy and emphasizes the importance of understanding how the company makes money and what critical business processes and IT systems support the mission. Later in the episode, Branden Newman shares his career path to becoming a CISO and his approach to building an effective cyber strategy. Newman stresses the importance of communication skills and the ability to influence people as the most critical skills for a CISO. He also shares his advice on how to effectively influence executives as a CISO.
Full Transcripts - https://docs.google.com/document/d/1nFxpOxVl6spkK-Y8GLU5q2f6R_4VD-a2
Chapters:
00:00 Introduction
01:06 The Four Questions (Who, What, Why, and How)
08:11 Building an accepted cyber strategy
09:19 Importance of communication skills for a CISO
10:19 Understanding financial statements
12:47 Following the money
14:09 Reputation and cybersecurity
15:24 Getting executive buy-in into cybersecurity
15:57 Building Trust with Executives
16:45 Security Enables New Elements of Business
17:13 Why Cybersecurity Gets Ignored
20:07 Framing Cybersecurity as a Competitive Advantage
21:19 Mistakes CISOs Make When Communicating with Executives
22:54 Telling Stories to Communicate with Executives
24:09 Using Business Cases and Examples
27:28 The Importance of Listening to the Executives
29:31 Making Informed Risk-Based Decisions
30:54 Building Trust and Champions
32:55 Building a Network of Trust
35:13 Being Pragmatic

#122 - Methodologies for Analysis (with Christopher Crowley)

Sometimes you just need structure to the madness. Christopher Crowley stops by to talk about methodologies that can help security organizations. Come and see why you need them, how we get the scientific method wrong in cyber, and how to leverage a CIA analytical methodology that can help you. There's a lot more to check out so tune in.
Analysis of Competing Hypothesis https://www.cia.gov/static/9a5f1162fd0932c29bfed1c030edf4ae/Pyschology-of-Intelligence-Analysis.pdf
Christopher Crowley's Company https://montance.com/ 
Full Transcripts: https://docs.google.com/document/d/1P4MI02fIw3y_u8RhLVDbB3iu0o7e27Fr
Chapters
00:00 Introduction
02:30 The Morris Worm and the Internet
04:17 The Future of Cybersecurity
06:41 How to setup a shared drive for multitasking
10:26 The Evolution of Career Paths
12:02 The Importance of Methodology in Problem Solving
14:16 The Importance of Hypothesis in Cybersecurity
19:58 MITRE ATT&CK® Framework: A Two Dimensional Array
21:54 The Importance of a Foregone Conclusion Methodology
23:29 The Disruptor's Role in Hypothesis Brainstorming
25:18 The Importance of Resilience in Leadership
27:45 Methodologies and Threat Hunting
29:21 The Importance of Information Bias in Threat Hunting
34:31 How to Sort Hypothesis in a Spreadsheet
37:22 The Importance of Refining the Matrix
40:34 How to Automate Analysis of Competing Hypothesis

#121 - Legal Questions (with Evan Wolff)

Have you ever wanted to get a legal perspective on cybersecurity?  On this episode of CISO Tradecraft, Evan Wolff stops by to discuss terms such as legal disclaimers, negligence, due care, and others.  He also provides important insights on how to structure your cyber policies, respond to regulators/auditors, and partner with general council.  Please enjoy. 
Full Transcripts: https://docs.google.com/document/d/1hbqB5GQfQsi0egPVdOtdfYEwLA3-1Jnh
Chapters
00:00 Introductions
01:52 The Attorney Client Privilege
04:49 What's the Difference Between a Discovery Order and an Attorney Client Privilege
06:30 CISO Disclaimer
09:23 Security Is a Component of Government Contracts
11:59 What are the Borders Between Information Security and Legal Risk
15:31 Cyber Security - Is there a Standard of Care?
18:11 Do you have a Reasonable Best Effort?
21:27 CMMC 2.0
26:22 Is your Privacy Policy going to expire?
28:30 What is Reasonable Assurance?
33:41 Advice for Partnering with the General Counsel

#120 - Negotiating Your Best CISO Package (with Michael Piacente)

Have you ever wondered how to negotiate your best CISO compensation package?  On this episode, we invite Michael Piacente from Hitch Partners to discuss important parts of the compensation packages.  Examples include but are not limited to: - Base Salary,
Bonuses (Annual, Relocation, & Hiring)
Reserve Stock Units
Annual Leave
Title (VP or SVP)
Directors & Officers Insurance
Accelerated Vesting Clauses
Severance Agreements
You can learn more about CISO compensations by Googling any of the following compensation surveys
Hitch Partners CISO Compensation and Organizational Structure Survey Report: https://www.hitchpartners.com/ciso-security-leadership-survey-results-23
Heidrick & Struggles Global Chief Information Officer Survey: https://www.heidrick.com/en/insights/...
IANS CISO Compensation and Budget Benchmark Study: https://www.iansresearch.com/ciso-com...
Full Transcripts: https://docs.google.com/document/d/1e...
Chapters:
00:00 Introduction
01:58 What's the Difference?
06:50 The Three-Legged Stool (Base Salary, Bonuses, & RSUs)
11:44 Is there a signing bonus?
13:56 What's the difference between RSUs & Options?
18:52 Private Companies - What's the Value of the Offer?
22:04 Double Triggers in Private Companies
26:38 Should you counter an offer?
28:17 Corporate Liability Insurance
29:50 Do you want to be extended on the Director and Officer Insurance Policy?
32:56 How to negotiate a severance agreement
36:00 Compensation Survey Reports

#119 - Ethics (with Stephen Northcutt)

One of the most difficult things to do as a manager or leader is to take an ethical stance on something you believe in.  Sometimes ethical stances are clear and you know you are doing what’s right.  Others are blurry, messy, and really weigh on your mind.  So we thought we would take this episode to talk about various ethical models, tricky ethical scenarios you might encounter as a CISO, and finally we will look at the Federal Case where Joe Sullivan the Former Chief Security Officer of Uber was convicted of federal charges for covering up a data breach.  Thanks to Stephen Northcutt for coming on today's show.
Full Transcript https://docs.google.com/document/d/1vin7gMBt9YvVGaVqT91ycPmacsKZe2T9
Chapters
00:00 Introduction
01:49 How to Make a Difference in Cybersecurity
03:34 Hackers and the Pursuit of Higher Principles
06:06 Is There a Use Case in Cybersecurity
10:56 Human Capital is the Most Important Asset That Any Organization Has
14:00 The Human Frailty Factor
18:21 Has Your Company Fully Embraced Diversity, Equity, and Inclusion
20:24 Do you have a Diversity of Experience
24:11 Getting Your EXO to Talk to Power and say you are wrong
27:40 CISOs and CISOs - Is this a Criminal Thing?
30:15 The Penalty of Crossing the Law
34:56 Pay the Ransom?
36:59 The Key to Resilience as a CISO

#118 - Data Engineering (with Gal Shpantzer)

Our systems generate fantastic amounts of information, but do we have a complete understanding of how we collect, analyze, manage, store, and retrieve possibly petabytes a day? Gal Shpantzer has been doing InfoSec for over 20 years and has managed some huge data engineering projects, and offers a lot of actionable insights in this CISO Tradecraft episode.
Gal's LinkedIn Page - https://www.linkedin.com/in/riskmanagement/
Gal's Twitter Page - https://twitter.com/Shpantzer
Full Transcript - https://docs.google.com/document/d/14RXnsVttvKlRi6VL94BTrItCjOAjgGem/
Chapters
00:00 Introduction
02:00 How do you Architect Big Data Data Infrastructure
03:33 Are you taking a look at Ransomware?
06:11 Web Scale Technologies are used mostly in Marketing & Fraud Detection
08:11 Data Engineering - The Mindset Shift
10:51 The Iron Triangle of Data Engineering
13:55 Can I Outsource My Logging Pipeline to a Vendor
15:37 Kafka & Flink - Data Engineering in the Pipeline
18:12 Streaming Analytics & Kafka
22:08 How to Enable Data Science Analytics with Streaming Analytics
26:33 Streaming Analytics
30:25 Data Engineering - Is there a Security Log
32:30 Streaming Analytics is a Weird Thing
35:50 How to Get a Handle on a Big Data Pipeline
39:11 Data Engineering Hacks for Big Data Analytics

#117 - Good Governance (with Sameer Sait)

Has bad governance given you trauma, boring committees, and long speeches on irrelevant issues?  Today we are going to overcome that by talking about what good governance looks like.  We bring on the former CISO of Amazon Whole Foods (Sameer Sait) to discuss his lessons learned as a CISO.  We also highlight key topics of good governance found in the Cyber Security Profile from the Cyber Risk Institute.Cyber Risk Institute - Cyber Security Profile https://cyberriskinstitute.org/the-profile/Full Transcripts: https://docs.google.com/document/d/1vBM6A0utvhRFMA04wzrZvR8ktNwYo-li
Chapters
00:00 Introduction
03:10 Good Governances is a Good Thing, Right?
05:08 Cyber Strategy & Framework
06:43 Is NIST the Same as ISO?
08:40 How to Convince the Executive Leadership Team to Buy In
11:19 The CEO's Challenge is Taking Measured Risk
20:05 Is there a Cybersecurity Policy
22:32 Culture eats Policy for Lunch
24:14 The Role of the CISO
27:52 How do you Convince the Leadership Team that you need extra resources
29:51 How do you Measure Cybersecurity?
32:22 How do we communicate Risk Findings to Senior Management
36:07 Are you Aligning with the Audit Committee

#116 - A European view of CISO responsibilities (with Michael Krausz)

In the US we often focus on SOC-2, NIST Special Pubs, and the Cybersecurity Framework. In Europe (and most of the rest of the world), ISO 27001 is the primary standard. ISO concerns itself with policy, practice, and proof, whereas NIST often shows the method to follow. Michael points out that a CISO is responsible for governance, (internal) consulting, and audit. In early stages of growing a security function, a CISO needs to be technically-focused, but as a security department matures, the CISO must be organizationally-focused. Also, to effectively grow your team, first determine what actions need to take place, how much effort it requires, and how often it needs to take place. Then, build an action sheet and collect data for three months. Finally, take that to your executives and document your requirements for more staff.
Michael Krausz LinkedIn Profile: https://www.linkedin.com/in/michael-krausz-b55862/
Michael Krausz Website: https://i-s-c.co.at/
Full Transcript: https://docs.google.com/document/d/13fghym7IWyPvuRANQXUvmv-ulkSj93xv 
Chapters
00:00 Introduction
04:01 Is there a Gap Analysis in ISO 27001?
08:05 Is there a Requirement for ISO Standards?
10:57 What is ISO 27001?
13:11 Is there a Parallel Development between the US and EU?
16:57 Do you want to be a trooper?
21:17 What's the Oldest Operating System?
23:09 Is there a Legacy Operating Systems that you can't get away with?
24:11 The Most Important Class for a CISO
26:33 The Secrets of a Successful CISO
29:30 CISO - I need 6 people period
33:40 What's the Primary Skill Needed in a CISO?
37:41 How to Maximize the Number of FTEs

#115 - The Business Case for a Global Lead of Field Cybersecurity (with Joye Purser)

How can cyber best help the sales organization?  It's a great thought exercise that we bring on Joye Purser to discuss. Learn from her experience as we go over how cybersecurity is becoming an even closer business partner with the creation of a new important role.
Full Transcript: https://docs.google.com/document/d/1Shd1Qldb8iKEHBgXJqFez81Iwfpl6JT-/
Chapters
00:00 Introduction
02:58 How did you marry those two cultures?
06:40 Building a Diverse Workforce
08:23 Is this a new role based on Pain Points?
10:27 Global Lead for Field Cyber Security
15:51 Is the Global Lead for Field Cybersecurity linked to sales numbers?
19:07 Is there a Global Lead for Field Cybersecurity?
24:46 Building Relationships in a Security Leadership Role
27:48 Do you have any lessons learned from your success at Global Management Consulting?
29:33 You need to schedule time to get things done
33:33 What about Due Diligence?
37:36 The Chief Technology Officer, CRO, & CTO

#114 - One Vendor to Secure Them All

Did you ever wonder how much security you can implement with a single vendor?  We did and were surprised by how much you can do using the Australian Top Eight as a template.  We'll bet you can improve your security by using these tips, tools, and techniques that you might not have even known were there.
Special thanks to our sponsor Praetorian for supporting this episode.
https://www.praetorian.com/
Full Transcripts:
https://docs.google.com/document/d/12HsuOhY9an1QzIw9wOREPMX0pXe5hqkJ
Helpful Links
Essential 8 https://www.microsoft.com/en-au/business/topic/security/essential-eight
Blocking Macros https://ite8.com.au/the-essential-8/office-macros-explained/ 
Windows Defender Application Control or WDAC (available from Windows 10 or Server 2016 or newer) previously Windows had App Locker (Windows 7 / 8)
https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control
Windows Group Policies
https://techexpert.tips/windows/gpo-block-website-url-google-chrome/
https://chromeenterprise.google/policies/#SafeBrowsingAllowlistDomains 
https://data.iana.org/TLD/tlds-alpha-by-domain.txt 
Software Restriction Policies http://woshub.com/how-to-block-viruses-and-ransomware-using-software-restriction-policies/
Blocking websites URL - only allow (.com, .org, .net, edu, .gov, .mil, and the countries you want).   
Locking down Active Directory https://attack.stealthbits.com/tag/active-directory 
File Service Resource Management
http://woshub.com/using-fsrm-on-windows-file-server-to-prevent-ransomware/
Enable MFA for RDP
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/secure-remote-vm-access  
https://duo.com/docs/rdp
Enable MFA for SSH
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ssh
https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-linux 
Windows Controlled Folder Access
https://support.microsoft.com/en-us/topic/ransomware-protection-in-windows-security-445039d6-537a-488a-ad53-48906f346363
Use Windows File History to create backups to one drive.
https://www.ubackup.com/windows-10/file-history-backup-to-onedrive-4348.html
Storing your files to One Drive which has ransomware detection
https://support.microsoft.com/en-us/office/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f
Windows Update
Select Start > Settings > Windows Update > Advanced options. Under Active hours, choose to update manually or automatically in Windows 11. 
https://support.microsoft.com/en-us/windows/keep-your-pc-up-to-date-de79813c-7919-5fed-080f-0871c7bd9bde 
Microsoft Conditional Policies- https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common 
Microsoft Authenticator with Number Matching, Geo, & Additional Context
https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context 
https://websetnet.net/microsoft-rolls-out-new-microsoft-authenticator-features-for-enterprise-users/
Application Approve List- https://www.bleepingcomputer.com/tutorials/create-an-application-whitelist-policy-in-windows/

#113 - SAST Security (with John Steven)

This episode provides a deep dive into Static Application Security Testing (SAST) tools.  Learn how they work, why they don't work as well as you think they will in certain use cases, and find some novel ways apply them to your organization.  Special thanks to John Steven for coming on the show to share his expertise.  
 
Special thanks to our sponsor Praetorian for supporting this episode.
https://www.praetorian.com/
Full Transcripts - https://docs.google.com/document/d/1zoA70k78IjqyJky-2u7_-i2jlWke8_cb
Chapters:
00:00 Introduction
02:51 Source Code Analyzers
04:22 The three bears of Static Analysis
06:01 Do Linters work Better?
08:00 The Value of Full Programming Analysis Tools over Linters
11:30 The Impact of a Developer's Analysis on a Developer Environment
13:05 SAST Testing
15:47 OWASP Benchmarking
19:13 The First Static Analysis Tools
20:53 Can you break up that worry about Automated Testing?
22:44 Using Static Analysis for Defect Discovery
24:18 Using Static Analysis to Improve Web Security
31:37 Using Static Analysis to Drive Cloud Security
33:15 The Second Thing to Look Out for When Choosing a Static Analysis Tool
34:55 Using Static Analysis to Build a Vulnerability Management Practice
37:35 Can you use Static Analysis to Find Insider Threat?

#112 - Attack Surface Management (with Richard Ford)

How do you defend against automated attacks in an era of ChatGPT-formulated malware, coordinated nation-state actors, and a host of disgruntled laid-off security professionals? Want to find your vulnerabilities faster than the bad actors do? Come listen to Richard Ford to learn how to apply best practices in attack surface management and defend your crown jewels.
Special thanks to our sponsor Praetorian for supporting this episode.
Full Transcripts - https://docs.google.com/document/d/18QyrN-7V91nxOyRQ0KsNeJU0-k-bTlqj
Chapters:
00:00 Introduction
04:22 The Impact of Continuous Attack Surface Mapping on Security Responses
07:48 What's the Difference between a CTO and a CIO?
10:24 What attracted you to the problem space?
12:53 Is the Attack Surface really exposed?
16:12 Shadow IT - The Unknown Unknowns that could Bite You
19:56 Is there a Shadow IT problem?
23:24 How to get management on board with Shadow IT?
26:38 Building an Attack Surface Management Program
29:57 You Get What You Measure, Right?
33:27 Do I Have Vulnerable Assets?
39:24 Attack Surface Management

#111 - Leading with Style

Have you ever wanted to be like Neo in "The Matrix" and learn things like Kung Fu in just a few minutes?  Well on today's episode, we try to do just that by cramming powerful leadership concepts into your head in just 45 minutes.  So sit back, relax, and enjoy CISO Tradecraft.
 
Show Notes with Pictures & References:
https://docs.google.com/document/d/1z5FwVwYlNiJlevQXP9IK48Z5kYqG-Ee_/edit?usp=sharing&ouid=104989998442085477687&rtpof=true&sd=true
Full Transcript:https://docs.google.com/document/d/11iTdKRxtg1UYiQeUn-mdgM7zKqafTq34/edit?usp=sharing&ouid=104989998442085477687&rtpof=true&sd=true

#110 - CISO Predictions for 2023

Want to know CISO Tradecraft's Top 10 cyber security predictions for 2023?  Listen to the episode to learn more about:
Proactive Identity Management = Automated Provisioning of Access + Minimizing Digital Blast Radius
Convergence of Security Tools
Collaboration Technology
Evolution of the Endpoint (Chromebooks or Browser Isolation)
Chatbots
Vague and unclear cyber laws
CISO liability increases
Umbrella IT general controls mapping
Companies will be less truthful during 3rd party questionnaires
Cyber defense will become more difficult because of people
Be sure to also check out G Mark Hardy's annual ISACA talk athttp://isaca-cmc.org/ 
Link to full transcripts of the podcast can be found here:https://docs.google.com/document/d/1RkrtkuunBn-qaU-Y9HvgHJzAKoIIszcW/edit?usp=sharing&ouid=104989998442085477687&rtpof=true&sd=true

#109 - The Right Stuff

Success leaves clues, but sometimes we limit ourselves by only looking close by for them.  This week, we pondered what business skills are essential for a successful CISO, and then extended the search to some non-traditional sources to find some very relevant advice.  Take the time to listen and do a self-examination (you don't have to submit for a grade :) and see where you could boost your skills portfolio to increase your success as a security leader.  Some of the essential skills we discuss on this episode of CISO Tradecraft are:
Be a leader
Manage money and resources
Differentiate yourself and your message
Communicate with clarity and emphasis
Delegate and hold subordinates accountable
Build a personal network
Mentor your team
Be adaptable
Be sensitive to cultural and political issues
Watch the details and ensure your management makes informed risk-based decisions &
Know your limitations
We thank our sponsor Nucleus Security for supporting this episode
Full Transcript: https://docs.google.com/document/d/1C357cX_4wKTRmhRUsGh_2d9vIMX5LspL/
Show links:
  https://www.smallbusiness.wa.gov.au/starting-and-growing/essential-business-skills
  https://cisotradecraft.podbean.com/e/108-budgeting-for-cisos-with-nick-vigier/
  https://nativeintelligence.com/
  https://github.com/cisotradecraft/Podcast#business-management--leadership
  https://www.ef.com/wwen/blog/efacademyblog/skills-for-success/
  https://www.criticalthinking.org/pages/defining-critical-thinking/766
  https://your.yale.edu/learn-and-grow-what-adaptability-workplace
  https://openai.com/blog/chatgpt/
  https://openai.com/dall-e-2/

#108 - Show Me The Money (with Nick Vigier)

There's a lot of things you need to know as a CISO, but one of the things least taught is budgeting best practices.  On today's episode, CISO Nick Vigier stops by to share his lessons learned on the topic.  His conversations focus on spends vs investments.  Remember spends = overhead, whereas investments = growth.  Here's a great point.
[10:00] There are opportunities that we have to frame some of these things as investments versus framing them as risk mitigations. And so one of the mantras or things that I like to think about is the business has a limited appetite for risk management, but they have infinite appetite for profits and making money. 
So if you're able to frame them as how they're actually going to help accelerate the business or improve the business that brings the CEO and the CFO along on the journey, that you're not just there to lock the doors, you might actually be there to help put another floor on the building and that's a very different conversation.
We also thank our sponsor Nucleus Security for supporting this episode.
Full Transcript: https://docs.google.com/document/d/1nURiml3BJFnszFRA8qov1CgO_VkDFaCY

#107 - Consolidating Vulnerability Management (with Jeff Gouge)

Special thanks to Jeff Gouge for sharing his thoughts on consolidating vulnerability management.  We also thank our sponsor Nucleus Security for supporting this episode.
Consistently tracking and prioritizing vulnerabilities is a difficult problem.  This episode talks about it in detail and helps you increase your understanding in:
Various application security scanning tools (SAST, DAST, SCA, Container, IoT, Secret Scanners, Cloud Security Scans, ...) and why companies need so many
How CVSS base scores are actually calculated so you can understand its strengths and weaknesses
How Threat Intelligence Data improves CVSS scoring
Knowing which vulnerabilities are being actively exploited by bad actors through the CISA Known Exploited Vulnerabilities Catalog
Knowing with vulnerabilities are being exploited in your industry or organization
Knowing how the Exploit Prediction Scoring System (EPSS) can predict which vulnerabilities will be exploited soon
Learning about the Stakeholder-Specific Vulnerability Categorization Guide (SSVC)
Note a Full Transcript of this podcast can be found here:
https://docs.google.com/document/d/1dWDS8rd-iscZuZ28U27IBuPPfrlFAV69/

#106 - How to Win Your First CISO Role

Are You Ready To Win Your First CISO role? Apply these techniques into your resume and interview process so both recruiters and hiring managers will offer you the job.  This show focuses on:
Highlighting the Different Types of CISO Roles
Showing how to progress from a Senior Director Role into a Fortune 100 CISO
Resume Tricks and Tips that get you noticed by recruiters
How to have a great interview with a recruiter
What Hiring Managers want to see from CISOs during their interviews
Please note the full show transcript can be found here https://docs.google.com/document/d/18Feg4eXbezHVPiNQ9qO6Pdht3P0eQ5nn

#105 - Start Me Up (with Bob Cousins)

Would you like to hear a master class on what Technology professionals need to know about startups?  On this episode Bob Cousins stops by to share his knowledge and experience on working in technology companies, dealing with founders, and partnering with venture capitalists.  Listen and learn more about:
What should a technology professional know about venture capital and dealing with venture capitalists?
What is the role of marketing?
What do engineers get wrong with helping businesses create profitable growth?
What is the value of a product?
Subscribe to the CISO Tradecraft LinkedIn Page

#104 - Breach and Attack Simulation (with Dave Klein)

Special Thanks to our podcast sponsor, Cymulate. 
On this episode, Dave Klein stops by to discuss the 3 Digital Challenges that organizations face:
Cyber threats evolve on a daily basis and this constant threat to our environment appears to be only accelerating
The level of vulnerabilities today is 30x what it was 10 years ago.  We have more IT infrastructure, complexity, and developers in our current environment.
In the pursuit of digital innovation, we are changing our IT infrastructure by the hour.  For Example: Infrastructure as Code capabilities (Chef, Puppet, Terraform, etc.) allow developers to deploy faster and create more opportunities for misconfigured code at scale.  
Breach and Attack Simulation tooling address these 3 digital challenges by focusing on Breach Attack Simulation, Vulnerability Prioritization, & Threat Exposure Management.  This combined approach allows a cyber organization to ensure its security is fully optimized and its risk exposure is minimized.  Key benefits of adopting Breach and Attack Simulation software include:
Managing organizational cyber-risk end to end
Rationalizing security spend
Prioritizing mitigations based on validated risks
Protecting against the latest threats in near real-time
Preventing environmental drift
 
Welcome back listeners and thank you for continuing your education in CISO Tradecraft.  Today we are excited to share with you a great episode focused on Breach and Attack Simulation software.  To begin we will provide a solid background on Breach and Attack Simulation then we are going to bring on our special guest Dave Klein who will give us the pro tips that help CISOs maximize the value from Breach and Attack Simulation Software.
 
Starting from the beginning.  What is Breach and Attack Simulation software and why is this needed?  At the end of the day most companies are not on an island.  They need to connect to clients, partners, and vendors.  They need the ability for employees to visit websites.  They need to host public facing websites to sell products and services.  Each of these activities result in creating organizational assets such as IT equipment that has internet connectivity.  Now internet connectivity isn’t a bad thing.  Remember internet connectivity allows companies to generate income which allows the organization to exist.  This income goes to funding expenses like the cyber organization so that is a good thing.  
 
If bad actors with the intent and capability to cause your company harm can find your company's internet connected assets which have vulnerabilities, then you have a risk to your organization.  So enter vulnerability assessment and penetration testing tools that companies can buy to identify and address this risk.  Now sometimes you will hear the terms Cyber Asset Attack Surface Management or (CAASM).  It’s also commonly referred to as continuous threat exposure management.  Essentially these two categories of tools are the latest evolution of vulnerability management tooling that have the additional benefit of ingesting data from multiple sources.  Essentially they are designed to address key questions such as: 
How do we get an inventory of what we have?
How do we know our vulnerabilities? and 
How do we know which vulnerabilities might be exploited by threat actors?  
 
Now if you want to take this line of questioning one step further, then you should consider adopting Breach and Attack Simulation software.  Note Breach and Attack Simulation software overlaps with many of the CAASM capabilities, but it does something unique.  Breach and Attack Simulation software allows you to pose as bad actors on your network and perform red team exercises.  Essentially you learn how bad actors can bypass your cyber tooling and safeguards.  This means you go from knowing where you are vulnerable to actually seeing how well your incident response activities perform.  Example if I can take a normal user's laptop and spawn a Powershell Script or run a tool like MimiKatz to gain Domain Admin level privileges, then I want to know if the Cyber Security Incident Response team was alerted to that activity.  I also want to know if the Incident Response team blocked or disabled this account in a timely manner.  According to the 2022 Microsoft Digital Defense Report the median time it takes for an attacker to access your private data if you fall victim to a phishing email is 1 hour 12 minutes.  The report also stated that the median time for an attacker to begin moving laterally within your corporate network once a device is compromised is 1 hour 42 minutes.  Remember the difference to responding to these attacks in minutes vs hours can be the difference between how much files get encrypted when ransomware actors get into your environment.  
 
Another thing that CISOs need to ensure is that vulnerabilities get fixed.  How do you test that?  You have to replay the attack.  
 
You can think of fire drills as the comparison.  If an organization only did one fire drill every 24 months, then chances are the company’s time to exit the building isn’t going to decrease all that much.  It’s likely to stay the same.  Now if an organization does 8-12 fire drills over the course of 24 months, then you would generally see a good decrease in departure times as people get familiar with knowing how to leave the building in a timely fashion.  The good thing on Breach and Attack Simulation tools is they have the ability to replay numerous attacks with the click of a button.  This can save your penetration testing team hours over manual exploitation activities which would have to be repeated to confirm successful patches and mitigations.
 
If we look at Breach and Attack Simulation software the tools have typically come in two flavors.  One is an agent based approach.  Example.  A company might install an attack agent on a laptop inside the corporate environment that runs Data Loss Protection software.  The attack agent might look at how much data it can exfiltrate which is not stopped by the DLP tool.  The attack agent could also run similar attacks with how much malware the Antivirus detects, how much sensitive email it send outside the company despite there being an email protection solution.  These attack agents can also be placed on servers to determine how effective web applications firewalls are at stopping attacks.
 
Essentially having an attack agent on the internal side of a trusted network and one on the outside allows an organization to evaluate the effectiveness of various cyber tools.  Now there’s a few concerns with this type of approach.  One, companies don't want to add more agents across their network because it steals critical system resources and makes things slower.  Two, the time it takes to install and test agents means the value you can get out of these tools is delayed because cyber needs approvals from the desktop team, the network team, the firewall team, etc. before these solutions can be deployed.  Three, by having an agent you don’t always truly simulate what an attacker would do since you don't have to live off the land and gain permissions the attacker did.  Your agent may not be know to antivirus or EDR tools, but using windows libraries to gain access does. 
 
Now let’s compare this with an agentless approach.  This approach is quite popular since labs where agents are run don’t always look like a production environment.  Example they lack the amount of traffic, don’t possess the same amount of production data, or contain last month’s versions of software.  
 
Here attacker software may start with the premise what happens if someone from the Accounting Team opens an Excel document containing a malicious macro.  Let’s see how we can automate an attack after that initial compromise step occurs.  Then let’s walk through every attack identified by the Mitre Attack Framework and see what gets caught and what doesn’t.  The tooling can then look at the technical safeguards in the organization that should have been applied and provide recommendations on how to increase their effectiveness.  This might be something simple like adding a Windows Group Policy to stop an attack.  Also breach and attack simulation tools can provide alerting recommendations to the SIEM that help identify when an endpoint attack occurred.  Example: Instead of knowing that bad actors can run an attack, the Breach and Attack Simulation software actually gives you the Splunk Signature that your SOC team can leverage.  That’s a great add to minimize the amount of time to improve your alerting capabilities.  
 
Now when the breach and attack simulation software replays attacks each month, cyber leadership can look at how fast the Incident Response team detected and remediated the attack.  It might be as simple as we stopped this attack before it could happen by applying the new Windows Group Policy or it took the team 4 hours to determine XYZ account had been taken over.  These metrics allow you to know how well your Response plans work.  So you get the value of a penetration test with the automation & scaling of vulnerability management tools.  
 
What’s even more impressive is how these tools are evolving to meet the larger mission of cyber organizations.  
 
Example: Most Financial and Health Care organizations have to demonstrate evidence that IT controls are working effectively.  Generally this is a manual process done in the Governance Risk and Compliance (GRC) team within a cyber organization.  GRC teams have to ask developers to provide evidence to various IT controls such as are you monitoring and alerting to privilege activity.  Now imagine if you had an automated tool that showed evidence that monitoring tools are installed on 99% of endpoints and these tools actually stopped various MITRE attacks immediately.  That evidence would minimize the data call which takes time from the developer teams.