Cybersecurity Where You Are (video)

In episode 103 of Cybersecurity Where You Are, Sean Atkinson examines education and experience as pathways for new professionals to enter the cybersecurity industry.

Here are some highlights from our episode:

• 01:42. What's motivating Sean to talk about this topic
• 03:32. The value of cybersecurity degrees
• 05:17. The pros and cons of degree programs in cybersecurity
• 07:47. How a cybersecurity certification compares to a degree
• 10:57. Considerations for pursuing a certification in cybersecurity
• 14:00. Using certifications to learn new technology paradigms
• 16:54. Why a breadth of practical experience is important
• 22:49. Pathways for gaining experience in cybersecurity

Resources

• Episode 75: How GenAI Continues to Reshape Cybersecurity
• Episode 59: Probing the Modern Role of the Pentest
• Outliers: The Story of Success
• Hack The Box
• TryHackMe
• David Bombal
• IppSec
• PortSwigger
• John Hammond

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 101 of Cybersecurity Where You Are, Sean Atkinson is joined by Justin Kohler, Vice President of Products at SpecterOps, and Jonathan Parfait, Technical Account Manager at SpecterOps.

Together, they discuss how the visualization of attack paths in Active Directory helps organizations to better contextualize risks to their enterprise security.

Here are some highlights from our episode:

• 01:54. What Bloodhound is and how it assists organizations in assessing risks in their Active Directory environments
• 05:08. Why have organizations look at their Active Directory environments
• 11:15. Common vulnerabilities and misconfigurations identified by Bloodhound
• 21:21. How organizations can best use Bloodhound as part of their cyber defensive strategy
• 29:18. How Bloodhound is adapting to keep up with evolving Active Directory environments

Resources

• Bloodhound Community Edition
• Episode 62: Inside the 'Spidey Sense' of a Pentester
• What You Need to Know About Hybrid Cloud Environments
• Vulnerability Management Policy Template for CIS Control 7
• CIS Benchmarks List

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 99 of Cybersecurity Where You Are, Sean Atkinson is joined by Marcus Sachs, SVP and Chief Engineer at the Center for Internet Security® (CIS®).

Together, they discuss how cyber-informed engineering builds resilience to the potential failure of a digital system into new and existing engineering products.

Here are some highlights from our episode:

• 03:51. What cyber-informed engineering is and how this paradigm has emerged
• 11:39. What CIS is doing to emphasize cyber-informed engineering among U.S. State, Local, Tribal, and Territorial (SLTT) government organizations
• 16:25. Why resilience requires everyone to be "cyber-informed"
• 20:50. The need for boards of directors and C-Suite leaders to understand cybersecurity risk
• 25:30. What preparations help to lay the foundation for cyber-informed engineering

Resources

• Cyber-Informed Engineering
• National Cyber-Informed Engineering Strategy
• Cyber-Informed Engineering Implementation Guide
• Episode 75: How GenAI Continues to Reshape Cybersecurity
• Smart Cities Need Smarter Security

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 98 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Roger Grimes, Data-Driven Defense Evangelist at KnowBe4.

Together, they embrace transparency as a vehicle for the cybersecurity industry to better defend against insider threats.

Here are some highlights from our episode:

• 01:28. How KnowBe4 detected an insider threat from North Korea
• 09:09. How the Center for Internet Security® (CIS®) responded to news of this incident
• 21:02. The role of technical controls in detecting these types of threats
• 23:56. Common signs you can use to detect fake employees in your hiring process
• 29:22. How cybersecurity companies can use this incident to improve their defenses

Resources

• How a North Korean Fake IT Worker Tried to Infiltrate Us
• North Korean Fake IT Worker FAQ
• Episode 77: Data's Value to Decision-Making in Cybersecurity
• Defense-in-Depth: A Necessary Approach to Cloud Security
• eBook: A CISO’s Guide to Bolstering Cybersecurity Posture

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 97 of Cybersecurity Where You Are, Tony Sager is joined by the following guests:

• Dr. Ramon Barquin, Board Member at the Center for Internet Security® (CIS®) and President and Chief Executive Officer at Barquin International
• Franklin Reeder, Director Emeritus and Founding Chair of CIS as well as Director of the National Cybersecurity Scholarship Foundation
• Clint Kreitner, Founding President/CEO and Former Board Member at CIS

Together, they look back at how much CIS has accomplished as an organization in the leadup to its 25th birthday.

Here are some highlights from our episode:

• 06:04. What brought everyone to CIS's founding meeting at the Cosmos Club
• 16:08. The first steps to operationalizing the takeaways of the Cosmos Club meeting
• 25:40. How CIS's business model came to be
• 34:24. The events that brought the Multi-State Information Sharing and Analysis Center® (MS-ISAC®) into CIS
• 42:42. Tracing the past forward to where we are now

Resources

• 20 Years of Creating Confidence in the Connected World
• Episode 35: Remembering the Late Alan Paller
• Reasonable Cybersecurity Guide
• Episode 79: Advancing Common Good in Cybersecurity – Part 1
• MS-ISAC: 20 Years as Your Trusted Cyber Defense Community
• Dr. Ramon Barquin
• Franklin Reeder

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 96 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Tarah Wheeler, CEO of Red Queen Dynamics.

Together, they discuss ongoing efforts to translate continuous compliance into something actionable for small- to medium-sized businesses (SMBs).

Here are some highlights from our episode:

• 03:11. The philosophy behind a business model focused on continuous compliance for SMBs
• 17:44. How the Fog of More complicates security and compliance for the "cyber-underserved"
• 30:56. How the industry can navigate the multiple-framework issue and streamline compliance

Resources

• Follow Tarah on LinkedIn
• Episode 95: AI Augmentation and Its Impact on Cyber Defense
• Implementation Guide for Small- and Medium-Sized Enterprises CIS Controls IG1
• Build a Robust Continuous Audit Program in 10 Steps
• How Prioritized Security Controls Break Through the Fog of More

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 95 of Cybersecurity Where You Are, Sean Atkinson is joined by Randy Rose, VP of Security Operations & Intelligence at the Center for Internet Security® (CIS®).

Together, they discuss AI augmentation in terms of how cyber defenders are using generative artificial intelligence to enhance their capabilities.

Here are some highlights from our episode:

• 01:16. How artificial intelligence has changed the landscape for cybersecurity defenders
• 03:49. How AI is starting to augment threat detection
• 10:12. What security researchers are exploring around AI and cyber defense
• 20:54. Key challenges and limitations for AI-based cyber defense
• 30:54. Future trends and innovations for cybersecurity defenders' use of AI

Resources

• Episode 56: Cybersecurity Risks and Rewards of LLMs
• Episode 59: Probing the Modern Role of the Pentest
• SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
• fr0gger / Awesome-GPT-Agents
• The LLM Misinformation Problem I Was Not Expecting
• Separating FUD from Practical for Post-Quantum Cryptography

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 94 of Cybersecurity Where You Are, Tony Sager is joined by the following guests from the Center for Internet Security® (CIS®):

• Carlos Kizzee, SVP of Multi-State Information Sharing and Analysis Center® (MS-ISAC®) Strategy & Plans
• Karen Sorady, VP of MS-ISAC Strategy & Plans
• Greta Noble, Director of Community Engagement

Together, they discuss how the ISAC Annual Meeting supports the 24x7x365 community defense efforts of the MS-ISAC and Elections Infrastructure Information Sharing and Analysis Center® (EI-ISAC®).

Here are some highlights from our episode:

• 02:30. Background information on ISACs in general and the role of the MS-ISAC
• 04:17. Why it's an annual meeting and not a conference
• 06:40. What made the 2024 ISAC Annual Meeting the largest of its kind so far
• 08:43. How the human dimension drives our yearly meeting
• 15:44. The role of the MS- and EI-ISACs in CIS's broader strategy
• 19:42. How our yearly meeting improves what CIS does
• 29:57. What's next for the ISAC Annual Meeting

Resources

• MS-ISAC: 20 Years as Your Trusted Cyber Defense Community
• Episode 76: The Role of Thought Leadership in Cybersecurity
• Reasonable Cybersecurity Guide
• Cybersecurity at Scale: Piercing the Fog of More

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 93 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined once again by John Cohen, Executive Director of Countering Hybrid Threats at the Center for Internet Security® (CIS®).

Together, they discuss a whole-of-society approach to help make the U.S. public resilient against multidimensional threats in our connected world.

Here are some highlights from our episode:

• 01:52. What the U.S. public needs to consider in order to strengthen its resilience
• 06:04. How a national framework addresses the need for organizations to build resilience and intercommunication in the face of increasingly sophisticated threats
• 11:41. Identifying who key partners are in a complex, hybrid world
• 16:49. How people are responding to the national framework and where they are seeing value
• 21:50. Clarifying hopes for the national framework going forward

Resources

• John D. Cohen
• Enhancing Safety in the Connected World — A National Framework for Action
• Episode 92: A Framework to Counter Evolving Cyber Threats
• Why Whole-of-State Cybersecurity Is the Way Forward
• Public Water and Wastewater Sector Face Mounting Cyber Threat
• The National Cybersecurity Strategy

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 92 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by John Cohen, Executive Director of Countering Hybrid Threats at the Center for Internet Security® (CIS®).

Together, they discuss "Enhancing Safety in the Connected World — A National Framework for Action," a multi-year project to help law enforcement and security professionals better contextualize and respond to evolving cyber threats.

Here are some highlights from our episode:

• 02:01. Why the current threat environment necessitates a framework that accounts for "cyber physical," "cyber safety," and other considerations
• 08:48. How entities at the federal level and local law enforcement approach evolving cyber threats differently
• 16:34. The different types of threats that characterize the evolving cyber threat environment
• 22:05. How the Federalist Papers inform the Framework's "whole-of-society" approach

Resources

• John D. Cohen
• Enhancing Safety in the Connected World
• Episode 75: How GenAI Continues to Reshape Cybersecurity
• Why Whole-of-State Cybersecurity Is the Way Forward
• Establishing Essential Cyber Hygiene

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 91 of Cybersecurity Where You Are, Sean Atkinson is joined by Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®).

Together, they discuss what you need to know about the release of CIS Controls v8.1.

Here are some highlights from our episode:

• 01:17. What you can expect to see in version 8.1 of the Controls
• 06:19. How CIS Controls v8.1 helps you to integrate other governance structures
• 09:23. How version 8.0 and version 8.1 of the Controls differ
• 14:19. What goes into creating a new version of the Controls
• 21:06. Which resources you can use to guide your implementation plan
• 26:39. A sneak peek into the development of version 9.0

Resources

• Follow Charity on LinkedIn
• CIS Critical Security Controls v8.1
• CIS Critical Security Controls v8.1 Change Log
• How to Construct a Sustainable GRC Program in 8 Steps
• CIS Controls v8.1 Mapping to NIST CSF 2.0
• CIS Critical Security Controls Navigator
• Episode 87: Marking 11 Years as a Verizon DBIR Contributor
• Cybersecurity at Scale: Piercing the Fog of More

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 90 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by the following guests:

• Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®)
• Mia LaVada, Product Manager of CIS Benchmarks and Cloud at CIS
• Don Freeley, VP of IT Services at CIS

Together, they discuss how you can use CIS resources to ensure control continuity when migrating to the cloud.

Here are some highlights from our episode:

• 01:35. The biggest drivers for why organizations are moving to the cloud
• 02:42. Foundational factors to consider as part of your cloud migration
• 07:24. Resources from CIS designed to help you in your transition to the cloud
• 11:00. Common challenges of migrating to the cloud
• 14:37. The importance of three CIS Controls to your cloud security program
• 18:35. The value of partnerships and community in driving cloud security improvements
• 19:32. How you can use the CIS Foundations Benchmarks to get started in the cloud
• 23:06. Inside the human and process side of moving to the cloud

Resources

• Follow Charity, Mia, and Don on LinkedIn
• Keep the Cloud Secure with CIS after Migrating to the Cloud
• Cloud Security
• CIS Software Supply Chain Security Guide
• Cloud Security and the Shared Responsibility Model

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 89 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by the following guests:

• Rian Davis, Elections Cyber Threat Intelligence Intern at the Center for Internet Security® (CIS®)

• Timothy Davis, Sr. Elections Cyber Threat Intelligence Analyst at CIS

Together, they discuss how cyber threat actors (CTAs) are using generative artificial intelligence (GenAI) as an enabler of their attacks.

Here are some highlights from our episode:

• 01:04. Why it's important to raise awareness of how CTAs are using GenAI
• 01:59. How the CIS Cyber Threat Intelligence (CTI) team is seeing generative AI in CTAs' attack methodology
• 03:50. The types of attacks that are using this technology and how the frequency of those attacks is changing
• 05:46. Some notable attacks that have used GenAI in their methodology
• 16:10. The ways in which CTAs are incorporating generative AI into social engineering
• 24:17. What defenders can do in response to CTAs' use of GenAI

Resources

• An Examination of How Cyber Threat Actors Can Leverage Generative AI Platforms
• Episode 56: Cybersecurity Risks and Rewards of LLMs
• Election Security Spotlight – Generative AI and Elections
• MS-ISAC Security Primer – Spear Phishing
• Why Employee Cybersecurity Awareness Training Is Important

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 88 of Cybersecurity Where You Are, co-host Sean Atkinson discusses the evolving role of a chief information security officer (CISO).

Here are some highlights from our episode:

• 02:47. Why communication is a core competency for CISOs
• 08:35. How to take a balanced approach when evaluating an organization's implementation of artificial intelligence (AI) and machine learning (ML)
• 11:47. The role a CISO plays in integrating privacy requirements into the organization
• 15:35. Thoughts on how you can start preparing for or moving into a CISO position
• 19:12. A future outlook of the CISO role
• 26:40. Average longevity of CISOs in their roles and how this affects a security posture

Resources

• Episode 75: How GenAI Continues to Reshape Cybersecurity
• Reasonable Cybersecurity Guide
• Episode 74: The Nexus of Cybersecurity & Privacy Legislation
• CIS Critical Security Controls® (CIS Controls®)
• Cybersecurity at Scale: Piercing the Fog of More
• CIS Software Supply Chain Security Guide

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 87 of Cybersecurity Where You Are, co-host Tony Sager is joined by the following guests:

• Charity Otwell, Director of the CIS Critical Security Controls® (CIS Controls®) at the Center for Internet Security® (CIS®)
• Philippe Langlois, Senior Principal, Security Risk Management and Author of the Verizon Data Breach Investigations Report (DBIR)
• Theodore "TJ" Sayers, Director of Intelligence & Incident Response at CIS

Together, they celebrate 11 years of CIS and Verizon working together to contextualize the threat activity security teams are seeing and to help teams use the Controls as an improvement framework.

Here are some highlights from our episode:

• 02:00. How the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS-ISAC® and EI-ISAC®) contribute anonymized data to the Verizon DBIR
• 07.27. The two types of data that Verizon uses as input for its report
• 13:50. The ways CIS uses the content of Verizon's DBIR to help people embrace programs of security improvement
• 24:48. A glimpse at what goes into producing the DBIR
• 28.33. The importance of leadership in guiding team dynamics and fun
• 32.07. Reception of the 2024 DBIR and exploration of what's next for the Verizon DBIR team

Resources

• 2024 DBIR Findings & How the CIS Critical Security Controls Can Help to Mitigate Risk to Your Organization
• CIS Controls Featured as Recommended Defenses in Verizon's 2024 Data Breach Investigations Report
• 2024 Data Breach Investigations Report
• The VERIS Framework
• CIS Community Defense Model 2.0

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 86 of Cybersecurity Where You Are, co-host Sean Atkinson is live once again from Booth 4319 at RSA Conference (RSAC) 2024.

00:57. Sean chats with Mat Everman, Information Security Operations Manager, about his talk, "Shades of Purple: Getting Started and Making Purple Teaming Possible." They discuss some of the questions Mat received following his talk and how they can put purple teaming into practice at the Center for Internet Security® (CIS®).

Sean asks passersby what they're looking to get out of RSAC 2024 and what stood out to them at the conference.

• 13:56. José Mena, Founder of Digital Twin Networks
• 20:34. Jonathan Kern, CEO of Castile Defense
• 25:42. Ken Klestinec, Regional Sales Manager at Akamai

Finally, Sean talks to fellow team members about CIS's objective for RSAC 2024.

• 18:10. Aaron Perkins, Director of Communications
• 23:25. Nick Rust, Director of Reseller & Channel Partners
• 27:04. Jeff Sparks, CIS Services Sr. Account Executive
• 28:08. Mia LaVada, Product Manager of CIS Benchmarks and Cloud
• 30:01. Mishal Makshood, Sr. Cloud Security Account Executive

Resources

• Episode 85: Reenergizing Collective Action at RSAC 2024
• Episode 75: How GenAI Continues to Reshape Cybersecurity
• How to Construct a Sustainable GRC Program in 8 Steps
• Tabletop Exercises (TTX)
• CIS Critical Security Controls
• CIS Benchmarks

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 85 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are live from Booth 4319 at RSA Conference (RSAC) 2024. Together, they discuss how events like RSAC 2024 reenergize collective action in the cybersecurity industry. They begin by noting how resources such as the CIS Community Defense Model (CDM) bring more data and transparency to security recommendations for the cybersecurity industry. They then look back on some of Tony's presentations at prior years of RSAC before looking at the interest surrounding supply chain security, zero trust, and artificial intelligence (AI). To address these developments, organizations must create a foundation for defense and scale rapid improvements, needs which Tony and Sean see as opportunities for collective action in the industry.

Resources

• From Attacks to Action: An Open Community Model to Drive Defensive Choices
• The "Fog of More" - A CyberSecurity Community Challenge
• CIS Community Defense Model 2.0
• Episode 77: Data's Value to Decision-Making in Cybersecurity
• Foundational Security for Your Software Supply Chain
• Episode 44: A Zero Trust Framework Knows No End
• CIS Critical Security Controls Implementation Groups
• Episode 75: How GenAI Continues to Reshape Cybersecurity

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 84 of Cybersecurity Where You Are, co-host Tony Sager is joined by Brian de Vallance, Senior Advisor at Cambridge Global Advisors; and Phyllis Lee, VP of Security Best Practices (SBP) Content Development at the Center for Internet Security® (CIS®). Together, they discuss the notion of reasonable cybersecurity. They begin by providing some background about reasonableness in cybersecurity and identifying the problem we need to solve — namely, the lack of a definition of reasonableness around which organizations can build their cybersecurity program. They then discuss how a definition for reasonable cybersecurity needs to include security best practices that are doable. They conclude by exploring how CIS's work around this topic may influence its content development going forward.

Resources

• Follow Brian and Phyllis on LinkedIn
• Reasonable Cybersecurity Guide
• Reasonable Cybersecurity
• CIS Critical Security Controls
• CIS Critical Security Controls Implementation Groups
• CIS Community Defense Model 2.0

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 83 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by nearly 20 employees at the Center for Internet Security® (CIS®). Together, they discuss the value of meeting in person to CIS workplace culture. With the company's 2024 Annual Full Staff Meeting in Orlando, FL, as their backdrop, they explore how personal relationships create a foundation for building effective teams, more agile workflows, and a sustainable sense of engagement and motivation at CIS. Along the way, they reflect on how much the company has changed since before the pandemic.

Resources

• Episode 82: How CIS Leadership Values Team Building Events
• Episode 58: Inside CIS's Award-Winning Workplace Culture
• Center for Internet Security Named Among 2024 Top Workplaces

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.

In episode 82 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by John Gilligan, President and CEO at the Center for Internet Security® (CIS®); and Gina Chapman, Chief Operating Officer at CIS. Together, they discuss the importance of in-person team building events. They use the pandemic as a frame to understand how events such as the 2024 Annual Full Staff Meeting preserve and cultivate CIS's workplace culture. They also look to other ongoing initiatives at the company, such as CIS Cares and the IDEA Alliance, as efforts to sustain employee engagement both in person and virtually.

Resources

• Follow John and Gina on LinkedIn
• Center for Internet Security Named Among 2024 Best Companies to Work for in New York
• CIS Leadership Principles
• Episode 43: Giving Back Through CIS CARES
• IDEA Alliance

If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing podcast@cisecurity.org.