Dust It Off – BSW #245
Full Audio
View Show IndexSegments
1. Zero Trust Access To, From and Within the Cloud – Colby Dyess – BSW #245
How cloud resources are architected and utilized is different for every organization, but whether cloud native or cloud traditionalist – security risk and complexity are problems. Concerns over account takeover, overprivileged access and the struggle to keep pace with the dynamism of the cloud are driving demand for a better way to secure access. Hear Colby Dyess, Director of Product at Appgate, discuss how the principles of Zero Trust strengthen and simplify access controls across varying cloud architectures. We’ll address everything from users connecting to multi-cloud resources, secure service-to-service communication and running security as code. This segment is sponsored by Appgate. Visit https://securityweekly.com/appgate to learn more about them!
Announcements
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Guest
![](https://image-optimizer.cyberriskalliance.com/unsafe/1920x0/https://files.scmagazine.com/wp-content/uploads/2022/05/colby-0-1-scaled.jpg)
Colby Dyess has 20+ years of experience in leading development, delivery and marketing of enterprise software solutions. As Director of Product Management at Appgate, he works with clients around the globe to accelerate their move to Zero Trust networks.
Hosts
2. No Log4j, 2021 Recaps, or 2022 Resolutions! – BSW #245
In the leadership and communications section, no, we're not discussing log4j, 2021 recaps or lessons learned, or 2022 new year's resolutions or predictions!
Announcements
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
We had an absolute blast putting together this year's SW Unlocked virtual event! All presentations are now available on-demand for your viewing pleasure. Please visit https://securityweekly.com/unlocked to register and watch now!
Hosts
- 1. Security Think Tank: Reframing CISO-boardroom relationsUltimately, the responsibility for security decisions is vested in the CEO, while it is the CISO’s role to influence and inform. Pitched at the right level and conciliatory in tone, this close engagement will enable information security teams to react in real time – not just to evolving threats, but also to a shifting operating environment that is dictated by external pressures outside an organisation’s control.
- 2. Why CISOs Shouldn’t Report to CIOs in the C-SuiteA CIO incentivized by short-term productivity is likely to make poor security decisions. When the CIO has incentives tied to output, security often takes a backseat. This puts the CISO, and the organization as a whole, in jeopardy. The CISO who reports to the CIO has no control over decisions that impact security risk. Having a CISO as a peer to the CIO alleviates this conflict of interest. It also holds true to the original meaning of “C-level” leadership, creating an executive team that advocates for the different priorities and policies that keep a business on the right track.
- 3. Why CIOs Should Report to CISOsThe case can be made that the emergence of the CISO role — and its separation from IT operations — is a primary reason for many of today’s cybersecurity failures. I’ve seen the approach of combining operations and security deliver distinct benefits for security when I was in the public sector. It’s something organizations in every sector now needs to consider returning to. The current environment calls for combining IT and security functions, with the CIO reporting to the CISO.
- 4. Six ways to reduce cyber risk in the C-suiteThe report highlighted six C-suite-level strategies that security leaders believe could help reduce cyber risk, including: 1. Discuss cybersecurity prominently in board meetings (79%) 2. Thoroughly evaluate the business risks of cyber threats (64%) 3. CEOs should assume overall responsibility for organizational cybersecurity (63%) 4. Increase cybersecurity budgets (62%) 5. Develop long-term cybersecurity strategies (57%) 6. Amend reporting structures to give security direct board access (50%)
- 5. CISOs, what’s in your travel security program?It's time to review (or create) your travel security program now that more people are traveling for work and pleasure. Here's what it should include: - Does this program include a list of countries posed as high risk or extreme risk to those employees or executives who travel or work outside the country of origin? - Does your travel security program require these risk countries to be communicated to the executive team and the personnel responsible for travel? - Does your travel security program identify expatriates working in high-risk countries? - Do you have a traveler briefing program required before every trip to a high-risk environment? - Do your employees understand never to leave confidential material unattended and to keep devices with them while traveling? - Does your travel program monitor and debrief personnel having traveled to high-risk environments? - Does the company’s security awareness and education program include a segment on travel? - Does your travel program brief on the data aggregation capabilities of social networks? What about how the sharing of an itinerary can permit an adversary to document and collate travel plans? - Does your travel program implement a sterile device program for high- or extreme-risk locales (e.g., throwaway mobile phones, sterile laptops)? - Are these sterile devices reviewed for compromise upon the traveler’s return? - Are all travelers issued cable locks and laptop privacy screens for their devices? - If key executives are traveling, are checks put in place concerning any expenditures they authorize be double-checked for authenticity, to avoid CEO/CFO business email compromise. - Does the program include the need for travelers to file itineraries with the company, sharing passport data page and have a daily “all safe” call into the company while employees travel?
- 6. Rethinking Cybersecurity Jobs as a Vocation Instead of a ProfessionAre cybersecurity jobs a profession or a vocation? When we consider the current workforce shortage in cybersecurity, our existing assumptions about the nature of cybersecurity jobs may be exacerbating the shortfall. For this reason, we may need to consider new ways of thinking about jobs within the cybersecurity field and the appropriate institutional structures that need to be in place to rapidly increase the available workforce.