In this episode...

• What is the Security Advisor Alliance?
• We discuss some of the issues facing CISOs today
• Clayton gives us his perspective on how to solve some of those issues
• Clayton tells us about the mission of the SAA
• If your'e a CISO, are you signed up for the SAA Summit?  Shoot Clayton an email

Guest

• Clayton Pummill ( @cp48isme ) - https://www.linkedin.com/pub/clayton-pummill/10/32a/44a - Clayton is the executive director of the Security Advisor Alliance. He also has a storied background so I encourage you to give it a check!

In this episode...

• Defenders are set up to fail? how and why
• How do we fill forensics and IR positions?What skills and qualifications do forensics/IR need to have?
• How can enterprises get better at IR from where they are today?
• How do we solve some of the problems plaguing the security industry?

Guest

• Andrew Case ( @attrc ) - Andrew Case is a senior incident response handler and malware analyst.He has conducted numerous large-scale investigations that span enterprises and industries. Andrew's previous experience includes penetration tests, source code audits, and binary analysis.  He is a core developer on the Volatility memory analysis framework and co-author of the highly popular and technical forensics analysis book "The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory".

In this episode...

• David Shearer, Executive Director for ISC2 joins us to talk about the results of the ISC2 2015 Information Security Workforce Study
• We ask David to highlight some of the results
• We discuss how malware and application security were identified as top threats 3 years in a row -- and what's to be done about this
• We discuss the major discrepancy between priorities from this survey and recent CIO surveys
• We discuss the importance of communication skills (identified in the survey) while leadership and business management are far down the scale
• We discuss with David how under his leadership ISC2 can build a much tighter alignment to business -- not just more security certifications

Guest

• David Shearer - David Shearer has more than 27 years of business experience including the chief operating officer for (ISC)², associate chief information officer for International Technology Services at the U.S. Department of Agriculture, the deputy chief information officer at the U.S. Department of the Interior, and the executive for architecture, engineering and technical services at the U.S. Patent and Trademark Office. Shearer has been responsible for managing and providing services via international IT infrastructures, and he has implemented large-scale SAP Enterprise Resource Planning (ERP) projects. Shearer holds a B.S. from Park College, a M.S. from Syracuse University, management and technical certificates from the U.S. National Defense University, and he is a U.S. federal executive presidential rank award recipient. As (ISC)² Executive Director, Shearer is responsible for the overall direction and management of the organization.

   

In this episode...

• A quick walk-through of Rob’s talk (“Hacker ghost stories”), and why it’s completely relevant today
• Simple things that work
  • blocking java (externally)
  • effectively blocking “uncategorized” sites in your forwarding proxies
  • (not) resolving DNS internally
  • (not) default routing to the Internet from inside
  • canaries in the coal mine, or evil canaries

Guests

• James Robinson ( @0xJames ) - https://www.linkedin.com/in/0xjames Currently the Director, Threat and Risk Management at Accuvant-Fishnet Security and part of the Office of the CISO. He has a long and storied career of success as an enterprise defender across various industries. 
• Rob Fuller ( @mubix ) - Rob is an experienced InfoSec industry insider, with many interesting achievements and accomplishments. He's easily findable, as are his many public doings.

In this episode...

• Where do you even start with “threat intelligence”?
• Ryan talks about context, and why it’s *the* most important thing when it comes to threat intel
• How does a SME make use of a “luxury item” like threat intelligence?
• Michael asks what are 1-2 things you can do *immediately* as an SME?
• What are the basics, beyond the basics of security? Where do you make your first investment?
• Getting your own house in order is harder than it sounds, so what then?
• Michael drops some #RiskCatnip
• Michael breaks down the “feedback loop” and his basic questions to ask/answer
• Down the rabbit hole of shiny boxes, standards, and productized threat intelligence
• The overlap of data on commercial threat intelligence providers

Guest

• Ryan Trost - Ryan is the CIO of ThreatQuotient and knowledgeable on matters of intelligence with his extensive background and history in the community.

In this episode...

• Michael C and the team talk bout "going back to basics" and the need for security fundamentals
• Michael C talks a little about why we (security professionals) fail at fixing problems at scale
• We dive into the need for automation, and Michael C talks about why creating more work for security professionals is a bad thing
• Michael C and the crew talk through why many of our metrics fail, highlighting the need to get away from the typical dashboard approach of "bigger numbers is better"
• We discuss the balance between false positives and false negatives -- a super critical topic
• Rafal brings up the role security professionals play in software security, and why we can't be expected to drive the daily tasks
• We talk through centralized vs. de-centralized security, and how to understand which works better, and where
• Michael C gives us his 3 key take-aways for listeners (don't miss these!)
• We talk through "assume breach", and what it means for security

Guest

• Michael Coates ( @_mwc ) - Currently, Michael is the Trust and Security Officer at Twitter where he leads the information security team and drives overall security efforts across the organization to a common goal and objective. Michael is a staple of the OWASP community now serving on its board and having contributed countless hours and lines of code to the effort. 

In this episode...

• We learn the origins of "RSnake" as told by Rob himself
• Rob gives us a peek into the dark side, from his contacts and experiences
• We discuss the black-hat economy as it's verticalized, specialized, and matured
• Rob discusses the balancing act of the good vs. bad and why the situation is as bad as it needs to be
• We discuss some of the things businesses and defenders really need to worry about
• Rob gives us his view of the inevitability of security from SMB to enterprise -- and why things are so good, or bad, or just right
• We discuss the different ways security is being understood, implemented and matured and why it's futile to chase absolutes
• Michael and Rob dive into the labor shortage in security - real, perceived, or misunderstood?
• Rob gives us his outlook on where things are going over the next decade or so

Guest

• Robert "RSnake" Hansen - ( @RSnake ) - Strategic. Web security expert. Visionary. Robert brings more than 20 years of web application and browser security experience, innovation, and vision to the WhiteHat Security team. Under Robert’s leadership, WhiteHat Labs successfully launched Aviator, the most secure browser available, for Mac and Windows, quickly racking up more than 170,000 downloads in less than six months. When asked about WhiteHat Labs’ mission, Hansen said, “Labs will strive to provide prototypes that go beyond customer expectations, to delight the user.” Before WhiteHat, Robert was the CEO of SecTheory and Falling Rock Networks. Robert has co-authored several books including XSS Exploits and Website Security for Dummies. Robert is also the author of Detecting Malice. He is a member of WASC, APWG, IACSP, ISSA, APWG and has contributed to several OWASP projects, including originating the XSS Cheat Sheet. When he is not breaking the web to make it stronger, Robert enjoys watching Formula One racing.

In this episode...

• The blog post that started it all - http://blog.norsecorp.com/2014/11/10/the-new-reality-in-security-offense-always-wins-and-defense-always-loses/
• Vince, tells us what he means by "Offense always wins, defense always loses"
• We disagree over this snip from his blog post: "To “win” in cyber security, defense must be right 100% of the time, while offense only has to be right once. We must wake up to the reality that defense is an impossible task; no matter what actions we take, we will lose."
• We discuss how we get away from being Eeyore defeatists?
• Vince give us security strategies he is advocating knowing that defense is better equipped, and better funded
• We briefly mention high-value assets, and why it's even more critical today than it has ever been before, and why we still stink at it
• We challenge Vince to give us some tangible steps to managing risk better, to get away from winning/losing?
• We discuss how we compress delivery time lines for security competencies? (Average time to deliver a technical control is months, plus budget cycle - maybe years)
• We close with lessons learned from your Vince's rich experience that he'd like to share with the listeners, to change the nature of the win/lose conversation

Guest

• Vince Crisler - Vince has done some very interesting things in his background including former Communications Officer with the US Air Force, who also worked at the White House as Presidential Communications Officerm backed security start-ups, and chairing a Washington DC OSINT group. He's definitely one of the people you should get to know.

Hi everyone! Welcome to the very first episode of the Down the Security Rabbithole Podcast for 2015! On this opening episode, Jeff Man joins us to talk truth to power on PCI-DSS and shatters myths for us.

In this episode

• Jeff tackles some common misunderstandings about PCI
• The crew discusses PCI – what’s right about it and what’s wrong about it
• Jeff tells us why he believes if you’re secure you’re compliant, but if you’re compliant you’re probably not secure
• The $64M question- Isn’t EMV, P2PE, and tokenization going to spell the end of PCI?
• Jeff tells us what to look forward to with PCI DSS v3.0

Guest

• Jeff Man ( @MrJeffMan ) - Mr. Man has 13 years of DoD experience (10 at NSA as a Cryptanalyst/Information Security Analyst), 18 years of commercial consulting – pen testing, vulnerability assessments, security architecture reviews, and 10 years as a QSA doing PCI (and yet he's never conducted a PCI audit and never been a CISSP). As a QSA he's been involved with most of the major companies that experienced breaches in the mid-2000’s (Walmart, TJX, Heartland) so he can speak with some credibility about recent breaches in the past year or so.

In this episode

• Michelle explains to us what Enterprise Architecture is, and what it isn't
• Michelle gives her take on how both security and enterprise architecture both support each other
• We discuss the roll of standards, standards, standards - and why you can't have security without it
• We talk about GRC
• We talk through roles & responsibilities definition between security, architecture, and the rest of IT
• "Application Portfolio Rationalization" --the most impossible project. Ever.
• Michelle schools us on data, high-value assets, meta-data and the really hard topics for security
• Michelle gives us a series of examples of "HOW" we can find high-value assets, and start security there
• Michelle addresses the phrase "business alignment" since it's pivotal to enterprise architecture

Guest

• Michelle-Marie Strah ( @CyberSlate ) - Director, Enterprise Architecture at NBCUniversal – recently joined the newly formed Strategy and Architecture team at NBCUniversal designed to drive enterprise architecture, solutions architecture and innovation management across all companies in the NBCUniversal global portfolio. Previously she was at Microsoft Corporation worldwide headquarters where she was responsible for leading emerging markets cloud deployments, go to market and compete strategies in Latin America for public, private and hybrid cloud offers (both Azure and partner hosted clouds). As part of her role on the Applied Incubation Team she worked closely with partners, CIOs and government officials as well as internal CTO, legal, and chief security officer teams in the region to ensure privacy and security standards for government and private sector cloud adoption in Latin America. As an enterprise architect, Michelle specializes in governance, risk, compliance, information security and enterprise information management and has decades of experience in highly regulated industries, government, defense and healthcare.

Additional Links

• IBM Security Framework: http://www.redbooks.ibm.com/abstracts/sg248100.html?Open
• OSA: http://www.opensecurityarchitecture.org
• TOGAF: The Open Group Architecture Framework: http://www.opengroup.org/togaf/

In this episode

• We revisit the 'human' side of hacking
• Chris tells us all about the Defcon CTF his team has hosted
• We discuss the role human nature plays in social engineering, or "Why the bad guys always win"
• Chris gives us his tips for making it harder for social engineers
• Michael and Chris talk metrics and measuring "getting better"

Guest

• Chris Hadnagy ( @HumanHacker ) - Chris Hadnagy (author of Social-Engineering: The Art of Human Hacking and Unmasking the Social Engineer: The Human Element of Security) is a speaker, teacher, pentester, and recognized expert in the field of social engineering and security.
  
  Chris Hadnagy is the President and CEO of Social-Engineer, Inc. He has spent the last 16 years in security and technology, specializing in understanding the ways in which malicious attackers are able to exploit human weaknesses to obtain access to information and resources through manipulation and deceit.
  
  Chris is a graduate of Dr. Paul Ekman’s courses in Microexpressions, having passed the certification requirements with an “Expert Level” grade. He also has significant experience in training and educating students in non-verbal communications. He hold certifications as an Offensive Security Certified Professional (OSCP) and an Offensive Security Wireless Professional (OSWP).
  
  Finally, Chris has launched a line of professional social engineering training and penetration testing services at Social-Engineer.Com. His goal is to assist companies in remaining secure by educating them on the methods used by malicious attackers. He accomplishes this by analyzing, studying, dissecting, then performing the very same attacks used during some of the most recent incidents (i.e. Sony, HB Gary, LockHeed Martin, Target, etc), Chris is able to help companies understand their vulnerabilities, mitigate issues, and maintain appropriate levels of education and security.
  
  Chris has developed one of the web’s most successful security podcasts, The Social-Engineer.Org Podcast, and the equally-popular SEORG Newsletter. Over the years, both have become a staple in most serious security practices and are used by Fortune 500 companies around the world to educate their staff.
  
  You can find Chris's articles for local, national, and international publications and journals, including Pentest Mag, EthicalHacker.net, and local and national Business Journals.

Links:

• Social Engineer Org - Your one-stop place for podcast, newsletter, and all things social engineering from Chris's team - http://www.social-engineer.org/
• SECTF Report - http://www.social-engineer.org/ctf/social-engineer-inc-releases-annual-report-def-con-22-social-engineering-capture-flag-sectf-contest/
• Social Engineer, Chris's company - http://www.social-engineer.com/

In this episode

• Ron gives us a brief history of Tenable and TVM for the enterprise
• Ron answers "How do you make network security obtainable and defendable?"
• We discuss TVM as a fundamental principle to many other security program items
• Ron tells us what the modern definition of "policy" is
• We discuss some hurdles and challenges of TVM programs in an enterprise
• We note that security scanning can always break stuff - so how do you get around that?
• Ron tells us why TVM is so much more than scanning
• Michael asks "Why are so many companies stuck in a Prince song (1999)?"
• We attempt to tackle - compliance, risk, and managing to a goal
• Ron answers the question - "Are we getting any better?"

Guest

• 
  Ron Gula ( @RonGula ) - CEO and CTO at Tenable Ron co-founded Tenable Network Security, Inc. in 2002 and serves as its Chief Executive Officer and Chief Technology Officer. Mr. Gula served as the President of Tenable Network Security, Inc. He served as the Chief Technology Officer of Network Security Wizards which was acquired by Enterasys Networks. Mr. Gula served as Vice President of IDS Products and worked with many top financial, government, security service providers and commercial companies to help deploy and monitor large IDS installations. Mr. Gula served as Director of Risk Mitigation for US Internetworking and was responsible for intrusion detection and vulnerability detection for one of the first application service providers. Mr. Gula worked at BBN and GTE Internetworking where he conducted security assessments as a consultant, helped to develop one of the first commercial network honeypots and helped develop security policies for large carrier-class networks. Mr. Gula began his career in information security while working at the National Security Agency conducting penetration tests of government networks and performing advanced vulnerability research. He was the original author of the Dragon IDS. Mr. Gula has a BS from Clarkson University and a MSEE from University of Southern Illinois.

In this episode

• DREAMR: What is it, and why is it so important to Enterprise Security today?
• Examples of aligning business and security requirements and winning hearts & minds
• How does a security organization get around "see I told you so!" security
• An example of how to make the framework work for you
• We discuss the importance of listening, then listening, then listening some more
• Jessica and Ben explain "accomodating" the business
• Jessica and Ben give us "One critical piece of advice"

Guests

• Jessica Hebenstreit ( @secitup ) - Jessica Hebenstreit has been a member of the Information Security community for over a decade. Having worked on both the technical and business sides of various enterprises, Hebenstreit has a unique perspective that allows for more understanding when balancing competing interests. She is a successful and results-oriented Information Security expert with hands-on information security experience in security monitoring, incident response, risk assessment, analysis, and architecture and solution design. She holds the following certifications, CISSP, GIAC-GSEC, CRISC and SFCP. In March 2012, she earned her Masters of Science in IT (MSIT) specializing in Information Assurance and Security. She is currently the Manager of Security Informatics - Threat Analysis and Response at Mayo Clinic.  She is building a smart response architecture for incident response from the ground up.
• Ben Meader ( @blmeader ) - Ben Meader is a Senior Security professional with a unique blend of technical acumen and business know-how. Meader’s security thought leadership has been battle tested at multi-national firms over the past 13 years ranging from network security and operational security to performing detailed risk assessments and implementing a firm-wide privacy program. He remains up to date in both security and business having received his M.B.A. from DePaul University and has a current CISSP. He is also active in the entrepreneurial community and is Co-Founder of a mobile application company on the side. His education and range of experiences in working with firms both large and small have given him a unique perspective on the role of security within different business cultures and how competing philosophies can collide.

In this episode

• Jason tells us why he isn't hating on compliance
• Jason talks about how security people are often the source of the issues
• Jason gives us his perspective on compliance-driven security
• Jason correlates compliance to quality assurance in security
• We talk about security's unbroken streak of failing at the basics
• We lament poor metrics, why we suck at them, and what comes next
• We discuss how you can tell whether an investment in security 'is working'
• We discuss the need for repetitive and consistent security
• Jaason gives us his three things that he wants to leave you with

Guest

• Jason Oliver ( @jasonmoliver ) - Jason M Oliver, CISSP, CRISC is the Chief and CEO of Tikras Technology Solutions Corp, a Native American Owned Small Business, President at Arrow Ventures, a seasoned security industry veteran, leader, and lifelong pursuer of knowledge. His unique approach to solving security issues involves individualized plans tailored to meet each specific customer’s needs. His high level of unwavering integrity has been met by the highest regard from both customers and peers.

In this episode

• Who is J.W. Goerlich (redux from episode - 
• How did he get to where he is now?
• How does the security executive deal with the "moving finish line"?
• JW discusses how 'security' people can break down barriers between "us" and "them"
• We discuss why we still fail at the basics, and what all this means...
• JWG tries to talk about his favorite controls framework
• We discuss what difference it makes where the CISO reports in the enterprise
• What will the CISO be, or need to do, in ~3-5 years?
• We discuss hiring into InfoSec - from outside, or within ... and why?
• JW gives us the one thing you need to remember

Guest

• J.W. Goerlich ( @jwgoerlich ) - Results-driven IT management executive with a track record of building high performance teams and providing flawless execution. Leverages background in systems engineering, software development, and information security expertise to consistently lower operating costs and raise service levels. Designs solutions that support long-term strategic planning and create immediate impact throughout product lifecycle in process and efficiency gains.