Advertise on podcast: Cloud Security Today

Send us a text In this conversation, Nicole Dove shares her unique journey into the cybersecurity field, highlighting her transition from a finance and audit background to becoming a leader in information security at Riot Games. She discusses the importance of continuous learning, the challenges of writing a book on cybersecurity, and the evolving role of Business Information Security Officers (BISOs) in aligning security with business goals. Nicole emphasizes the need for innovative problem-solving and relationship management in cybersecurity, while also reflecting on her personal routines for maintaining sharpness in her role.

Send us a text In this conversation, Rinki Sethi, a seasoned cybersecurity leader, shares her journey from being a CISO at major companies to her current role at Upwind Security. She discusses the evolving landscape of cybersecurity, the impact of AI, and the importance of community in the industry. Rinki emphasizes the need for strong communication skills for CISOs, the significance of evaluating company culture before taking on new roles, and the necessity of leveraging AI to enhance cybersecurity programs. She also highlights the importance of personal growth and building supportive networks within the cybersecurity community.

Send us a text In this month's installment, Toni De La Fuente shares his journey into cybersecurity, detailing his early experiences with computers and his passion for hacking. He discusses the creation of Prowler, an open-source cloud security tool, and its differences from commercial solutions. The conversation explores cloud security challenges, the importance of open-source solutions, and the dynamics of scaling a startup. Toni also emphasizes the significance of passion in one's career and offers advice for aspiring tech professionals. And yes...we also talk about his LOVE for Iron Maiden ;-)

Send us a text In this episode, Matt interviews Bel Lepe, CEO and co-founder of Cerby, discussing the challenges and opportunities in identity security. They explore the significance of disconnected applications, the impact of shadow IT, and the importance of automation and AI in enhancing security practices. Bel shares insights from his previous experience at Ooyala and the lessons learned in building Cerby, including the recent Series B funding and future plans for the company. Takeaways Disconnected applications pose significant risks in identity management.Shadow IT is becoming a major part of the IT landscape, not just a side issue.The startup journey involves learning from past experiences and adapting strategies.The human element remains a critical factor in cybersecurity incidents.

Send us a text In this conversation, Tammy Klotz discusses her journey as a leader and author, focusing on her book 'Leading with Empathy and Grace.' She shares insights on the importance of empathy, vulnerability, and authenticity in leadership and the challenges and rewards of writing a book. The discussion highlights the significance of acknowledging personal lives in the workplace and the foundational role of trust in professional relationships. If you are an aspiring leader in Cyber, this episode is for you. Tammy shares her secrets to successful leadership.

Send us a text In this conversation, MK Palmore shares insights from his diverse leadership journey, spanning the Marine Corps, FBI, and cybersecurity. He emphasizes the importance of a people-centered leadership approach, the balance between technical and leadership skills, and the significance of effective communication. MK reflects on his experiences, the impact of mentorship, and the lessons learned from both successes and failures in leadership roles. MK highlights the challenges in attracting diverse talent to cybersecurity and the necessity of nurturing new professionals. He concludes with insights on continuous learning and the importance of maintaining a beginner's mindset. Takeaways Diverse experiences shape leadership philosophy.Mentorship plays a significant role in professional development.Silence from leaders can lead to assumptions and uncertainty.Leaders should increase communication during times of uncertainty.Maintaining a mindset of continuous learning is vital for personal growth.Chapters 00:00 Introduction to Leadership and Music 02:57 Diverse Leadership Experiences 06:05 The Importance of People-Centered Leadership 09:05 Technical Skills vs. Leadership Skills 11:49 Communication as a Leadership Skill 14:53 Learning from Mistakes in Communication 18:01 The Impact of Silence in Leadership 20:44 Navigating Uncertainty in Leadership 25:06 Bridging the Gap: Technical and Business Communication 30:22 Building Personal Brand and Eminence 32:53 Overcoming Barriers in Cybersecurity Talent Acquisition 38:31 Staying Sharp: Continuous Learning and Adaptability

Send us a text In this conversation, Lance Spitzner shares his unique journey from a military tank officer to a pioneer in cybersecurity, detailing the evolution of his career and the inception of the Honeynet Project. He emphasizes the importance of understanding the human element in security, advocating for a shift from mere security awareness to fostering a robust security culture within organizations. Spitzner discusses practical steps for security teams to enhance their approach, including leveraging AI to improve communication and engagement. He concludes by reflecting on the impact of his work and the growing recognition of the human side of cybersecurity. Takeaways The Honeynet Project was born from a need for cyber threat intelligence.Security culture is broader than security awareness; it encompasses attitudes and beliefs.Changing the environment is key to changing organizational culture.AI can be leveraged to enhance communication and simplify security policies.Positive interactions with security teams build a stronger security culture.Chapters 00:00 From Military to Cybersecurity Pioneer 03:04 The Birth of the Honeynet Project 05:59 Understanding the Human Element in Security 09:13 Security Culture vs. Security Awareness 11:51 Changing Organizational Culture for Security 14:46 Practical Steps for Security Teams 17:55 Leveraging AI in Security Culture 21:11 Measuring Success in Cybersecurity Training

Send us a text In this conversation, Dr. Chase Cunningham, aka Dr. Zero Trust, shares his unique journey into the cybersecurity field, emphasizing the importance of purpose and self-care in a high-stress industry. He discusses the challenges of implementing zero trust strategies in organizations, the significance of understanding offensive tactics to enhance defensive measures, and the need for systemic change in national cybersecurity. Dr. Zero Trust also provides valuable advice for aspiring cybersecurity professionals, highlighting the supportive community and the importance of continuous learning. Takeaways Zero Trust is a strategy, not a product.Self-care is critical in high-stress environments.Understanding offensive tactics is essential for defense.Start small when implementing Zero Trust.

Send us a text In this conversation, Steve Martano discusses his journey from writing about baseball analytics to becoming a key player in cybersecurity executive search and strategy. He emphasizes the evolving role of CISOs, the importance of aligning with business objectives, and the need for strong leadership skills. The discussion also covers trends in CISO compensation, the mental health challenges faced by security leaders, and the significance of organizational culture in driving satisfaction and effectiveness in cybersecurity roles. The Latest CISO Compensation Trends & Benchmarks. Takeaways Understanding economics can enhance a CISO's effectiveness.Compensation data must be contextualized for accurate benchmarking.Low attrition doesn't always indicate job satisfaction.CISOs face increasing pressures and scope creep in their roles.The job market is expected to become more active in 2025. Chapters 00:00 The Journey from Baseball to Cybersecurity05:53 The Intersection of Leadership and Cybersecurity12:00 Mental Health and Satisfaction Among CISOs17:49 Preparing for Future Attrition in Cybersecurity Roles26:29 Engagement and Satisfaction Beyond Compensation32:13 The Evolving Role of Cybersecurity Leadership38:15 Mentorship and Professional Growth The future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text Nate Lee discusses his transition from a CISO role to fractional CISO work, emphasizing the importance of variety and exposure in his career. He delves into the rise of AI, particularly large language models (LLMs), and the associated security concerns, including prompt injection risks. Nate highlights the critical role of orchestrators in managing AI interactions and the need for security practitioners to adapt to the evolving landscape. He shares insights from his 20 years in cybersecurity and offers recommendations for practitioners to engage with AI responsibly and effectively. Takeaways Nate transitioned to fractional CISO work for variety and exposure.Prompt injection is a major vulnerability in LLM systems.Orchestrators are essential for managing AI interactions securely.Security practitioners must understand how LLMs work to mitigate risks.Nate emphasizes the importance of human oversight in AI systems.Link to Nate's research with the Cloud Security Alliance. The future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text Summary In this conversation, Chris Hetner discusses the evolving role of boards of directors in cybersecurity, emphasizing the need for improved communication and understanding of cyber risks. He highlights the challenges boards face in adapting to new SEC rules and the importance of leveraging AI responsibly. Hetner also shares insights on tools for quantifying cyber risk and prioritizing investments while advocating for continuous learning and proactive engagement with board members. Takeaways Boards are becoming more aware of cybersecurity risks.Cybersecurity discussions often receive limited airtime in board meetings.The SEC's new disclosure rules can drive more frequent discussions on cyber risk.AI governance is crucial as AI technologies become more prevalent.Collaboration with general counsel and risk officers is essential.Chapters 00:00 Introduction and Background on Cybersecurity and Boards 03:05 Current Challenges Facing Boards in Cybersecurity 06:11 Understanding Cyber Risk and Communication with Boards 08:58 Improving Board Engagement with Cybersecurity 11:56 Leveraging SEC Guidelines for Cyber Risk Discussions 15:02 The Role of AI in Cybersecurity Governance 18:05 Tools for Quantifying Cyber Risk 21:12 Prioritizing Cybersecurity Investments 24:02 The Importance of AI Governance 26:57 Staying Informed in Cybersecurity 30:13 Final Thoughts and Continuous Learning The future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text Meg Anderson, the CISO at Principal Financial Group, discusses her 17-year tenure as a CISO and the factors contributing to her long-term success. She attributes her longevity to her passion for the job and the opportunities for growth and development at Principal. Meg emphasizes the importance of understanding the business impact of cybersecurity and holding people accountable. She also highlights the significance of focusing on the basics of cybersecurity and not getting caught up in the latest trends. Meg shares her experience with mentorship and its role in her career. She also discusses the programs implemented at Principal to attract and retain cyber talent, such as a formal mentorship program and a robust internship program. Takeaways Passion for the job and naivete can contribute to long-term success as a CISO.Understanding the business impact of cybersecurity and holding people accountable is crucial.Focusing on the basics of cybersecurity is essential, rather than getting caught up in the latest trends.Mentorship plays a significant role in career development.Taking time away from work is essential for personal growth and avoiding burnout. Chapters 00:00 Introduction and Long-Term Success as a CISO03:15 The Importance of Naivete and Passion06:34 The Role of Mentorship10:54 Attracting and Retaining Cyber Talent12:50 Organizing a Cyber Youth Summit21:13 Building a Cyber Program Around Company Culture28:07 Focusing on the Basics of Cybersecurity36:19 Personal Growth and Parting WordsThe future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text Purav Desai is a Microsoft 365 incident responder at a large financial institution (name withheld to protect the innocent). He shares his journey and expertise in the field. He explains how his early exposure to Microsoft security solutions and their constant innovation led him to specialize in 365 security and incident response. He discusses the importance of mentors and influential figures in his career, highlighting the lessons he learned from them. He then dives into his popular project, Deciphering UAL (Unified Audit Logs), which aims to make sense of the complex logs in Microsoft 365.  Purav shares an incident response scenario involving a banking Trojan and how he used telemetry and logging to investigate and remediate the issue. He concludes by discussing effective threat detection methods in Microsoft 365, including threat hunting with KQL and leveraging Zero-Hour Auto-Purge (ZAP) to prevent the spread of attacks.  In our conversation, we dive into: How specializing in Microsoft 365 security and incident response can be a wise choice due to the constant innovation and market demand for Microsoft solutions.How having mentors and influential figures in your career can provide valuable guidance and inspire you to push yourself and try new things.His personal project, Deciphering UAL (Unified Audit Logs), aims to make sense of the complex logs in Microsoft 365, providing insights for digital forensics and incident response.How proper licensing and logging configuration are crucial for effective incident response.How native tools like Purview Audit and eDiscovery provide valuable insights for forensic analysis.The future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text This month, we welcome Eric Gagnon, Team Lead of Adversary Simulation, Purple Teaming, and Tradecraft Development at Desjardins. The conversation covers a wide range of topics related to cybersecurity, including purple teaming, red teaming, blue teaming, and Eric's journey in cybersecurity. Eric shares insights on certifications, threat hunting, cloud security, and the importance of knowledge exchange between red and blue teams. He also discusses the use of AI in cybersecurity and the need to stay sharp in the field. Takeaways Purple teaming involves collaborative operations to exchange ideas, evaluate security controls, and test out tactics, techniques, and procedures (TTPs) real threat actors use.Certifications in cybersecurity, such as Offensive Security Certified Professional (OSCP) and Offensive Security Certified Expert (OSCE), provide valuable knowledge and an edge in the field.Threat hunting involves looking for a granular activity that may indicate a compromise, filtering out the noise, and focusing on the suspicious behavior of threat actors.Cloud security requires automation, cyber hygiene, and visibility, focusing on prioritizing techniques and testing them against the enterprise's environment.Knowledge exchange between red and blue teams during a purple team engagement is essential and should include a common language, centralized documentation, and reporting against the MITRE ATT&CK framework.Staying sharp in cybersecurity involves continuous learning, participation in CTFs, engaging with passionate individuals, and challenging oneself through talks, podcasts, and specialized training.Chapters 00:00 Introduction to Purple Teaming and Cybersecurity Journey 08:09 Certifications and Insights in Cybersecurity 15:08 Threat Hunting and Granular Activity Detection 35:02 Knowledge Exchange in Purple Teaming: Red and Blue Collaboration 39:57 Staying Sharp in Cybersecurity: Continuous Learning and Engagement The future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text This month, we welcome Swathi Joshi, VP of SaaS Cloud Security at Oracle, to discuss key moments and decisions that shaped her career path, including rejections from Google and Twitter. She emphasizes the importance of learning from rejection and seeking feedback to improve. Swathi also shares insights on the role of mentors and advises on finding and working with mentors. In the second part of the conversation, she discusses building a SaaS security program as an enterprise consumer of SaaS. She highlights the importance of addressing misconfigurations, ensuring visibility and access control, and meeting compliance needs. Swathi also suggests asking about backup and exploring risk scoring for vendors. In this conversation, Swathi discusses best practices for managing vendor risk, vulnerability management through third parties, and incident response in SaaS applications. She also shares insights on privacy operations and critical privacy controls in SaaS. Swathi emphasizes the importance of collaboration, robust incident response plans, and data lifecycle management. She also highlights the need for identity and access control and the challenges of normalizing incident response across different SaaS platforms. Swathi's leadership philosophy is collaborative and pace-setting, and she emphasizes the importance of stress management. Takeaways Learn from rejection and seek feedback to improveBuild long-term relationships with mentors and create a personal advisory boardWhen building a SaaS security program, focus on addressing misconfigurations, ensuring visibility and access control, and meeting compliance needsAsk about backup and explore risk scoring for vendors. Managing vendor risk requires close collaboration with privacy, legal, and contract partners.Incident response in SaaS applications shares foundational principles with traditional on-prem software, but there are differences in data snapshotting and managing dependencies.Privacy operations can be operationalized by focusing on identity, access control, and data lifecycle management.Leadership should be collaborative, open to ideas, and adaptable to different situations.Stress management is crucial for effective leadership and should be acknowledged and actively managed.Links Privacy Operations Template Swathi's LI Profile Chapters 00:00 Navigating Career Challenges and Learning from Rejection 08:13 The Role of Mentors in Career Growth 15:26 Building a Strong SaaS Security Program 21:20 Meeting Compliance Needs in a SaaS Environment 21:56 Backup and Risk Scoring for SaaS Vendors 22:38 Managing Vendor Risk 26:12 Improving Vulnerability Management through Third Parties 26:35 Navigating Incident Response in SaaS Applications 34:03 Operationalizing Privacy Operations in SaaS 40:50 The Importance of Collaboration in Leadership 43:04 Managing Stress for Effective Leadership The future of cloud security.Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.