In this episode...

• We discuss what life is like as the CISO when you have all the responsibility for, but no administrative access (or hands on keyboard)
• Brandon tells his story about how his IT organization went from in-house, to out-house, and how they got where they are
• Brandon tells us the process and strategy he uses to get a handle on his security
• We discuss why visibility is one of the most important things to outsourced IT (and security)
• Brandon tells a story of an incident where things went very sideways
• We discuss the balance between outsourcer scalability and customer deviations
• Brandon tells us why sometimes it takes 3 months to scan your environment for a vulnerability ( your head will explode )
• …and so much more

Guest

• Brandon Dunlap ( @bsdunlap ) - Brandon is the global Chief Information Security Officer for a an employee-owned, global leader in building critical infrastructure in energy, water, telecommunications and government services currently operating in more than 100 countries through consulting, engineering, construction, operations and program management.

In this episode...

• Just when you thought America's neutered "chip & sign" was a safe
  
  • http://krebsonsecurity.com/2015/08/chip-card-atm-shimmer-found-in-mexico/
  • Admittedly we put these stories in here just to get Michael all fired up
• Ashley Madison's data and source code and CEO's email spool now released and public
  • http://www.theregister.co.uk/2015/08/20/ashley_madison_email_dump/
  • http://www.csoonline.com/article/2973575/business-continuity/ashley-madison-self-assessments-highlight-security-fears-and-failures.html
  • So much to talk about that's just wrong with this story...
• Uber is hiring people for security
  • http://www.ibtimes.com/uber-boost-security-staff-after-data-privacy-concerns-2055903
  • Does more headcount equal better security?
  • Where will these people come from given the shortage of talent? <snark>
• That gadget you attached to your OBD2 port on your car to "save on car insurance" may be used to kill you
  • Seriously
  • The dangers of all these wireless & connected devices is scary
  • Risk assessment anyone?
  • http://www.wired.com/2015/08/hackers-cut-corvettes-brakes-via-common-car-gadget/
  • Someone get Flo on the phone...
• Windows 2003 which is now expired still has 609,000 public servers on the Internet
  • Translates into roughly 175M websites (Netcraft)
  • Why are thse out there?
  • Is there really a risk or is this hype?
  • http://www.zdnet.com/article/windows-server-2003-servers-insecure-unpatched/
• ATC systems go down as they were ...<drumroll> being updated!
  • Common problem of ancient systems going down due to upgrade
  • ATC has ZERO patch window
  • ..also close to ZERO ability to test patches/updates in "lab" environment
  • Complex, ancient systems fail when they're upgraded, sometimes catastrophically
  • http://thehill.com/policy/cybersecurity/251310-software-limits-exposed-in-air-traffic-outage

In this episode...

• We discuss the ever-growing need for strong leadership in security
• I ask whether experience and longevity in a position naturally brings leadership qualities
• We talk through how leadership interplays with other competencies
• Michael asks whether the security leader has a place at the executive table (the "big kids table")
• Michael asks if the MBA has value in security leadership
• We discuss the model my team uses for leadership and how we build them
• Michael and Heath discuss various competency models for leadership
• We discuss measuring, KPIs and relative distance
• We discuss how leaders can make better decisions
• Heath leaves us with an Alex Hutton quote

In this episode...

• The Belgian government's internal phishing test has "gone off the rails" a bit
  • Used a legitimate entity to test against
  • Panic and hilarity ensued, but mostly panic
  • http://www.networkworld.com/article/2951514/security/belgian-government-phishing-test-goes-offtrack.html
• British ICO makes a 180,000 pound fine
  • Disconnect between policy and reality
  • Was anything lost?
  • 2 big failures lead to a fine
  • https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/08/ico-fines-nationwide-money-lender-the-money-shop-180-000/
• McAfee and Black Hat attendee surveys wildly different
  • Answers you get depend on who and how you ask
  • Interesting answert though...
  • Lesson: The more experience you have, the less confidence?
  • http://www.slate.com/blogs/future_tense/2015/07/21/two_surveys_of_cybersecurity_professionals_show_starkly_different_attitudes.html

In this episode

• Raf asks - Why haven’t we solved the same old software security bugs?
• James asks how a security team gets out of the way and still get better security?
• We discuss threat modeling, and channel a bit of John Steven
• Jeff talks about the OWASP ESAPI and standard security libraries and controls
• Jeff talks about “libraries with known vulnerabilities” and the role of open source components
• Raf brings up the ugly side of enterprise outsourcing - code development by committee
• We discuss static, dynamic and run-time security tools
• Raf asks Jeff what the RIGHT approach to creating a software program looks like

Guest

• Jeff Williams ( @PlanetLevel ) - Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. In 2002, Jeff co-founded and became CEO of Aspect Security, a successful and innovative consulting company focused on application security. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many other widely adopted free and open projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.