CISO Tradecraft®

#40 - Risky Business

In this episode, we take a deep dive into that four-letter word RISK. Risk is measurable uncertainty. As a component of Governance, Risk, and Compliance (GRC), risk management is an important part of a security leader's responsibility. Risk assessment is conducted for a number of reasons, and measuring risk is an important component of effectively overseeing our IT investments. We'll look at NIST and ISO standards for risk, and define the different types of risk assessments. And, because there is risk inherent in many endeavors, this episode will be continued in a part 2, because we didn't allow for the risk of running over with this much great information.

#39 - Stressed Out? Find your Ikigai and 6 Invaluable Factors

Being a CISO has been described as the "toughest job in the world."  It comes with a lot of stress, which can lead to early burnout as well as a number of health and relationship problems.  Well, we're going to tackle this elephant in the room and investigate some of the sources of stress and ways we can deal with it.
 
88% of CISOS report being "moderately or tremendously stressed"   We discuss eight everyday situations that can cause CISO stress, and then explore the way of Ikigai, Japanese for "reason for being."  The intersection of what you love, what you are good at, what the world needs, and what you can be paid for represents this ideal state.  Mihaly Csikszentmihalyi describes this as "flow," when work comes seemingly effortlessly because we are in alignment with our actions.  We'll also explore Dave Crenshaw's factors to being invaluable, which can help us better meet the demands of our job by being the best possible fit.
 
Tune in and gain some ideas on how to help yourself. and your staff, deal with stress.
 
CISO Tradecraft By Topic on GitHub 
Csikszentmihalyi
Ikigai
Invaluable: The Secret to Becoming Irreplaceable
The Six Invaluable Factors by David Crenshaw

#38 - CMMC and Me

This episode of CISO Tradecraft discusses CMMC.  The Cybersecurity Maturity Model Certification (CMMC), is the US government response to the massive amounts of defense-related information compromised over the years from contractors and third parties.  The program will be mandatory for all defense contractors by 2025, and has the potential to expand to the entire Federal government, affecting every entity that sells to Uncle Sam.  CMMC has five levels of progressively more rigorous certification with up to 171 controls based on acquisition regulations, NIST standards, and Federal information processing standards. In addition, there will be an entire ecosystem of trainers, consultants, assessors, and the organizations that support them.  We'll cover those in enough detail so that you can decide if expanding your career skill set into CMMC might make sense.

#37 - Cyber Security Laws & Regulations

On this episode of CISO Tradecraft, you will hear about the most prominent Cyber Security Laws and Regulations:
The Health Insurance Portability and Accountability Act (HIPAA) advocates the security and privacy of personal health information
Administrative Safeguards
Physical Safeguards
Technical Safeguards
The Sarbanes-Oxley Act (SOX) is designed to provide transparency on anything that could cause material impact to the financials of a company
Cyber Risk Assessment
Identify Disclosure Controls and Policies
Implementing Cyber Security Controls Using a Reliable Framework (NIST CSF / ISO 27001)
Monitor and Test SOX Controls
The Gramm Leach Bliley Act (GLBA) requires Financial Institutions to protect Personally Identifiable Information (PII) 
The Federal Information Security Management Act (FISMA) requires executive agencies in the federal government to address cyber security concerns
Plan for security
Assign responsibility
Periodically review security controls on systems
Authorize systems to Operate
The Payment Card Industry Data Security Standards (PCI-DSS) is a framework required to protect payment card information
The General Data Protection Regulation (GDPR) - Data Compliance and Privacy law for European citizens
Consent
Data Minimization
Individual Rights
The California Consumer Protection Act (CCPA) - Data Compliance and Privacy law for California residents.  This law provides Californians the right to know what data is collected or sold, the right to access data, the ability to request its deletion, and the ability to opt out of it being collected or sold.
The Cybersecurity Maturity Model Certification (CMMC)- combines various cybersecurity standards and best practices and maps these controls and processes across maturity levels for Department of Defense contractors.

#36 - IPv6 Your Competitive Advantage (with Joe Klein)

This episode of CISO Tradecraft is all about IPv6, featuring Joe Klein.  IPv6 is becoming the dominant protocol on the Internet, and CISOs should understand the implications of how their enterprise is potentially vulnerable to attacks that may come from that vector, as well as be aware of defenses that may originate from an effective IPv6 deployment.  This broadcast will cover the business cases for IPv6, the technical differences between IPv4 and IPv6, and the security implications of implementing this protocol correctly and incorrectly.

#35 - Setting Up an Application Security Program

On this episode of CISO Tradecraft, you can learn how to build an Application Security program.
 Start with Key Questions for
Security
IT Operations
Application Development/Engineering Groups
Identify Key Activities
Asset Discovery
Asset Risk Prioritization
Mapping Assets Against Compliance Requirements
Setting up a Communications Plan
Perform Application Security Testing Activities
SAST
DAST
Vulnerability Scanners
Software Composition Analysis
Secrets Scanning
Cloud Security Scanning
Measure and Improve Current Vulnerability Posture through metrics
The number of vulnerabilities present in an application
The time to fix vulnerabilities
The remediation rate of vulnerabilities
The time vulnerabilities remain open
Defect Density - number of vulnerabilities per server
We also recommend reading the Microsoft Security Developer Life Cycle Practices Link
For more great ideas on setting up an application security program please read this amazing guide from WhiteHat Security Link
If you would like to improve cloud security scanning by automating Infrastructure as Code checks, then please check out Indeni CloudRail Link

#34 - Metrics that Matter

What is measured gets done.  However before you measure you need to think about how best to measure.  On this episode of CISO Tradecraft, we provide you new insights into optimizing metrics that matter.  
What is a Metric?
Metrics drive outcomes.  Before picking a metric consider the following:
What data is required?
What stories can it tell?
What questions does it invite?
How sustainable is it?
When you report metrics highlight three things:
Status or Measure- Where is your company right now?
Trends- What direction is your company headed?
Goals- A description of where your company wants to be
Goals or Metrics should be SMART:
Specific, Measurable, Achievable, Realistic, and Time-based
For a helpful list of metrics that you might consider please check out the following list from Security Scorecard Link
Thank you again to our sponsor CyberArk, please check out their CISO Reports.

#33 - 10 Steps to Cyber Incident Response Playbooks

On this episode of CISO Tradecraft, you can learn the 10 steps to Incident Response Planning:
Establish a Cyber Incident Response Team
Develop a 24/7 Contact list for Response Personnel
Compile Key Documentation of Business-Critical Networks and Systems
Identify Response Partners and Establish Mutual Assistance Agreements
Develop Technical Response Procedures for Incident Handling that your team can follow:
External Media - An alert identifies someone plugged in a removable USB or external device 
Attrition - An alert identifies brute force techniques to compromise systems, networks, or applications.  (Examples Attackers trying thousands of passwords on login pages)
Web - A Web Application Firewall alert shows attacks carried out against your website or web-based application
Email - A user reports phishing attacks with a malicious link or attachment
Impersonation - An attack that inserts malicious processes into something benign (example Rogue Access Point found on company property)
Improper Usage - Attack stemming from user violation of the IT policies.  (Example employee installs file sharing software on a company laptop) 
Physical Loss- Loss or theft of a physical device (Example employee loses their luggage containing a company laptop)
Classify the Severity of the Cyber Incident
Develop Strategic Communication Procedures
Develop Legal Response Procedures
Obtain CEO or Senior Executive Buy-In and Sign-off
Exercise the Plan, Train Staff, and Update the Plan Regularly
To learn more about Incident Response Planning, CISO Tradecraft recommends reading this helpful document from the American Public Power Association
If you would like to automate security reviews of infrastructure-as-code, then please check out Indeni CloudRail Link

#32 - Brace for Incident (with Bryan Murphy)

Special Thanks to our podcast Sponsor, CyberArk.  
Experienced CISOs know that it's not a matter of if, but when.  Incidents happen, and there is an established response strategy nicknamed PICERL that works:
 (P)reparation
 (I)dentification
 (C)ontainment
 (E)radication
 (R)ecovery
 (L)essons Learned
If we "shift left" with our incident planning, we can minimize our organizational risk -- thorough preparation, including establishing an environment of least privilege, significantly increases the challenge for an attacker, buys us time to identify early, and limits the damage potential from an incident.
 
This episode features Bryan Murphy, the Incident Response team leader at CyberArk.  His insights from managing dozens of responses are invaluable, and they are now yours through this special episode

#31 - Executive Order on Improving the Nation’s Cybersecurity

On this episode of CISO Tradecraft, you can learn about the new Executive Order on Improving the Nation's Cyber Security.  The episode provides a brief background on three security incidents which have influenced the Biden administration:
SolarWinds
Microsoft Exchange Servers
Colonial Pipeline Attack
The episode then overviews the various sections of the new Executive Order:
Policy
Removing Barriers to Sharing Threat Information
Modernizing Federal Government Cybersecurity
Enhancing Software Supply Chain Security
Establish a Cyber Safety Review Board
Standardizing the Federal Government’s Playbook for Responding to Cybersecurity Vulnerabilities and Incidents
Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks
Improving the Federal Government’s Investigative and Remediation Capabilities
National Security Systems
Thanks to CyberArk for sponsoring this episode.  Please check out CyberArk's new conference

#30 - Cloud Drift (with Yoni Leitersdorf)

This episode is sponsored by Indeni.  
On this episode of CISO Tradecraft, G Mark Hardy discusses with Yoni Leitersdorf (CEO and CISO of Indeni) the risks which can occur in a cloud environment after it has been provisioned. Essentially it's quite common for organizations to change their cloud environment from what was declared in a Terraform or Cloud Formation Script.  These unapproved cloud changes or Cloud Drift often create harmful misconfigurations and have the potential to create data loss events.
The podcast discusses the pros and cons of two key approaches to solve the Cloud Drift problem:
Static Security Testing in a build pipeline
Runtime Inventory Approaches 
The podcast features Yoni Leitersdorf.  Yoni founded a company (Indeni) to address Cloud Drift and discusses the business point of view of why this is a critical concern for the business.  If you would like to learn more about what Yoni is working on please check out Indeni
 
Yoni Leitersdorf can also be found on:LinkedIn
Twitter

#29 - Identity and Access Management is the New Perimeter

Identity is the New Perimeter.  On this episode of CISO Tradecraft you will increase your understanding of Identity and Access Management.  Key topics include:
Audit Trail
Authentication
Authorization
Identity Compromise
Least Privilege
Microsegmentation
Multi Factor Authentication (MFA)
Privileged Access/Account Management (PAM)
Role Based Access Control (RBAC)
Single Sign On (SSO)

#28 - AI and ML and How to Tell When Vendors Are Full of It

Have you ever heard a vendor has software features such as Artificial Intelligence (AI) or Machine Learning (ML)?   What does that mean?  On this episode we answer those questions so you know when vendors are full of it. 
Common reasons to use Artificial Intelligence
Types of Artificial Intelligence
What Machine Learning is
How Machine Learning works
How to select the right algorithm
References
How to Select Machine Learning Algorithms
ML Algorithm Cheat Sheet
63 Machine Learning Algorithms

#27 - Roses, Buds, & Thorns

Today, CISO Tradecraft hosts a 5 minute discussion to talk about reflection.  The concept is Roses, Buds, and Thorns.  It’s an exercise designed to identify opportunities to make positive change.
Roses- What’s working
Buds - What are new ideas
Thorns- What do we need to stop
If you would like to learn more please check out the article from MITRE
We would love to hear your feedback here.
Thank you,CISO Tradecraft

#26 - Blockchain for CISOs

On this episode CISO Tradecraft we dive into the world of blockchain.  As a CISO you may be expected to explain to executives what the technology does and possibly how it works.  Here's your briefing to make you successful.  We'll cover:
History of money and birth of bitcoin
Why blockchain uniquely solves an age-old trust problem
Potential business uses of blockchain technology
Smart contracts and why they work
Blockchain variants such as private and permissioned
https://www.cisotradecraft.com

#25 - Slay the Dragon or Save the Princess?

This episode CISO Tradecraft continues the Ransomware Discussion.  Do you slay the dragon (avoid the ransom) or save the princess (recover your files)? 
Talking points include:
Background on Ransomware
What if we choose to pay a ransom?
Is the Ransomware on the sanctions list?
Negotiation/Payments
Involving Law Enforcement
Involving Legal Council
Dealing with Cryptocurrencies

#24 - Everything you wanted to know about Ransomware

Would you like to know more about Ransomware?  On this episode of CISO Tradecraft, G Mark Hardy and Ross Young provide an in-depth discussion on Ransomware.  Key discussions include:
What is ransomware?
Why does it work?
Ransomware Types (Client-Side, Server-Side, & Hybrid)
How each of these enter a target environment
Ransomware Incidents
The Economics of Ransomware
How is Ransomware Evolving?
Why Ransomware continues to work :(
Ethical Issues to consider before paying
Ransomware Defenses
Please subscribe to the CISO Tradecraft LinkedIn Group to get even more great content
CISA Ransomware Guide Link

#23 - NSA’s Top 10 Cybersecurity Mitigation Strategies

If there's one place that knows how Advanced Persistent Threat (APT) actors work, it's the National Security Agency (NSA).  On this episode of CISO Tradecraft G Mark Hardy and Ross Young discuss NSA's Top Ten Cybersecurity Mitigation Strategies and how to use them to secure your company.
Since the mitigation strategies are ranked by effectiveness against known APT tactics, they can be used to set the priorities for organizations to minimize mission impact from cyber attacks.
Update and Upgrade Software Immediately
Defend Privileges and Accounts
Enforce Signed Software Execution Policies
Exercise a System Recovery Plan
Actively Manage Systems & Configurations
Continuously Hunt for Network Intrusions
Leverage Modern Hardware Security Features
Segregate Networks using Application-Aware Defenses
Integrate Threat Reputation Services
Transition to Multi-Factor Authentication
Link to NSA's Material

#22 - Modern Software Development Practices

Would you like to know the best practices in modern software development?  On this episode G Mark Hardy and Ross Young overview the 12 Factor App and its best practices:
Codebase: One codebase tracked in revision control with many deploys.
Dependencies: Explicitly declare and isolate dependencies.
Config: Store configurations in the environment.
Backing Services: Treat backing services as attached resources
Build, Release, Run: Strictly separate build and run stages 
Processes: Execute the app as one or more stateless processes.
Port Binding: Export services are via port binding.
Concurrency: Scale out via the process model.
Disposability: Maximize robustness with fast startups and graceful shutdowns.
Dev/Prod parity: Keep development, staging, and production as similar as possible.
Logs: Treat logs as event streams.
Admin Processes: Run admin/management tasks as one-off processes.
The episode of CISO Tradecraft discusses important software development concepts such as Extreme Programming, Lean Product Development, and User Centered Design Methodologies.  To learn more about these important concepts please look at the Pivotal Process

#21 - Your First 90 Days as a CISO (with Mark Egan)

This special episode features Mark Egan (Former CIO of Symantec as well as VMWare).  Mark discusses what he looks for during interviews with CISOs, what executives need to demonstrate during their first 90 days to be successful, and how he helps the next generation of cyber professionals at Merritt College.
Three Questions to ask during any interview:
What do you like best about this role?
What are the most challenging pieces of this role?
What does success look like for this role one year into the future?
Five Step Plan for New CISOs:
Start with an assessment of the current “As-Is” IT architecture
Perform Business Requirements Analysis (What are the strategic objectives, tactical issues, and business environment).
Design of the Future “To Be” IT architecture (application architecture, organization architecture, network architecture, infrastructure architecture)
Gap Analysis = (Future - Present).  This is the most important step as you need to determine a good list of alternatives for management.  Talk to consultants and peers in other companies to see how you can come up with a wide range of solutions.
Options to Bridge the Gaps = (Cost, Time, & Business Environment).  Present management with alternative approaches for transforming the organization.  Remember speak in business terms and specify ways that align with business objectives.  In terms of cyber it might be Ensuring Financially Significant Applications don’t have operational disruption, ensuring revenue and brand protection by securing internet facing applications, meeting compliance and regulatory concerns, etc.
Merritt College Overview Link
Volunteer to Help Merritt College Link
Contact Merritt College Link
Mark Egan LinkedIn Profile Link

#20 - Zero Trust

Would you actually like to learn about what Zero Trust is without a bunch of marketing jargon?  On this week's episode G Mark Hardy and Ross Young provide a thoughtful discussion on Zero Trust from NIST and Microsoft:
Microsoft's Zero Trust Principles
Verify Explicitly
Use Least Privileged Access
Assume Breach
NIST 800-207 Seven Tenets of Zero Trust
All data sources and computing services are considered resources
All communication is secured regardless of network location
Access to individual enterprise resources is granted on a per-session basis
Access to resources is determined by dynamic policy
The enterprise monitors and measures the integrity and security posture of all owned and associated assets
All resource authentication and authorization are dynamic and strictly enforced before access is allowed
The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communication and uses it to improve its security posture
Six Foundational Elements of Zero Trust
Identities
Devices
Applications
Data
Infrastructure
Networks

#19 - Team Building

Every leader needs to know how to lead and manage a team.  On this episode G Mark Hardy and Ross Young share tradecraft on team building.
Pitfalls to team building with becoming a hero
Organizational Maturity Models (Levels 1-5)
Tuckman Teaming Model (Forming, Storming, Norming, and Performing)
Leadership Styles (Telling, Selling, Participating, & Delegating)
Aligning your Team and Regaining former employees

#18 - Executive Presence

Having the ability to inspire confidence is crucial to lead others and allows you the opportunity to gain access to executive roles.  On this episode G Mark Hardy and Ross Young discuss executive presence:
What is it
Why you need it
How to get it
We will discuss Gerry Valentine's 7 Key Steps to building Your executive presence:
Have a vision, and articulate it well
Understand how others experience you
Build your communication skills
Become an excellent listener
Cultivate your network and build political savvy
Learn to operate effectively under stress
Make sure your appearance isn't a distraction

#17 - Global War on Email

If you use email, this episode is for you.  Attackers leverage email for ransomware, Business Email Compromise (BEC), account takeover, and other threats that can be reduced with effective technical controls (as well as user education.)
These three tools all involve placing simple entries in your DNS records.  To work effectively, the recipient also needs to be checking entries.  They are:
SPF = sender policy framework; designates only mail from designated IP address(es) or mail server(s) are valid.  For example:  v=spf1 include:spf.protection.outlook.com 
DKIM = domain keys identified mail; advertises a public key that can be used to validate all mail sent was signed with corresponding private key.  For example:  v=DKIM1\; k=rsa\; 0123456789ABCDEF…
DMARC = domain-based message authentication, reporting, and conformance; establishes policy of what recipient should do when message fails an SPF or DKIM check.  For example:  v=DMARC1; p='quarantine'
Check your settings at MXToolbox
Learn DMARC Link
Implementing these protections require a small amount of work but can yield outsized benefits.  In addition to allowing recipients of your mail to validate SPF, DKIM, and DMARC, ensure your incoming mail is checked for conformance as well, labeling, quarantining, or rejecting any that fail.
Lastly, blocking top-level domains (TLDs) with which you do not do business can significantly improve your security by short-circuiting many ransomware, command-and-control, and malware URLs that will be unable to resolve through your DNS.  Get the latest list from IANA
Great Background Reading from Australian Signals Directorate Link
Email Authenticity 101 Link

#16 - The Essential Eight

The Australian Cyber Security Center (ACSC) believes that not all cyber security controls are created equal.  The have assessed various strategies to mitigate cyber security incidents and determined there are eight essential cyber security controls which safeguard any organization more than another control. These controls are commonly known as, "The Essential Eight" are highly recommended.
Application control to prevent execution of unapproved/malicious programs including .exe, DLL, scripts (e.g. Windows Script Host, PowerShell and HTA) and installers.
Patch applications (e.g. Flash, web browsers, Microsoft Office, Java and PDF viewers). Patch/mitigate computers with ‘extreme risk’ security vulnerabilities within 48 hours. Use the latest version of applications.
Configure Microsoft Office macro settings to block macros from the internet, and only allow vetted macros either in ‘trusted locations’ with limited write access or digitally signed with a trusted certificate.
User application hardening. Configure web browsers to block Flash (ideally uninstall it), ads and Java on the internet. Disable unneeded features in Microsoft Office (e.g. OLE), web browsers and PDF viewers.
Restrict administrative privileges to operating systems and applications based on user duties. Regularly revalidate the need for privileges. Don’t use privileged accounts for reading email and web browsing.
Patch operating systems. Patch/mitigate computers (including network devices) with ‘extreme risk’ security vulnerabilities within 48 hours. Use the latest operating system version. Don’t use unsupported versions.
Multi-factor authentication including for VPNs, RDP, SSH and other remote access, and for all users when they perform a privileged action or access an important (sensitive/high-availability) data repository.
Daily backups of important new/changed data, software and configuration settings, stored disconnected, retained for at least three months. Test restoration initially, annually and when IT infrastructure changes.
Strategies to mitigate cyber incidents Link
Strategies to mitigate cyber incidents poster Link
Essential Eight Maturity Model Link Link