In this segment, we explore key areas critical to enhancing cybersecurity, focusing on multi-factor authentication and security training. By addressing vulnerabilities and promoting awareness, organizations can significantly strengthen their security posture and mitigate potential risks effectively.

Here is the verbatim discussion:

Identify the areas that are the most critical to you and I'll I'll pick an example here um multiactor authentication so um anyone that you on the front page of the newspaper you'll see uh organizations that or you'll see that criminals are are having these data breaches and they're stealing uh all these records these records end up being username and password and um and what's end up happening is uh with access of service is criminals are able to just you know their main entry point is credential stuffing and they can use automated tools that just go after an organization and then they just keep trying different combinations uh until they find an access to someone and then they get in they move laterally and get to an administrator so an organization can reduce their attack surface significantly just by having multiactor authentication um and it adds that extra layer of uh security in their environment and then there's other areas that are there but um you know that's the the biggest area um the other area is uh security training overall just making people aware it's a mindset it's a it's a culture and and identifying if I see a fishing email I need to report it and having a process around that and then and then building it over time um so maybe uh doing a simulated fishing exercise that turns into a uh ransing.

In this segment, we explore essential strategies for strengthening cybersecurity defenses, focusing on the importance of patching, device visibility, and continuous testing. By addressing vulnerabilities and maintaining up-to-date systems, organizations can enhance their security posture and mitigate potential risks effectively.

Here is the verbatim discussion:

And identifying making making sure that you keep up with the patching and and um maintaining the latest and greatest updates on all of your devices and also knowing where those devices are so um you know a lot of times what ends up happening um when I covered ransomware specifically uh as well as endpoint security and and um to ler extent on kind of the internet of things or iot side a lot of organizations just it was over 50% % of organizations didn't know the devices that they had in their environment and if you don't know that it's there and you don't know that there's a door or you know a device that's on your Network that has access to your um to effectively to your crown jewels and the the critical assets that you're trying to protect then you're completely in the blind you're in the dark um so that you know that's that's like the the best easy way to identify the areas where you need to improve and then around that you can actually take action so you can actually Implement uh and and Patch those systems and you can identify and and prioritize that effectively and actually build that into your your risk program now on this is more about ASM right the ASM providing of your infrastructure and and now Gartner is also calling it esm external attex surface management which gives you the full view of your complete digital Jesus not close enough is the answer so um really what it comes down to is um organizations like current state of the the market right now is organizations are really broken up into um kind of five different levels of maturity so it's it's really from zero all the way up to five um and and with that organizations that typically are in the continuous um security testing space and actually doing it on a continuous basis are the upper level five uh Arena and they typically have the budgets to support it ends up being Financial in healthare and to um you basically.

Highlights:

Identifying Weak Points and Prioritizing Patching: Experts emphasize the criticality of identifying weak points in network security and prioritizing patching efforts accordingly. By ensuring all devices are updated with the latest patches, organizations can reduce their attack surface and mitigate potential vulnerabilities.

Device Visibility: The discussion highlights the significance of knowing all devices on the network to effectively manage security risks. Many organizations struggle with device visibility, leaving them vulnerable to blind spots and potential security breaches. By maintaining a comprehensive inventory of devices, organizations can better protect their critical assets.

Continuous Security Testing: Experts delve into the importance of continuous security testing in enhancing cybersecurity resilience. Organizations at the highest maturity levels engage in continuous testing to validate their security measures effectively. By adopting a proactive approach to security validation, organizations can stay ahead of emerging threats and strengthen their defense capabilities.

Addressing vulnerabilities through patching, maintaining device visibility, and engaging in continuous security testing are crucial steps in bolstering cybersecurity defenses. By implementing these strategies, organizations can mitigate risks effectively and enhance their resilience against evolving cyber threats. This segment underscores the importance of proactive measures in safeguarding digital assets and maintaining a robust security posture in today's dynamic threat landscape.

Speakers:

In this segment, we explore a strategic approach to enhancing cyber resilience within organizations, emphasizing the "crawl, walk, run" methodology. By starting small and gradually advancing security measures, organizations can effectively improve their security posture.

Here is the verbatim discussion:

And what I've recommended over the years is uh taking the approach of crawl walk run so start small and and identify what your current state is figure out in Baseline you where you are from a security posture perspective and there's tons of organizations out there that can do these assessments there's tons of templates and and things out there that you know at given your organization you should be you you're currently at a level one or level two and your goal should be to get to the next level whether it's two or three and um identifying all those areas and how you can make that you can step from one area to the next and then from there you know ultimately kind of the the the key areas that organizations end up um fall you not prioritizing effectively and and can really um increase their of it wasn't anywhere near where it is today um and over the the past you know really 10 years a lot of things have have really moved to the cloud and there's been a lot of automation a lot of things like machine learning and artificial intelligence and a lot of these great tools that have U been brought to the market that allow us to to provide better defense uh against these types of attacks the the downside to that is those same tool same tools are actually available to criminals as well and although organizations have gone through their digital transformation you over the past 10 years um so is the the the hacking community and the criminals at large and and basically what's ended up happening is there's um a a giant ecosystem it's a it's a whole underground economy where you have uh.

Highlights:

Crawl, Walk, Run Methodology: Experts advocate for a phased approach to cybersecurity improvement, beginning with assessing the organization's current security posture. By identifying baseline security levels and prioritizing areas for enhancement, organizations can strategically progress from one security level to the next.

Utilizing Assessment Tools and Templates: Various organizations offer assessment tools and templates to help organizations evaluate their security posture effectively. By leveraging these resources, organizations can identify areas for improvement and develop a roadmap to advance their security maturity.

The Evolution of Cyber Threats: The discussion highlights the evolution of cyber threats over the past decade, with attacks increasing exponentially. The emergence of an underground economy, where nation states collaborate with criminal groups, has heightened the sophistication of cyber attacks, posing significant challenges for organizations.

Harnessing Technology for Defense: While advancements in technology, such as cloud computing, automation, machine learning, and artificial intelligence, have provided organizations with better defense capabilities, they have also empowered cybercriminals. The availability of these tools to both defenders and attackers underscores the importance of proactive security measures.

 Adopting a strategic approach to cybersecurity, starting with assessing the current state and gradually advancing security measures, is essential for building cyber resilience. By prioritizing effective security measures and leveraging available resources and technologies, organizations can mitigate risks and strengthen their defense against evolving cyber threats. This segment emphasizes the importance of proactive and adaptive cybersecurity strategies in safeguarding digital assets and maintaining resilience in the face of emerging threats.

Speakers:

In this segment, we delve into the evolving cybersecurity landscape, where nation-state actors and ransomware groups continuously exploit small windows of opportunity to compromise systems. We explore the changing attacker landscape and the significance of continuous security validation in addressing emerging cybersecurity challenges.

Here is the verbatim discussion:

Here is the verbatim discussion:

Brad LaPorte provides valuable insights into the current state of cybersecurity practices, emphasizing the need for organizations to embrace continuous security testing and proactive approaches to breach mitigation. He identifies five levels of maturity within organizations and highlights the growing adoption of continuous security testing, particularly among upper-level enterprise.

Here is the verbatim discussion:

Jesus uh not close enough is the answer so um really what it comes down to is um organizations like current state of the the market right now is organizations are really broken up into um kind of five different levels of maturity so it's it's really from zero all the way up to five um and and with that organizations that typically are in the continuous um security testing space and actually doing it on a continuous basis are the upper level five uh Arena and they typically have the budgets to support it ends up being financial and health care and to um you basically the global 500 that are in that aspect it's starting to go Downstream though which is great because I'm starting to see uh that you know in the lower levels uh uh areas there organizations are starting to get involved and then there's um a lot of manage detection response and and manage security um service providers that are integrating these types of security testings as part of their their larger stack so and they're automating a large portion of it which you ultimately makes it ideal for it to be 247 365 and implementing things like red you know automated red uh continuous automated red team or cart uh attack surface management and identifying you know where the actual attack surface today and that's a very important mindset like accepting that there will be those breaches h i see it more now than I have I ever have in the past two decades but it's not anywhere near where uh it needs to be and unfortunately um the root cause of a lot of what exists today is um it's nimi it's not in my backyard so it's not going to happen to me it's going to happen to somebody else and it's not until it's someone that's close to them so if they're in the industry say they're in retail and um they're the biggest competitor.

Highlights:

Continuous Security Testing: LaPorte discusses how organizations at the highest maturity level (level five) are actively engaged in continuous security testing, supported by robust budgets, particularly in financial and healthcare sectors and among global 500 companies. He notes a positive trend of adoption among organizations at lower maturity levels, facilitated by managed security service providers who integrate automated testing into their offerings.

Automated Testing and 24/7 Vigilance: The integration of continuous security testing into larger security stacks by managed service providers enables organizations to achieve 24/7 coverage. LaPorte highlights the importance of automated red team testing and attack surface management in identifying and mitigating potential vulnerabilities proactively.

Acceptance of Breach Inevitability: Despite growing awareness, LaPorte notes that acceptance of breach inevitability remains inadequate, with many organizations still adopting a "not in my backyard" mentality. He emphasizes the need for a cultural shift towards proactive cybersecurity practices, citing the prevalence of this mindset as a root cause of existing vulnerabilities.

LaPorte's insights underscore the critical importance of continuous security testing and proactive breach mitigation strategies in today's cybersecurity landscape. By embracing these practices, organizations can enhance their cyber resilience and better protect their assets against evolving threats. However, there remains a significant cultural barrier to overcome, with many organizations still failing to acknowledge the inevitability of breaches. Addressing this mindset is essential to fostering a proactive cybersecurity culture and effectively mitigating risks in an increasingly complex threat environment

Speakers:

Here is the verbatim discussion:

Days was not so much there outside and then try to compromise systems so interestingly what has happened is the same thing today is being done by the nation state actors they're just looking for that window of small opportunity and whenever that opportunity is there they would like to grab it right the same is true for ransomware guys so the adversary is doing this continuously in terms of looking for that one single opportunity for a few minutes or few hours as well as the number of changes that's happening is also at that same frequency right the release frequency people do release every day what I call the human element so they'll get in through fishing or social engineering you know they'll convince you knock on the door and and you know try to figure out a way to get into your your organization and it's really just a it's typically an outside in view you know it's like if I was an attacker how would I break into this house how would they how would I break into your infrastructure it helps identify those weak points so you can address it and sometimes it ends up being um areas where you know it might be on email security because of fishing or social engineering it might be just uh security awareness training and leveling up your people in terms of being aware of these types of scenarios and then it might be um actionable advice as I go along and um the number one piece of advice that I have to organization s is uh to uh fully Embrace horizontally and vertically throughout your organization and and it goes above and beyond just your own four walls to have the right mindset that you will eventually be breached so do you see that mindset I mean do you see and you have worked with both the smbs and the large Enterprises do you see that mindset today and that's a very important mindset like accepting that there will those breaches huh I see it more now than I have I ever have in the past two decades but it's not anywhere near where uh it needs to be and unfortunately um the root cause of a lot of what exists today is um it's nimi it's not in my backyard so it's not going to happen to me it's going to happen to somebody else and it's not until it's someone that's close to them so if they're in the industry let say they're in retail and um they're the biggest competitor.

Highlights:

The speaker, a former army officer, reflects on their experience encountering nation-state cyber attacks early in their career. They describe the evolution of cybersecurity tactics, from traditional forensic methods to modern cloud-based and automated solutions.

Here is the verbatim discussion:

In the realm of risk communication, simplicity and clarity are paramount when conveying complex information to management or board members. While traditional models like the 5x5 matrix are widely used, some organizations opt for a more intuitive approach, such as using heat maps, to present risk data. This discussion explores the effectiveness of heat maps as a tool for risk communication and their potential advantages over numerical-based models.

Here is the verbatim discussion:

Effective communication of risks to management or board members is crucial for informed decision-making within organizations. One commonly used model for this purpose is the 5x5 matrix, which assesses risk based on likelihood and impact. While this model is popular and resonates well with many boards, it also faces criticism within the industry.

Here is the verbatim discussion: 

How would you uh communicate that risk to themanagement or board members right so the traditional model of the 5x5 matrix likelihood and impact and you know high medium low etc it's the most popular model it's a model that many boards respond to well and and it's a model that will resonate with those boards there are plenty of detractors in our industry who will point out that that likelihood impact is is a messed up mess um some people will talk about how the scales are ordinal and yet some people use it as a multiplicative in other words  five and five is twenty-five not ten uh you multiply the numbers instead of adding them which with an ordinal scale makes no sense but helps to demonstrate the drama of this is really bad this is really good you know 1 to 25 is a much more pronounced scale. 

Highlights :

Traditional Model: The 5x5 matrix, with its categorization of risk into high, medium, and low based on likelihood and impact, is widely adopted and understood by boards.

Model Criticisms: Despite its popularity, some industry critics argue that the likelihood-impact scale within the 5x5 matrix is flawed. One critique is the treatment of scales as ordinal rather than multiplicative, leading to potential misinterpretation.

Multiplicative Approach: Despite criticisms, some organizations opt for a multiplicative interpretation of the 5x5 matrix, where the numerical values represent a more pronounced scale of risk severity. This approach aims to emphasize the magnitude of risks and their potential impact.

While the 5x5 matrix remains a prevalent tool for risk communication, it's essential to acknowledge its limitations and potential for misinterpretation. Organizations should consider the nuances of risk communication and tailor their approach to effectively convey the severity of risks to management or board members.

 https://twitter.com/AllanAlfordinTX

https://www.linkedin.com/in/allanalford/

Effective risk communication to management or board members is essential for informed decision-making. This clip explores various models and approaches for communicating risk, ranging from traditional methods to more visually-oriented techniques.

Here is the verbatim discussion:

 https://twitter.com/AllanAlfordinTX

https://www.linkedin.com/in/allanalford/

Here is the verbatim discussion:

The CISO Platform Summit welcomes attendees to a decade-long journey of collaboration and knowledge-sharing among senior security executives, fostering a safer online world. Omri Sejkov, CEO of Profero, presents a captivating session on Iranian cyber threats in the Israeli cyberspace, titled "Same Kitten, Different Name." Despite pandemic restrictions, the virtual platform enables engaging presentations, with hopes of in-person interactions in the future.

Here is the verbatim discussion:

Here is the verbatim disussion:

In this insightful discussion, two cybersecurity professionals, Matthew and his colleague, delve into the intricacies of understanding organizational dynamics and navigating challenges within the cybersecurity landscape. The conversation touches upon various aspects, including the importance of comprehending an organization's business culture and strategy, the challenges of data management, and the influence of mentorship and continuous learning in career development.

Here is the verbatim discussion:

In this insightful discussion, a new Chief Information Security Officer (CISO) shares their top priorities for the first month on the job. Emphasizing the importance of building relationships, understanding the business strategy, and assessing the alignment of the current security strategy, the conversation provides valuable insights for cybersecurity professionals stepping into leadership roles

.

Here is the verbatim discussion:

Here is the verbatim discussion:

In this insightful conversation, the speakers delve into the intricate world of cybersecurity, focusing on the challenges of data protection, business alignment, and effective communication with organizational leaders. The discussion highlights the importance of understanding where data resides and building relationships with business leaders to demonstrate the value of cybersecurity in supporting overall business strategy.

Here is the verbatim discussion:

There there's as you as you mentioned there's all this data whether it's on individuals hard drives  i once saw a chief legal officer that put all of his important documents on his hard drive uh we had to have a disaster recovery business continuity discussion about how fragile his hard drive is um we have data everywhere in this industry and data leakage protection there's solutions and tools that say they'll discover thing but who has access is actually easy once you know where the data is most systems you can right click and look and see who has access but you can't right click on something you don't know where it lives building those relationships with those leaders to show that you have value to their business strategy not a security value not a dlp value not a intellectual uh property leakage value but that you're supporting the business once you're successful in getting the business leader to recognize that you are a business leader then they want to learn about security for their business value where i made mistakes in the past as i came in as the security expert and demanded the business leaders do the security things and i was so  right you have like so many acronyms and nobody cares for those right so so how to bring in uh business alignment how how to change our language because a lot of times i hear the ciso saying oh those guys don't understand security and and stuff like that and i think um it's very unfair to expect them to learn security they do what they do very well it's probably important for us to communicate it to them in the right way so matt what are some of your tactics and strategies to convert  i try to recognize being humble and seeking to understand listening to understand it's very easy to listen to a conversation and take notes of what you're going to respond to or listen for where the speaker is making a mistake so that you're prepared to show how you're smarter than you're the smartest guy in the room um that that just doesn't work so um i i really believe that going in and asking questions seeking to understand taking notes actual listen to what they're there for in my current environment uh at ntt research i am surrounded by folks that have no less than two phds most of the people have more than two phds in completely different subject matter cardiology and and physics like totally different um people and these guys are true geniuses that i work with um i have a lot to learn from them and and the the thing every every monday night i sit down with uh several researchers and i learn two to three new topics or papers that are being written and it's hard for me i think i'm a smart guy.

Here is the verbatim discussion: