<![CDATA[Great Security Debate]]>f997d68c-f53d-5434-965f-f181246ad8b2Tue, 10 Mar 2026 19:29:16 +0000Captivate.fmThe Great Security Debatehttps://artwork.captivate.fm/08639da4-723a-4196-82f7-08b4504211b9/cover.jpgGreat Security DebateThe Great Security DebateThe Great Security DebateTwo CISOs and a security-minded friend discuss and debate topics of security and privacy, with a focus on looking at the topic from various angles, both that they support and those they don't. Sign up for our newsletter to be notified when new episodes drop, or when new projects are announced https://newsletter.greatsecuritydebate.net https://distillingsecurity.com/securitydebate/falseepisodichttps://feeds.captivate.fm/greatsecuritydebate/yespodcastDoorbells Ring HollowDoorbells Ring HollowWhat on earth were Ring and Amazon thinking when they aired their Super Bowl advert that previewed a “there’s nowhere you can hide” type of dystopian future masked as a way to find your lost dog? With cameras everywhere, are we safer or just more exposed? When camera data is deleted, is it really gone (spoiler alert: not necessarily), and more. Are we approaching the new location of the “creepy line” or as a society are we content to trade privacy for security? And what happens when the glasses with cameras become more pervasive? Are we all on cam all the time whether we like it or not?

Show notes:

  1. Ring Super Bowl Advert - https://www.nytimes.com/2026/02/19/business/ring-super-bowl-ad-privacy.html
  2. Decoder Podcast - Let’s talk about Ring, lost dogs, and the surveillance state - https://youtu.be/QQjW68B7s8g
  3. Ring and Flock cancel partnership - https://techcrunch.com/2026/02/13/amazons-ring-cancels-partnership-with-flock-a-network-of-ai-cameras-used-by-ice-feds-and-police/
  4. Savanna Guthrie Nest Video Retrieval - https://www.theverge.com/tech/877235/nancy-guthrie-google-nest-cam-video-storage
  5. Apple San Bernardino Matter - https://epic.org/documents/apple-v-fbi-2/
  6. DJI robot vacuum cameras accessible via Internet - https://www.theverge.com/tech/879088/dji-romo-hack-vulnerability-remote-control-camera-access-mqtt
  7. Unifi protect cameras - https://geni.us/isNyY2
  8. Zuck in court to testify on social media addiction - https://apnews.com/article/mark-zuckerberg-trial-testimony-instagram-c8cbaa32ccbf4933ec3a7beebd6cf34b
  9. Glassholes are back - and forbidden in court - https://www.cbsnews.com/news/meta-trial-mark-zuckerberg-ai-glasses/
  10. Movie recommendation - Happy Gilmore - https://geni.us/v96XEgb
  11. Meta/Facebook studies on addictiveness of social media - https://www.cnn.com/2026/02/23/tech/facebook-researchers-study-addictive-features
  12. LinkedIn/Microsoft Verification data being shared with many others, including Persona -= https://thelocalstack.eu/posts/linkedin-identity-verification-privacy/

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>What on earth were Ring and Amazon thinking when they aired their Super Bowl advert that previewed a “there’s nowhere you can hide” type of dystopian future masked as a way to find your lost dog? With cameras everywhere, are we safer or just more exposed? When camera data is deleted, is it really gone (spoiler alert: not necessarily), and more. Are we approaching the new location of the “creepy line” or as a society are we content to trade privacy for security? And what happens when the glasses with cameras become more pervasive? Are we all on cam all the time whether we like it or not?

Show notes:

  1. Ring Super Bowl Advert - https://www.nytimes.com/2026/02/19/business/ring-super-bowl-ad-privacy.html
  2. Decoder Podcast - Let’s talk about Ring, lost dogs, and the surveillance state - https://youtu.be/QQjW68B7s8g
  3. Ring and Flock cancel partnership - https://techcrunch.com/2026/02/13/amazons-ring-cancels-partnership-with-flock-a-network-of-ai-cameras-used-by-ice-feds-and-police/
  4. Savanna Guthrie Nest Video Retrieval - https://www.theverge.com/tech/877235/nancy-guthrie-google-nest-cam-video-storage
  5. Apple San Bernardino Matter - https://epic.org/documents/apple-v-fbi-2/
  6. DJI robot vacuum cameras accessible via Internet - https://www.theverge.com/tech/879088/dji-romo-hack-vulnerability-remote-control-camera-access-mqtt
  7. Unifi protect cameras - https://geni.us/isNyY2
  8. Zuck in court to testify on social media addiction - https://apnews.com/article/mark-zuckerberg-trial-testimony-instagram-c8cbaa32ccbf4933ec3a7beebd6cf34b
  9. Glassholes are back - and forbidden in court - https://www.cbsnews.com/news/meta-trial-mark-zuckerberg-ai-glasses/
  10. Movie recommendation - Happy Gilmore - https://geni.us/v96XEgb
  11. Meta/Facebook studies on addictiveness of social media - https://www.cnn.com/2026/02/23/tech/facebook-researchers-study-addictive-features
  12. LinkedIn/Microsoft Verification data being shared with many others, including Persona -= https://thelocalstack.eu/posts/linkedin-identity-verification-privacy/

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>79fd7340-77b3-4559-96d1-bece606ab44cMon, 23 Feb 2026 09:00:00 -040046:49falsefull568685Complacency in the LoopComplacency in the LoopAI is growing in use within information security, but are we ready to trust it to do all the things we hope it can, and do so automatically without doing harm? Context is king, and training to that level is only possible when you give all your experience to the AI. What are the tradeoffs to doing so? What happens when we depend on AI and forget (or worse, never learn) the underpinnings of what makes the AI system work (remember the calculator debates of the 1980s?). And does the end justify the means when it comes to AI use? And what is that “ends” anyway? Efficiency, automation, knowledge? Erik, Dan, and Brian discuss it all in this week’s Great Security Debate!

Show Notes

  1. Report on reasons Israel didn’t catch oct 7 attacks - https://www.npr.org/2025/03/05/nx-s1-5318591/israel-shin-bet-security-failure-october-7-attack
  2. Shin Bet Report - Source Doc (Hebrew) - https://www.documentcloud.org/documents/25551448-yqry-tkhqyr-shyrvt-hbytkhvn-hklly-710/#document/p1
  3. Waymo hits student on bicycle - https://www.theverge.com/2024/2/7/24065063/waymo-driverless-car-strikes-bicyclist-san-francisco-injuries
  4. Waymo violates school bus rules - https://www.cbsnews.com/news/waymo-recall-3000-vehicles-software-school-bus/
  5. Podcast Recommendation - Agentic Dan - https://distillingsecurity.com/episode-64-agentic-dan/
  6. TV Recommendation - Pluribus - https://tv.apple.com/us/show/pluribus/umc.cmc.37axgovs2yozlyh3c2cmwzlza
  7. Trust Issues in AI -
  8. “I bought this Tesla before Elon went crazy” magnet - https://geni.us/DXQYk
  9. OpenAI adds ads - https://apnews.com/article/chatgpt-ads-openai-advertising-83812a066375a805fa2e29b28fc77da1
  10. Satya Nadella AI Internal Memo - https://africa.businessinsider.com/news/nadellas-message-to-microsoft-execs-get-on-board-with-the-ai-grind-or-get-out/sq0fe52
  11. FDA AI Rules - https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological
  12. Utah AI Prescriptions - https://www.politico.com/news/2026/01/06/artificial-intelligence-prescribing-medications-utah-00709122
  13. Movie Recommendation: Terminator - https://geni.us/59025
  14. Book Recommendation: The Cuckoos Egg - https://geni.us/hYE9
  15. Book Recommendation: AI 2041 - https://geni.us/5dtV54h
  16. Anthropic Super Bowl Ad - Scott Galloway on why Anthropic's Super Bowl ad got to Sam ... - Fortune
  17. China facial recognition payments - https://www.chowhound.com/2073279/grocery-store-facial-recognition-china-smile-to-pay/
  18. Movie Recommendation: Sneakers - https://geni.us/P7SB
  19. The Dawn of the Post Literate Society - https://jmarriott.substack.com/p/the-dawn-of-the-post-literate-society-aa1
  20. Leading Causes of Death in the US, 2023 - https://www.cdc.gov/nchs/fastats/leading-causes-of-death.htm
  21. Automated car sex in backseat - https://dailydot.com/driverless-car-sex-autonomous
  22. Podcast Recommendation: The Final Act - https://distillingsecurity.com/new-podcast-coming-soon-the-final-act/
  23. Calculators and Children - https://www.linkedin.com/pulse/crunching-numbers-debate-over-calculator-use-math-education-church-sg6te/
  24. Podcast Recommendation: Mentorcore - https://distillingsecurity.com/tag/mentorcore/

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>AI is growing in use within information security, but are we ready to trust it to do all the things we hope it can, and do so automatically without doing harm? Context is king, and training to that level is only possible when you give all your experience to the AI. What are the tradeoffs to doing so? What happens when we depend on AI and forget (or worse, never learn) the underpinnings of what makes the AI system work (remember the calculator debates of the 1980s?). And does the end justify the means when it comes to AI use? And what is that “ends” anyway? Efficiency, automation, knowledge? Erik, Dan, and Brian discuss it all in this week’s Great Security Debate!

Show Notes

  1. Report on reasons Israel didn’t catch oct 7 attacks - https://www.npr.org/2025/03/05/nx-s1-5318591/israel-shin-bet-security-failure-october-7-attack
  2. Shin Bet Report - Source Doc (Hebrew) - https://www.documentcloud.org/documents/25551448-yqry-tkhqyr-shyrvt-hbytkhvn-hklly-710/#document/p1
  3. Waymo hits student on bicycle - https://www.theverge.com/2024/2/7/24065063/waymo-driverless-car-strikes-bicyclist-san-francisco-injuries
  4. Waymo violates school bus rules - https://www.cbsnews.com/news/waymo-recall-3000-vehicles-software-school-bus/
  5. Podcast Recommendation - Agentic Dan - https://distillingsecurity.com/episode-64-agentic-dan/
  6. TV Recommendation - Pluribus - https://tv.apple.com/us/show/pluribus/umc.cmc.37axgovs2yozlyh3c2cmwzlza
  7. Trust Issues in AI -
  8. “I bought this Tesla before Elon went crazy” magnet - https://geni.us/DXQYk
  9. OpenAI adds ads - https://apnews.com/article/chatgpt-ads-openai-advertising-83812a066375a805fa2e29b28fc77da1
  10. Satya Nadella AI Internal Memo - https://africa.businessinsider.com/news/nadellas-message-to-microsoft-execs-get-on-board-with-the-ai-grind-or-get-out/sq0fe52
  11. FDA AI Rules - https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological
  12. Utah AI Prescriptions - https://www.politico.com/news/2026/01/06/artificial-intelligence-prescribing-medications-utah-00709122
  13. Movie Recommendation: Terminator - https://geni.us/59025
  14. Book Recommendation: The Cuckoos Egg - https://geni.us/hYE9
  15. Book Recommendation: AI 2041 - https://geni.us/5dtV54h
  16. Anthropic Super Bowl Ad - Scott Galloway on why Anthropic's Super Bowl ad got to Sam ... - Fortune
  17. China facial recognition payments - https://www.chowhound.com/2073279/grocery-store-facial-recognition-china-smile-to-pay/
  18. Movie Recommendation: Sneakers - https://geni.us/P7SB
  19. The Dawn of the Post Literate Society - https://jmarriott.substack.com/p/the-dawn-of-the-post-literate-society-aa1
  20. Leading Causes of Death in the US, 2023 - https://www.cdc.gov/nchs/fastats/leading-causes-of-death.htm
  21. Automated car sex in backseat - https://dailydot.com/driverless-car-sex-autonomous
  22. Podcast Recommendation: The Final Act - https://distillingsecurity.com/new-podcast-coming-soon-the-final-act/
  23. Calculators and Children - https://www.linkedin.com/pulse/crunching-numbers-debate-over-calculator-use-math-education-church-sg6te/
  24. Podcast Recommendation: Mentorcore - https://distillingsecurity.com/tag/mentorcore/

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>ee56e385-40f2-4ab0-ab50-f5d879fb45f9Mon, 09 Feb 2026 11:00:00 -040043:34falsefull567675WOPR Was RightWOPR Was RightRecently and over the past few years, world events may have included cybersecurity components in their enactment. So, Brian, Erik, and Dan started talking about the role of security in critical infrastructure protection, asking questions about the ethics and thresholds for government and corporate roles in cyber retaliation, whether we as security practitioners have a role (or an obligation, or even a liability) to close vulnerabilities that can be used in primary or retaliatory scenarios. How much of human nature makes cyber retaliation a foregone conclusion, or can we find ways to reduce the need or use or availability of ways in via the technology. From Stuxnet to Iran to Caracas, using cybersecurity is a prevalent vector of retaliation, but does it always have to be that way? Or will it end with WOPR’s recognition that the only way to win the game is not to play at all?

It’s hard to talk about modern cybersecurity and not bring in current events, and even harder to keep it from turning political. We tried very hard to do a good job in the latter as we talked about the former. 

Thanks for being part of the debate!


Show Notes:



Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>Recently and over the past few years, world events may have included cybersecurity components in their enactment. So, Brian, Erik, and Dan started talking about the role of security in critical infrastructure protection, asking questions about the ethics and thresholds for government and corporate roles in cyber retaliation, whether we as security practitioners have a role (or an obligation, or even a liability) to close vulnerabilities that can be used in primary or retaliatory scenarios. How much of human nature makes cyber retaliation a foregone conclusion, or can we find ways to reduce the need or use or availability of ways in via the technology. From Stuxnet to Iran to Caracas, using cybersecurity is a prevalent vector of retaliation, but does it always have to be that way? Or will it end with WOPR’s recognition that the only way to win the game is not to play at all?

It’s hard to talk about modern cybersecurity and not bring in current events, and even harder to keep it from turning political. We tried very hard to do a good job in the latter as we talked about the former. 

Thanks for being part of the debate!


Show Notes:



Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>8ecc79ee-de3d-426b-8e71-13e4697b34a8Mon, 12 Jan 2026 16:15:00 -040044:41falsefull566665Signs, Signs. Everywhere A Sign.Signs, Signs. Everywhere A Sign.Rules are made and policies are established. But the “how” of implementing and meeting those regulations or policies will be very context specific. In this episode of the Great Security Debate, Dan, Erik, and Brian cover a number of key policies and requirements and some different ways to think about implementing them and how the specific situation, company, risk will affect the way you meet the rule. From driving a car to incident response and everything in between. We debate the need to look back at old rules and see if they all still make sense (a great programme called Kill Stupid Rules), and flexibility in control implementation to meet evolving business needs, to move quickly, and keeping the whole picture of the business, customer, and employees in mind.

Thanks for Listening!

Show Notes:

  1. Passing on the right in Michigan: https://legislature.mi.gov/Laws/MCL?objectName=MCL-257-637
  2. Overtake time in Triathlon: https://www.triathlete.com/training/race-tips/9-race-rules-didnt-know-breaking/
  3. Reflex Security (Agentic Tabletop Exercises and Training): https://reflexsecurity.io
  4. Kill Stupid Rules: https://www.wsb.com/blog/employee-retention-secret/
  5. GM Dress Code Change (2020): https://gmauthority.com/blog/2020/06/how-general-motors-ceo-mary-barra-changed-the-companys-dress-code-for-the-better/
  6. Silly State Rules: https://www.buzzfeed.com/rhiannacampbell/weird-old-american-laws-you-wont-believe
  7. Sex in Full Self Driving Cars (Clean): https://www.cbc.ca/news/science/sex-distracted-driving-1.3562029
  8. Movie Recommendation - The Usual Suspects: https://geni.us/wVrLOCB
  9. John Bingham, COO, Speak by Design: https://www.speakbydesign.com/about-us
  10. Movie Recommendation - Gremlins: https://geni.us/qE6NAC
  11. Movie Recommendation -Die Hard: https://geni.us/eMASs
  12. Movie Recommendation - Love Actually: https://geni.us/yj8Fqh

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>Rules are made and policies are established. But the “how” of implementing and meeting those regulations or policies will be very context specific. In this episode of the Great Security Debate, Dan, Erik, and Brian cover a number of key policies and requirements and some different ways to think about implementing them and how the specific situation, company, risk will affect the way you meet the rule. From driving a car to incident response and everything in between. We debate the need to look back at old rules and see if they all still make sense (a great programme called Kill Stupid Rules), and flexibility in control implementation to meet evolving business needs, to move quickly, and keeping the whole picture of the business, customer, and employees in mind.

Thanks for Listening!

Show Notes:

  1. Passing on the right in Michigan: https://legislature.mi.gov/Laws/MCL?objectName=MCL-257-637
  2. Overtake time in Triathlon: https://www.triathlete.com/training/race-tips/9-race-rules-didnt-know-breaking/
  3. Reflex Security (Agentic Tabletop Exercises and Training): https://reflexsecurity.io
  4. Kill Stupid Rules: https://www.wsb.com/blog/employee-retention-secret/
  5. GM Dress Code Change (2020): https://gmauthority.com/blog/2020/06/how-general-motors-ceo-mary-barra-changed-the-companys-dress-code-for-the-better/
  6. Silly State Rules: https://www.buzzfeed.com/rhiannacampbell/weird-old-american-laws-you-wont-believe
  7. Sex in Full Self Driving Cars (Clean): https://www.cbc.ca/news/science/sex-distracted-driving-1.3562029
  8. Movie Recommendation - The Usual Suspects: https://geni.us/wVrLOCB
  9. John Bingham, COO, Speak by Design: https://www.speakbydesign.com/about-us
  10. Movie Recommendation - Gremlins: https://geni.us/qE6NAC
  11. Movie Recommendation -Die Hard: https://geni.us/eMASs
  12. Movie Recommendation - Love Actually: https://geni.us/yj8Fqh

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>0305c8fc-7dc8-4764-bec4-5acd7d737325Mon, 29 Dec 2025 09:00:00 -040054:14falsefull565655Agentic DanAgentic DanWe are back for another Great Security Debate.

In this episode: we discuss the potential role of agentic AI in security, from true “copilot” to automated decider of things, and whether LLMs are just a really cool search engine. Brian, Erik, and Dan also debate the means and extent to which we could replace ourselves with agents and what the inhibitors and risks are (spoiler alert: trust and survival of that agent after employment were big factors), and how do we train those agents of all the steps our brains take to make the decisions that the humans make, and do so without polluting it with aspirational versions of ourselves (think: Instagram vs Reality). And it all leads to a parenting lesson by Brian and an automotive process lesson by Erik? It’s quite a debate. 

Thanks for listening! We might do one more episode in 2026, but if not have a wonderful holidays and a happy new year!

Here’s the quote that Brian references at the end of the episode by Tolstoy:

Patience is waiting. Not passively waiting. That is laziness. But to Keep going when the going is hard and slow - that is patience. The two most powerful warriors are patience and time. The value lies not in reducing "power" (computational energy) but in leveraging that processing power to achieve outcomes that are difficult, slow, or impossible for humans to manage alone.

Thanks for listening!

Show Notes:


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>We are back for another Great Security Debate.

In this episode: we discuss the potential role of agentic AI in security, from true “copilot” to automated decider of things, and whether LLMs are just a really cool search engine. Brian, Erik, and Dan also debate the means and extent to which we could replace ourselves with agents and what the inhibitors and risks are (spoiler alert: trust and survival of that agent after employment were big factors), and how do we train those agents of all the steps our brains take to make the decisions that the humans make, and do so without polluting it with aspirational versions of ourselves (think: Instagram vs Reality). And it all leads to a parenting lesson by Brian and an automotive process lesson by Erik? It’s quite a debate. 

Thanks for listening! We might do one more episode in 2026, but if not have a wonderful holidays and a happy new year!

Here’s the quote that Brian references at the end of the episode by Tolstoy:

Patience is waiting. Not passively waiting. That is laziness. But to Keep going when the going is hard and slow - that is patience. The two most powerful warriors are patience and time. The value lies not in reducing "power" (computational energy) but in leveraging that processing power to achieve outcomes that are difficult, slow, or impossible for humans to manage alone.

Thanks for listening!

Show Notes:


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>37860e49-629f-4063-b408-e9eb6a1bdb5bMon, 15 Dec 2025 09:00:00 -040048:51falsefull564645Give a Sh!t Posture ManagementGive a Sh!t Posture ManagementOn this weeks’ Debate, Brian brings a truckload of acronyms for more single panes of glass to help us consolidate our various single panes of glass, Erik may actually be Brian (or maybe Brian is Erik), and Dan confirms he still (and likely always will) spend the rest of his days living in the house he just built deep in the Trough of Disillusionment.

What started out as a chat about some new technologies in the space turned into a treatise on the state of leadership and the future talent pipeline’s need for more curiosity (and why we think they are starved of the opportunity to learn to be curious). Along the way we talk about what motivates organisations to do security right from the get go vs leaving it alone based on difficulty to remediate, and the risk balances of both (think: productivity vs security). Throw in a little “binary opinions have dragged us into the mire” and you’ve got a full episode of The Great Security Debate.

We also drop some hints about a new show coming from The Distilling Security network in 2026 called The Final Act which will bring guests in the later stages of their careers about the urgency of our careers in security and tech, what they want to leave behind as legacy, and what they are doing to prepare their orgs for their eventual departure. Add on how they have and will give back to the community, and what their successors want to see done before this first generation of security and tech leaders hit the road.

Please subscribe and leave a comment.  If you’d like to sponsor the network, please email sponsors@distillingsecurity.com

Thanks for listening!

Show Notes:


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>On this weeks’ Debate, Brian brings a truckload of acronyms for more single panes of glass to help us consolidate our various single panes of glass, Erik may actually be Brian (or maybe Brian is Erik), and Dan confirms he still (and likely always will) spend the rest of his days living in the house he just built deep in the Trough of Disillusionment.

What started out as a chat about some new technologies in the space turned into a treatise on the state of leadership and the future talent pipeline’s need for more curiosity (and why we think they are starved of the opportunity to learn to be curious). Along the way we talk about what motivates organisations to do security right from the get go vs leaving it alone based on difficulty to remediate, and the risk balances of both (think: productivity vs security). Throw in a little “binary opinions have dragged us into the mire” and you’ve got a full episode of The Great Security Debate.

We also drop some hints about a new show coming from The Distilling Security network in 2026 called The Final Act which will bring guests in the later stages of their careers about the urgency of our careers in security and tech, what they want to leave behind as legacy, and what they are doing to prepare their orgs for their eventual departure. Add on how they have and will give back to the community, and what their successors want to see done before this first generation of security and tech leaders hit the road.

Please subscribe and leave a comment.  If you’d like to sponsor the network, please email sponsors@distillingsecurity.com

Thanks for listening!

Show Notes:


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>cedb110d-1e1f-4665-9453-3af8ecc0108eMon, 17 Nov 2025 09:00:00 -040054:51falsefull563635The 100 Years AI FloodThe 100 Years AI FloodThe Great Security Debate is *back*! It’s been a busy year, but it’s time to get this show back on the air (and maybe on the road). Dan takes a break from the rat race, Erik took over the world, and Brian uses Elmer’s Glue to splice his network cables.

Topics in the show this week:

  • AWS and Microsoft make the best cases for business continuity plans, the AI
  • Is public cloud reliable enough? Should we all move back to local data centres? How can we reliably assess that risk?
  • Want an AI Data Centre on your town? NIMBY vs Innovation!

We will be back every 2 weeks on Mondays. Subscribe on YouTube at https://youtube.com/@greatsecuritydebate to see our smiling faces as you watch, or in your favourite podcast application to listen on your commute or with your whole family around the radio.

See you on the 17th with more debates! And some entirely new shows coming from Distilling Security very soon, too. Subscribe to the newsletter on our website https://distillingsecurity.com to hear all about them

Links to mentioned articles and topics:


]]>The Great Security Debate is *back*! It’s been a busy year, but it’s time to get this show back on the air (and maybe on the road). Dan takes a break from the rat race, Erik took over the world, and Brian uses Elmer’s Glue to splice his network cables.

Topics in the show this week:

  • AWS and Microsoft make the best cases for business continuity plans, the AI
  • Is public cloud reliable enough? Should we all move back to local data centres? How can we reliably assess that risk?
  • Want an AI Data Centre on your town? NIMBY vs Innovation!

We will be back every 2 weeks on Mondays. Subscribe on YouTube at https://youtube.com/@greatsecuritydebate to see our smiling faces as you watch, or in your favourite podcast application to listen on your commute or with your whole family around the radio.

See you on the 17th with more debates! And some entirely new shows coming from Distilling Security very soon, too. Subscribe to the newsletter on our website https://distillingsecurity.com to hear all about them

Links to mentioned articles and topics:


]]>32b53907-921b-4dac-8af6-7f59c903f33bMon, 03 Nov 2025 09:00:00 -040047:26falsefull562625Risky Risks: Live from the GTS Security SummitRisky Risks: Live from the GTS Security SummitThe Great Security Debate crew recorded a live episode at the GTS Security Summit in Detroit, Michigan with special guest, Zah Gonzalvo, SVP of Financial, Climate, and Operational Risk at Banco Popular. Tune in for a great discussion on risk, risk mitigation, risk prioritisation, and risk in context. Yep, it's all about risk!

Takeaways:

  • The evolution of security has shifted from a binary perspective to a more nuanced understanding of risk management, acknowledging the need for flexibility in addressing diverse security challenges.
  • In contemporary discussions, it is increasingly evident that security must be integrated into business strategy, highlighting the imperative for security professionals to communicate effectively with stakeholders.
  • The role of the Chief Information Security Officer (CISO) has transcended traditional technological boundaries, necessitating a comprehensive grasp of business risk and operational efficiency.
  • Effective risk management within organizations requires a shared responsibility model, where every employee contributes to the overall security posture, thus reinforcing the concept that security is a collective endeavor.
  • Scenario analysis is a potent tool in risk management, enabling organizations to anticipate potential threats and understand the implications of various risk scenarios on their operations.
  • Engaging with business units to contextualize security risks in terms of operational impact and financial implications is vital for securing necessary budgets and resources for security initiatives.

]]>The Great Security Debate crew recorded a live episode at the GTS Security Summit in Detroit, Michigan with special guest, Zah Gonzalvo, SVP of Financial, Climate, and Operational Risk at Banco Popular. Tune in for a great discussion on risk, risk mitigation, risk prioritisation, and risk in context. Yep, it's all about risk!

Takeaways:

  • The evolution of security has shifted from a binary perspective to a more nuanced understanding of risk management, acknowledging the need for flexibility in addressing diverse security challenges.
  • In contemporary discussions, it is increasingly evident that security must be integrated into business strategy, highlighting the imperative for security professionals to communicate effectively with stakeholders.
  • The role of the Chief Information Security Officer (CISO) has transcended traditional technological boundaries, necessitating a comprehensive grasp of business risk and operational efficiency.
  • Effective risk management within organizations requires a shared responsibility model, where every employee contributes to the overall security posture, thus reinforcing the concept that security is a collective endeavor.
  • Scenario analysis is a potent tool in risk management, enabling organizations to anticipate potential threats and understand the implications of various risk scenarios on their operations.
  • Engaging with business units to contextualize security risks in terms of operational impact and financial implications is vital for securing necessary budgets and resources for security initiatives.

]]>dba0904a-8943-49b2-a9bb-94cdb059b5e2Mon, 12 May 2025 09:00:00 -040047:30falsefull461614Fantasy Hacker LeagueFantasy Hacker LeagueIn this episode of The Great Security Debate, Dan, Brian and Erik invent (and copyright) the idea of a Fantasy Hacker League then dig into more serious discussions on deception technology, asset discovery challenges, and resource management. The conversation also delves into the impact of budget constraints on security projects, the mental toll on cybersecurity professionals, and the evolving role of CISOs in digital transformation. Issues such as job stress, burnout, and role mismatches among security leaders are addressed, alongside strategic insights on integrating security within broader business operations.

00:00 Introduction to the Great Security Debate

00:39 Humorous Take on Hacker Recruitment

03:16 Fantasy Hacker League Concept

09:18 Microsoft's Honeypot Strategy

22:58 Challenges in Security Budgets and Resources

31:03 The Reality of Full-Time Positions

31:31 Introverts vs. Extroverts in Leadership

32:06 The Challenges of Being a CISO

33:53 Work-Life Balance and Stress

37:04 The Role of Security in Business

39:36 The Future of Security Leadership

41:00 Adapting to Economic Constraints

59:28 The Importance of Enjoying Your Work

01:00:26 Conclusion and Farewell

]]>In this episode of The Great Security Debate, Dan, Brian and Erik invent (and copyright) the idea of a Fantasy Hacker League then dig into more serious discussions on deception technology, asset discovery challenges, and resource management. The conversation also delves into the impact of budget constraints on security projects, the mental toll on cybersecurity professionals, and the evolving role of CISOs in digital transformation. Issues such as job stress, burnout, and role mismatches among security leaders are addressed, alongside strategic insights on integrating security within broader business operations.

00:00 Introduction to the Great Security Debate

00:39 Humorous Take on Hacker Recruitment

03:16 Fantasy Hacker League Concept

09:18 Microsoft's Honeypot Strategy

22:58 Challenges in Security Budgets and Resources

31:03 The Reality of Full-Time Positions

31:31 Introverts vs. Extroverts in Leadership

32:06 The Challenges of Being a CISO

33:53 Work-Life Balance and Stress

37:04 The Role of Security in Business

39:36 The Future of Security Leadership

41:00 Adapting to Economic Constraints

59:28 The Importance of Enjoying Your Work

01:00:26 Conclusion and Farewell

]]>4800a409-2470-49fd-ac2a-1e92dba12264Mon, 21 Oct 2024 09:00:00 -040001:02:08falsefull460604Free Disaster Recovery Tests!Free Disaster Recovery Tests!Welcome to the Great Security Debate! In this episode, experts take on a multifaceted discussion about the intricacies of technology and cybersecurity. The debate navigates through the recent incident involving CrowdStrike and Microsoft, dissecting the layers of technology, processes, and the roles of different entities in maintaining security. Emphasizing the lessons learned, the debate also explores the challenges of disaster recovery, business continuity, and balancing risk in an increasingly complex digital landscape. Tune in as the hosts delve into the ramifications of over-consolidation, the implications of vendor lock-in, and the importance of maintaining a culture of quality and robust testing.

00:00 Introduction to the Great Security Debate

00:37 Layers of Technology and Finger Pointing

01:23 Disaster Recovery and Business Continuity

02:34 Market Leaders and Single Points of Failure

08:25 The Complexity of Software and Manufacturing Analogies

14:27 Kernel Access and Security Implications

23:29 BitLocker Keys and Recovery Challenges

28:05 Daily Text File Sharing

28:21 Transitioning BitLocker Management

28:45 Risk Profiles and Encryption Decisions

31:47 Team Collaboration and Lessons Learned

33:38 CrowdStrike Incident Analysis

36:18 The Importance of Response and Culture

44:10 Balancing Speed and Safety in Software

51:41 Closing Remarks and Future Plans

]]>Welcome to the Great Security Debate! In this episode, experts take on a multifaceted discussion about the intricacies of technology and cybersecurity. The debate navigates through the recent incident involving CrowdStrike and Microsoft, dissecting the layers of technology, processes, and the roles of different entities in maintaining security. Emphasizing the lessons learned, the debate also explores the challenges of disaster recovery, business continuity, and balancing risk in an increasingly complex digital landscape. Tune in as the hosts delve into the ramifications of over-consolidation, the implications of vendor lock-in, and the importance of maintaining a culture of quality and robust testing.

00:00 Introduction to the Great Security Debate

00:37 Layers of Technology and Finger Pointing

01:23 Disaster Recovery and Business Continuity

02:34 Market Leaders and Single Points of Failure

08:25 The Complexity of Software and Manufacturing Analogies

14:27 Kernel Access and Security Implications

23:29 BitLocker Keys and Recovery Challenges

28:05 Daily Text File Sharing

28:21 Transitioning BitLocker Management

28:45 Risk Profiles and Encryption Decisions

31:47 Team Collaboration and Lessons Learned

33:38 CrowdStrike Incident Analysis

36:18 The Importance of Response and Culture

44:10 Balancing Speed and Safety in Software

51:41 Closing Remarks and Future Plans

]]>53c823d8-5261-48ba-b4a7-3ba5ce54e896Tue, 03 Sep 2024 09:00:00 -040053:17falsefull459594To Insure or Not To Insure: It’s Not Even a QuestionTo Insure or Not To Insure: It’s Not Even a QuestionThis episode of 'The Great Security Debate' delves into the complexities surrounding cyber insurance, discussing its impact on minimising business risks and ensuring compliance. Erik, Brian, and Dan talk about how connected systems and automation increase risks and integrates AI reliance concerns.

Insurance policies, force majeure, and government regulations get some quality discussion and debate time, revealing fears and misconceptions about standardised security controls vs. adaptive security practices. And last up: the practicality and pitfalls of self-insurance, government intervention, and the need for standardised security terminology.

Show Links:


Help support the podcast: https://ko-fi.com/distillingsecurity

Thanks for listening! We have got some exciting changes ahead including ways to support the podcast, some big announcements, new shows and conversations, and more! Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

00:00 Introduction to the Great Security Debate

00:30 The Role of Cyber Insurance

01:49 Manual Processes and Business Continuity

03:09 Manufacturing and Supply Chain Challenges

06:11 Insurance Policies and Cybersecurity

08:00 Standardization and Government Involvement

19:14 The Complexity of Cyber Warfare

22:35 Globalization and Cybersecurity

30:33 Leadership vs. Boss Mentality

33:53 The Role of Communication in Crisis

36:51 The Cost of Compliance

40:30 Global Cybersecurity Challenges

44:22 The Complexity of Online Trust

47:56 Insurance and Cybersecurity

53:07 The Future of Cyber Insurance

01:00:15 Conclusion and Final Thoughts

]]>This episode of 'The Great Security Debate' delves into the complexities surrounding cyber insurance, discussing its impact on minimising business risks and ensuring compliance. Erik, Brian, and Dan talk about how connected systems and automation increase risks and integrates AI reliance concerns.

Insurance policies, force majeure, and government regulations get some quality discussion and debate time, revealing fears and misconceptions about standardised security controls vs. adaptive security practices. And last up: the practicality and pitfalls of self-insurance, government intervention, and the need for standardised security terminology.

Show Links:


Help support the podcast: https://ko-fi.com/distillingsecurity

Thanks for listening! We have got some exciting changes ahead including ways to support the podcast, some big announcements, new shows and conversations, and more! Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

00:00 Introduction to the Great Security Debate

00:30 The Role of Cyber Insurance

01:49 Manual Processes and Business Continuity

03:09 Manufacturing and Supply Chain Challenges

06:11 Insurance Policies and Cybersecurity

08:00 Standardization and Government Involvement

19:14 The Complexity of Cyber Warfare

22:35 Globalization and Cybersecurity

30:33 Leadership vs. Boss Mentality

33:53 The Role of Communication in Crisis

36:51 The Cost of Compliance

40:30 Global Cybersecurity Challenges

44:22 The Complexity of Online Trust

47:56 Insurance and Cybersecurity

53:07 The Future of Cyber Insurance

01:00:15 Conclusion and Final Thoughts

]]>6b878415-5ca5-4001-af83-6dd903d99fe6Mon, 01 Jul 2024 10:00:00 -040001:01:42falsefull458584Wear a Stop Sign On Your ShirtWear a Stop Sign On Your ShirtIn this episode of the Great Security Debate, Brian, Erik, and Dan dive into the latest trends in ransomware including an uptick in attacks against the hypervisor. Speaking of VMWare, we also "discuss" the way that Broadcom has handled the VMWare acquisition and why it both make sense (to them) and doesn't (to many customers).

The debate also heads into the impact of AI in cyber threats, and compare strategies for mitigating risk, such as prioritising vulnerabilities and understanding the attack landscape.

Additionally, the conversation shifts to business practices in tech acquisitions and the potential future disruptions in the market and importance of balancing security measures with user experience, and the need for adaptive, short-term security roadmaps to stay ahead in an ever-changing environment.

And break the big news about an upcoming Distilling Security in-person meet-up in Michigan in July!

Help support the podcast: https://ko-fi.com/distillingsecurity

Show Notes:

episode-links


Thanks for listening! We have got some exciting changes ahead including ways to support the podcast, some big announcements, new shows and conversations, and more! Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>In this episode of the Great Security Debate, Brian, Erik, and Dan dive into the latest trends in ransomware including an uptick in attacks against the hypervisor. Speaking of VMWare, we also "discuss" the way that Broadcom has handled the VMWare acquisition and why it both make sense (to them) and doesn't (to many customers).

The debate also heads into the impact of AI in cyber threats, and compare strategies for mitigating risk, such as prioritising vulnerabilities and understanding the attack landscape.

Additionally, the conversation shifts to business practices in tech acquisitions and the potential future disruptions in the market and importance of balancing security measures with user experience, and the need for adaptive, short-term security roadmaps to stay ahead in an ever-changing environment.

And break the big news about an upcoming Distilling Security in-person meet-up in Michigan in July!

Help support the podcast: https://ko-fi.com/distillingsecurity

Show Notes:

episode-links


Thanks for listening! We have got some exciting changes ahead including ways to support the podcast, some big announcements, new shows and conversations, and more! Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>da2d5eb8-3e52-4d3f-983a-8f0668d465a0Thu, 06 Jun 2024 07:00:00 -040048:12falsefull457574Mine EverythingMine EverythingSorry about the audio on this one. We have got the tech back on track for the next episode. I promise!

Join the Great Security Debate as Brian, Erik, and Dan delve into 'pig slaughtering,' a scam involving rapport building to swindle victims out of money.

The discussion explores the intersections of security awareness, blockchain technology, and the ethical implications of digital tracking tools like chain analysis. Featuring real-world cases, including child exploitation traced through blockchain, and the broader debate on privacy versus legality in technology use. Are public blockchain transactions truly private?

And how can we balance innovative tech with ethical concerns? Tune in to hear all about it

Help support the podcast: https://ko-fi.com/distillingsecurity

Show Notes:


Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>Sorry about the audio on this one. We have got the tech back on track for the next episode. I promise!

Join the Great Security Debate as Brian, Erik, and Dan delve into 'pig slaughtering,' a scam involving rapport building to swindle victims out of money.

The discussion explores the intersections of security awareness, blockchain technology, and the ethical implications of digital tracking tools like chain analysis. Featuring real-world cases, including child exploitation traced through blockchain, and the broader debate on privacy versus legality in technology use. Are public blockchain transactions truly private?

And how can we balance innovative tech with ethical concerns? Tune in to hear all about it

Help support the podcast: https://ko-fi.com/distillingsecurity

Show Notes:


Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>9f4f5362-283a-4078-8870-4ea327401365Wed, 05 Jun 2024 07:00:00 -040044:58falsefull456564Spoiler Alert: Leave the World BehindSpoiler Alert: Leave the World BehindJoin Dan, Brian, and Erik in the latest episode of The Great Security Debate as they explore the impact and implications of the movie 'Leave the World Behind.' Delving into cyber security, societal impacts of technology, and philosophical elements, this discussion touches upon vulnerability management, risk management, and the effect of constant connectivity on modern life. Tune in to hear not only their analysis of the film but also personal reflections on communication, societal changes, and practical steps for improving individual security resilience. This episode also marks the exciting announcement of the Great Security Debate becoming a part of the Distilling Security network. Don't miss out!

Help support the podcast: https://ko-fi.com/distillingsecurity

Show Notes:

episode-links


Editor note: This episode was recorded in the final days of 2023... but was lost to technology demons until now. One of those demons made it necessary to show the Zoom screen rather than our usual edited video cast. Sorry for the inconvenience and pain on your eyes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>Join Dan, Brian, and Erik in the latest episode of The Great Security Debate as they explore the impact and implications of the movie 'Leave the World Behind.' Delving into cyber security, societal impacts of technology, and philosophical elements, this discussion touches upon vulnerability management, risk management, and the effect of constant connectivity on modern life. Tune in to hear not only their analysis of the film but also personal reflections on communication, societal changes, and practical steps for improving individual security resilience. This episode also marks the exciting announcement of the Great Security Debate becoming a part of the Distilling Security network. Don't miss out!

Help support the podcast: https://ko-fi.com/distillingsecurity

Show Notes:

episode-links


Editor note: This episode was recorded in the final days of 2023... but was lost to technology demons until now. One of those demons made it necessary to show the Zoom screen rather than our usual edited video cast. Sorry for the inconvenience and pain on your eyes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate and Distilling Security, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>16decf54-c97f-4c23-b37e-5d7cb7cbbbc0Tue, 04 Jun 2024 07:15:00 -040058:31falsefull455554Potpourri of Debate... Now with AIPotpourri of Debate... Now with AIIt's an "all rounder" episode of The Great Security Debate. Brian watched a movie, Erik watched an advertisement, and Dan was overtly cynical. Just another day in the podcast booth for these three.

A variety pack of topics ranging from recent security attacks, to AI in technology, to automotive manufacturing (go figure), to privacy, to sponsorship and vendor models at live events, and more.

Links to everything we talked about are available in the show notes.

Thanks for listening and welcome to 2024! We have got some exciting changes ahead this year including ways to support the podcast, some big announcements, new shows and conversations, and more! Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>It's an "all rounder" episode of The Great Security Debate. Brian watched a movie, Erik watched an advertisement, and Dan was overtly cynical. Just another day in the podcast booth for these three.

A variety pack of topics ranging from recent security attacks, to AI in technology, to automotive manufacturing (go figure), to privacy, to sponsorship and vendor models at live events, and more.

Links to everything we talked about are available in the show notes.

Thanks for listening and welcome to 2024! We have got some exciting changes ahead this year including ways to support the podcast, some big announcements, new shows and conversations, and more! Thanks for listening!

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

]]>04143ae8-3215-4b34-92c4-b80e19f2ee9eMon, 08 Jan 2024 10:00:00 -040001:04:58falsefull554545The Downfall of All Security (Sales)The Downfall of All Security (Sales)It's not easy to sell things. It's even harder to sell to security practitioners and leaders. The Great Security Debate this week covers some angles in security tools (and selling those tools to security teams) that have taken their toll on the trust that needs to exist between those who buy and those who make the products that we use. From the software providers to the VAR (resellers) in the middle to the people and techniques used to market and sell the solutions. Some of the key topics of the discussion include:

  • The challenges of security tool consolidation by non-security vendors
  • Security is not a lock-in tool, and security is not an upsell tool
  • Pushing changes to products without telling the customers before they happen or letting those customers have control over the change (and if they take it or not)
  • Security Selling with VARs & Deal Registration
  • What are the motivators when a product is recommended to you
  • You can still buy direct (and why you might want to)
  • The challenge of selling into the SMB
  • The power of the “vouch” that flies in the face of some sales methods
  • The importance of being genuine in sales communications (aka knock off the programmatic drip campaigns that pretend to be personal)

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

]]>It's not easy to sell things. It's even harder to sell to security practitioners and leaders. The Great Security Debate this week covers some angles in security tools (and selling those tools to security teams) that have taken their toll on the trust that needs to exist between those who buy and those who make the products that we use. From the software providers to the VAR (resellers) in the middle to the people and techniques used to market and sell the solutions. Some of the key topics of the discussion include:

  • The challenges of security tool consolidation by non-security vendors
  • Security is not a lock-in tool, and security is not an upsell tool
  • Pushing changes to products without telling the customers before they happen or letting those customers have control over the change (and if they take it or not)
  • Security Selling with VARs & Deal Registration
  • What are the motivators when a product is recommended to you
  • You can still buy direct (and why you might want to)
  • The challenge of selling into the SMB
  • The power of the “vouch” that flies in the face of some sales methods
  • The importance of being genuine in sales communications (aka knock off the programmatic drip campaigns that pretend to be personal)

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

]]>7dd8f6a9-e916-433f-a616-fdf9d648df00Mon, 27 Nov 2023 09:00:00 -040055:09falsefull453534Less LLM, More PianoLess LLM, More PianoThis week we are debating modern AI systems, especially the commercial ones on just about everyone's lips when talking about CVs, high school term papers, and interview answers.

Large Language Models (LLMs), of which ChatGPT and Bard are two examples, are growing in prominence, but will they disrupt the technology world, or are they nothing more than just another blockchain fizzle?

In this episode:

  • Are these even actually "AI" models, or really just very fast processing of large data sets?
  • What should I (and should I not) be putting into LLMs? How does the re-teaching based on data entered impact what you should put into public LLMs?
  • What are some valid use cases for LLMs?
  • Does depending on tools like LLMs (or calculators) bring us further from core understanding of how things work? Or should we be OK with the efficiency it brings?
  • How does copyright fit into the LLM expectation and model, and does the legal licensing of training data dull the shine of LLMs?
  • Are the analyses from LLMs skewed not only by the data they chose to use for training, but also by the userbase that uses that LLM?
  • How are any of the "good practise" security and privacy requirements for LLM different from any other systems? Spoiler alert: not at all.

Unrelated to AI, we also talk about what happens to all the "smart" things in your house when the internet goes out? What stops working? Way more than you might think...

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

Links:

Is OpenAI almost bankrupt?: https://www.windowscentral.com/software-apps/chatgpts-fate-hangs-in-the-balance-as-openai-reportedly-edges-closer-to-bankruptcy

Maybe not bankrupt, but has business problem: https://www.forbes.com/sites/lutzfinger/2023/08/18/is-openai-going-bankrupt-no-but-ai-models-dont-create-moats/?sh=3c8922845e22

Gartner declares LLMs at the peak of inflated expectations: https://www.gartner.com/en/newsroom/press-releases/2023-08-16-gartner-places-generative-ai-on-the-peak-of-inflated-expectations-on-the-2023-hype-cycle-for-emerging-technologies

When ChatGPT goes Bad: https://sloanreview.mit.edu/article/from-chatgpt-to-hackgpt-meeting-the-cybersecurity-threat-of-generative-ai/

https://venturebeat.com/security/how-fraudgpt-presages-the-future-of-weaponized-ai/

The Circle (Movie): https://www.imdb.com/title/tt4287320/

Amazon Sidewalk, and it's privacy issues: https://www.popsci.com/technology/amazon-sidewalks-privacy-concerns/

Idiocracy (Movie): https://www.imdb.com/title/tt0387808/

Moores law is dead: https://www.technologyreview.com/2016/05/13/245938/moores-law-is-dead-now-what/

GM deletes Car Play from future EVs: https://www.theverge.com/2023/4/4/23669523/gm-apple-carplay-android-auto-ev-restrict-access

GM announces $130K EV Escalade (without CarPlay): https://www.theverge.com/2023/8/10/23827059/gm-no-carplay-android-auto-escalade-iq

Fragile Things (Book): https://amzn.to/47BWWkB

]]>This week we are debating modern AI systems, especially the commercial ones on just about everyone's lips when talking about CVs, high school term papers, and interview answers.

Large Language Models (LLMs), of which ChatGPT and Bard are two examples, are growing in prominence, but will they disrupt the technology world, or are they nothing more than just another blockchain fizzle?

In this episode:

  • Are these even actually "AI" models, or really just very fast processing of large data sets?
  • What should I (and should I not) be putting into LLMs? How does the re-teaching based on data entered impact what you should put into public LLMs?
  • What are some valid use cases for LLMs?
  • Does depending on tools like LLMs (or calculators) bring us further from core understanding of how things work? Or should we be OK with the efficiency it brings?
  • How does copyright fit into the LLM expectation and model, and does the legal licensing of training data dull the shine of LLMs?
  • Are the analyses from LLMs skewed not only by the data they chose to use for training, but also by the userbase that uses that LLM?
  • How are any of the "good practise" security and privacy requirements for LLM different from any other systems? Spoiler alert: not at all.

Unrelated to AI, we also talk about what happens to all the "smart" things in your house when the internet goes out? What stops working? Way more than you might think...

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

Links:

Is OpenAI almost bankrupt?: https://www.windowscentral.com/software-apps/chatgpts-fate-hangs-in-the-balance-as-openai-reportedly-edges-closer-to-bankruptcy

Maybe not bankrupt, but has business problem: https://www.forbes.com/sites/lutzfinger/2023/08/18/is-openai-going-bankrupt-no-but-ai-models-dont-create-moats/?sh=3c8922845e22

Gartner declares LLMs at the peak of inflated expectations: https://www.gartner.com/en/newsroom/press-releases/2023-08-16-gartner-places-generative-ai-on-the-peak-of-inflated-expectations-on-the-2023-hype-cycle-for-emerging-technologies

When ChatGPT goes Bad: https://sloanreview.mit.edu/article/from-chatgpt-to-hackgpt-meeting-the-cybersecurity-threat-of-generative-ai/

https://venturebeat.com/security/how-fraudgpt-presages-the-future-of-weaponized-ai/

The Circle (Movie): https://www.imdb.com/title/tt4287320/

Amazon Sidewalk, and it's privacy issues: https://www.popsci.com/technology/amazon-sidewalks-privacy-concerns/

Idiocracy (Movie): https://www.imdb.com/title/tt0387808/

Moores law is dead: https://www.technologyreview.com/2016/05/13/245938/moores-law-is-dead-now-what/

GM deletes Car Play from future EVs: https://www.theverge.com/2023/4/4/23669523/gm-apple-carplay-android-auto-ev-restrict-access

GM announces $130K EV Escalade (without CarPlay): https://www.theverge.com/2023/8/10/23827059/gm-no-carplay-android-auto-escalade-iq

Fragile Things (Book): https://amzn.to/47BWWkB

]]>8eac9312-8828-4dd9-876e-b0ee01c35de0Mon, 21 Aug 2023 09:00:00 -040051:33falsefull452524Security *is* Business!Security *is* Business!It's been a minute, but we are back with another Great Security Debate!

Whether it is compliance, trust, questionnaires, we all sell something to someone and security is core to that process.

In this episode, the focus is on how security integrates into the core of each of our businesses or organisations. From being part of strategic planning, the reminder that perfect being the enemy of progress, to the power in being a first mover on security and privacy topics:

  • Compliance vs security: Is it pro forma? Do you check the SOC2 (and other) reports you get from your suppliers?
  • You're not a special snowflake: Why won't more orgs use standard questionnaires on supplier assessments?
  • There are multiple ways to solve a problem, and context is key. The process and environment may mean you don't need a technology control or a specific (prescribed) technology control.
  • "The business" is a term that should never be uttered again by security or technology practitioners and leaders.
  • There is power and business value in governance and transparency in security and privacy; build trust in your brand.
  • We need to move our programs a layer above the specific people. Risk is reduced by living at the process layer. Heroics are not scalable.
  • How can preparing for a triathlon be used to describe adherence to targets that lead to good security (and the brand value that comes with it)

Remember that you can't be "SOC2 Certified." And PFMEA is not always the answer to every question. Or is it?

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

]]>It's been a minute, but we are back with another Great Security Debate!

Whether it is compliance, trust, questionnaires, we all sell something to someone and security is core to that process.

In this episode, the focus is on how security integrates into the core of each of our businesses or organisations. From being part of strategic planning, the reminder that perfect being the enemy of progress, to the power in being a first mover on security and privacy topics:

  • Compliance vs security: Is it pro forma? Do you check the SOC2 (and other) reports you get from your suppliers?
  • You're not a special snowflake: Why won't more orgs use standard questionnaires on supplier assessments?
  • There are multiple ways to solve a problem, and context is key. The process and environment may mean you don't need a technology control or a specific (prescribed) technology control.
  • "The business" is a term that should never be uttered again by security or technology practitioners and leaders.
  • There is power and business value in governance and transparency in security and privacy; build trust in your brand.
  • We need to move our programs a layer above the specific people. Risk is reduced by living at the process layer. Heroics are not scalable.
  • How can preparing for a triathlon be used to describe adherence to targets that lead to good security (and the brand value that comes with it)

Remember that you can't be "SOC2 Certified." And PFMEA is not always the answer to every question. Or is it?

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.

Thanks for listening!

]]>7258afb7-68d5-4e55-97bc-d32cdedd66edWed, 05 Jul 2023 09:00:00 -040046:16falsefull451514Jess and Jeff InvadeJess and Jeff InvadeWelcome to a very special Great Security Debate. If it is spring, it means that the annual Forrester “Top Recommendations For Your Security Program” report has come out, and we get to visit with one of the authors, Jess Burn. But this year, we get an added extra voice in that of Jess’ Forrester colleague Jeff Pollard. Both Jess and Jeff share a ton of insight on topics from that report and a few others (see the links below for blog posts about most of them)

In this episode we cover:

  • How (if) CISOs have been able to become “part of the business” and help colleagues understand that in 2023 security is business.
  • Board reporting by CISOs and CIOs and where/how we succeed and fail.
  • Talent shortages in infosec: a self-created nightmare?
  • Consolidation in times of austerity: right or wrong for security?

Huge thanks to Jess and Jeff for joining (find their LinkedIn and Twitter in the links section). Even though Jess is legacy, we are pretty sure that Jeff will be welcomed back in 2024 with open arms.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for Listening!

Special Guest: Jessica Burn.

Support The Great Security Debate

Links:


]]>Welcome to a very special Great Security Debate. If it is spring, it means that the annual Forrester “Top Recommendations For Your Security Program” report has come out, and we get to visit with one of the authors, Jess Burn. But this year, we get an added extra voice in that of Jess’ Forrester colleague Jeff Pollard. Both Jess and Jeff share a ton of insight on topics from that report and a few others (see the links below for blog posts about most of them)

In this episode we cover:

  • How (if) CISOs have been able to become “part of the business” and help colleagues understand that in 2023 security is business.
  • Board reporting by CISOs and CIOs and where/how we succeed and fail.
  • Talent shortages in infosec: a self-created nightmare?
  • Consolidation in times of austerity: right or wrong for security?

Huge thanks to Jess and Jeff for joining (find their LinkedIn and Twitter in the links section). Even though Jess is legacy, we are pretty sure that Jeff will be welcomed back in 2024 with open arms.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for Listening!

Special Guest: Jessica Burn.

Support The Great Security Debate

Links:


]]>be3cff22-5fa9-47c4-a12a-f274ec3396f8Mon, 24 Apr 2023 09:00:00 -040054:04falsefull450504Bankplosion!Bankplosion!This week, Brian, Erik, and Dan look into the security impacts of last week’s Silicon Valley Bank closure, both from a direct security risk, but also what we can learn about risk from the events leading up to the incident that we can apply to our information security responsibilities.

Brian kicks it off with a great description of how Silicon Valley Bank got here (based on what we knew on 12 March 2023 - subject to change as more becomes known after). And from that, we go some of the direct and indirect lessons and implications such as:


  • Fraud attempts amongst a bevvy of legitimate bank account payment change requests from companies. Check from a known source before changing where you pay.


  • Putting all your eggs into one (infosec or financial) basket can be risky. And risk can bring great rewards, or great resentment


  • Evaluating vendors for where they bank as part of third party risk management (or not)


  • Clear insight to tough choices that have to be made to keep small business and startups running - sometimes that’s not “doing every thing of security”


  • Business continuity planning requires a more realistic “yeah that could happen” when doing the review


  • Remember that there is no such thing as no risk, just determining the right balance of (realistic) risk and downtime for your organisation


  • If one vendor goes away suddenly, what happens? What about if 6 go away all at once?


  • Diversity of suppliers vs. focusing on basics in the security stack


Along with some strong recommendations (or maybe they are warnings) for our security vendor listeners on how not to use this incident as a sales tool (tl;dr: DON’T!), there are a few correlations to the automotive industry. And check out the book club recommendations in the show notes on our website www.greatsecuritydebate.net, too.


Since we recorded another bank, Signature Bank, has also been closed and placed into receivership. On behalf of all of us at Great Security Debate, we wish all those affected either as companies of these banks or their customers good wishes and hope for good news ahead on the recovery of funds.


Thanks for listening!

Support The Great Security Debate

Links:


]]>This week, Brian, Erik, and Dan look into the security impacts of last week’s Silicon Valley Bank closure, both from a direct security risk, but also what we can learn about risk from the events leading up to the incident that we can apply to our information security responsibilities.

Brian kicks it off with a great description of how Silicon Valley Bank got here (based on what we knew on 12 March 2023 - subject to change as more becomes known after). And from that, we go some of the direct and indirect lessons and implications such as:


  • Fraud attempts amongst a bevvy of legitimate bank account payment change requests from companies. Check from a known source before changing where you pay.


  • Putting all your eggs into one (infosec or financial) basket can be risky. And risk can bring great rewards, or great resentment


  • Evaluating vendors for where they bank as part of third party risk management (or not)


  • Clear insight to tough choices that have to be made to keep small business and startups running - sometimes that’s not “doing every thing of security”


  • Business continuity planning requires a more realistic “yeah that could happen” when doing the review


  • Remember that there is no such thing as no risk, just determining the right balance of (realistic) risk and downtime for your organisation


  • If one vendor goes away suddenly, what happens? What about if 6 go away all at once?


  • Diversity of suppliers vs. focusing on basics in the security stack


Along with some strong recommendations (or maybe they are warnings) for our security vendor listeners on how not to use this incident as a sales tool (tl;dr: DON’T!), there are a few correlations to the automotive industry. And check out the book club recommendations in the show notes on our website www.greatsecuritydebate.net, too.


Since we recorded another bank, Signature Bank, has also been closed and placed into receivership. On behalf of all of us at Great Security Debate, we wish all those affected either as companies of these banks or their customers good wishes and hope for good news ahead on the recovery of funds.


Thanks for listening!

Support The Great Security Debate

Links:


]]>583b83d3-014f-441e-ae6f-04d141fe1732Mon, 13 Mar 2023 09:00:00 -040001:02:18falsefull449494Back to Normal?Back to Normal?The Great Security Debate Book Club is in FULL force this week as we talk about life after you’ve gotten the job in information security and are looking for the growth and promotion that come as you grow your career.

Check out the show notes on our website www.greatsecuritydebate.net/48 to get links to all the books, articles, and references we discuss up through the show.

A mere appetiser sized sampling of the topics we cover in this hour include:



  • What does it mean to “return to normal” in work in 2023?


  • How do you grow in your role once you are in the Infosec field?


  • The “old-man” perspective on entitlement in growing within jobs


  • What approaches work (and don’t work) when asking for promotions, raises, new roles, within your organisation


  • Conversely, how to approach getting responsibilities added with out getting additional compensation


  • Using the word “I” vs “We” when talking about a job and your team


  • What to consider the factors and risks outside the office when looking at role and organisational growth


  • The importance of knowing the difference between what you want to say vs how it will be received when read by the recipient


  • What do you do when you find yourself as (or think you are) the smartest person in the room?


  • What resources can people use to get ready for their next growth step at work?


  • How can networking and mentoring be valuable to find the next position?


Since it came up a few times in the show, remember that not every securty career path ends with becoming a CISO, or nor should we expect that everyone in infosec wants to become a CISO!


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>The Great Security Debate Book Club is in FULL force this week as we talk about life after you’ve gotten the job in information security and are looking for the growth and promotion that come as you grow your career.

Check out the show notes on our website www.greatsecuritydebate.net/48 to get links to all the books, articles, and references we discuss up through the show.

A mere appetiser sized sampling of the topics we cover in this hour include:



  • What does it mean to “return to normal” in work in 2023?


  • How do you grow in your role once you are in the Infosec field?


  • The “old-man” perspective on entitlement in growing within jobs


  • What approaches work (and don’t work) when asking for promotions, raises, new roles, within your organisation


  • Conversely, how to approach getting responsibilities added with out getting additional compensation


  • Using the word “I” vs “We” when talking about a job and your team


  • What to consider the factors and risks outside the office when looking at role and organisational growth


  • The importance of knowing the difference between what you want to say vs how it will be received when read by the recipient


  • What do you do when you find yourself as (or think you are) the smartest person in the room?


  • What resources can people use to get ready for their next growth step at work?


  • How can networking and mentoring be valuable to find the next position?


Since it came up a few times in the show, remember that not every securty career path ends with becoming a CISO, or nor should we expect that everyone in infosec wants to become a CISO!


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>e76d3f4e-a16c-4a28-b23b-43dddd696ba1Mon, 27 Feb 2023 09:00:00 -040054:12falsefull448484Uninsurable!Uninsurable!Insurance for information security is changing. Recently some reports came out that there were moves by insurance companies to leave the cybersecurity insurance market - that it was uninsurable. Dan, Brian, and Erik discuss on this week's Great Security Debate:


  • What happens now that cybersecurity insurance is built into contracts and requirements by customers doing business with other companies?


  • Are the carveouts such that it’s easier to just pay and not inform insurance that you want them to pay for the incident?


  • Does having “easy” insurance give too many orgs a pass on having to actually improve their security control sets?


  • How do insurance “formularies” make companies less secure by not letting them buy the newer, better technologies?


  • Conversely, how does the formulary of products help prevent from buying junk tech that calls itself “security”?


  • How does the threat of nonpayment of expenses and losses by insurance companies after the fact affect organisational security decisions for or against the formulary?


  • How is relying on insurance to determine tech standards the same as the EU demanding all chargers be USB-C?


  • Does insurance go away altogether? Do we want it to go away?


  • What is the law of the horse and how does it apply to insurance in information security?


  • Can shifting downstream supplier risk into insurance really work to reduce risk?


  • Is security a cost centre, a cost of doing business, or a potential profit centre for orgs?


  • Should we shift from insurance mandate to “figure it out”


  • How does the conscious decision not to patch because the patch causes worse issues affect the insurance coverage?


  • How can we balance the expectation with our technology suppliers to maintain support longer, especially on IOT or high-cost, long life devices?


  • Can a move toward clear, yet broad expectations on controls be enough to meet security expectations for insurance without prescriptive formularies of technology and process?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>Insurance for information security is changing. Recently some reports came out that there were moves by insurance companies to leave the cybersecurity insurance market - that it was uninsurable. Dan, Brian, and Erik discuss on this week's Great Security Debate:


  • What happens now that cybersecurity insurance is built into contracts and requirements by customers doing business with other companies?


  • Are the carveouts such that it’s easier to just pay and not inform insurance that you want them to pay for the incident?


  • Does having “easy” insurance give too many orgs a pass on having to actually improve their security control sets?


  • How do insurance “formularies” make companies less secure by not letting them buy the newer, better technologies?


  • Conversely, how does the formulary of products help prevent from buying junk tech that calls itself “security”?


  • How does the threat of nonpayment of expenses and losses by insurance companies after the fact affect organisational security decisions for or against the formulary?


  • How is relying on insurance to determine tech standards the same as the EU demanding all chargers be USB-C?


  • Does insurance go away altogether? Do we want it to go away?


  • What is the law of the horse and how does it apply to insurance in information security?


  • Can shifting downstream supplier risk into insurance really work to reduce risk?


  • Is security a cost centre, a cost of doing business, or a potential profit centre for orgs?


  • Should we shift from insurance mandate to “figure it out”


  • How does the conscious decision not to patch because the patch causes worse issues affect the insurance coverage?


  • How can we balance the expectation with our technology suppliers to maintain support longer, especially on IOT or high-cost, long life devices?


  • Can a move toward clear, yet broad expectations on controls be enough to meet security expectations for insurance without prescriptive formularies of technology and process?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>219c5ed3-af5f-4a27-a093-0c6047442296Mon, 16 Jan 2023 09:00:00 -040001:02:32falsefull447474A Niche Inside a Niche Is Really Just a QuicheA Niche Inside a Niche Is Really Just a QuicheWelcome to the year-end 2022 episode of The Great Security Debate.

In this hour, Brian, Erik, and Dan cover myriad ways hiring processes are failing job seekers and hiring organisations. It all kicked off with the impersonal nature of automated 1-way video interviews. It quickly jumped into the myriad of other ways we can do better on both sides, including (but not limited to):


  • Do video interviews encourage fraud? Multiple jobs for one person? A fake version of you applying for a job?


  • Why are hiring managers and HR using video interviews? Are there legitimate reasons?


  • Does the lack of ability to assess the candidate’s response to the interviewer’s response makes the interview less effective?


  • What is the impression left when a candidate is immediately rejected based on analytics and matching, not human interaction?


  • What’s the value of using your network around a broken applicant system? What do we lose by only depending on our networks for hiring?


  • How do these recorded methods exclude introverts and others that may not be camera comfortable in their presentation skills?


  • Can and should there be roles for people at higher levels that don’t include people management?


  • Is “AI” (term used in quotes on purpose) really the antithesis of diversity or inclusion?


  • How is connecting people to others and helping them expand their networks better than sending resumes to people you know?


  • In times of cash crunch, will hiring come from experienced people having been let go from roles, or hiring entry-level and ups killing them?


You’ll also get a few mentions of Buzzword Bingo; the shocking revelation that Brian works for a vendor; and Dan goes on a tirade about new software that does recording and analysis in Zoom meetings with and without permission. It’s another great debate!


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>Welcome to the year-end 2022 episode of The Great Security Debate.

In this hour, Brian, Erik, and Dan cover myriad ways hiring processes are failing job seekers and hiring organisations. It all kicked off with the impersonal nature of automated 1-way video interviews. It quickly jumped into the myriad of other ways we can do better on both sides, including (but not limited to):


  • Do video interviews encourage fraud? Multiple jobs for one person? A fake version of you applying for a job?


  • Why are hiring managers and HR using video interviews? Are there legitimate reasons?


  • Does the lack of ability to assess the candidate’s response to the interviewer’s response makes the interview less effective?


  • What is the impression left when a candidate is immediately rejected based on analytics and matching, not human interaction?


  • What’s the value of using your network around a broken applicant system? What do we lose by only depending on our networks for hiring?


  • How do these recorded methods exclude introverts and others that may not be camera comfortable in their presentation skills?


  • Can and should there be roles for people at higher levels that don’t include people management?


  • Is “AI” (term used in quotes on purpose) really the antithesis of diversity or inclusion?


  • How is connecting people to others and helping them expand their networks better than sending resumes to people you know?


  • In times of cash crunch, will hiring come from experienced people having been let go from roles, or hiring entry-level and ups killing them?


You’ll also get a few mentions of Buzzword Bingo; the shocking revelation that Brian works for a vendor; and Dan goes on a tirade about new software that does recording and analysis in Zoom meetings with and without permission. It’s another great debate!


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>959d6adb-2321-4a29-98da-2c45810e71ffTue, 27 Dec 2022 09:00:00 -040056:49falsefull346463Live From the Big HouseLive From the Big HouseRecorded on Saturday 29 October 2022, at the tailgate before the University of Michigan vs Michigan State University (American) football game, Brian, Erik and Dan chat about the news of the day, with more than a few correlations back to football. And we had a special guest join us, too: Zah Gonzalvo Rodriguez


  • There was an upcoming OpenSSL vulnerability hitting the world this week. How would Software Bill of Materials (SBOM) make the response easier?


  • A reminder of our dependence on the stability and security of some very core tools (like OpenSSL) to run our businesses. Mot to mention the fact that such tools are often within the libraries we use and don’t even realise it’s there.


  • Similarities between football and security in the need to adjust based on what the other team shows signs of throwing at you, and further based on what they actually bring to the line.


  • How repeatable process and inventory help make the response to these vulnerability disclosures less like a firedrill and more like standard ops.


  • Did you know that credit ratings are being affected by information security posture and breach response?


  • Same thing with M&A and investment valuation… if you’re not as mature in security and privacy you may see a discount taken on your value!


  • How transparent should we be with the peer companies and the public world about our security posture (like incident response plans, and security controls in place)?


And if you’re curious, you can find out what team Dan (the lifelong Badger) was supporting in the game. Congratulations to the University of Michigan in later winning this game, and to both teams for keeping the rivalry alive and spicy.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

]]>Recorded on Saturday 29 October 2022, at the tailgate before the University of Michigan vs Michigan State University (American) football game, Brian, Erik and Dan chat about the news of the day, with more than a few correlations back to football. And we had a special guest join us, too: Zah Gonzalvo Rodriguez


  • There was an upcoming OpenSSL vulnerability hitting the world this week. How would Software Bill of Materials (SBOM) make the response easier?


  • A reminder of our dependence on the stability and security of some very core tools (like OpenSSL) to run our businesses. Mot to mention the fact that such tools are often within the libraries we use and don’t even realise it’s there.


  • Similarities between football and security in the need to adjust based on what the other team shows signs of throwing at you, and further based on what they actually bring to the line.


  • How repeatable process and inventory help make the response to these vulnerability disclosures less like a firedrill and more like standard ops.


  • Did you know that credit ratings are being affected by information security posture and breach response?


  • Same thing with M&A and investment valuation… if you’re not as mature in security and privacy you may see a discount taken on your value!


  • How transparent should we be with the peer companies and the public world about our security posture (like incident response plans, and security controls in place)?


And if you’re curious, you can find out what team Dan (the lifelong Badger) was supporting in the game. Congratulations to the University of Michigan in later winning this game, and to both teams for keeping the rivalry alive and spicy.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

]]>7c3ea270-7c21-48ad-a484-5921fcedf43cSun, 30 Oct 2022 13:00:00 -040045:05falsefull345453Recorded on Saturday 29 October 2022, at the tailgate before the University of Michigan vs Michigan State University (American) football game, Brian, Erik and Dan chat about the news of the day, with more than a few correlations back to football. And we had a special guest join us, too: https://www.linkedin.com/in/zahira-zah-rodriguez-gonzalvo-1a97692/ (Zah Gonzalvo Rodriguez) There was an upcoming OpenSSL vulnerability hitting the world this week. How would Software Bill of Materials (SBOM) make the response easier? A reminder of our dependence on the stability and security of some very core tools (like OpenSSL) to run our businesses. Mot to mention the fact that such tools are often within the libraries we use and don’t even realise it’s there. Similarities between football and security in the need to adjust based on what the other team shows signs of throwing at you, and further based on what they actually bring to the line. How repeatable process and inventory help make the response to these vulnerability disclosures less like a firedrill and more like standard ops. Did you know that credit ratings are being affected by information security posture and breach response? Same thing with MandA and investment valuation… if you’re not as mature in security and privacy you may see a discount taken on your value! How transparent should we be with the peer companies and the public world about our security posture (like incident response plans, and security controls in place)? And if you’re curious, you can find out what team Dan (the lifelong Badger) was supporting in the game. Congratulations to the University of Michigan in later winning this game, and to both teams for keeping the rivalry alive and spicy. We also have a video channel on YouTube that airs the &quot;with pictures&quot; edition of the podcast. Please head to https://youtube.com/@greatsecuritydebate (https://youtube.com/@greatsecuritydebate) and watch, subscribe and &quot;like&quot; the episodes. Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links. Thanks for listening! https://www.patreon.com/securitydebate (Support The Great Security Debate)No More Ads, No More Privacy Problem?No More Ads, No More Privacy Problem?This week’s debate comes amid a combo platter of increased analytics leading to near-immediate contact when visiting a product’s website, along with more clarity from enforcement bodies about how they will approach their respective privacy legislation. One such fine was the Sephora CCPA matter in which California Attorney General levied a $1.2M fine on the company ([https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement])

Listen in to hear Dan, Brian and Erik talk about:


  • Are privacy and shareholder value at odds? How does protecting the privacy of the consumer help shareholder value?


  • A reminder that security and privacy can serve as a business differentiator


  • How to deal with the reputation of a company being set by misleading headlines (and people not reading the actual article/detail)?


  • Does better privacy practices in companies lead to reduced data for sale on the illicit market?


  • Does just “saying no to data collection” by companies make for a better privacy posture?


  • How long should (vs. how long do) you hold onto data?


  • How will companies be judged in the future by how they manage data today?


  • Are ads themselves the source of all our problems?


  • Why does the push for more advertising to reduce costs increases the push for more data collection?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>This week’s debate comes amid a combo platter of increased analytics leading to near-immediate contact when visiting a product’s website, along with more clarity from enforcement bodies about how they will approach their respective privacy legislation. One such fine was the Sephora CCPA matter in which California Attorney General levied a $1.2M fine on the company ([https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement])

Listen in to hear Dan, Brian and Erik talk about:


  • Are privacy and shareholder value at odds? How does protecting the privacy of the consumer help shareholder value?


  • A reminder that security and privacy can serve as a business differentiator


  • How to deal with the reputation of a company being set by misleading headlines (and people not reading the actual article/detail)?


  • Does better privacy practices in companies lead to reduced data for sale on the illicit market?


  • Does just “saying no to data collection” by companies make for a better privacy posture?


  • How long should (vs. how long do) you hold onto data?


  • How will companies be judged in the future by how they manage data today?


  • Are ads themselves the source of all our problems?


  • Why does the push for more advertising to reduce costs increases the push for more data collection?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you choose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you use them. We do not make our recommendations based on the availability or benefits of these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>07bffc00-c108-4e05-9369-cda8e1ec7511Mon, 03 Oct 2022 09:00:00 -040055:35falsefull344443New Team, Who Dis?New Team, Who Dis?We've all seen it (or been it): a new boss arrives at the company and quickly thereafter a bunch of their old colleagues get hired. It feels like they are getting the band back together at the new place. What does that say to the organisation about that leader? What does doing the opposite (pausing, growing from within) say differently? Brian, Dan and Erik discuss, debate and dissect this from a few angles, including some of the following:


  • The power of threes: Three paths when you come in as a new leader: bring your own, nurture within, hire all new. And the three arcs of a company - startup/scrappy , growth/maturation, steady/run.


  • Two critical skills we wish we were taught in school and earlier in work: communications and public speaking


  • The impacts on culture on leadership and how they approach the staffing question, and how you bring people in will be the biggest impact on the culture of the organisation


  • How can metrics hide the actual performance of the team?


  • Are the CISO retention numbers as bad as the urban myth ? Are CISOs staying longer than we think they are?


  • What organisational situations drive leaders to resort to bringing in the people they know and trust vs. Trusting those already there?


  • How does growth by acquisition change the way we approach the listening and staffing of our teams and supporting our organisations?


  • Approaches to finding people to provide new perspectives, without having already worked with them directly?


  • How does geographic culture affect the decision on how to staff your team as a new leader in an organisation?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>We've all seen it (or been it): a new boss arrives at the company and quickly thereafter a bunch of their old colleagues get hired. It feels like they are getting the band back together at the new place. What does that say to the organisation about that leader? What does doing the opposite (pausing, growing from within) say differently? Brian, Dan and Erik discuss, debate and dissect this from a few angles, including some of the following:


  • The power of threes: Three paths when you come in as a new leader: bring your own, nurture within, hire all new. And the three arcs of a company - startup/scrappy , growth/maturation, steady/run.


  • Two critical skills we wish we were taught in school and earlier in work: communications and public speaking


  • The impacts on culture on leadership and how they approach the staffing question, and how you bring people in will be the biggest impact on the culture of the organisation


  • How can metrics hide the actual performance of the team?


  • Are the CISO retention numbers as bad as the urban myth ? Are CISOs staying longer than we think they are?


  • What organisational situations drive leaders to resort to bringing in the people they know and trust vs. Trusting those already there?


  • How does growth by acquisition change the way we approach the listening and staffing of our teams and supporting our organisations?


  • Approaches to finding people to provide new perspectives, without having already worked with them directly?


  • How does geographic culture affect the decision on how to staff your team as a new leader in an organisation?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>d6cc611a-bbaa-4037-94df-be56158b382dThu, 01 Sep 2022 13:30:00 -040001:01:31falsefull343433Subscribe and Don't Like!Subscribe and Don't Like!Are we getting subscription overload? The move to more and more subscriptions is good for those selling, but are they good for those buying, too?


  • Do subscriptions offset by other non-cash costs (e.g. data collection, advertising) reduce subscription fatigue? How does that fit into the security product world? What are the risks of making security technology only for those that can't afford it? Why are the ad-supported versions more heavily marketed than the no-ad versions?


  • How do subscriptions encourage continuous development of software and features? What about innovation?


  • What's a persistent feature, and what can be revoked or shifted into a different subscription tier (take a look at Slack's recent move to make the free tier way less valuable and encourage the need to move to a paid tier)


  • Do the combinatoric vastness of features that can go on and off based on the subscriptions you buy introduce an unnecessary or unsafe risk of not working well together in specific combos?


  • What are the legalities of jailbreaking your software rather than paying to activate it by subscription? How does doing so affect the liability and effectiveness of the product?


We also talk about some things unrelated to subscriptions (and cars)!


  • What is needed to adapt your communications (and subscription sales pitch) to VC/PE vs the CIO/CISO at a company? East coast vs west coast? Etc.


  • Tips for job candidates on looking for public info on what a company thinks is important from security and risk (hint: it's SEC filings like the 8-K and 10-K!)


Tune in to delight as Dan rants in Yiddish and then mess up the name of some of the most popular movies of our time. Enjoy seeing (or hearing) Erik get on a soapbox stumping for Sig Sigma. Binge on Brian talking about automotive manufacturing (who knew) and for once not be broadcasting from a "train station".


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


If you're watching on YouTube, we are very sorry for the video sync issues this week! The sound is great, but one of our hosts does a very poor Milli Vanilli impression. We are writing up the root cause analysis documents and issuing CAPAs to keep it from happening agai


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>Are we getting subscription overload? The move to more and more subscriptions is good for those selling, but are they good for those buying, too?


  • Do subscriptions offset by other non-cash costs (e.g. data collection, advertising) reduce subscription fatigue? How does that fit into the security product world? What are the risks of making security technology only for those that can't afford it? Why are the ad-supported versions more heavily marketed than the no-ad versions?


  • How do subscriptions encourage continuous development of software and features? What about innovation?


  • What's a persistent feature, and what can be revoked or shifted into a different subscription tier (take a look at Slack's recent move to make the free tier way less valuable and encourage the need to move to a paid tier)


  • Do the combinatoric vastness of features that can go on and off based on the subscriptions you buy introduce an unnecessary or unsafe risk of not working well together in specific combos?


  • What are the legalities of jailbreaking your software rather than paying to activate it by subscription? How does doing so affect the liability and effectiveness of the product?


We also talk about some things unrelated to subscriptions (and cars)!


  • What is needed to adapt your communications (and subscription sales pitch) to VC/PE vs the CIO/CISO at a company? East coast vs west coast? Etc.


  • Tips for job candidates on looking for public info on what a company thinks is important from security and risk (hint: it's SEC filings like the 8-K and 10-K!)


Tune in to delight as Dan rants in Yiddish and then mess up the name of some of the most popular movies of our time. Enjoy seeing (or hearing) Erik get on a soapbox stumping for Sig Sigma. Binge on Brian talking about automotive manufacturing (who knew) and for once not be broadcasting from a "train station".


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


If you're watching on YouTube, we are very sorry for the video sync issues this week! The sound is great, but one of our hosts does a very poor Milli Vanilli impression. We are writing up the root cause analysis documents and issuing CAPAs to keep it from happening agai


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>d9993736-e18a-4d68-92cb-11edf2f5cd36Thu, 18 Aug 2022 09:00:00 -040001:06:50falsefull342423Are we getting subscription overload? The move to more and more subscriptions is good for those selling, but are they good for those buying, too? Do subscriptions offset by other non-cash costs (e.g. data collection, advertising) reduce subscription fatigue? How does that fit into the security product world? What are the risks of making security technology only for those that can&#39;t afford it? Why are the ad-supported versions more heavily marketed than the no-ad versions? How do subscriptions encourage continuous development of software and features? What about innovation? What&#39;s a persistent feature, and what can be revoked or shifted into a different subscription tier (take a look at Slack&#39;s recent move to make the free tier way less valuable and encourage the need to move to a paid tier) Do the combinatoric vastness of features that can go on and off based on the subscriptions you buy introduce an unnecessary or unsafe risk of not working well together in specific combos? What are the legalities of jailbreaking your software rather than paying to activate it by subscription? How does doing so affect the liability and effectiveness of the product? We also talk about some things unrelated to subscriptions (and cars)! What is needed to adapt your communications (and subscription sales pitch) to VC/PE vs the CIO/CISO at a company? East coast vs west coast? Etc. Tips for job candidates on looking for public info on what a company thinks is important from security and risk (hint: it&#39;s SEC filings like the 8-K and 10-K!) Tune in to delight as Dan rants in Yiddish and then mess up the name of some of the most popular movies of our time. Enjoy seeing (or hearing) Erik get on a soapbox stumping for Sig Sigma. Binge on Brian talking about automotive manufacturing (who knew) and for once not be broadcasting from a &quot;train station&quot;. We also have a video channel on YouTube that airs the &quot;with pictures&quot; edition of the podcast. Please head over to https://bit.ly/gsdyoutube (https://bit.ly/gsdyoutube) and watch, subscribe and &quot;like&quot; the episodes. If you&#39;re watching on YouTube, we are very sorry for the video sync issues this week! The sound is great, but one of our hosts does a very poor Milli Vanilli impression. We are writing up the root cause analysis documents and issuing CAPAs to keep it from happening agai Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links. Thanks for listening! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: http://www.amazon.com/exec/obidos/ASIN/0062292986/securitydebat-20 (Crossing the Chasm, 3rd Edition: Marketing and Selling Disruptive Products to Mainstream Customers (Collins Business Essentials): Moore, Geoffrey A.: 9780062353948: Amazon.com: Books) http://www.amazon.com/exec/obidos/ASIN/B0877D6H28/securitydebat-20 (This Is How They Tell Me the World Ends: The Cyberweapons Arms Race - Kindle edition by Perlroth, Nicole. Politics & Social Sciences Kindle eBooks @ Amazon.com.)Fake It Till You Make It?Fake It Till You Make It?It's the dog days of summer here in the northern hemisphere, and we have some episodes to make the hot, muggy days go by faster (or the drive up to the cabin in the woods to escape it all).

This week Dan, Brian and Erik talk about what it takes to be a Virtual or Fractional CISO. Does someone that calls themselves one need to have had in-house CISO experience to do the job? Or do the fresh perspectives of someone that doesn't come with history benefit the organisation in a different way? Risks, challenges, and talking to Boards of Directors definitely have a strong place in the debate (and we hit on all of them)

We will be back with more episodes through August and then back to our usual bi-weekly pace as we hit the autumn.


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


If you're watching on YouTube, we are very sorry for the video sync issues this week! The sound is great, but one of our hosts does a very poor Milli Vanilli impression. We are writing up the root cause analysis documents and issuing CAPAs to keep it from happening agai


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>It's the dog days of summer here in the northern hemisphere, and we have some episodes to make the hot, muggy days go by faster (or the drive up to the cabin in the woods to escape it all).

This week Dan, Brian and Erik talk about what it takes to be a Virtual or Fractional CISO. Does someone that calls themselves one need to have had in-house CISO experience to do the job? Or do the fresh perspectives of someone that doesn't come with history benefit the organisation in a different way? Risks, challenges, and talking to Boards of Directors definitely have a strong place in the debate (and we hit on all of them)

We will be back with more episodes through August and then back to our usual bi-weekly pace as we hit the autumn.


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


If you're watching on YouTube, we are very sorry for the video sync issues this week! The sound is great, but one of our hosts does a very poor Milli Vanilli impression. We are writing up the root cause analysis documents and issuing CAPAs to keep it from happening agai


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>0af2dbc6-7bcb-4eae-9ecd-c2b05a939c72Wed, 03 Aug 2022 13:00:00 -040059:22falsefull341413It&#39;s the dog days of summer here in the northern hemisphere, and we have some episodes to make the hot, muggy days go by faster (or the drive up to the cabin in the woods to escape it all). This week Dan, Brian and Erik talk about what it takes to be a Virtual or Fractional CISO. Does someone that calls themselves one need to have had in-house CISO experience to do the job? Or do the fresh perspectives of someone that doesn&#39;t come with history benefit the organisation in a different way? Risks, challenges, and talking to Boards of Directors definitely have a strong place in the debate (and we hit on all of them) We will be back with more episodes through August and then back to our usual bi-weekly pace as we hit the autumn. We also have a video channel on YouTube that airs the &quot;with pictures&quot; edition of the podcast. Please head over to https://bit.ly/gsdyoutube (https://bit.ly/gsdyoutube) and watch, subscribe and &quot;like&quot; the episodes. If you&#39;re watching on YouTube, we are very sorry for the video sync issues this week! The sound is great, but one of our hosts does a very poor Milli Vanilli impression. We are writing up the root cause analysis documents and issuing CAPAs to keep it from happening agai Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links. Thanks for listening! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://twitter.com/browninfosecguy/status/1531666982562562048 (Sonny 🇨🇦❄️⚓ on Twitter: "WTF is this ??? #CyberSecurity #InfoSec https://t.co/DLHivTJ9Qw" / Twitter) http://www.amazon.com/exec/obidos/ASIN/1635576059/securitydebat-20 (This Is How They Tell Me the World Ends: The Cyberweapons Arms Race: Perlroth, Nicole: 9781635576054: Amazon.com: Books) https://www.securelyyoursllc.com/sajay-rai/ (Sajay Rai — Securely Yours LLCSecurely Yours LLC) https://www.linkedin.com/in/sajay-rai-cpa-cissp-cism-72244/ (Sajay Rai CPA, CISSP, CISM | LinkedIn) http://www.amazon.com/exec/obidos/ASIN/1250067057/securitydebat-20 (Amazon - Extreme Ownership: How U.S. Navy SEALs Lead and Win: Willink, Jocko, Babin, Leif: 9781250067050: Books) https://rafeeqrehman.com/2022/04/24/ciso-mindmap-2022-what-do-infosec-professionals-really-do/ (CISO MindMap 2022: What do InfoSec Professionals really do?Rafeeq Rehman | Cyber | Automation | Digital)What Got You Here Won’t (Necessarily) Get You ThereWhat Got You Here Won’t (Necessarily) Get You ThereDan, Brian and Erik look at how the past informs our security future, and how things we have done in the past may not get us where we need to be in the future. Join us for a live podcast recording with live audience Q&A, direct from the MCWT Executive Connection Summit.

In the live recording we covered a flurry of topics focused on changing ourselves, refreshing ourselves and renewing ourselves including:


  • The barriers to entry to get into the security field


  • Experience vs. education requirements in security hiring


  • Changes afoot in hiring appetite as recession looms


  • Reporting requirements by public companies on breach or security events


  • Security beyond just confidentiality


  • Improvements that can be made to the hiring process


  • And lots more!


Huge thanks to the wonderful team at the Michigan Council on Women in Technology (https://mcwt.org) for asking us to be part of this great event bringing the Michigan technology community together to build connections.


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>Dan, Brian and Erik look at how the past informs our security future, and how things we have done in the past may not get us where we need to be in the future. Join us for a live podcast recording with live audience Q&A, direct from the MCWT Executive Connection Summit.

In the live recording we covered a flurry of topics focused on changing ourselves, refreshing ourselves and renewing ourselves including:


  • The barriers to entry to get into the security field


  • Experience vs. education requirements in security hiring


  • Changes afoot in hiring appetite as recession looms


  • Reporting requirements by public companies on breach or security events


  • Security beyond just confidentiality


  • Improvements that can be made to the hiring process


  • And lots more!


Huge thanks to the wonderful team at the Michigan Council on Women in Technology (https://mcwt.org) for asking us to be part of this great event bringing the Michigan technology community together to build connections.


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availability or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>3034b96b-0de3-464a-a133-848fccb1d617Thu, 26 May 2022 09:00:00 -040045:27falsefull340403Program Your ProgramProgram Your ProgramThis week on The Great Security Debate we have arrived at one of our favourite episodes of the year (and what is and will be an annual thing!) when Forrester Senior Analyst, Jess Burn, returns to the show to share this years recommendations for security programs.

An overarching theme of the report is to use the captital that the CISO has acquired over the past few years and build out your program to where it needs to be. AKA, “strike while the iron is hot”

More detailed topics including:



  • Career paths and changes in comp methodology for security teams need to change


  • Security Awareness needs adjustment for work for anywhere


  • Minimum viable security - it’s definitely not just “barely secure”


And a reminder that Dan, Brian and Erik will be doing a live episode of the podcast at the upcoming Michigan Women in Technology ExecutiveManagement Conference on May 5 in Novi, Michigan. Tickets for the whole conference are now available (https://MCWT.org) and the agenda for the day is great. See you there


If you want to listen to Jess’s previous episode, check out Episode 20, “It All Comes Down To Relaltionships.” https://www.greatsecuritydebate.net/20


You can find Jess on LinkedIn (https://www.linkedin.com/in/jessburn), Twitter (https://twitter.com/jess_burn_) and at the Forrester blog (https://go.forrester.com/blogs/author/jess_burn/).


Thanks for joining us, Jess! And thanks to you for listening and watching.

Special Guest: Jessica Burn.

Support The Great Security Debate

Links:


]]>This week on The Great Security Debate we have arrived at one of our favourite episodes of the year (and what is and will be an annual thing!) when Forrester Senior Analyst, Jess Burn, returns to the show to share this years recommendations for security programs.

An overarching theme of the report is to use the captital that the CISO has acquired over the past few years and build out your program to where it needs to be. AKA, “strike while the iron is hot”

More detailed topics including:



  • Career paths and changes in comp methodology for security teams need to change


  • Security Awareness needs adjustment for work for anywhere


  • Minimum viable security - it’s definitely not just “barely secure”


And a reminder that Dan, Brian and Erik will be doing a live episode of the podcast at the upcoming Michigan Women in Technology ExecutiveManagement Conference on May 5 in Novi, Michigan. Tickets for the whole conference are now available (https://MCWT.org) and the agenda for the day is great. See you there


If you want to listen to Jess’s previous episode, check out Episode 20, “It All Comes Down To Relaltionships.” https://www.greatsecuritydebate.net/20


You can find Jess on LinkedIn (https://www.linkedin.com/in/jessburn), Twitter (https://twitter.com/jess_burn_) and at the Forrester blog (https://go.forrester.com/blogs/author/jess_burn/).


Thanks for joining us, Jess! And thanks to you for listening and watching.

Special Guest: Jessica Burn.

Support The Great Security Debate

Links:


]]>56367464-f5b9-4101-9d3e-54117115512aMon, 25 Apr 2022 09:00:00 -040001:02:43falsefull339393This week on The Great Security Debate we have arrived at one of our favourite episodes of the year (and what is and will be an annual thing!) when Forrester Senior Analyst, Jess Burn, returns to the show to share this years recommendations for security programs. An overarching theme of the report is to use the captital that the CISO has acquired over the past few years and build out your program to where it needs to be. AKA, “strike while the iron is hot” More detailed topics including: Career paths and changes in comp methodology for security teams need to change Security Awareness needs adjustment for work for anywhere Minimum viable security - it’s definitely not just “barely secure” And a reminder that Dan, Brian and Erik will be doing a live episode of the podcast at the upcoming Michigan Women in Technology ExecutiveManagement Conference on May 5 in Novi, Michigan. Tickets for the whole conference are now available (https://MCWT.org (https://MCWT.org)) and the agenda for the day is great. See you there If you want to listen to Jess’s previous episode, check out Episode 20, “It All Comes Down To Relaltionships.” https://www.greatsecuritydebate.net/20 (https://www.greatsecuritydebate.net/20) You can find Jess on LinkedIn (https://www.linkedin.com/in/jessburn (https://www.linkedin.com/in/jessburn)), Twitter (https://twitter.com/jess_burn_ (https://twitter.com/jess_burn_)) and at the Forrester blog (https://go.forrester.com/blogs/author/jess_burn/ (https://go.forrester.com/blogs/author/jess_burn/)). Thanks for joining us, Jess! And thanks to you for listening and watching. Special Guest: Jessica Burn. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.forrester.com/blogs/our-2022-top-recommendations-for-your-security-program-cisos-get-an-offer-they-cant-refuse/ (Forrester's 2022 Top Recommendations For Your Security Program) https://www.forrester.com/blogs/the-return-of-the-cybersecurity-incident-response-services-wave/ (The Return Of The Forrester Wave™: Cybersecurity Incident Response Services) https://www.inputmag.com/tech/starlink-russian-jamming-attack-us-military-elon-musk-vladimir-putin (Starlink fought off Russian jamming attack faster than the military could)Laws and RegsLaws and RegsThe Great Security Debate rolls on, this week looking at how governments, regulations and business values are and will shape the security posture of enterprises.


  • Is attribution worth pursuing to the end?


  • How can state and federal law enforcement help figure out who and what happened after an incident?


  • Fast (agile) vs good (quality) vs cheap (cost)


  • Are you chasing the right metrics in your organisation? Do they encourage the right behaviour?


  • Is regulation required to make good security a greater market force?


  • What will the regulations emerging in the US focus on? The “what”, the “why”, the “how”, or the “who”? How will they change when and how companies report material breaches?


  • How does attribution of attack correlate to insurance coverage? How do IR firms fit into the equation?


Erik, Dan and Brian also announce that the podcast is going LIVE and On the road. On May 5, Great Security Debate will be recording a live episode at the MCWT Executive Connection Summit in Novi, Michigan! More info and registration details are at https://mcwt.wildapricot.org/event-4630370. Ticket sales begin on 18 April 2022.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>The Great Security Debate rolls on, this week looking at how governments, regulations and business values are and will shape the security posture of enterprises.


  • Is attribution worth pursuing to the end?


  • How can state and federal law enforcement help figure out who and what happened after an incident?


  • Fast (agile) vs good (quality) vs cheap (cost)


  • Are you chasing the right metrics in your organisation? Do they encourage the right behaviour?


  • Is regulation required to make good security a greater market force?


  • What will the regulations emerging in the US focus on? The “what”, the “why”, the “how”, or the “who”? How will they change when and how companies report material breaches?


  • How does attribution of attack correlate to insurance coverage? How do IR firms fit into the equation?


Erik, Dan and Brian also announce that the podcast is going LIVE and On the road. On May 5, Great Security Debate will be recording a live episode at the MCWT Executive Connection Summit in Novi, Michigan! More info and registration details are at https://mcwt.wildapricot.org/event-4630370. Ticket sales begin on 18 April 2022.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>2d2e1bcc-c921-4486-90c3-8418a13b095dWed, 13 Apr 2022 09:00:00 -040045:10falsefull338383Squality!Squality!Recently, Brian, Dan and Erik had the great fortune to do a live version of the podcast at the monthly meeting of the SIM Detroit Chapter (https://chapter.simnet.org/detroit/home). At the close of that discussion, the comment was raised as to whether or not security should be used as a competitive advantage by businesses. The topic seemed perfect for The Great Security Debate, so here we are. In this episode, we cover:


  • Can security be used as a business differentiator?


  • SHOULD security be used as a business differentiator?


  • If security is added too deeply into the sales cycle does it incentivise the wrong behaviours just to make a sale?


  • How can we quantify the value of security in the purchasing process when it is not easily attributable to direct cost saving or value?


  • How do closed systems compare to open systems with regard to security?


  • How does the rise of customer trust as a key organisational focus indicate the use of security as a business differentiator?


  • Do the fears that using security as a differentiator means that the collaborative nature and history of security will disappear?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>Recently, Brian, Dan and Erik had the great fortune to do a live version of the podcast at the monthly meeting of the SIM Detroit Chapter (https://chapter.simnet.org/detroit/home). At the close of that discussion, the comment was raised as to whether or not security should be used as a competitive advantage by businesses. The topic seemed perfect for The Great Security Debate, so here we are. In this episode, we cover:


  • Can security be used as a business differentiator?


  • SHOULD security be used as a business differentiator?


  • If security is added too deeply into the sales cycle does it incentivise the wrong behaviours just to make a sale?


  • How can we quantify the value of security in the purchasing process when it is not easily attributable to direct cost saving or value?


  • How do closed systems compare to open systems with regard to security?


  • How does the rise of customer trust as a key organisational focus indicate the use of security as a business differentiator?


  • Do the fears that using security as a differentiator means that the collaborative nature and history of security will disappear?


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>1bbd3d48-737f-40c5-9256-dbf55d63ac84Tue, 29 Mar 2022 09:00:00 -040001:05:36falsefull337373How Do You Sleep At Night?How Do You Sleep At Night?Current global events have led to increased focus on technology security. In this week's episode we debate to what extent this does or will confirm the rise of the information security roles within organisations. Our thoughts and good wishes go out to the people of Ukraine.


  • Do current events confirm that the rise of the CISO organisation was warranted?


  • How do CISOs sleep at night considering everything going on?


  • How to reply to the question “what else should we be doing?”


  • Are the attacks the primary objective or are they a smokescreen?


  • How does the game of chess tie into to information security practises?


  • What is the CISOs role in reducing FUD (fear, uncertainty, doubt)?


  • Will current information it pay for acts of war? Does it raise our collective stature?


  • Why is humility so important in the information security world?


The underlying message is that while it is late in the process now to do all the steps to protect your organisation, it’s never too late to get started!

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>Current global events have led to increased focus on technology security. In this week's episode we debate to what extent this does or will confirm the rise of the information security roles within organisations. Our thoughts and good wishes go out to the people of Ukraine.


  • Do current events confirm that the rise of the CISO organisation was warranted?


  • How do CISOs sleep at night considering everything going on?


  • How to reply to the question “what else should we be doing?”


  • Are the attacks the primary objective or are they a smokescreen?


  • How does the game of chess tie into to information security practises?


  • What is the CISOs role in reducing FUD (fear, uncertainty, doubt)?


  • Will current information it pay for acts of war? Does it raise our collective stature?


  • Why is humility so important in the information security world?


The underlying message is that while it is late in the process now to do all the steps to protect your organisation, it’s never too late to get started!

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>cf1422b5-0a7b-4595-a1f3-e9df90db752dMon, 28 Feb 2022 09:00:00 -040001:04:21falsefull336363Security Super AgentSecurity Super AgentThis week’s episode was sparked by a recent TechCrunch article https://techcrunch.com/2022/02/01/free-agent-series-a/ asking whether tech workers should have agents to negotiate their salaries. We took up the debate on this and a few adjacent topics including:


  • The Great Resignation’s impact on working habits


  • Should security practitioners and leaders be represented by “agents” to negotiate better compensation for roles?


  • What are the ways that formal agents exacerbate bias and increase the gaps between levels?


  • The importance of networks for getting advice to help you be your own “agent”


  • Is it the Great Resignation or the Great Realisation?


  • How do ethics and values play into staff’s desire to go to or stay at a company?


  • At different levels in one’s career who can help be your agent of change?
We should not be afraid to talk about our salaries and numbers


And yes, those are Pączki on Brian’s hat. If you are not sure what this about, take a look at the video version on our YouTube channel https://www.youtube.com/watch?v=CAYRL1flZic

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>This week’s episode was sparked by a recent TechCrunch article https://techcrunch.com/2022/02/01/free-agent-series-a/ asking whether tech workers should have agents to negotiate their salaries. We took up the debate on this and a few adjacent topics including:


  • The Great Resignation’s impact on working habits


  • Should security practitioners and leaders be represented by “agents” to negotiate better compensation for roles?


  • What are the ways that formal agents exacerbate bias and increase the gaps between levels?


  • The importance of networks for getting advice to help you be your own “agent”


  • Is it the Great Resignation or the Great Realisation?


  • How do ethics and values play into staff’s desire to go to or stay at a company?


  • At different levels in one’s career who can help be your agent of change?
We should not be afraid to talk about our salaries and numbers


And yes, those are Pączki on Brian’s hat. If you are not sure what this about, take a look at the video version on our YouTube channel https://www.youtube.com/watch?v=CAYRL1flZic

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>765716cd-c922-431b-8aa7-0ef0633207e6Tue, 15 Feb 2022 09:00:00 -040001:02:01falsefull335353From the Inside OutFrom the Inside OutWe got a message from a listener asking for some discussion about putting the data first and securing it with that mind - the inside out, rather than looking at the perimeter and infrastructure and working back toward the data - outside in.

And since we love our listeners and your feedback, we took the chance to cover this topic in depth. In the process we also covered:


  • Data Loss Prevention - Is it possible to improve this without the painful data classification, startup work or culture change?


  • When doing data analysis for attacks (or fraud) you have to account for the fraud already baked in the normal you know today


  • We can’t meaningfully count on IP address for geography…thanks to security asking for more use of VPNs


  • The pros and cons and risks to ponder when securing data in on premise vs. cloud/SaaS arrangements


  • When is the right time to establish a security team in a growing company? And how bad will the data sprawl be when they arrive?


  • Will the CTO/CIO and the CISO merge into a single role? Will the CIO report to the CISO eventually? It depends, of course, on the people and the organisation


  • Controls today may not be the controls we need for tomorrow


  • We try to secure things, but there’s also important value in good use of data to improve a business


  • Sunk cost fallacy and Security: when to burn it all down and start over


  • Audit is the best friend of the CISO: a new set of eyes and accountability partner makes all the difference


Dan also goes on a small tirade over the way security professionals use the term “the business” as something distinct from the security team that is absolutely part of the business itself. Enjoy that soapbox moment.


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>We got a message from a listener asking for some discussion about putting the data first and securing it with that mind - the inside out, rather than looking at the perimeter and infrastructure and working back toward the data - outside in.

And since we love our listeners and your feedback, we took the chance to cover this topic in depth. In the process we also covered:


  • Data Loss Prevention - Is it possible to improve this without the painful data classification, startup work or culture change?


  • When doing data analysis for attacks (or fraud) you have to account for the fraud already baked in the normal you know today


  • We can’t meaningfully count on IP address for geography…thanks to security asking for more use of VPNs


  • The pros and cons and risks to ponder when securing data in on premise vs. cloud/SaaS arrangements


  • When is the right time to establish a security team in a growing company? And how bad will the data sprawl be when they arrive?


  • Will the CTO/CIO and the CISO merge into a single role? Will the CIO report to the CISO eventually? It depends, of course, on the people and the organisation


  • Controls today may not be the controls we need for tomorrow


  • We try to secure things, but there’s also important value in good use of data to improve a business


  • Sunk cost fallacy and Security: when to burn it all down and start over


  • Audit is the best friend of the CISO: a new set of eyes and accountability partner makes all the difference


Dan also goes on a small tirade over the way security professionals use the term “the business” as something distinct from the security team that is absolutely part of the business itself. Enjoy that soapbox moment.


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.


Some of the links in the show notes contain affiliate links that may earn a commission should you chose to make a purchase using these links. Using these links supports The Great Security Debate, so we appreciate it when you do use them. We do not make our recommendations based on the availabliity or benefits from these affiliate links.


Thanks for listening!

Support The Great Security Debate

Links:


]]>54ef91b4-4fa9-4394-a481-08a1fcafc977Thu, 20 Jan 2022 09:00:00 -040001:05:01falsefull334343Log4Jelly of the Month ClubLog4Jelly of the Month ClubSome say that Log4J is the gift that keeps on giving, much like the Jelly of the Month Club. After the initial surge of discussion a couple weeks ago there were mitigations, a vaccine and multiple iterations of official patches to keep the issue at bay and the new ones that cropped up afterwards. Brian, Dan and Erik discuss the log4j vulnerability as it relates to enterprise systems, supportability, balancing the risk of patching and the ways that open-source software are used within the enterprise.

Join us this week as we cover:


  • The Log4J vulnerability and saga in a nutshell


  • The pros and cons of waiting to patch until there's a stable one vs. patching again with each iteration and risk my system's stability


  • The critical need for system and application (and library) inventory and keeping up to date


  • How best to react when the media and public discussion picks up on a vulnerability and causes a stir


  • The challenges in the flurry of email and surveys from and to SaaS and service providers about their state on the vulnerability of the day


  • What is the cost of "free" when it comes to running (and maintaining) open source software like Log4j


  • How to make sure procurement departments are not just involved but include the risks of procurement decisions into the process


  • Are the external capability assessments like SOC2 able to move beyond perfunctory review by those asking for them


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>Some say that Log4J is the gift that keeps on giving, much like the Jelly of the Month Club. After the initial surge of discussion a couple weeks ago there were mitigations, a vaccine and multiple iterations of official patches to keep the issue at bay and the new ones that cropped up afterwards. Brian, Dan and Erik discuss the log4j vulnerability as it relates to enterprise systems, supportability, balancing the risk of patching and the ways that open-source software are used within the enterprise.

Join us this week as we cover:


  • The Log4J vulnerability and saga in a nutshell


  • The pros and cons of waiting to patch until there's a stable one vs. patching again with each iteration and risk my system's stability


  • The critical need for system and application (and library) inventory and keeping up to date


  • How best to react when the media and public discussion picks up on a vulnerability and causes a stir


  • The challenges in the flurry of email and surveys from and to SaaS and service providers about their state on the vulnerability of the day


  • What is the cost of "free" when it comes to running (and maintaining) open source software like Log4j


  • How to make sure procurement departments are not just involved but include the risks of procurement decisions into the process


  • Are the external capability assessments like SOC2 able to move beyond perfunctory review by those asking for them


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>32f4acbf-bfd0-4122-857b-999f4624d1c9Mon, 03 Jan 2022 14:00:00 -040001:03:36falsefull333333Sweet or Suite?Sweet or Suite?It's a sports analogy-filled episode of The Great Security Debate, but don't let that scare you away. This week, we cover a whole host of topics, primarily focused on the ideas of simple vs. complex and best-of-breed vs. tightly integrated when dealing with technology, change, process or securing your environment.


  • Pace of change in security is ridiculous right now


  • How does reducing complexity and technical debt improve security and technology?


  • (Said differently: simplicity is the heart of good security)


  • Tech is nothing without process or people (see Episode 29 - People Process and Product)


  • Can security vendors be everything to everyone? In what environments do "suites" give better security balance than "best of breed"?


  • What are the risks and benefits of a set of suite technologies vs. best of breed?


  • How does securing your organisation parallel with American Football?


  • What's changing in how we buy technology (and security technology)? Shorter contracts, even if it means less "savings"?


  • Should we invest in security technology heavily up front to win one battle at all costs, or plan for the long-term war?


Note that all American Football references were to games that had not yet been played at the time of recording. Congratulations, University of Michigan Wolverines on winning the Big Ten championship later that evening.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>It's a sports analogy-filled episode of The Great Security Debate, but don't let that scare you away. This week, we cover a whole host of topics, primarily focused on the ideas of simple vs. complex and best-of-breed vs. tightly integrated when dealing with technology, change, process or securing your environment.


  • Pace of change in security is ridiculous right now


  • How does reducing complexity and technical debt improve security and technology?


  • (Said differently: simplicity is the heart of good security)


  • Tech is nothing without process or people (see Episode 29 - People Process and Product)


  • Can security vendors be everything to everyone? In what environments do "suites" give better security balance than "best of breed"?


  • What are the risks and benefits of a set of suite technologies vs. best of breed?


  • How does securing your organisation parallel with American Football?


  • What's changing in how we buy technology (and security technology)? Shorter contracts, even if it means less "savings"?


  • Should we invest in security technology heavily up front to win one battle at all costs, or plan for the long-term war?


Note that all American Football references were to games that had not yet been played at the time of recording. Congratulations, University of Michigan Wolverines on winning the Big Ten championship later that evening.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>3e216c50-e4e4-4149-914d-cea02a165498Mon, 06 Dec 2021 09:00:00 -040055:35falsefull232322It&#39;s a sports analogy-filled episode of The Great Security Debate, but don&#39;t let that scare you away. This week, we cover a whole host of topics, primarily focused on the ideas of simple vs. complex and best-of-breed vs. tightly integrated when dealing with technology, change, process or securing your environment. Pace of change in security is ridiculous right now How does reducing complexity and technical debt improve security and technology? (Said differently: simplicity is the heart of good security) Tech is nothing without process or people (see https://www.greatsecuritydebate.net/29 (Episode 29 - People Process and Product)) Can security vendors be everything to everyone? In what environments do &quot;suites&quot; give better security balance than &quot;best of breed&quot;? What are the risks and benefits of a set of suite technologies vs. best of breed? How does securing your organisation parallel with American Football? What&#39;s changing in how we buy technology (and security technology)? Shorter contracts, even if it means less &quot;savings&quot;? Should we invest in security technology heavily up front to win one battle at all costs, or plan for the long-term war? Note that all American Football references were to games that had not yet been played at the time of recording. Congratulations, University of Michigan Wolverines on winning the Big Ten championship later that evening. We also have a video channel on YouTube that airs the &quot;with pictures&quot; edition of the podcast. Please head over to https://bit.ly/gsdyoutube (https://bit.ly/gsdyoutube) and watch, subscribe and &quot;like&quot; the episodes. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.greatsecuritydebate.net/29 (The Great Security Debate Episode 29: People, Process and Product) http://www.amazon.com/exec/obidos/ASIN/0062060244/securitydebat-20 (The Innovator's Dilemma: The Revolutionary Book That Will Change the Way You Do Business: Christensen, Clayton M.: 8601300047348: Amazon.com: Books) https://en.wikipedia.org/wiki/A_rising_tide_lifts_all_boats (A rising tide lifts all boats - Wikipedia) https://www.youtube.com/watch?v=PTs6UY1G9wM (Progressive Insurance Commercial - How Not To Become Your Parents) https://www.dailywire.com/news/agent-scott-boras-rips-mlb-system-following-braves-world-series-win (Agent Scott Boras Rips MLB System Following Braves World Series Win | The Daily Wire) http://www.amazon.com/exec/obidos/ASIN/0739342231/securitydebat-20 (What Got You Here Won't Get You There: How Successful People Become Even More Successful: Goldsmith, Marshall, Reiter, Mark, Goldsmith, Marshall: 9780739342237: Amazon.com: Books)The Infinite GameThe Infinite GameIn security (and elsewhere) the long game is often overlooked in lieu of short-term advances and accomplishments. From building security into the culture of an organisation to setting goals and objectives for leaders and staff, being strategic in your security approach is critical.

In this episode we cover:


  • How to balance an organisation's drive to shareholder value over the short term with the need to invest strategically in security, privacy and compliance


  • What are we doing wrong by throwing technology alone at security problems (and not looking at the process or people issues along the way)


  • Does proceduralising security or training up staff reduce the efficiency of the organisation or set up the org for longer-term efficiency?


  • Degrees vs. experience? And the ever deteriorating definition of "entry level"


  • The impact and importance of building the time in to train entry-level staff vs. hiring "ready now" experienced people (if you can find them at all)


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>In security (and elsewhere) the long game is often overlooked in lieu of short-term advances and accomplishments. From building security into the culture of an organisation to setting goals and objectives for leaders and staff, being strategic in your security approach is critical.

In this episode we cover:


  • How to balance an organisation's drive to shareholder value over the short term with the need to invest strategically in security, privacy and compliance


  • What are we doing wrong by throwing technology alone at security problems (and not looking at the process or people issues along the way)


  • Does proceduralising security or training up staff reduce the efficiency of the organisation or set up the org for longer-term efficiency?


  • Degrees vs. experience? And the ever deteriorating definition of "entry level"


  • The impact and importance of building the time in to train entry-level staff vs. hiring "ready now" experienced people (if you can find them at all)


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>d0c109e8-9651-4678-9004-782a41aabf9fMon, 15 Nov 2021 09:00:00 -040001:00:46falsefull231312In security (and elsewhere) the long game is often overlooked in lieu of short-term advances and accomplishments. From building security into the culture of an organisation to setting goals and objectives for leaders and staff, being strategic in your security approach is critical. In this episode we cover: How to balance an organisation&#39;s drive to shareholder value over the short term with the need to invest strategically in security, privacy and compliance What are we doing wrong by throwing technology alone at security problems (and not looking at the process or people issues along the way) Does proceduralising security or training up staff reduce the efficiency of the organisation or set up the org for longer-term efficiency? Degrees vs. experience? And the ever deteriorating definition of &quot;entry level&quot; The impact and importance of building the time in to train entry-level staff vs. hiring &quot;ready now&quot; experienced people (if you can find them at all) We also have a video channel on YouTube that airs the &quot;with pictures&quot; edition of the podcast. Please head over to https://bit.ly/gsdyoutube (https://bit.ly/gsdyoutube) and watch, subscribe and &quot;like&quot; the episodes. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: http://www.amazon.com/exec/obidos/ASIN/073521350X/securitydebat-20 (The Infinite Game: Sinek, Simon: 9780735213500: Amazon.com: Books) https://www.greatsecuritydebate.net/29 (The Great Security Debate Episode 29: People, Process and Product) https://mcwt.org/ (Michigan Council of Women in Technology Foundation / Michigan council of women in technology foundation) https://www.gao.gov/assets/gao-22-105024.pdf (Education Should Take Additional Steps to Help Protect K-12 Schools from Cyber Threats) https://www.infodocket.com/ (Library Journal INFOdocket — Information Industry News from Gary Price) http://www.amazon.com/exec/obidos/ASIN/0804136661/securitydebat-20 (Amazon.com: The Third Door: The Wild Quest to Uncover How the World's Most Successful People Launched Their Careers: 9780804136662: Banayan, Alex: Books)Monkeys On Your BackMonkeys On Your BackSecurity has truly gone mainstream. From late night television jokes to state governors not knowing how technology works, as a profession and a vocation, we have arrived.


  • Jimmy Fallon has jokes about security on his show


  • What are the implications of out of date security laws that define what it is to “hack” systems? Keep in mind that some were written as much as 30+ years ago!


  • Is it security’s job to know all the tools in place? Or the business to approach security to help make their tools secure?


  • Is viewing publicly available information or information pushed to your browser actually hacking, or is it legal/OK?


  • Creating laws that stand the test of time is hard. And subject to lots of lobbying.


  • CISO Liability and visibility based on the prominence of the role. Does this lead to targeting to discredit? (think: false social media profiles and deepfakes)


  • Offensive techniques and what happens when companies go offensive against attackers?


  • Prevention as a growing tactic by security teams - especially when life is on the line in the products we make


  • SPAM: is it food or is it email?


  • When is the right time to bring security into your startup? Weaving it in when it is young!


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>Security has truly gone mainstream. From late night television jokes to state governors not knowing how technology works, as a profession and a vocation, we have arrived.


  • Jimmy Fallon has jokes about security on his show


  • What are the implications of out of date security laws that define what it is to “hack” systems? Keep in mind that some were written as much as 30+ years ago!


  • Is it security’s job to know all the tools in place? Or the business to approach security to help make their tools secure?


  • Is viewing publicly available information or information pushed to your browser actually hacking, or is it legal/OK?


  • Creating laws that stand the test of time is hard. And subject to lots of lobbying.


  • CISO Liability and visibility based on the prominence of the role. Does this lead to targeting to discredit? (think: false social media profiles and deepfakes)


  • Offensive techniques and what happens when companies go offensive against attackers?


  • Prevention as a growing tactic by security teams - especially when life is on the line in the products we make


  • SPAM: is it food or is it email?


  • When is the right time to bring security into your startup? Weaving it in when it is young!


We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>8b959705-213f-43cc-81ce-21c53ea00a71Mon, 01 Nov 2021 09:00:00 -040058:16falsefull230302People, Process and ProductPeople, Process and ProductIn the adage "people, process, technology" the technology comes last in the list for a reason as it is only as good as the people and processes that surround and support it. In this week's Great Security Debate we cover a range of topics all focused on the importance (and impacts) of the people and the process as key to the success of security technology. Said differently we can throw all the tech in the world out there, and it does no good without the other two.


  • Around the world, in some locations government drives commercial security innovation, and in others, commercial interests drive government security adoption. Where is that innovation coming from?


  • The recent rumblings that security insurance policies may soon come with "buy lists". What impacts on the efficacy of controls come when the tech is chosen for you. And how do we guarantee the genuineness of how such a formulary was created.


  • What can security learn and use to teach the wider business world about availability and resilience from the current supply chain impacts taking place in manufacturing or consumer goods after COVID-19?


Tune in to this week's episde to learn all about these and more. Show links below have the details of articles, items we cover in the episode.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>In the adage "people, process, technology" the technology comes last in the list for a reason as it is only as good as the people and processes that surround and support it. In this week's Great Security Debate we cover a range of topics all focused on the importance (and impacts) of the people and the process as key to the success of security technology. Said differently we can throw all the tech in the world out there, and it does no good without the other two.


  • Around the world, in some locations government drives commercial security innovation, and in others, commercial interests drive government security adoption. Where is that innovation coming from?


  • The recent rumblings that security insurance policies may soon come with "buy lists". What impacts on the efficacy of controls come when the tech is chosen for you. And how do we guarantee the genuineness of how such a formulary was created.


  • What can security learn and use to teach the wider business world about availability and resilience from the current supply chain impacts taking place in manufacturing or consumer goods after COVID-19?


Tune in to this week's episde to learn all about these and more. Show links below have the details of articles, items we cover in the episode.

We also have a video channel on YouTube that airs the "with pictures" edition of the podcast. Please head over to https://bit.ly/gsdyoutube and watch, subscribe and "like" the episodes.

Support The Great Security Debate

Links:


]]>38b0984c-4512-4d7d-9b01-d6a95e317713Wed, 13 Oct 2021 11:00:00 -040057:18falsefull229292In the adage &quot;people, process, technology&quot; the technology comes last in the list for a reason as it is only as good as the people and processes that surround and support it. In this week&#39;s Great Security Debate we cover a range of topics all focused on the importance (and impacts) of the people and the process as key to the success of security technology. Said differently we can throw all the tech in the world out there, and it does no good without the other two. Around the world, in some locations government drives commercial security innovation, and in others, commercial interests drive government security adoption. Where is that innovation coming from? The recent rumblings that security insurance policies may soon come with &quot;buy lists&quot;. What impacts on the efficacy of controls come when the tech is chosen for you. And how do we guarantee the genuineness of how such a formulary was created. What can security learn and use to teach the wider business world about availability and resilience from the current supply chain impacts taking place in manufacturing or consumer goods after COVID-19? Tune in to this week&#39;s episde to learn all about these and more. Show links below have the details of articles, items we cover in the episode. We also have a video channel on YouTube that airs the &quot;with pictures&quot; edition of the podcast. Please head over to https://bit.ly/gsdyoutube (https://bit.ly/gsdyoutube) and watch, subscribe and &quot;like&quot; the episodes. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.pcisecuritystandards.org/ (Official PCI Security Standards Council Site - Verify PCI Compliance, Download Data Security and Credit Card Security Standards) https://www.bbc.com/news/technology-58665809 (EU rules to force USB-C chargers for all phones - BBC News) https://getbreakout.com/blog/what-is-one-piece-flow/ (What is One-Piece Flow in the Production Process? | Breakout) https://jalopnik.com/i-asked-experts-why-carmakers-cant-just-transition-to-n-1847739665 (Why The Chip Shortage Is So Complex According To Experts) http://www.amazon.com/exec/obidos/ASIN/B079DWSYYB/securitydebat-20 (Amazon.com: The Infinite Game eBook : Sinek, Simon: Kindle Store) https://www.businessroundtable.org/business-roundtable-redefines-the-purpose-of-a-corporation-to-promote-an-economy-that-serves-all-americans (Business Roundtable Redefines the Purpose of a Corporation to Promote ‘An Economy That Serves All Americans’ | Business Roundtable) https://semiwiki.com/automotive/7695-iso-26262-people-process-and-product/ (ISO 26262: People, Process and Product - SemiWiki) https://automotiveisac.com/auto-isac-summit-2021/ (Auto-ISAC Summit 2021 – Auto-ISAC)Stop, Collaborate and PivotStop, Collaborate and PivotOver the past 18 months, the way we work has changed including within the security field. On this episode of The Great Security Debate, Dan, Brian and Erik dig into some of the long-term implications of working today and beyond.


  • From remote work to in-person or hybrid : what works best?


  • Does security have a talent shortage, and how is it exacerbated by leadership issues?


  • Was innovation and productivity stifled during COVID by remote work?


  • How to build strong remote teams and learning from the history of global remote teams?


  • Does remote work help or hurt the chances for smaller orgs to get good talent?


  • Is money the biggest driver for people in work? How does mission and team comfort play in?


  • Can we change culture of long-standing in-person culture enough to support remote/hybrid work?


  • Which is better to look at, certifications or experience?


  • What role does influence play in leadership and innovation, especially in non-management roles?


This episode is available in both audio and video formats. The video edition is on our YouTube channel along with a growing collection of video from previous episodes. https://youtu.be/p099pC4dh3A

Get notified via email when each new episode is published, and find out about exciting new projects from The Great Security Debate team. Sign up here: https://newsletter.greatsecuritydebate.net


Thanks for listening! Tell your friends and let us know your comments, feedback and ideas for future Great Security Debates.

Support The Great Security Debate

Links:


]]>Over the past 18 months, the way we work has changed including within the security field. On this episode of The Great Security Debate, Dan, Brian and Erik dig into some of the long-term implications of working today and beyond.


  • From remote work to in-person or hybrid : what works best?


  • Does security have a talent shortage, and how is it exacerbated by leadership issues?


  • Was innovation and productivity stifled during COVID by remote work?


  • How to build strong remote teams and learning from the history of global remote teams?


  • Does remote work help or hurt the chances for smaller orgs to get good talent?


  • Is money the biggest driver for people in work? How does mission and team comfort play in?


  • Can we change culture of long-standing in-person culture enough to support remote/hybrid work?


  • Which is better to look at, certifications or experience?


  • What role does influence play in leadership and innovation, especially in non-management roles?


This episode is available in both audio and video formats. The video edition is on our YouTube channel along with a growing collection of video from previous episodes. https://youtu.be/p099pC4dh3A

Get notified via email when each new episode is published, and find out about exciting new projects from The Great Security Debate team. Sign up here: https://newsletter.greatsecuritydebate.net


Thanks for listening! Tell your friends and let us know your comments, feedback and ideas for future Great Security Debates.

Support The Great Security Debate

Links:


]]>d9f60410-7ec7-4158-8420-d8f48dda9bf6Mon, 13 Sep 2021 09:00:00 -040001:00:49falsefull228282Risks, Regulations, and ReputationsRisks, Regulations, and ReputationsA recent visit by US companies to the White House sparked a debate between Dan, Brian and Erik about how to improve security. Was the result useful to the cause, or useful to the marketing goals of the attendees? The risks are high, but are the responses going to move the needle? We discuss on this week's Great Security Debate.

Leave some feedback, give a thumbs up, a star or whatever your favourite podcast app prefers, and tell your friends about the podcast. Thanks for being a listener!

Support The Great Security Debate

Links:


]]>A recent visit by US companies to the White House sparked a debate between Dan, Brian and Erik about how to improve security. Was the result useful to the cause, or useful to the marketing goals of the attendees? The risks are high, but are the responses going to move the needle? We discuss on this week's Great Security Debate.

Leave some feedback, give a thumbs up, a star or whatever your favourite podcast app prefers, and tell your friends about the podcast. Thanks for being a listener!

Support The Great Security Debate

Links:


]]>9c37d278-71a3-451a-90f6-f408482adbc3Sat, 28 Aug 2021 09:00:00 -040058:16falsefull227272A recent visit by US companies to the White House sparked a debate between Dan, Brian and Erik about how to improve security. Was the result useful to the cause, or useful to the marketing goals of the attendees? The risks are high, but are the responses going to move the needle? We discuss on this week&#39;s Great Security Debate. Leave some feedback, give a thumbs up, a star or whatever your favourite podcast app prefers, and tell your friends about the podcast. Thanks for being a listener! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.whitehouse.gov/briefing-room/statements-releases/2021/08/25/fact-sheet-biden-administration-and-private-sector-leaders-announce-ambitious-initiatives-to-bolster-the-nations-cybersecurity/ (FACT SHEET: Biden Administration and Private Sector Leaders Announce Ambitious Initiatives to Bolster the Nation’s Cybersecurity | The White House) https://www.washingtonpost.com/technology/2021/08/25/white-house-cybersecurity-summit-apple-amazon/ (Biden discusses cybersecurity with Amazon, Google, Apple CEOs at White House - The Washington Post) https://www.nationalisacs.org/ (National Council of ISACs) https://www.fsisac.com/ (Financial Services Information Sharing and Analysis Center) https://www.theregister.com/2021/08/26/big_tech_biden_cybersecurity_meeting/ (Big tech proud as punch about cameos in Joe Biden's security theatre • The Register) https://www.bbc.com/news/business-58230388 (Why is there a chip shortage? - BBC News) https://www.whatissixsigma.net/pfmea/ (Process Failure Mode Effects Analysis (PFMEA) Explained) https://www.whatissixsigma.net/dfmea/ (What is Design Failure Mode and Effects Analysis (DFMEA)?) https://www.enx.com/en-US/TISAX/ (Welcome to TISAX · ENX Portal) https://www.amazon.com/Outliers-Story-Success-Malcolm-Gladwell-ebook/dp/B001ANYDAO/ref=sr_1_1?crid=YIA9JD4APCTI&dchild=1&keywords=outliers+malcolm+gladwell&qid=1630182664&s=books&sprefix=outliers+%2Cstripbooks%2C173&sr=1-1 (Amazon.com: Outliers: The Story of Success eBook : Gladwell, Malcolm: Kindle Store) https://www.amazon.com/Think-Again-Power-Knowing-What/dp/1984878107 (Think Again: The Power of Knowing What You Don't Know: Grant, Adam: 9781984878106: Amazon.com: Books) https://www.imdb.com/title/tt0816711/ (World War Z (2013) - IMDb)It's PersonalIt's PersonalIf you want to check out the new video edition of the podcast, please go to:

https://youtu.be/FBBmA9YDNfQ

where you can subscribe, give thumbs up and ring bells like YouTubers have been asking you to do for years. You know the drill.


Also, our apologies for the hum in the audio throughout the entire episode. The problem has been identified and the source (Dan) has been taken out back and schooled on the difference between mic-level and line-level audio feeds. He promises it won't happen again... often.


Now, on to the show.


This week, Dan, Brian and Erik tackle the recent changes announced by Apple regarding moves to protect children from online predators and from the passing of illegal material about children. The project has three parts, each with its own benefits and concerns. We cover them each individually:


First, the scanning of messages inbound to minors (Under 18s) on a Apple Family Sharing account in which images are tested for inappropriateness, blurred and the child alerted that they may be about to look at something that they may want to reconsider. If they are under 13 and decide to view the image the parents are notified. This is an opt-in programme and parents decide whether or not to join for the family.


Next comes the proactive scanning of iCloud Photo Library stored at Apple. For a long time many have wondered why end-to-end encryption had not been put into iCloud, and this is a likely factor. The photos are tested against the hashes of a set of known images containing child pornography and issues are raised to the authorities. This is and has been happening on other cloud photo services including Microsoft and Flickr for some time.


Finally, and most controvertially from a privacy perspective, Apple is implementing a proactive test of the hashes ofphotos stored on customers' Apple devices against this same set of known images. In the US there is no law that prevents this but runs counter to the marketing emphasis Apple has placed on the privacy of data within their devices. The method is rather intricate and strives to prevent Apple from seeing anything unless it suspects there are systemic child pornography issues at bay.


These technology approaches change the game for prosecutors and law enforcement, and they expose issues earlier. But what happens when this capability gets expanded, or brought into law as mandatory for use against its citizens who speak out politically, or is taken over by bad actors? Look at the link in the show notes regarding the keys the TSA made for physical locks at the airport - every hole is a potential future vulnerability. Does the end justify the means? We discuss in depth on this week's Great Security Debate!


If you want to support the efforts of The Great Security Debate, please feel free to become a patron and get some cool benefits of supporting this independent show - https://www.patreon.com/securitydebate

Support The Great Security Debate

Links:


]]>If you want to check out the new video edition of the podcast, please go to:

https://youtu.be/FBBmA9YDNfQ

where you can subscribe, give thumbs up and ring bells like YouTubers have been asking you to do for years. You know the drill.


Also, our apologies for the hum in the audio throughout the entire episode. The problem has been identified and the source (Dan) has been taken out back and schooled on the difference between mic-level and line-level audio feeds. He promises it won't happen again... often.


Now, on to the show.


This week, Dan, Brian and Erik tackle the recent changes announced by Apple regarding moves to protect children from online predators and from the passing of illegal material about children. The project has three parts, each with its own benefits and concerns. We cover them each individually:


First, the scanning of messages inbound to minors (Under 18s) on a Apple Family Sharing account in which images are tested for inappropriateness, blurred and the child alerted that they may be about to look at something that they may want to reconsider. If they are under 13 and decide to view the image the parents are notified. This is an opt-in programme and parents decide whether or not to join for the family.


Next comes the proactive scanning of iCloud Photo Library stored at Apple. For a long time many have wondered why end-to-end encryption had not been put into iCloud, and this is a likely factor. The photos are tested against the hashes of a set of known images containing child pornography and issues are raised to the authorities. This is and has been happening on other cloud photo services including Microsoft and Flickr for some time.


Finally, and most controvertially from a privacy perspective, Apple is implementing a proactive test of the hashes ofphotos stored on customers' Apple devices against this same set of known images. In the US there is no law that prevents this but runs counter to the marketing emphasis Apple has placed on the privacy of data within their devices. The method is rather intricate and strives to prevent Apple from seeing anything unless it suspects there are systemic child pornography issues at bay.


These technology approaches change the game for prosecutors and law enforcement, and they expose issues earlier. But what happens when this capability gets expanded, or brought into law as mandatory for use against its citizens who speak out politically, or is taken over by bad actors? Look at the link in the show notes regarding the keys the TSA made for physical locks at the airport - every hole is a potential future vulnerability. Does the end justify the means? We discuss in depth on this week's Great Security Debate!


If you want to support the efforts of The Great Security Debate, please feel free to become a patron and get some cool benefits of supporting this independent show - https://www.patreon.com/securitydebate

Support The Great Security Debate

Links:


]]>a5ce4033-5ac8-4c17-9369-f0317c6a7f47Mon, 09 Aug 2021 09:00:00 -040001:01:33falsefull226262We'll SeeWe'll SeeGet notified in an email every time a new episode of The Great Security Debate drops, or when we announce in-person episode recordings (coming soon)! Sign up for our newsletter: https://newsletter.greatsecuritydebate.net

Dan, Brian, and Erik find themselves debating whether or not the new up-to-$10M reward for information regarding ransomware and other attacks will make a material difference in the upward trend in technology as a weapon.


  • What are some non-technical examples of ransomware (hint: it involves warm weather islands and boats and flags with skulls)


  • How will the new ransomware bounty work? Will it work at all?


  • Who sets the definition of "minimum viable security?" Who should and who can set that definition?


  • Can we get beyond human nature to take advantage of a situation that is beneficial to them?


  • What other economic impacts take place if we can eliminate bad actors (other than a lot of out-of-work security practitioners?)


Tune in and enjoy this episode of The Great Security Debate. Please let us know your thoughts by leaving rating feedback in your podcast app, and/or sending us an email to feedback@greatsecuritydebate.net. Thanks for listening!

Support The Great Security Debate

Links:


]]>Get notified in an email every time a new episode of The Great Security Debate drops, or when we announce in-person episode recordings (coming soon)! Sign up for our newsletter: https://newsletter.greatsecuritydebate.net

Dan, Brian, and Erik find themselves debating whether or not the new up-to-$10M reward for information regarding ransomware and other attacks will make a material difference in the upward trend in technology as a weapon.


  • What are some non-technical examples of ransomware (hint: it involves warm weather islands and boats and flags with skulls)


  • How will the new ransomware bounty work? Will it work at all?


  • Who sets the definition of "minimum viable security?" Who should and who can set that definition?


  • Can we get beyond human nature to take advantage of a situation that is beneficial to them?


  • What other economic impacts take place if we can eliminate bad actors (other than a lot of out-of-work security practitioners?)


Tune in and enjoy this episode of The Great Security Debate. Please let us know your thoughts by leaving rating feedback in your podcast app, and/or sending us an email to feedback@greatsecuritydebate.net. Thanks for listening!

Support The Great Security Debate

Links:


]]>f686160a-a050-4e3c-b457-f67a0003db59Mon, 19 Jul 2021 09:00:00 -040001:00:44falsefull225252Get notified in an email every time a new episode of The Great Security Debate drops, or when we announce in-person episode recordings (coming soon)! Sign up for our newsletter: https://newsletter.greatsecuritydebate.net (https://newsletter.greatsecuritydebate.net) Dan, Brian, and Erik find themselves debating whether or not the new up-to-$10M reward for information regarding ransomware and other attacks will make a material difference in the upward trend in technology as a weapon. What are some non-technical examples of ransomware (hint: it involves warm weather islands and boats and flags with skulls) How will the new ransomware bounty work? Will it work at all? Who sets the definition of &quot;minimum viable security?&quot; Who should and who can set that definition? Can we get beyond human nature to take advantage of a situation that is beneficial to them? What other economic impacts take place if we can eliminate bad actors (other than a lot of out-of-work security practitioners?) Tune in and enjoy this episode of The Great Security Debate. Please let us know your thoughts by leaving rating feedback in your podcast app, and/or sending us an email to feedback@greatsecuritydebate.net. Thanks for listening! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.starz.com/us/en/series/black-sails/19568 (Watch Black Sails Online: Stream Full Series on STARZ - Free Trial) https://www.netflix.com/title/81035118 (The Lost Pirate Kingdom | Netflix Official Site) https://www.nytimes.com/2021/07/15/us/biden-reward-ransomware.html ($10 Million Reward Offered for Information on Ransomware Attacks - The New York Times) https://www.philvenables.com/post/cybersecurity-and-the-curse-of-binary-thinking (Cybersecurity and the Curse of Binary Thinking) https://www.amazon.com/Charlie-Wilsons-War-Tom-Hanks/dp/B001688V2E (Watch Charlie Wilson's War | Prime Video) https://www.wsj.com/articles/the-fbis-advice-on-ransomware-dont-pay-but-tell-us-if-you-do-11623167330 (The FBI’s Advice on Ransomware: Don’t Pay, but Tell Us if You Do - WSJ (Subscription required)) https://www.sec.gov/whistleblower (SEC.gov | Office of the Whistleblower) https://www.greatsecuritydebate.net/24 (The Great Security Debate Episode 24: Back to Basics)Back to BasicsBack to BasicsRecently a lot of newsworthy security incidents have taken place. A common thread through many is not that they were sophisticated or required lots of time to plan and execute, or even that the victim had not invested in a lot of whizbang security technology which led to them not noticing the attack. The common thread much more simple: that fundamental security measures were not being taken by the organisation. Things like turning off accounts when people left the organisation, removing disused technology from the network, and the reuse of passwords by staff amongst public-facing and internal systems.

The fundamentals make it easy for attackers to get into networks and systems, both enterprise and personal, and are all things that we can each work on individually and within our organisations to improve and make the attacks that much harder for the bad actors to execute. This week's episode discusses those fundamentals and how to approach them.

The "slide" that is often referenced in the episode comes from a talk that Dan gave to the National Information Standards Organisation (NISO) last week on why it was so important to maintain the security of their systems. The whole presentation deck is available at http://slideshare.net/secratic/security-is-an-enabler-not-securing-is-an-inhibitor-249421889 and the specific slide is on Slide 8.


Thanks for listening. You can subscribe to the podcast on your favourite podcast application or by visiting our website https://www.greatsecuritydebate.net/subscribe. Please let us know what you think by leaving a comment in the podcast application's rating section or emailing us feedback@greatsecuritydebate.net

Support The Great Security Debate

Links:


]]>Recently a lot of newsworthy security incidents have taken place. A common thread through many is not that they were sophisticated or required lots of time to plan and execute, or even that the victim had not invested in a lot of whizbang security technology which led to them not noticing the attack. The common thread much more simple: that fundamental security measures were not being taken by the organisation. Things like turning off accounts when people left the organisation, removing disused technology from the network, and the reuse of passwords by staff amongst public-facing and internal systems.

The fundamentals make it easy for attackers to get into networks and systems, both enterprise and personal, and are all things that we can each work on individually and within our organisations to improve and make the attacks that much harder for the bad actors to execute. This week's episode discusses those fundamentals and how to approach them.

The "slide" that is often referenced in the episode comes from a talk that Dan gave to the National Information Standards Organisation (NISO) last week on why it was so important to maintain the security of their systems. The whole presentation deck is available at http://slideshare.net/secratic/security-is-an-enabler-not-securing-is-an-inhibitor-249421889 and the specific slide is on Slide 8.


Thanks for listening. You can subscribe to the podcast on your favourite podcast application or by visiting our website https://www.greatsecuritydebate.net/subscribe. Please let us know what you think by leaving a comment in the podcast application's rating section or emailing us feedback@greatsecuritydebate.net

Support The Great Security Debate

Links:


]]>e9b8fdcd-e75d-4e51-8362-4a9ab3539b97Mon, 21 Jun 2021 09:00:00 -040001:00:32falsefull224242It DependsIt DependsA wide range of cause and effect discussion in this week's episode.


  • What happens when a cellphone gets compromised for one purpose and has unrelated, follow-on consequences?


  • Will there be material impact from the recent decrees, executive orders and vocal support by President Biden that additional focus is required on information security, ransomware and corruption?


  • What are the downstream impacts of paying, and not paying a ransom and what happens if they are prohibited by law?


  • Is doing the mininum amount of security OK, or is the minimum not really the required minimum?


  • And more on the security position on data lakes, too.


Join Erik, Brian and Dan as they count their pieces of flair and determine if we are the right fit to keep working at Flingers.

Support The Great Security Debate

Links:


]]>A wide range of cause and effect discussion in this week's episode.


  • What happens when a cellphone gets compromised for one purpose and has unrelated, follow-on consequences?


  • Will there be material impact from the recent decrees, executive orders and vocal support by President Biden that additional focus is required on information security, ransomware and corruption?


  • What are the downstream impacts of paying, and not paying a ransom and what happens if they are prohibited by law?


  • Is doing the mininum amount of security OK, or is the minimum not really the required minimum?


  • And more on the security position on data lakes, too.


Join Erik, Brian and Dan as they count their pieces of flair and determine if we are the right fit to keep working at Flingers.

Support The Great Security Debate

Links:


]]>3a3a991d-7fc2-490e-b794-1b7485fd1522Mon, 07 Jun 2021 09:00:00 -040059:32falsefull223232Sidewalks and AirTagsSidewalks and AirTagsThe news of the week includes discussion about some changes to Amazon's home devices including Echo and Ring with the activation of their Sidewalk Network on all those devices by default and the potential for both ubiquitous connectivity for IoT devices, and the possibiity of abuse of the data that is seen . Brian, Erik and Dan also talk about the impact that the launch of the new Apple Application Tracking Transparency (ATT) program which asks users if they want to be tracked (spoiler alert: they very much do not). This will impact ads and apps that depends on ads pretty heartily, and we debate the pros and cons. Enter the data lakes (troves of data just waiting to be mined by companies to find "interesting things" (or targets for attackers).

We really appreciate your feedback, both through subscribing and rating on your favourite podcast application, and by email to us at feedback@greatsecuritydebate.net

Thanks for listening!

Support The Great Security Debate

Links:


]]>The news of the week includes discussion about some changes to Amazon's home devices including Echo and Ring with the activation of their Sidewalk Network on all those devices by default and the potential for both ubiquitous connectivity for IoT devices, and the possibiity of abuse of the data that is seen . Brian, Erik and Dan also talk about the impact that the launch of the new Apple Application Tracking Transparency (ATT) program which asks users if they want to be tracked (spoiler alert: they very much do not). This will impact ads and apps that depends on ads pretty heartily, and we debate the pros and cons. Enter the data lakes (troves of data just waiting to be mined by companies to find "interesting things" (or targets for attackers).

We really appreciate your feedback, both through subscribing and rating on your favourite podcast application, and by email to us at feedback@greatsecuritydebate.net

Thanks for listening!

Support The Great Security Debate

Links:


]]>faced208-c4e6-449f-b59f-20109914692bMon, 24 May 2021 09:00:00 -040054:43falsefull222222The news of the week includes discussion about some changes to Amazon&#39;s home devices including Echo and Ring with the activation of their Sidewalk Network on all those devices by default and the potential for both ubiquitous connectivity for IoT devices, and the possibiity of abuse of the data that is seen . Brian, Erik and Dan also talk about the impact that the launch of the new Apple Application Tracking Transparency (ATT) program which asks users if they want to be tracked (spoiler alert: they very much do not). This will impact ads and apps that depends on ads pretty heartily, and we debate the pros and cons. Enter the data lakes (troves of data just waiting to be mined by companies to find &quot;interesting things&quot; (or targets for attackers). We really appreciate your feedback, both through subscribing and rating on your favourite podcast application, and by email to us at feedback@greatsecuritydebate.net Thanks for listening! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.sidewalklabs.com/ (Home | Sidewalk Labs) https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK (Amazon.com Help: Enable or Disable Amazon Sidewalk for Your Account) https://www.inc.com/jason-aten/amazons-sidewalk-network-is-turned-on-by-default-heres-how-to-turn-it-off.html (Amazon's Sidewalk Network Is Turned On by Default. Here's How to Turn It Off | Inc.com) https://www.cnbc.com/2021/05/07/amazon-partners-with-tile-to-take-on-apple-airtags.html (Amazon partners with Tile to take on Apple AirTags) https://www.amazon.com/Amazon-Sidewalk/b?node=21328123011 (Amazon.com: Amazon Sidewalk: Amazon Devices & Accessories) https://www.reuters.com/article/us-tech-antitrust-apple-tile-idUSKBN21J72V (Tile says Apple's behavior is anticompetitive and has 'gotten worse, not better' | Reuters) https://www.greatsecuritydebate.net/1 (The Great Security Debate Episode 1: Privacy Drone)Why Does My CISO Hate Me?Why Does My CISO Hate Me?We got asked by a listener to help answer the question, "Why Does My CISO Hate Me?" While we may not be privy to the exact situation in play there, we are pretty sure that no one's CISO truly hates them (but they may not be fond of all the things that everyone does all the time). In the debate today, we talk about some of the things that challenge CISOs including:


  • Security is more than just confidentiality... there's also integrity and availability


  • Undocumented processes and changes make it hard to figure out where things go wrong


  • Security is a bidirectional partnership, not an Q&A/task queue from the rest of the organisation, nor the acceptor of risks


  • Please ask questions if you are concerned about something or want more info, or even if something sort of smells fishy (or phishy). There are no such thing as stupid questions, only unasked ones.


We also highlight a number of the things that CISOs and security teams can improve on to build better and stronger relationships across the organisation, too, such as:


  • Better listening and asking good questions


  • Understanding the business through servant leadership


  • Helping to determine what is most important to the business (and what needs to be protected)


We are all heading toward a common goal, so let's work together to accomplish it!


Thanks for listening. Until next time...

Support The Great Security Debate

Links:


]]>We got asked by a listener to help answer the question, "Why Does My CISO Hate Me?" While we may not be privy to the exact situation in play there, we are pretty sure that no one's CISO truly hates them (but they may not be fond of all the things that everyone does all the time). In the debate today, we talk about some of the things that challenge CISOs including:


  • Security is more than just confidentiality... there's also integrity and availability


  • Undocumented processes and changes make it hard to figure out where things go wrong


  • Security is a bidirectional partnership, not an Q&A/task queue from the rest of the organisation, nor the acceptor of risks


  • Please ask questions if you are concerned about something or want more info, or even if something sort of smells fishy (or phishy). There are no such thing as stupid questions, only unasked ones.


We also highlight a number of the things that CISOs and security teams can improve on to build better and stronger relationships across the organisation, too, such as:


  • Better listening and asking good questions


  • Understanding the business through servant leadership


  • Helping to determine what is most important to the business (and what needs to be protected)


We are all heading toward a common goal, so let's work together to accomplish it!


Thanks for listening. Until next time...

Support The Great Security Debate

Links:


]]>6306abe8-ac27-40a7-8eac-6509a1519249Sun, 02 May 2021 09:00:00 -040051:10falsefull221212We got asked by a listener to help answer the question, &quot;Why Does My CISO Hate Me?&quot; While we may not be privy to the exact situation in play there, we are pretty sure that no one&#39;s CISO truly hates them (but they may not be fond of all the things that everyone does all the time). In the debate today, we talk about some of the things that challenge CISOs including: Security is more than just confidentiality... there&#39;s also integrity and availability Undocumented processes and changes make it hard to figure out where things go wrong Security is a bidirectional partnership, not an QandA/task queue from the rest of the organisation, nor the acceptor of risks Please ask questions if you are concerned about something or want more info, or even if something sort of smells fishy (or phishy). There are no such thing as stupid questions, only unasked ones. We also highlight a number of the things that CISOs and security teams can improve on to build better and stronger relationships across the organisation, too, such as: Better listening and asking good questions Understanding the business through servant leadership Helping to determine what is most important to the business (and what needs to be protected) We are all heading toward a common goal, so let&#39;s work together to accomplish it! Thanks for listening. Until next time... https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.amazon.com/Toyota-Way-Management-Principles-Manufacturer/dp/0071392319 (Amazon.com: The Toyota Way: 14 Management Principles from the World's Greatest Manufacturer (8601404279935): Liker, Jeffrey: Books) https://www.amazon.com/ITSM-Complete-Guide-Gerardus-Blokdyk/dp/0655914927/ref=sr_1_2?dchild=1&keywords=ITSM&qid=1619876969&s=books&sr=1-2 (ITSM A Complete Guide - 2020 Edition: Gerardus Blokdyk: 9780655914921: Amazon.com: Books) https://www.amazon.com/ITIL-foundation-Axelos/dp/0113316070/ref=sr_1_2?dchild=1&keywords=itIL+books&qid=1619877304&sr=8-2 (ITIL Foundation, ITIL 4 Edition (ITIL 4 Foundation): AXELOS: 9780113316076: Amazon.com: Books) https://echelonfront.com/jocko-willink/ (Jocko Willink - Echelon Front) https://www.nbc.com/saturday-night-live/video/nick-burns-your-companys-computer-guy/n11524 (Watch Saturday Night Live Highlight: Nick Burns, Your Company's Computer Guy with Billy Bob Thornton - NBC.com)It All Comes Down to Relationships (Guest Debater: Jessica Burn)It All Comes Down to Relationships (Guest Debater: Jessica Burn)We open season 2 with a new format: guests! Our first guest, Jessica Burn, has been working closely with CISOs and the security industry at Forrester where she is a Senior Analyst covering the role of the CISO, Incident Response, Zero Trust Strategy and Continuous Controls Monitoring.

Dan, Erik, Brian and Jess use a new Forrester report about recommendations for security programs in 2021 as the basis for the discussion (and debate), including a few major themes:


  • The impacts of the consolidation of technology, both in security and the wider tech arena


  • Balancing the monitoring and the privacy when tracking employees as they work remotely as a result of the pandemic


  • Securing what you sell both because you need to, but also because it is good for your business


  • Where are our inventories and why do we still generally fail at knowing what systems we have


  • Of course, third party risk management. It's a mandatory "slide 3" on every board presentation, of course.


We still debate, we still discuss, we still shift the discussion to automotive and manufacturing from time to time, but now we have some additional voices to add to the debate, too. Thanks so much, Jess!

Special Guest: Jessica Burn.

Support The Great Security Debate

Links:


]]>We open season 2 with a new format: guests! Our first guest, Jessica Burn, has been working closely with CISOs and the security industry at Forrester where she is a Senior Analyst covering the role of the CISO, Incident Response, Zero Trust Strategy and Continuous Controls Monitoring.

Dan, Erik, Brian and Jess use a new Forrester report about recommendations for security programs in 2021 as the basis for the discussion (and debate), including a few major themes:


  • The impacts of the consolidation of technology, both in security and the wider tech arena


  • Balancing the monitoring and the privacy when tracking employees as they work remotely as a result of the pandemic


  • Securing what you sell both because you need to, but also because it is good for your business


  • Where are our inventories and why do we still generally fail at knowing what systems we have


  • Of course, third party risk management. It's a mandatory "slide 3" on every board presentation, of course.


We still debate, we still discuss, we still shift the discussion to automotive and manufacturing from time to time, but now we have some additional voices to add to the debate, too. Thanks so much, Jess!

Special Guest: Jessica Burn.

Support The Great Security Debate

Links:


]]>5a3b0d15-5c92-452b-887b-2a4a34d39091Mon, 19 Apr 2021 09:00:00 -040001:02:42falsefull220202We open season 2 with a new format: guests! Our first guest, Jessica Burn, has been working closely with CISOs and the security industry at Forrester where she is a Senior Analyst covering the role of the CISO, Incident Response, Zero Trust Strategy and Continuous Controls Monitoring. Dan, Erik, Brian and Jess use a new Forrester report about recommendations for security programs in 2021 as the basis for the discussion (and debate), including a few major themes: The impacts of the consolidation of technology, both in security and the wider tech arena Balancing the monitoring and the privacy when tracking employees as they work remotely as a result of the pandemic Securing what you sell both because you need to, but also because it is good for your business Where are our inventories and why do we still generally fail at knowing what systems we have Of course, third party risk management. It&#39;s a mandatory &quot;slide 3&quot; on every board presentation, of course. We still debate, we still discuss, we still shift the discussion to automotive and manufacturing from time to time, but now we have some additional voices to add to the debate, too. Thanks so much, Jess! Special Guest: Jessica Burn. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.amazon.com/Good-They-Cant-Ignore-You/dp/1455509124 (So Good They Can't Ignore You: Why Skills Trump Passion in the Quest for Work You Love: Newport, Cal: 8601420220263: Amazon.com: Books) https://go.forrester.com/blogs/security-recommendations-2021-taking-stock-for-the-long-term/ (Security Recommendations 2021: Taking Stock For The Long Term) https://www.forrester.com/report/A+CISOs+First+100+Days/-/E-RES159295 (A CISO's First 100 Days) https://go.forrester.com/blogs/developer-security-champions-now-more-than-ever/ (Developer Security Champions Are Needed Now More Than Ever) https://www.fsisac.com/ (Financial Services Information Sharing and Analysis Center) https://www.ls-isao.com/ (Legal Services Information Sharing | LS-ISAO) https://www.inc.com/michael-schneider/only-10-percent-of-people-are-natural-leaders-rest-of-us-have-to-work-on-developing-these-3-qualities.html?cid=sf01002&fbclid=IwAR3I8HTQ_PtI4FStq4Pogp-VV_nVMPRSrH5IS_SZ0YxQ70Yh6fB8NYl63XA (Only 10 Percent of People Are Natural Leaders. The Rest of Us Have to Work on Developing These 3 Qualities | Inc.com)Out of Office: One Year LaterOut of Office: One Year LaterExactly one year ago, most of the population of the US was given the word to begin to work from home. Security and technology teams were large parts of the preparation for this change, and were also largely able to move their operations to a home office for the duration of the last twelve months. The last year has been one of constant "on", whether due to changing technology requirements that need to be worked on, increasing incident and response, 10 hours per day in front of the camera on Zoom, and filling what used to be commutes with (wait for it) even more work.

Dan, Brian and Erik cover a lot of topics, including security of remote work, the mental health impacts of prolonged working remotely, looking out for ourselves and those in our lives, and reconnecting with those that we may have lost contact with over the years. The guys also share positive and negative observations about work/life from the past year, too.

Please subscribe and leave ratings or feedback in your favourite podcast application! It really helps the podcast out a lot when you do!

Support The Great Security Debate

Links:


]]>Exactly one year ago, most of the population of the US was given the word to begin to work from home. Security and technology teams were large parts of the preparation for this change, and were also largely able to move their operations to a home office for the duration of the last twelve months. The last year has been one of constant "on", whether due to changing technology requirements that need to be worked on, increasing incident and response, 10 hours per day in front of the camera on Zoom, and filling what used to be commutes with (wait for it) even more work.

Dan, Brian and Erik cover a lot of topics, including security of remote work, the mental health impacts of prolonged working remotely, looking out for ourselves and those in our lives, and reconnecting with those that we may have lost contact with over the years. The guys also share positive and negative observations about work/life from the past year, too.

Please subscribe and leave ratings or feedback in your favourite podcast application! It really helps the podcast out a lot when you do!

Support The Great Security Debate

Links:


]]>2dcb0031-f68d-4e63-8d43-3686efab91a3Mon, 15 Mar 2021 10:00:00 -040057:55falsefull119191Exactly one year ago, most of the population of the US was given the word to begin to work from home. Security and technology teams were large parts of the preparation for this change, and were also largely able to move their operations to a home office for the duration of the last twelve months. The last year has been one of constant &quot;on&quot;, whether due to changing technology requirements that need to be worked on, increasing incident and response, 10 hours per day in front of the camera on Zoom, and filling what used to be commutes with (wait for it) even more work. Dan, Brian and Erik cover a lot of topics, including security of remote work, the mental health impacts of prolonged working remotely, looking out for ourselves and those in our lives, and reconnecting with those that we may have lost contact with over the years. The guys also share positive and negative observations about work/life from the past year, too. Please subscribe and leave ratings or feedback in your favourite podcast application! It really helps the podcast out a lot when you do! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://mentorcore.biz/ (MentorCore – Growth and Development at your Fingertips) https://www.hulu.com/movie/kid-90-f6944ad5-bd84-4093-99e8-5f1d1d44c787 (Watch kid 90 Streaming Online | Hulu) https://www.amazon.com/Smarter-Faster-Better-Transformative-Productivity-ebook/dp/B00Z3FRYB0 (Smarter Faster Better: The Transformative Power of Real Productivity - Kindle edition by Duhigg, Charles. Health, Fitness & Dieting Kindle eBooks @ Amazon.com.) https://www.amazon.com/Habits-Highly-Effective-People-Powerful-ebook/dp/B07WF972WK/ref=sr_1_3?crid=2GT921FN9UNEJ&dchild=1&keywords=7+habits+of+highly+effective+people&qid=1615731980&s=digital-text&sprefix=7+habits+of+%2Cdigital-text%2C175&sr=1-3 (Amazon.com: The 7 Habits of Highly Effective People: 30th Anniversary Edition eBook: Covey, Stephen R., Collins, Jim, Covey, Sean: Kindle Store) https://www.kaizen.com/what-is-kaizen.html (What is KAIZEN™) https://www.amazon.com/Algorithms-Oppression-Search-Engines-Reinforce/dp/1479837245 (Algorithms of Oppression: How Search Engines Reinforce Racism: Noble, Safiya Umoja: 9781479837243: Amazon.com: Books)The ABCs of CISOsThe ABCs of CISOsThis week we look at the security organisation through the looking glass. From within the org, the leaders and the partners and product/service providers we work with, we dig into some of the ways that security works with the rest of the business and customers, and how the needs of each org changes over time and necessitates the need for different mindsets to support those needs from a security perspective.


  • CISO tenure, churn and average age compared to other C-levels


  • How security applies to business value (or sometimes not in the obvious ways)


  • What's better on an RFP response? More detail, or just yes/no answers?


  • CISOs (and all security professionals) as storytellers


  • Relationships with security product vendors, VARs and others selling into organisations on how to build trust and transparency and turn from selling into true partnerships


Also, Dan successfully makes an automotive analogy; you can't miss that!

We name drop a few friends who have shared insights that led to our comments today. Check them out and give them wave and a thanks from us!


John Bingham, Chief Operating Officer at Speak by Design


Jeff Pollard, VP & Principal Analyst at Forrester - https://twitter.com/jeff_pollard2?s=20


Enjoy the episode.

Support The Great Security Debate

Links:


]]>This week we look at the security organisation through the looking glass. From within the org, the leaders and the partners and product/service providers we work with, we dig into some of the ways that security works with the rest of the business and customers, and how the needs of each org changes over time and necessitates the need for different mindsets to support those needs from a security perspective.


  • CISO tenure, churn and average age compared to other C-levels


  • How security applies to business value (or sometimes not in the obvious ways)


  • What's better on an RFP response? More detail, or just yes/no answers?


  • CISOs (and all security professionals) as storytellers


  • Relationships with security product vendors, VARs and others selling into organisations on how to build trust and transparency and turn from selling into true partnerships


Also, Dan successfully makes an automotive analogy; you can't miss that!

We name drop a few friends who have shared insights that led to our comments today. Check them out and give them wave and a thanks from us!


John Bingham, Chief Operating Officer at Speak by Design


Jeff Pollard, VP & Principal Analyst at Forrester - https://twitter.com/jeff_pollard2?s=20


Enjoy the episode.

Support The Great Security Debate

Links:


]]>7106202e-56e6-435f-8511-204cb3ff4a0cSun, 28 Feb 2021 08:00:00 -040001:09:54falsefull118181Our Favourite ThingsOur Favourite ThingsIt's Valentine's Day and you get presents. Dan, Brian and Erik discuss the books, people and tools that they each love and changed their lives. None are specifically security-related, so see what's been impactful on each of them in this episode. The links are an especially big part of the episode, so take a look in your podcast app or on the site (https://www.greatsecuritydebate.net/17) to see all the recommendations and get more info about the topics and items covered.

Support The Great Security Debate

Links:


]]>It's Valentine's Day and you get presents. Dan, Brian and Erik discuss the books, people and tools that they each love and changed their lives. None are specifically security-related, so see what's been impactful on each of them in this episode. The links are an especially big part of the episode, so take a look in your podcast app or on the site (https://www.greatsecuritydebate.net/17) to see all the recommendations and get more info about the topics and items covered.

Support The Great Security Debate

Links:


]]>df894182-f666-46a9-8f39-2f346829ecf5Sun, 14 Feb 2021 13:00:00 -040001:06:00falsefull117171The Winds of ChangeThe Winds of ChangeThe time for job change happens and there are a lot of things go along with it including. We cover a ton of them in this week's episode:


  • The reasons to make a career change


  • Deciding the time is right to make a change (and how do you know)


  • Taking our own advice when it comes to our own career change


  • The importance of support of family to make more drastic changes


  • The power of self-reflection and the need to let go of the present to achieve the future


  • The importance of strong personal and community networking in career growth


  • Impostor syndrome


  • Certification overload in security and privacy


  • Letting someone you know that it may be time for them to make a change


And the quote of the day is from The Great One, Wayne Gretsky - you miss 100% of the shots you don't take!

Support The Great Security Debate

Links:


]]>The time for job change happens and there are a lot of things go along with it including. We cover a ton of them in this week's episode:


  • The reasons to make a career change


  • Deciding the time is right to make a change (and how do you know)


  • Taking our own advice when it comes to our own career change


  • The importance of support of family to make more drastic changes


  • The power of self-reflection and the need to let go of the present to achieve the future


  • The importance of strong personal and community networking in career growth


  • Impostor syndrome


  • Certification overload in security and privacy


  • Letting someone you know that it may be time for them to make a change


And the quote of the day is from The Great One, Wayne Gretsky - you miss 100% of the shots you don't take!

Support The Great Security Debate

Links:


]]>685e36a1-6288-407b-8e1b-606ed452a08bSun, 31 Jan 2021 18:00:00 -040051:50falsefull116161The time for job change happens and there are a lot of things go along with it including. We cover a ton of them in this week&#39;s episode: The reasons to make a career change Deciding the time is right to make a change (and how do you know) Taking our own advice when it comes to our own career change The importance of support of family to make more drastic changes The power of self-reflection and the need to let go of the present to achieve the future The importance of strong personal and community networking in career growth Impostor syndrome Certification overload in security and privacy Letting someone you know that it may be time for them to make a change And the quote of the day is from The Great One, Wayne Gretsky - you miss 100% of the shots you don&#39;t take! https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://hpatton.medium.com/security-leadership-moving-on-d95f63818a5b (Security Leadership: Moving On. How to Know When It’s Time To Go | by Helen Patton | Jan, 2021 | Medium) https://mentorcore.biz/ (MentorCore – Growth and Development at your Fingertips) https://www.colorado-security.com/ (Colorado = Security) &mdash; If you are in Colorado and in security, click on Join our Slack Workspace at the bottom to join the Colorado=Security Slack! https://www.linkedin.com/posts/veronica-toscano-_six-months-ago-i-applied-for-a-chief-of-activity-6760348777871233024-R_4y/ (Six Months Ago I Applied for a Chief of Staff Role) https://www.womsa.org/ (Home | WomSA) https://genius.com/Chumbawamba-tubthumping-lyrics (Chumbawamba – Tubthumping Lyrics | Genius Lyrics) https://www.amazon.com/SPEED-TRUST-Thing-Changes-Everything/dp/1416549005 (Speed of Trust: The One Thing That Changes Everything: Stephen M .R. Covey, Stephen R. Covey, Rebecca R. Merrill: 8601405449078: Amazon.com: Books) https://erick.rudiak.com/ciso/my-favorite-cisos-arent-cisos/ (My Favorite CISOs aren't CISOs)Jobs (Not Woz)Jobs (Not Woz)We are 9 months into a period in which many workers, including technology and security professionals, are still doing their jobs remotely. Some have moved away from their primary homes, often without letting their company know that this has happened. As business processes catch up with this change in approach, some companies are taking steps to a) formalise work from home as a more standard offering, b) determine how to pay people wherever they are in the country/world, c) decide if in-person culture is key to their ethos, and how to deal with the new focus on remote work.

In this week's debate, Brian, Erik and Dan chat look at these topics from the pros and the cons, and what it could be like if everyone stays remote, the benefits and risks of geographically independent pay scales, and more.

Please take a moment and subscribe to the podcast in your preferred podcast application, and while you are there give soime feedback, either via a rating, or a comment, or both! We want to hear your feedback and ideas, so you can also email us at feedback@greatsecuritydebate.net or on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>We are 9 months into a period in which many workers, including technology and security professionals, are still doing their jobs remotely. Some have moved away from their primary homes, often without letting their company know that this has happened. As business processes catch up with this change in approach, some companies are taking steps to a) formalise work from home as a more standard offering, b) determine how to pay people wherever they are in the country/world, c) decide if in-person culture is key to their ethos, and how to deal with the new focus on remote work.

In this week's debate, Brian, Erik and Dan chat look at these topics from the pros and the cons, and what it could be like if everyone stays remote, the benefits and risks of geographically independent pay scales, and more.

Please take a moment and subscribe to the podcast in your preferred podcast application, and while you are there give soime feedback, either via a rating, or a comment, or both! We want to hear your feedback and ideas, so you can also email us at feedback@greatsecuritydebate.net or on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>b08949ec-aba2-483e-aed7-7544df545982Sun, 03 Jan 2021 18:00:00 -040058:31falsefull115151Sun and BreezeSun and BreezeA few weeks ago, a company called SolarWinds was discovered to have had some bad actors in placing things in their technology (code) for a while. How did it happen? What does it mean to others? We don't know all the answers yet but we do know that it means we will have to make some changes to things like those universally hated security questionnaires, and how we manage our own source code to ensure better security.

Along with a discussion about how cow stomachs relate to information security, and Brian's invoking of The Art of War, there's something for everyone in this epsiode.

Propeller head warning - this one's a bit more security "inside baseball" than other episodes as we dig into the recent SolarWinds technology attack and some of the ways that the technology and security practitioners can address issues that have been identified. It's still a "for everyone" episode, but we do go a little more in depth that we usually do in some parts. Let us know what you think!


Please take a moment and subscribe to the podcast in your preferred podcast application, and while you are there give soime feedback, either via a rating, or a comment, or both! We want to hear your feedback and ideas, so you can also email us at feedback@greatsecuritydebate.net or on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>A few weeks ago, a company called SolarWinds was discovered to have had some bad actors in placing things in their technology (code) for a while. How did it happen? What does it mean to others? We don't know all the answers yet but we do know that it means we will have to make some changes to things like those universally hated security questionnaires, and how we manage our own source code to ensure better security.

Along with a discussion about how cow stomachs relate to information security, and Brian's invoking of The Art of War, there's something for everyone in this epsiode.

Propeller head warning - this one's a bit more security "inside baseball" than other episodes as we dig into the recent SolarWinds technology attack and some of the ways that the technology and security practitioners can address issues that have been identified. It's still a "for everyone" episode, but we do go a little more in depth that we usually do in some parts. Let us know what you think!


Please take a moment and subscribe to the podcast in your preferred podcast application, and while you are there give soime feedback, either via a rating, or a comment, or both! We want to hear your feedback and ideas, so you can also email us at feedback@greatsecuritydebate.net or on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>bf3bc284-01ea-4807-942e-0154ed7ae7dbTue, 29 Dec 2020 14:00:00 -040001:02:17falsefull114141A few weeks ago, a company called SolarWinds was discovered to have had some bad actors in placing things in their technology (code) for a while. How did it happen? What does it mean to others? We don&#39;t know all the answers yet but we do know that it means we will have to make some changes to things like those universally hated security questionnaires, and how we manage our own source code to ensure better security. Along with a discussion about how cow stomachs relate to information security, and Brian&#39;s invoking of The Art of War, there&#39;s something for everyone in this epsiode. Propeller head warning - this one&#39;s a bit more security &quot;inside baseball&quot; than other episodes as we dig into the recent SolarWinds technology attack and some of the ways that the technology and security practitioners can address issues that have been identified. It&#39;s still a &quot;for everyone&quot; episode, but we do go a little more in depth that we usually do in some parts. Let us know what you think! Please take a moment and subscribe to the podcast in your preferred podcast application, and while you are there give soime feedback, either via a rating, or a comment, or both! We want to hear your feedback and ideas, so you can also email us at feedback@greatsecuritydebate.net or on Twitter at https://twitter.com/securitydebate (https://twitter.com/securitydebate) https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714 (Identifying UNC2452-Related Techniques for ATT&CK | by Matt Malone | MITRE ATT&CK® | Dec, 2020 | Medium) https://www.amazon.com/Art-War-Sun-Tzu/dp/160459893X (The Art of War: Tzu, Sun, Giles, Lionel: 9781604598933: Amazon.com: Books)E-Phish-EncyE-Phish-EncyOne of the ways that companies have tried to improve education and awareness about the risks of phishing is the use of phishing tests to see if colleagues click on the link or open the suspect attachment in an unsuspecting yet controled environment. If they do, some instant education comes their way. There are those that think that this approach keeps the topic at the front of everyone's mind, and there are those that think that it can have the effect of chilling the relationship between IT/Security and the rest of the organisation. There are a lot of variables in the equation like how you respond when someone clicks on the phish, how you encourage reporting of potential phishing and more, so the answer is a resounding "it depends."

We also cover some of the increased security challenges that come with the now more common "working remotely," and what happens when you walk into an empty castle after having gotten past the moat and door, but there is no one inside to defend it.

Support The Great Security Debate

Links:


]]>One of the ways that companies have tried to improve education and awareness about the risks of phishing is the use of phishing tests to see if colleagues click on the link or open the suspect attachment in an unsuspecting yet controled environment. If they do, some instant education comes their way. There are those that think that this approach keeps the topic at the front of everyone's mind, and there are those that think that it can have the effect of chilling the relationship between IT/Security and the rest of the organisation. There are a lot of variables in the equation like how you respond when someone clicks on the phish, how you encourage reporting of potential phishing and more, so the answer is a resounding "it depends."

We also cover some of the increased security challenges that come with the now more common "working remotely," and what happens when you walk into an empty castle after having gotten past the moat and door, but there is no one inside to defend it.

Support The Great Security Debate

Links:


]]>64eb2a29-6aa4-4bdd-a143-f2842531db6bSat, 05 Dec 2020 09:00:00 -040001:02:53falsefull113131One of the ways that companies have tried to improve education and awareness about the risks of phishing is the use of phishing tests to see if colleagues click on the link or open the suspect attachment in an unsuspecting yet controled environment. If they do, some instant education comes their way. There are those that think that this approach keeps the topic at the front of everyone&#39;s mind, and there are those that think that it can have the effect of chilling the relationship between IT/Security and the rest of the organisation. There are a lot of variables in the equation like how you respond when someone clicks on the phish, how you encourage reporting of potential phishing and more, so the answer is a resounding &quot;it depends.&quot; We also cover some of the increased security challenges that come with the now more common &quot;working remotely,&quot; and what happens when you walk into an empty castle after having gotten past the moat and door, but there is no one inside to defend it. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.ansys.com/blog/what-is-dfmea (What Is DFMEA?) https://quality-one.com/pfmea/ (Process FMEA | Process Failure Mode & Effects Analysis | Quality-One) https://www.samuelthomasdavies.com/five-whys/ (How to Overcome Obstacles by Using Toyota’s Five Whys Technique | Sam Thomas Davies) https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 (Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon: Zetter, Kim: 9780770436193: Amazon.com: Books) https://www.amazon.com/Perfect-Weapon-Sabotage-Fear-Cyber/dp/0451497899/ref=sr_1_1?crid=3W43EQ4UENQXC&dchild=1&keywords=the+perfect+weapon&qid=1607180302&s=books&sprefix=the+perfect+wea%2Cstripbooks%2C178&sr=1-1 (The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age: Sanger, David E.: 9780451497895: Amazon.com: Books) https://cloud.google.com/beyondcorp (BeyondCorp - Enterprise Security | Google Cloud) https://www.amazon.com/Phoenix-Project-DevOps-Helping-Business/dp/0988262592 (The Phoenix Project: A Novel about IT, DevOps, and Helping Your Business Win: Kim, Gene, Behr, Kevin, Spafford, George: 8601404253799: Amazon.com: Books) https://www.hbo.com/documentaries/the-perfect-weapon (The Perfect Weapon - Watch the HBO Original Documentary | HBO) https://www.sho.com/homeland (Homeland: Seasons, Episodes, Cast, Characters - Official Series Site | SHOWTIME)A Frictional ResponseA Frictional ResponseA regular complaint by those who consume and use technology is that security adds friction to their process, which often means they get frustrated at the control put in their path, curse technology in general, or abandon the activity altogether. In today's episode, Dan, Erik and Brian explore the balance necessary to understand when certain controls (and the friction they add) are necessary, or can be made smoother. Each decision on reduction of friction has the potential for knock-on effects to the security, privacy and performance of the system and should be considered before making any change to the control. In some cases the conscious addition of friction is the better approach, too, especially to support transparency with users and enable meaningful, informed choices.

Support The Great Security Debate

Links:


]]>A regular complaint by those who consume and use technology is that security adds friction to their process, which often means they get frustrated at the control put in their path, curse technology in general, or abandon the activity altogether. In today's episode, Dan, Erik and Brian explore the balance necessary to understand when certain controls (and the friction they add) are necessary, or can be made smoother. Each decision on reduction of friction has the potential for knock-on effects to the security, privacy and performance of the system and should be considered before making any change to the control. In some cases the conscious addition of friction is the better approach, too, especially to support transparency with users and enable meaningful, informed choices.

Support The Great Security Debate

Links:


]]>a666bf31-916b-4e93-81e3-84f54b42a103Sun, 15 Nov 2020 08:45:00 -040001:06:17falsefull112121A regular complaint by those who consume and use technology is that security adds friction to their process, which often means they get frustrated at the control put in their path, curse technology in general, or abandon the activity altogether. In today&#39;s episode, Dan, Erik and Brian explore the balance necessary to understand when certain controls (and the friction they add) are necessary, or can be made smoother. Each decision on reduction of friction has the potential for knock-on effects to the security, privacy and performance of the system and should be considered before making any change to the control. In some cases the conscious addition of friction is the better approach, too, especially to support transparency with users and enable meaningful, informed choices. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.amazon.com/RSA-SecurID-Authenticator-SID800-Pack/dp/B00CEZCNQI (Amazon.com: RSA SecurID Authenticator SID800 Key Fob (Pack of 25): Computers & Accessories) https://www.daymarksi.com/information-technology-navigator-blog/understanding-office-365-impossible-travel (Understanding Office 365 Impossible Travel) https://cloud.google.com/beyondcorp/ (BeyondCorp - Enterprise Security | Google Cloud) https://www.techrepublic.com/article/half-of-security-pros-would-rather-walk-barefoot-in-a-public-restroom-than-use-public-wi-fi/ (Half of security pros would rather walk barefoot in a public restroom than use public Wi-Fi - TechRepublic) https://www.amazon.com/Step2-KidAlert-V-W-S-Safety-Sign/dp/B0193MPQJA/ref=sr_1_6?crid=20WKN2WQ3KAFJ&dchild=1&keywords=children+at+play+sign&qid=1605450766&sprefix=children+at+play+%2Caps%2C171&sr=8-6 (Amazon.com: Step2 KidAlert V.W.S. Safety Sign: Toys & Games) https://www.macrumors.com/2020/10/28/ios-14-anti-tracking-prompt-antitrust-complaint/ (iOS 14's Upcoming Anti-Tracking Prompt Sparks Antitrust Complaint in France - MacRumors) https://www.bbc.com/news/technology-54838978 (Popular app T&Cs 'longer than Harry Potter' - BBC News) https://www.michigan.gov/mdot/0,4616,7-151-9621_101547---,00.html (MDOT - CAV Corridor) https://www.engadget.com/2017-09-14-amazon-waves-goodbye-to-its-one-click-purchase-patent.html (Amazon waves goodbye to its one-click purchase patent | Engadget)Who You Gonna Call?Who You Gonna Call?When bad things happen to the computers in your organisation, who is the first person you call? IT, the FBI, your general counsel, the insurance company? Today, Erik, Dan and Brian cover attacks, response and middle people negotiating with the attackers on your behalf.

Other topics discussed include:


  • The risk of cheap IoT devices and long term support (or lack thereof),


  • Whose insurance policy covers the tree on your neighbour's land that falls and hits your house,


  • The law of unintended consequences when creating things, and


  • The joy of reading fake Amazon reviews


Support The Great Security Debate

Links:


]]>When bad things happen to the computers in your organisation, who is the first person you call? IT, the FBI, your general counsel, the insurance company? Today, Erik, Dan and Brian cover attacks, response and middle people negotiating with the attackers on your behalf.

Other topics discussed include:


  • The risk of cheap IoT devices and long term support (or lack thereof),


  • Whose insurance policy covers the tree on your neighbour's land that falls and hits your house,


  • The law of unintended consequences when creating things, and


  • The joy of reading fake Amazon reviews


Support The Great Security Debate

Links:


]]>e5f50d69-ef4f-4395-90e9-a7b04ea23662Sat, 31 Oct 2020 08:00:00 -040001:04:25falsefull111111Yippie Ki-Yay... Let's Hack the GibsonYippie Ki-Yay... Let's Hack the GibsonSo many movies about technology and security, so little time. We start our with some of our favourite (and least favourite) security movies. We also wander into a few other areas including: data use and ethics, balancing when to let an attack happen vs. when to let it happen to not let on that you know, Shodan, Stuxnet, Wannacry and more. Check out the complete list of movies we discuss and mention in the links list below!

Support The Great Security Debate

Links:


]]>So many movies about technology and security, so little time. We start our with some of our favourite (and least favourite) security movies. We also wander into a few other areas including: data use and ethics, balancing when to let an attack happen vs. when to let it happen to not let on that you know, Shodan, Stuxnet, Wannacry and more. Check out the complete list of movies we discuss and mention in the links list below!

Support The Great Security Debate

Links:


]]>84c3fa8b-cae5-435a-ab98-41f988cc1fa8Sat, 17 Oct 2020 08:00:00 -040001:04:03falsefull110101Privacy Drone 2: This Time It's PersonalPrivacy Drone 2: This Time It's PersonalIn what will surely become a recurring topic, the discussion turns to the short-term vs. long-term implications of privacy decisions we each make, the ethics of collecting and using data, and whether a European model of privacy (or data protection as Dan reiterates we should be calling it) would help in the US. We ask why we can't stop needing instant replies and gratification, is the value of the services we get worth the tradeoff for the data we are "paying" in order to use them, and more. Erik even beats Dan to be the first to use his "It Depends" catchphrase, so you know it's going to be a lively discussion.

Privacy is on everyone's mind these days, and it's the topic of The Great Security Debate today.

Support The Great Security Debate

Links:


]]>In what will surely become a recurring topic, the discussion turns to the short-term vs. long-term implications of privacy decisions we each make, the ethics of collecting and using data, and whether a European model of privacy (or data protection as Dan reiterates we should be calling it) would help in the US. We ask why we can't stop needing instant replies and gratification, is the value of the services we get worth the tradeoff for the data we are "paying" in order to use them, and more. Erik even beats Dan to be the first to use his "It Depends" catchphrase, so you know it's going to be a lively discussion.

Privacy is on everyone's mind these days, and it's the topic of The Great Security Debate today.

Support The Great Security Debate

Links:


]]>7457d43e-2de1-4a81-8940-53c240360c75Sat, 03 Oct 2020 09:00:00 -040057:04falsefull1991In what will surely become a recurring topic, the discussion turns to the short-term vs. long-term implications of privacy decisions we each make, the ethics of collecting and using data, and whether a European model of privacy (or data protection as Dan reiterates we should be calling it) would help in the US. We ask why we can&#39;t stop needing instant replies and gratification, is the value of the services we get worth the tradeoff for the data we are &quot;paying&quot; in order to use them, and more. Erik even beats Dan to be the first to use his &quot;It Depends&quot; catchphrase, so you know it&#39;s going to be a lively discussion. Privacy is on everyone&#39;s mind these days, and it&#39;s the topic of The Great Security Debate today. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.amazon.com/Charlie-Wilsons-War-Extraordinary-Congress/dp/0802143415 (Charlie Wilson's War: The Extraordinary Story of How the Wildest Man in Congress and a Rogue CIA Agent Changed the History of Our Times: Crile, George: 9780802143419: Amazon.com: Books) https://www.amazon.com/Coddling-American-Mind-Intentions-Generation/dp/0735224897 (The Coddling of the American Mind: How Good Intentions and Bad Ideas Are Setting Up a Generation for Failure: Lukianoff, Greg, Haidt, Jonathan: 9780735224896: Amazon.com: Books) https://www.imdb.com/title/tt5497778/?ref_=ttep_ep1 ("Black Mirror" Nosedive (TV Episode 2016) - IMDb) https://www.amazon.com/Upload-Season-1/dp/B0858YGKZ4 (Watch Upload - Season 1 | Prime Video) https://www.secureworldexpo.com/industry-news/trump-biden-cybersecurity-encryption-privacy (Trump vs. Biden on Cybersecurity, Encryption, and Data Privacy) https://iapp.org/news/a/privacy-and-information-security-the-territorial-challenges1/#:~:text=While%20the%20security%20of%20information,related%20to%20a%20subject's%20identity (Privacy and Information Security: The Territorial Challenges) https://www.economist.com/leaders/2017/05/06/the-worlds-most-valuable-resource-is-no-longer-oil-but-data (Regulating the internet giants - The world’s most valuable resource is no longer oil, but data | Leaders | The Economist) https://www.cnet.com/how-to/amazon-sidewalk-is-coming-to-your-neighborhood-ble-900-mhz/ (Amazon Sidewalk will create entire smart neighborhoods. Here's what you should know - CNET)Back to SchoolBack to SchoolThe school year is upon us. This week Erik, Brian and Dan are talking about things related to security and education. First, we cover the ongoing dilemma of which is better to establish and grow your career in security: certifications or experience. We also debate how traditional education (aka degrees) fit into the equation, and how to jump in if you have neither formal experience nor education and want to join the field... you'd never have guessed but "it depends!" Finally we talk about the challenges that K12 districts have managing security and privacy in normal times, let alone in the recent rush to move to remote learning so quickly.

We also spent a lot of time on mentoring and reaching out to people who are in the field for help, and some resources you can go to for info on mentoring, and the reminder that if you had mentors and those who helped you get where you are, to give back to those who will carry the torch next. Links to resources are in the links below.

Support The Great Security Debate

Links:


]]>The school year is upon us. This week Erik, Brian and Dan are talking about things related to security and education. First, we cover the ongoing dilemma of which is better to establish and grow your career in security: certifications or experience. We also debate how traditional education (aka degrees) fit into the equation, and how to jump in if you have neither formal experience nor education and want to join the field... you'd never have guessed but "it depends!" Finally we talk about the challenges that K12 districts have managing security and privacy in normal times, let alone in the recent rush to move to remote learning so quickly.

We also spent a lot of time on mentoring and reaching out to people who are in the field for help, and some resources you can go to for info on mentoring, and the reminder that if you had mentors and those who helped you get where you are, to give back to those who will carry the torch next. Links to resources are in the links below.

Support The Great Security Debate

Links:


]]>c764cfa5-0f77-4648-8a06-97debceffd53Sat, 12 Sep 2020 13:00:00 -040059:56falsefull1881The school year is upon us. This week Erik, Brian and Dan are talking about things related to security and education. First, we cover the ongoing dilemma of which is better to establish and grow your career in security: certifications or experience. We also debate how traditional education (aka degrees) fit into the equation, and how to jump in if you have neither formal experience nor education and want to join the field... you&#39;d never have guessed but &quot;it depends!&quot; Finally we talk about the challenges that K12 districts have managing security and privacy in normal times, let alone in the recent rush to move to remote learning so quickly. We also spent a lot of time on mentoring and reaching out to people who are in the field for help, and some resources you can go to for info on mentoring, and the reminder that if you had mentors and those who helped you get where you are, to give back to those who will carry the torch next. Links to resources are in the links below. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://gitbook.zachgoebel.com/ (Home - Zach's Book) https://www.womsa.org/ (Home | WomSA) https://mentorcore.biz/ (MentorCore – Growth and Development at your Fingertips) https://cloudsecurityalliance.org/ (Home | Cloud Security Alliance) https://mcwt.org/ (Michigan Council of Women in Technology Foundation / MCWT Foundation) https://www.sans.org/ (Information Security Training | SANS Cyber Security Certifications & Research) https://www.isc2.org/ (Cybersecurity and IT Security Certifications and Training | (ISC)²)Hold Me For RansomHold Me For RansomRansomware is increasing. Brian, Dan and Erik discuss the evolution of ransomware, the preparation and the response, and the debate about whether to pay the ransom or not.

Support The Great Security Debate

Links:


]]>Ransomware is increasing. Brian, Dan and Erik discuss the evolution of ransomware, the preparation and the response, and the debate about whether to pay the ransom or not.

Support The Great Security Debate

Links:


]]>fd8f4102-7c20-49ff-a00b-1ee1c802552dSun, 23 Aug 2020 08:45:00 -040001:16:44falsefull1771Ransomware is increasing. Brian, Dan and Erik discuss the evolution of ransomware, the preparation and the response, and the debate about whether to pay the ransom or not. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.theverge.com/2020/8/18/21372435/oculus-facebook-login-change-separate-account-support-end-quest-october (You’ll need a Facebook account to use future Oculus headsets - The Verge) https://www.knowbe4.com/aids-trojan (AIDS Trojan | PC Cyborg | Original Ransomware | KnowBe4) https://www.upguard.com/blog/wannacry (What is the WannaCry Ransomware Attack?) https://www.blackhillsinfosec.com/projects/backdoorsandbreaches/ (Backdoors and Breaches) https://www.nomoreransom.org/ (The No More Ransom Project) https://www.congress.gov/bill/99th-congress/house-bill/4718 (H.R.4718 - 99th Congress (1985-1986): Computer Fraud and Abuse Act of 1986 | Congress.gov | Library of Congress) https://www.ibm.com/security/digital-assets/cost-data-breach-report/?utm_medium=OSocial&utm_source=Blog&utm_content=000039JJ&utm_term=10013747&utm_id=SI-blog-1&cm_mmc=OSocial_Blog-_-Portfolio%20Security_Security%20Conversation-_-WW_WW-_-SI-blog-1_ov76748&cm_mmca1=000039JJ&cm_mmca2=10013747#/ (Cost of a Data Breach Report 2020 | IBM)Pippen and JordanPippen and JordanOn the debate today: it was overheard (over-read?) by one of the crew that security leaders and teams shoudl stop whining when security is not a “superstar” part of the business, but rather should focus on being a reliable supporting act that is there to prop up the actual “superstars.” There was a flawed comparison in this same read to the relationship between Scottie Pippen and Michael Jordan on the Chicago Bulls of the 90s. In the course of this episode we cover the “best” place for the security organisation to live, the need for CISOs and their teams to be at the table vs. the backoffce, quotes from Colin Powell and more.

Support The Great Security Debate

Links:


]]>On the debate today: it was overheard (over-read?) by one of the crew that security leaders and teams shoudl stop whining when security is not a “superstar” part of the business, but rather should focus on being a reliable supporting act that is there to prop up the actual “superstars.” There was a flawed comparison in this same read to the relationship between Scottie Pippen and Michael Jordan on the Chicago Bulls of the 90s. In the course of this episode we cover the “best” place for the security organisation to live, the need for CISOs and their teams to be at the table vs. the backoffce, quotes from Colin Powell and more.

Support The Great Security Debate

Links:


]]>a1eab1f7-f95a-4931-89fc-223f47979346Sat, 08 Aug 2020 10:00:00 -040058:07falsefull1661On the debate today: it was overheard (over-read?) by one of the crew that security leaders and teams shoudl stop whining when security is not a “superstar” part of the business, but rather should focus on being a reliable supporting act that is there to prop up the actual “superstars.” There was a flawed comparison in this same read to the relationship between Scottie Pippen and Michael Jordan on the Chicago Bulls of the 90s. In the course of this episode we cover the “best” place for the security organisation to live, the need for CISOs and their teams to be at the table vs. the backoffce, quotes from Colin Powell and more. https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://erick.rudiak.com/ciso/the-c-matters/ (The "C" Matters or: How I Learned to Stop Worrying and Love the CISO Job) https://themilitaryleader.com/priceless-colin-powell/ (11 Priceless Colin Powell Quotes - The Military Leader)Gripped With FearGripped With FearSupport The Great Security Debate

Links:


]]>Support The Great Security Debate

Links:


]]>8424fe6f-f51e-4612-952d-3d80abf00843Sun, 26 Jul 2020 09:00:00 -040058:33falsefull1551https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.backblaze.com/blog/the-3-2-1-backup-strategy/ (Backup Strategies: Why the 3-2-1 Backup Strategy is the Best) https://metro.org/event/data-privacy-big-tech-how-facebook-amazon-apple-netflix-and-google-deal-with-data-and-what-it-means-for-you/ (Data Privacy + Big Tech: How Facebook, Amazon, Apple, Netflix, and Google Deal With Data (And What It Means for You) - METRO) https://www.linkedin.com/posts/gabrielfriedlander_informationsecurity-securityawareness-activity-6692936815084662784-G1m-/ (Wizer)In The House (Or Not)In The House (Or Not)Dan, Brian and Erik discuss the pros and cons of managed services for security vs. building similar capability internally, best of breed security vs. suite (for the 5th time since 1995), and education and awareness.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>Dan, Brian and Erik discuss the pros and cons of managed services for security vs. building similar capability internally, best of breed security vs. suite (for the 5th time since 1995), and education and awareness.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>51347337-f10f-465b-ac12-edc1a91e8e80Sat, 04 Jul 2020 19:00:00 -040001:08:01falsefull1441Dan, Brian and Erik discuss the pros and cons of managed services for security vs. building similar capability internally, best of breed security vs. suite (for the 5th time since 1995), and education and awareness. Visit our website at https://www.greatsecuritydebate.net (https://www.greatsecuritydebate.net) Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate (https://twitter.com/securitydebate) https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.cbronline.com/interview/peter-yapp-schillings-interview (The Big Interview: Peter Yapp, Partner, Schillings and former NCSC Deputy Director: “Boards Need a CISO Who Reports Directly to Them, Rather than the CIO”) https://www.linkedin.com/in/mbally/ (Martin Bally | LinkedIn)MVP vs. TSPMVP vs. TSPDan, Brian and Erik debate the pros and cons to starting a product (or even a project) fully focused on hitting MVP (minimum viable product) or focusing more on TSP (totally secure product). Spoiler alert: it's somewhere in the middle! Also covered: the importance of support, defence vs response, and the mission of the podcast.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>Dan, Brian and Erik debate the pros and cons to starting a product (or even a project) fully focused on hitting MVP (minimum viable product) or focusing more on TSP (totally secure product). Spoiler alert: it's somewhere in the middle! Also covered: the importance of support, defence vs response, and the mission of the podcast.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>77d0f6a7-26d4-4d6b-9874-37ee55b90013Sat, 13 Jun 2020 17:00:00 -040001:00:42falsefull1331Dan, Brian and Erik debate the pros and cons to starting a product (or even a project) fully focused on hitting MVP (minimum viable product) or focusing more on TSP (totally secure product). Spoiler alert: it&#39;s somewhere in the middle! Also covered: the importance of support, defence vs response, and the mission of the podcast. Visit our website at https://www.greatsecuritydebate.net (https://www.greatsecuritydebate.net) Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate (https://twitter.com/securitydebate) https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://er.educause.edu/blogs/2020/3/thoughtfulness-in-a-pandemic (Thoughtfulness in a Pandemic) https://hbr.org/2015/03/why-data-breaches-dont-hurt-stock-prices (HBR: Why Data Breaches Don’t Hurt Stock Prices) https://www.amazon.com/Extreme-Ownership-U-S-Navy-SEALs/dp/1250067057 (Extreme Ownership: How U.S. Navy SEALs Lead and Win (9781250067050): Willink, Jocko, Babin, Leif: Books) https://www.amazon.com/Leaders-Eat-Last-Together-Others/dp/1591848016/ref=sr_1_1?dchild=1&keywords=Leaders+Eat+Last&qid=1592100999&s=books&sr=1-1 (Leaders Eat Last: Why Some Teams Pull Together and Others Don't: Sinek, Simon: 9781591848011: Amazon.com: Books) https://go.forrester.com/blogs/dont-reward-the-brilliant-jerk/ (Don't Reward The Brilliant Jerk: The Role Of Culture In Employee Retention) https://www.amazon.com/True-North-Discover-Authentic-Leadership/dp/0787987514 (True North: Discover Your Authentic Leadership: Bill George, Peter Sims, David Gergen: 9780787987510: Amazon.com: Books) https://www.youtube.com/watch?v=l7UnEGbHx78 (Hang Out A Shingle - Starting Your Cybersecurity Company Feat. Daniel Ayala and Douglas Brush - YouTube) https://www.amazon.com/Crucial-Conversations-Talking-Stakes-Second/dp/0071771328/ref=sr_1_1?dchild=1&keywords=Crucial+Conversations&qid=1592101093&s=books&sr=1-1 (Crucial Conversations Tools for Talking When Stakes Are High, Second Edition: Patterson, Kerry, Grenny, Joseph, McMillan, Ron, Switzler, Al: 8580001040288: Amazon.com: Books) https://wizer-training.com/ (Wizer: Security Awareness Training) https://www.linkedin.com/posts/sidragon1_dataintegrity-pollution-bigdata-activity-6676758042261889025-CMkI/ (The Sixth Ocean!)Free Range SecurityFree Range SecurityDan, Brian and Erik discuss how to talk about security in ways that encourage end users to understand security and want to be part of the process, and the challenges of selling security products into security organisations.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>Dan, Brian and Erik discuss how to talk about security in ways that encourage end users to understand security and want to be part of the process, and the challenges of selling security products into security organisations.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>f5cd2236-43ef-451c-834b-1868a34a9b5eSat, 30 May 2020 14:00:00 -040059:16falsefull1221Dan, Brian and Erik discuss how to talk about security in ways that encourage end users to understand security and want to be part of the process, and the challenges of selling security products into security organisations. Visit our website at https://www.greatsecuritydebate.net (https://www.greatsecuritydebate.net) Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate (https://twitter.com/securitydebate) https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.amazon.com/Crossing-Chasm-3rd-Disruptive-Mainstream/dp/0062292986 (Crossing the Chasm) https://www.amazon.com/Never-Split-Difference-Negotiating-Depended/dp/0062407805 (Never Split the Difference) https://www.amazon.com/Phoenix-Project-DevOps-Helping-Business-ebook/dp/B078Y98RG8/ (The Phoenix Project) https://www.greatsecuritydebate.net (Great Security Debate Website) https://twitter.com/securitydebate (Great Security Debate Twitter)Privacy DronePrivacy DroneEpisode 1: Privacy Drone. Dan, Brian and Erik discuss expectation of privacy; privacy as a business enabler; transparency and ethical increase of privacy and how much should leaders and legislators understand privacy innately.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>Episode 1: Privacy Drone. Dan, Brian and Erik discuss expectation of privacy; privacy as a business enabler; transparency and ethical increase of privacy and how much should leaders and legislators understand privacy innately.

Visit our website at https://www.greatsecuritydebate.net

Contact us at feedback@greatsecuritydebate.net


Follow us on Twitter at https://twitter.com/securitydebate

Support The Great Security Debate

Links:


]]>640a1cea-a4ff-463c-a39c-6d5b738da4beSat, 16 May 2020 17:00:00 -040001:08:08falsefull1111Episode 1: Privacy Drone. Dan, Brian and Erik discuss expectation of privacy; privacy as a business enabler; transparency and ethical increase of privacy and how much should leaders and legislators understand privacy innately. Visit our website at https://www.greatsecuritydebate.net (https://www.greatsecuritydebate.net) Contact us at feedback@greatsecuritydebate.net Follow us on Twitter at https://twitter.com/securitydebate (https://twitter.com/securitydebate) https://www.patreon.com/securitydebate (Support The Great Security Debate) Links: https://www.greatsecuritydebate.net (Great Security Debate Website) https://twitter.com/securitydebate (Great Security Debate Twitter)