We open up our 2016 year interviewing Shawn Tuma on the show. Shawn is our legal eagle, and a regular contributor to the podcast. This episode ran a little bit long (OK a lot long) but I think you'll enjoy the show... 

In this episode...

• Most important cybersecurity-related legal developments of 2015
  • Tectonic Shift that occurred with “standing” in consumer data breach claims
    • Discussion of law prior to Neiman Marcus case, and post Neiman Marcus
    • Does this now apply to all consumer data breach cases?
    • Immediate impact? Companies now liable?
    • Lesson is in seeing the trend and how incrementalism works
• Regulatory Trends
  • FTC & SEC gave hints in 2014, post-emergence of Target details
  • Wyndham challenged authority – came to fruition in August 2015
  • SEC not far behind – significant case in September 2015
  • Aggressiveness of FTC is substantial – FTC v. LabMD … all over LimeWire
• Officer & Director Liability
  • 2014 – SEC Comm. fired the warning shot … pointed the finger
  • Shareholder derivative litigation
  • Individual liability of IT / Compliance / Privacy “officers”
• Major 2016 Legal Trends
  • Regulatory enforcement … which, by the way, is why NIST is becoming default
  • Shareholder Derivative – much more likely than consumer class actions at this time
  • Lessons from both of these: when you need to persuade the “money folks” that they need to act, mention D&O Liability (especially Caremark) and Regulatory focus on individuals … now they're in the cross-hairs
  • Realization that cybersecurity is more of a legal issue than anything else (IT or business) b/c it is the legal requirements and consequences that ultimately drive everything

In this episode...

• We discuss what in the world is going on in the healthcare space, and why they’re such a target for attackers
• Dustin discusses why the explosion in digitalization in health care is both amazing and terrifying
• We discuss future-proofing “smart” healthcare
• I stumble on “the fundamentals”
• Dustin discusses the security of “data analytics” in the healthcare space
• I ask how we can make health care professionals better security people, without making them security people
• I ask Dustin what the healthcare industry should be doing, going forward into 2016

Guest

• "Dustin" is a progressive CISO at a Fortune 250 Healthcare organization

Thanks for joining us! This is a very important episode with true experts on the topic of cyber insurance. I was lucky enough to get an attorney and a VP of an insurance firm who specialize in the topic and their depth of knowledge and candor may shock you.

The net is that cyber insurance is a positive for our industry.

In this episode..

• Eran says that if you don’t do good security, the courts will frown down upon that
• Keith tells us why insurance covers security, but it does not cover negligence
• We start back on the discussion on the importance of knowing your critical assets
• Keith discusses why the insurance market is essentially a mirror of your program
• Eran talks about how his team dissect and investigate breaches to improve understanding
• Keith and Eran discuss how the process of buying cyber insurance can actually lead to improved security

Guests

• Eran Kahana ( https://www.linkedin.com/in/erankahana ) - Attorney, Maslon, LLP with extensive data security experience and an expert in cyber insurance marketplace.
• L.Keith Burkhardt ( https://www.linkedin.com/in/keith-burkhardt-587b3772 ) - VP, Kraus-Anderson Insurance where he works towards innovative products and services for the industry and has been addressing the cyber insurance market for about two years.

In this episode

I interview Mike Daugherty - author of The Devil Inside the Beltway [Amazon.com link] live from the Security Advisor Alliance first-ever Summit in Dallas, TX. Mike was kind enough to sit down with me (twice, thanks to a tech failure) and tell his absolutely surreal story of what happened to him, his company at the hands of what can only be described as an insane situation.

If you own a business, or manage a business, or work in enterprise -- you need to hear Mike's story. If it wasn't documented and video recorded, you'd never believe it's true.

Truth be told, I've been a supporter of the FTC as an advocate for the victims of breaches - the person who's information is stolen. After hearing Mike's story... I have had my mind completely changed.

In this episode

• We start a constructive discussion addressing the problem of the ‘talent shortage’
• The panel discusses the general lack of understanding of the big picture challenge from both sides: business and security
• The panel discusses basic security issues in an expanding ecosystem of Internet connected things
• The panel discusses some real potential solutions to our talent issue

Guests

• Bryce Austin ( @BryceA )
• Holly Miller ( @OPSEC_Girl )
• Jeff Man ( @MrJeffMan )
• Mike Kearn ( @MichaelKearn )

In this episode

• Rob & Liam discuss the practical applications of threat intelligence for today's enterprise
• We discuss what enterprise threat intelligence really is (and also what it isn't)
• We discuss the place of feeds, tools, processes and people in the mechanics of the program
• We discuss the need to conduct a program-based intelligence approach for the enterprise

Guests

• Liam Randall ( @hectaman ) - With a career spanning 20 years, Liam Randall has worked at every level of the information systems pipeline- from building and operating large networks, developing and maintaining large 100M+ e-commerce solutions, to designing and implementing global network security monitoring sensor grids. A frequent speaker and trainer at security conferences Liam has trained over 1000 students on advanced incident response with a focus on leveraging the open source Bro Platform. 
  • https://www.linkedin.com/in/hectaman
• Robert M. Lee ( @RobertMLee ) - Robert M. Lee is the founder and CEO at Dragos Security LLC where he helped design and build CyberLens - a cyber situational awareness software tool for critical infrastructure networks. He is also a non-resident National Cybersecurity Fellow at New America focusing on policy issues relating to the cyber security of critical infrastructure. For his research and focus areas, Robert was named one of Passcode’s Influencers and awarded EnergySec's 2015 Cyber Security Professional of the Year.
  • https://www.linkedin.com/in/robert-m-lee-b2096532

In this episode...

• Raf sits down with Howard Shmidt to talk about Cyber Security from the public to private sectors and everything in between.
• Howard & Raf talk through challenges of cyber security in the board room
• Howard gives us some of the challenges that government faces, from his experience
• Don't miss this episode!

Guest

• Howard A. Schmidt ( @HowardAS ) - Former Supervisory Special Agent,Director of Computer Crime and Information Warfare, AF OSI, Former CSO Microsoft Corp. Former Chairman of White House Critical Infrastructure Protection Board, VP, CISO eBay Inc. Special Agent, US Army CID (Reserves). Law Enforcement Officer Chandler Police Department, AZ

In this episode...

• Raf asks why we talking about global supply chain, 3rd party risk again
• Josh discusses what little things we are not thinking about today, that we should
• Josh discusses what happens as companies move critical data to the cloud
• We discuss regional IT in a global data world
• Raf opens up the “tiny company 3rd party” can of worms
• We discuss the cyber crime survey and CISO board reporting results; link:
  http://www.csoonline.com/article/2978020/security-leadership/do-boards-of-directors-actually-care-about-cybersecurity.html
  
• What about supply-chain issues with electronic components, software?

Guest:

• Josh Douglas - CTO for Raytheon Cyber Products – has nearly two decades of experience in helping global enterprises and government agencies secure their most prized business/mission assets. During his past 9 years at Raytheon, he has overseen Raytheon’s Cyber Security Intelligence Operations, Malware Concepts, Security Infrastructure Operations and Research Technologies tasked to produce effective forward-looking cyber software solutions to contain and control advanced threats. These solutions are used to help commercial and government entities protect their enterprises and the global cyber supply chain from ever-changing advanced persistent threats and malware.
  
  Prior to joining Raytheon, Joshua has a successful track record in network security operations and engineering management positions, securing enterprise environments while promoting contextual response. Prior employers include Enterasys Networks, Kronos, Genuity, MIT Lincoln Laboratory and other prominent enterprises. Joshua earned a Bachelor of Science Degree in Computer Science from Appalachian State University and currently holds a number of technical computer and network security certifications. LinkedIn: https://www.linkedin.com/in/jdouglas

In this episode...

• Kirby tells us what OSINT is
• We discuss how much we are giving away on digital channels?
• We discuss if there is such a thing as anonymity anymore
• Location sharing in apps — the bad, the ugly, the scary
• Kirby and Michael discuss “checking up on your executives”
• Raf talks about “logo pages” — why do these still exist?!
• Kirby gives us some thoughts on OPSEC
• Kirby leaves us with a dose of reality about privacy in today’s world

Guest

• Kirby Plessas ( @kirbstr ) - Kirby is the CEO of Plessas Experts Network, Inc. She did some things before this too, but we can't tell you about them or we'd have to black-bag you and send you to Gitmo. You can get her LinkedIn bio here: https://www.linkedin.com/in/kirbyp.

In this episode...

• Brandon, Michael and I discuss the challenges of leadership and how leadership is more than just telling people what to do. Brandon gives us some of his back-stories and anecdotes to illustrate his points on leadership along the way.
• I promise you'll love this episode, and I highly encourage you to go donate what you're able to, to Red Circle Foundation (http://redcirclefoundation.org).

Guest

• Brandon Webb ( @BrandonTWebb ) - Brandon is a former Navy SEAL, bestselling author and CEO of Force12 Media. He founded Red Circle Foundation as a way to give back to the families of the Special Ops community in a meaningful way.

Links

• Red Circle Foundation - http://redcirclefoundation.org/ 
• SOFREP - http://sofrep.com
• Brandon's website - http://brandontylerwebb.com/

In this episode...

• We discuss what life is like as the CISO when you have all the responsibility for, but no administrative access (or hands on keyboard)
• Brandon tells his story about how his IT organization went from in-house, to out-house, and how they got where they are
• Brandon tells us the process and strategy he uses to get a handle on his security
• We discuss why visibility is one of the most important things to outsourced IT (and security)
• Brandon tells a story of an incident where things went very sideways
• We discuss the balance between outsourcer scalability and customer deviations
• Brandon tells us why sometimes it takes 3 months to scan your environment for a vulnerability ( your head will explode )
• …and so much more

Guest

• Brandon Dunlap ( @bsdunlap ) - Brandon is the global Chief Information Security Officer for a an employee-owned, global leader in building critical infrastructure in energy, water, telecommunications and government services currently operating in more than 100 countries through consulting, engineering, construction, operations and program management.

In this episode...

• We discuss the ever-growing need for strong leadership in security
• I ask whether experience and longevity in a position naturally brings leadership qualities
• We talk through how leadership interplays with other competencies
• Michael asks whether the security leader has a place at the executive table (the "big kids table")
• Michael asks if the MBA has value in security leadership
• We discuss the model my team uses for leadership and how we build them
• Michael and Heath discuss various competency models for leadership
• We discuss measuring, KPIs and relative distance
• We discuss how leaders can make better decisions
• Heath leaves us with an Alex Hutton quote

In this episode

• Raf asks - Why haven’t we solved the same old software security bugs?
• James asks how a security team gets out of the way and still get better security?
• We discuss threat modeling, and channel a bit of John Steven
• Jeff talks about the OWASP ESAPI and standard security libraries and controls
• Jeff talks about “libraries with known vulnerabilities” and the role of open source components
• Raf brings up the ugly side of enterprise outsourcing - code development by committee
• We discuss static, dynamic and run-time security tools
• Raf asks Jeff what the RIGHT approach to creating a software program looks like

Guest

• Jeff Williams ( @PlanetLevel ) - Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. In 2002, Jeff co-founded and became CEO of Aspect Security, a successful and innovative consulting company focused on application security. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many other widely adopted free and open projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.

In this episode

• Talent shortage - is it real, and how bad is it?
• We discuss: what does negative unemployment actually mean?
• Michael asks- ecurity is still relatively new, how do we determined what “qualified” means?
• What skills are necessary to be a good security professional?
• Hiring - we discuss how we get better at screening potentially qualified employees
• We discuss how we can vet out real experience, versus resume skills
• Mark and Michael discuss specialization, automation, and optimizing our workforce
• Mark shares his thoughts on growing and retaining top talent

Guest

• Mark Orlando ( @MarkAOrlando )  - As the Director of Cyber Operations, Mark is responsible for Foreground’s Federal practice as well as the Virtual Security Operations Center (V-SOC) managed service. He leads a national team of analysts, engineers, incident responders, and managers who secure some of the most high profile networks in the Federal, financial, commercial, and power and utilities industries. As the senior operations subject matter expert, he is also responsible for security services strategy and advises on strategic Foreground initiatives such as threat intelligence analysis, custom analytics development. Mark is also a key advisor to the company’s award-winning educational unit, Foreground University. Prior to joining Foreground Security, Mark advanced through the technical ranks as a Security Analyst and Technical Lead in a variety of operations environments. In his 13+ years of experience, he has built and led security operations teams at the White House, the Department of Energy, the Pentagon, and numerous commercial organizations. He has also managed the operations division of a major Managed Security Service Provider supporting hundreds of private and public sector clients. Mark enjoys teaching and learning from others. He has presented on security operations and assessment at the Institute for Applied Network Security Forum and RSA Conference. Mark has earned the CISSP, PMP, CEH, ITIL, and multiple SANS GIAC certifications and holds a B.S. In Advanced Information Technology from George Mason University. Mark served in the US Marine Corp where he was a Marine Artillery NCO.
  
  Foreground Security (http://foregroundsecurity.com/)

In this episode

• We take a little peek inside the mind of a CEO, from the security perspective
• We discuss the state of information security in the last decade
• Dan shares his wisdom on how the role of a security professional and security leadership has changed over the course of his career
• We discuss about the talent shortage - and get an in-depth look at solving some of this problem
• Dan shares with us his views on balancing people, processes and technology resources to achieve meaningful security
• We talk strategy, and Dan and the guys talk through why it's so vital
• We get Dan's "closing remark" (something you won't want to miss)

Guest

• Dan Burns, CEO Optiv, Inc. -  Dan Burns brings more than 23 years of business, technology and security industry experience to his role as chief executive officer. In this role he is responsible for the development and implementation of high-level strategies and direction of the company’s growth. Being able to provide clear insight into navigating the complex information security landscape is a priority for Burns. His philosophy is to focus on building long-term relationships with clients, working with them to simplify their lives and becoming a trusted information security partner rather than a reseller or outside consultant.
  From 2002 when he co-founded Accuvant, until 2012 when he assumed his position as the company’s first CEO, Burns served as senior vice president of Accuvant’s sales organization. In that role, he was responsible for strategic planning, sales growth and problem resolution. Burns co-developed and helped to successfully execute on Accuvant’s initial vision – to build a company with the breadth, depth and capabilities to address the information security needs of organizations worldwide. He launched the sales force and grew it to a national powerhouse organization within a 10-year period, conducting business with nearly half of the Fortune 500, and driving $740M in revenue in 2014.
  Prior to his achievements with Accuvant, Burns was the regional vice president of sales for the western region of OneSecure. He played an integral role in transitioning the organization from a managed security services (MSS) provider to a product company, delivering to the marketplace the first intrusion prevention system (IPS) and generating $40M in product sales in the first year.
  Previously, as the western region vice president for Exault, an integrator, consulting organization and reseller, Burns secured some of the largest enterprise clients in the Rocky Mountain region and helped grow revenues to nearly $150M in two years. He also held positions at Access Graphics, Arrowpoint, and Netrex where he supported some of the largest telecommunication companies in building their information security programs, implementing technology and taking advantage of Netrex’s world-class MSS.
  Burns earned a bachelor’s degree in economics from San Jose State University