In this episode of the Security by Default podcast, host Joe Carson engages with Vladislav Shapiro, who shares his journey from a mathematician to an identity management expert. They discuss the evolution of identity management, its growing importance in business, and the innovations shaping the future of identity technology. The conversation emphasizes the need for a business-oriented approach to identity, the gaps in current practices, and the ethical considerations in technology development. In this conversation, Joseph Carson and Vladislav Shapiro explore the complexities of AI governance, drawing parallels with nuclear energy management. They discuss the importance of control mechanisms, the role of identity in AI, and the emerging threats related to computational workload theft. The conversation emphasizes the need for continuous learning in a rapidly evolving technological landscape and the significance of visibility in understanding both good and bad actors in the AI space.

The dialogue between Joe Carson and Vlad Shapiro unfolds a captivating narrative that chronicles Vlad's evolution from an accomplished mathematician to a distinguished identity management expert. Vlad's journey is steeped in serendipity and introspection, illustrating the transformative power of career shifts propelled by the dynamics of professional landscapes and personal revelations. As he delves into his past, Vlad reflects on his academic pursuits in Ukraine and his subsequent migration to the United States, where he initially aspired to teach mathematics at a university level. However, as he navigated the academic landscape and its stark contrasts to European standards, he pivoted towards industry, seeking avenues to apply his analytical skills in a pragmatic context. The discussion transitions into a broader exploration of the identity management sector, a field that has burgeoned in significance over recent years. Vlad articulates the paradigm shift that identity management has undergone, now recognized as a critical business function rather than merely an IT concern. The conversation delves into the intricacies of identity governance, emphasizing the need for organizations to reconsider how they manage identity in a world increasingly reliant on digital interactions. Vlad's insights on the intersection of identity management and business strategy underscore the imperative for organizations to engage with this evolving landscape, reflecting on how identity impacts operational efficiency and risk management. As the episode progresses, Vlad shares his perspectives on contemporary challenges within the identity management domain, notably the importance of interoperability among diverse systems and the necessity for organizations to adapt to a rapidly evolving technological environment. His reflections on the ethical dimensions of identity management, particularly concerning data privacy and consumer trust, resonate deeply within the ongoing discourse surrounding digital identities. This episode serves as a profound reminder of the critical role that identity management plays in shaping secure and efficient organizational practices, and it encapsulates the wisdom gleaned from Vlad's unique journey through the realms of mathematics and identity management.

Takeaways:

• Vlad Shapiro's transition from a trained mathematician to an identity management expert showcases the fluidity of career paths in the technology sector.
• The evolution of identity management has transformed it into a critical business function, emphasizing its integral role in organizational security and efficiency.
• Understanding identity as a business imperative rather than merely a technical challenge is essential for engaging stakeholders and achieving strategic alignment.
• The importance of fostering a culture of curiosity and continuous learning is paramount in the ever-evolving landscape of identity management and cybersecurity.
• Innovations in identity management must prioritize interoperability to ensure seamless integration across diverse systems and platforms.
• The conversation around identity management now encompasses ethical considerations, prompting a reevaluation of policies to mitigate risks associated with technological advancements.

🎙️ Security by Default Podcast

Practical AI Security: Attacking, Defending, and Securing the Future of AI

With Harriet Farlow — Founder of Mileva Security Labs & Author of Practical AI Security

Artificial Intelligence is transforming the way we build technology, automate decisions, analyze data, and solve some of the world’s biggest challenges.

But as AI becomes more powerful and more deeply embedded into our lives, one critical question becomes increasingly important:

How do we secure AI itself?

In this episode of Security by Default, host Joseph Carson is joined by Harriet Farlow, AI security researcher, founder of Mileva Security Labs, and author of “Practical AI Security: A Hands-On Guide to Attacking, Defending, and Securing Modern AI Systems.”

Together they explore the rapidly evolving world of AI security, adversarial machine learning, and why understanding how AI works is essential before we can protect it.

About This Episode

AI is often described as the next technological revolution, but securing AI requires us to rethink many traditional cybersecurity approaches.

Unlike conventional software, AI systems are built on data, probability, optimization, and learning models. They do not always fail in predictable ways, and vulnerabilities are not always solved with a simple patch.

Harriet shares her fascinating journey from studying physics and anthropology to working in data science, national security, and artificial intelligence, eventually discovering the world of adversarial machine learning — where attackers attempt to manipulate and disrupt AI systems themselves.

This conversation goes beyond the hype and explores what defenders, developers, and organizations need to understand as AI becomes a critical part of modern technology.

What You Will Learn

🤖 Why AI Security Matters More Than Ever

AI is becoming part of software development, business operations, healthcare, finance, critical infrastructure, and cybersecurity itself.

As adoption accelerates, organizations must move beyond simply asking:

“How can we use AI?”

and start asking:

“How do we secure AI?”

🧠 Understanding How AI Really Works

Harriet explains why machine learning systems are fundamentally different from traditional software.

AI systems are:

• Probabilistic rather than deterministic
• Dependent on training data quality
• Designed around optimization
• Continuously influenced by changing environments

Understanding these foundations is essential for anyone responsible for protecting AI.

🔓 The World of Adversarial Machine Learning

What happens when attackers stop targeting only applications and infrastructure…

…and start targeting the AI model itself?

The episode explores:

• Model manipulation
• Data poisoning
• AI weaknesses
• Training challenges
• Unexpected behaviors
• The difficulty of understanding model decisions

🛠️ How Do You Patch AI?

One of the biggest questions facing cybersecurity professionals today:

If AI learns something wrong, how do we fix it?

Traditional security follows a familiar process:

Find vulnerability → Apply patch → Reduce risk

AI changes that.

Sometimes protecting AI is not about fixing code.

It is about understanding and correcting behavior.

⚔️ AI for Security vs Security for AI

For years, organizations have focused on using AI to improve cybersecurity.

But now the challenge has expanded.

Cybersecurity needs AI.

But AI also needs cybersecurity.

As AI becomes part of everyday systems, security teams must understand how to protect the models, data, and decisions that organizations rely on.

🌍 Why AI Security Requires Different Skills

The future of AI security requires collaboration between:

• Cybersecurity professionals
• AI engineers
• Data scientists
• Researchers
• Risk leaders
• Policy experts

Building trustworthy AI means bringing these worlds together.

Security must be part of AI from the beginning.

Key Topics Discussed

🔹 Harriet’s journey from physics and anthropology into AI security

🔹 Working in data science and national security environments

🔹 Discovering adversarial machine learning

🔹 Founding Mileva Security Labs

🔹 Writing Practical AI Security with No Starch Press

🔹 Why AI vulnerabilities are different from software vulnerabilities

🔹 The importance of data quality and model training

🔹 Understanding probability and machine learning foundations

🔹 How attackers target AI systems

🔹 Why securing AI requires a new mindset

🔹 The future of AI safety and cybersecurity

🔹 Staying updated in a fast-moving industry

🔹 Building responsible and secure AI systems

Memorable Quotes

💬 “Before we can secure AI, we first need to understand how it works.”

💬 “AI security is not always about fixing a bug. Sometimes it is about correcting a behavior.”

💬 “Cybersecurity needs AI, but AI also needs cybersecurity.”

💬 “The future is not just about building smarter AI — it is about building safer AI.”

Episode Chapters

00:00 – Introduction to Security by Default

01:03 – Harriet Farlow’s origin story

04:28 – From data science to cybersecurity

08:48 – Creating Mileva Security Labs

10:51 – Conferences, community, and writing Practical AI Security

17:28 – How AI has evolved

19:43 – Understanding machine learning models

21:43 – The challenge of patching AI systems

23:37 – Training data, quality, and user impact

25:23 – Why AI models can be difficult to understand

27:36 – AI and cybersecurity coming together

30:18 – Why AI fundamentals matter

32:04 – Practical examples and real-world AI security

33:38 – Staying updated in AI security

36:27 – Learning from the AI security community

38:08 – Ethics and responsible AI development

Guest

Harriet Farlow

Founder — Malevra Security Labs

Author — Practical AI Security

🔗 LinkedIn:

https://www.linkedin.com/in/harriet-farlow-654963b7/

📘 Practical AI Security — No Starch Press

https://nostarch.com

🎓 AI Fundamentals Course

https://harriethacks.com/course/

Listen & Subscribe

🎧 Security by Default Podcast

Exploring the people, stories, and ideas helping make technology safer.

Because security should not be an afterthought.

Security should be by default.

#SecurityByDefault #AISecurity #Cybersecurity #ArtificialIntelligence #MachineLearning #AdversarialML #AI #ResponsibleAI #SecurityResearch

Takeaways:

• The podcast episode discusses the importance of understanding AI security in the context of national security and its implications.
• Harriet's journey from a background in physics and anthropology to her current role in AI security demonstrates the interdisciplinary nature of the field.
• The conversation highlights the necessity for collaboration between AI developers and cybersecurity professionals to ensure secure AI systems.
• Listeners are encouraged to engage with various resources to stay informed about the rapidly evolving landscape of AI and cybersecurity.
• The significance of addressing the ethical considerations in AI development is emphasized throughout the discussion, focusing on empowering rather than replacing human effort.
• The episode underscores the idea that AI security is not merely about using AI for cybersecurity but also about securing AI systems from external threats.

In this episode of the Security by Default podcast, host Joe Carson welcomes Diana Kelley, a prominent figure in the tech industry, to discuss her journey in technology, the evolution of AI, and its implications for cybersecurity and the job market. They explore the historical context of AI, from early systems like ELIZA to modern advancements like Watson and ChatGPT, and address common misconceptions about AI's capabilities. The conversation also delves into the future of jobs in an AI-driven world, emphasizing the need for training and understanding of AI technologies. In this conversation, Joseph Carson and Diana Kelley discuss the evolution of jobs in the context of technological advancements, particularly focusing on AI and its implications for the workforce. They explore the necessity of continuous retraining and the emergence of new roles, the importance of contextual understanding in AI, and the behavior of AI agents. Additionally, they emphasize the need for control mechanisms in AI development and the importance of empowering women in cybersecurity to address the growing challenges in the field.

Takeaways

• The podcast aims to bring clarity and transparency to the chaos in the tech world.
• Diana Kelley has a rich history in technology, starting from the DARPAnet in the 1970s.
• ELIZA was one of the first AI systems, designed to emulate a therapist.
• Watson's success in Jeopardy was due to its speed, not intelligence.
• AI's interaction with humans can lead to misconceptions about its capabilities.
• Chain of thought prompting has improved AI's problem-solving abilities.
• AI is a probability machine, not a sentient being.
• Training is essential for effective AI usage.
• The evolution of AI has implications for job security and creation.
• Legacy systems still require human oversight and expertise. The jobs we have today are constantly evolving due to technology.
• Retraining is essential to stay relevant in the workforce.
• AI will create new job opportunities in various fields.
• Understanding context is crucial for effective AI interaction.
• Prompt engineering is a vital skill in working with AI models.
• Control mechanisms are necessary for managing AI behavior.
• Empowering women in cybersecurity is critical for the industry's future.
• Community support is essential for fostering diversity in tech.
• Continuous learning is key to adapting to technological changes.
• Networking and mentorship play a significant role in career development.

Chapters

00:00 Introduction to the Podcast and Guest

01:01 Diana Kelley's Journey in Tech

04:56 The Evolution of AI: From ELIZA to Watson

10:14 AI in Cybersecurity: Training Watson for Cyber

14:03 Understanding AI: Human-like Interaction and Misconceptions

16:33 Advancements in AI: Chain of Thought Prompting

20:11 The Future of Jobs in the Age of AI

21:20 The Evolution of Jobs and Skills

23:51 AI and Human Interaction

27:06 Contextual Understanding in AI

29:56 Agent Behavior and Control

32:58 Staying Informed in a Rapidly Changing Field

36:07 Empowering Women in Cybersecurity

Resources & Links:

• ELIZA - Joseph Weizenbaum's AI Program
• Diana Kelley - LinkedIn
• OWASP GenAI Project
• Women in Cybersecurity (WiCyS)
• IBM Watson
• OpenAI GPT Models
• Anthropic's Claude

Connect with Diana Kelley:

• LinkedIn

Enjoy this insightful conversation on the past, present, and future of AI and cybersecurity, highlighting the balance between innovation and responsible deployment.

The discourse conducted in the latest installment of the Security By Default podcast presents a profound exploration of the evolution of artificial intelligence (AI) and its consequential implications within the cybersecurity domain. The host, Joe Carson, alongside esteemed guest Diana Kelly, embarks on a reflective journey that traverses the historical underpinnings of AI, commencing with early innovations such as the DARPA Net and the pioneering chatbot Eliza, which simulated therapeutic conversation. As the conversation unfolds, they elucidate the transformative journey of AI from rudimentary systems to contemporary models like IBM's Watson and emergent generative AI technologies. The dialogue is rich with insights on how these advancements not only augment human capabilities but also necessitate a reevaluation of cybersecurity protocols, particularly in the context of AI's dual potential for both beneficial applications and nefarious exploits. Through this enlightening exchange, the episode instills a nuanced understanding of the need for responsible AI usage, emphasizing the importance of training and ethical considerations in the burgeoning field of AI-driven technologies.

Takeaways:

• In this episode, we explore the evolution of AI technologies from early models like Eliza to modern systems such as Claude and ChatGPT, discussing their implications and societal impacts.
• The podcast emphasizes the importance of understanding the context in which AI operates, highlighting that these models do not possess true intelligence or decision-making capabilities.
• We address the urgency of educating users about responsible AI use, advocating for training requirements that ensure individuals comprehend the limitations and potential risks associated with these technologies.
• The discussion includes insights on the future of the workforce, particularly on how AI may transform job roles while also creating new opportunities for skilled professionals.
• We reflect on the historical significance of AI advancements, illustrating how past innovations inform our current understanding and utilization of machine learning algorithms.
• The episode concludes with a call to action for listeners to engage with AI thoughtfully, encouraging them to remain informed and proactive in adapting to the rapidly changing technological landscape.

In this episode, cybersecurity expert JC Vega shares insights on effective communication, leadership, and risk management in cybersecurity. He emphasizes the importance of translating technical concepts for business leaders, building trust, and fostering community to enhance organizational resilience.

keywords

cybersecurity, leadership, risk management, communication, trust, community, organizational resilience, cybersecurity education

keytopics

• Translating cybersecurity for non-technical audiences
• Building champions within organizations
• The importance of trust and verification in security
• Cybersecurity as an enterprise survival issue
• Leveraging AI and technology responsibly

sound bites

"Validate and verify, don't just trust."

"Train like it's a Super Bowl."

"Leave a link, build a community."

Chapters

00:00 Introduction to Cybersecurity Leadership

02:34 Translating Cybersecurity for Non-Technical Audiences

05:13 Building a Team of Champions

08:02 Understanding Business Impact and Risk

10:39 The Role of AI in Cybersecurity

12:58 Cybersecurity as an Enterprise Survival Problem

15:21 The Importance of Ecosystem Relationships

18:00 Trust and Zero Trust in Cybersecurity

20:28 Continuous Learning and Community Engagement

resources

Cyber Cannon Project - https://cybercannonproject.org/

B-Sides Conferences - https://www.bsidescon.org/

LinkedIn Profile of JC Vega - https://www.linkedin.com/in/jcvega/

Takeaways:

• The podcast emphasizes the necessity of translating complex cybersecurity concepts into practical business language for effective communication.
• I believe that strong relationships with champions within organizations are crucial for cybersecurity success and operational resilience.
• Our discussion highlights the importance of understanding the operational goals of various stakeholders to better address their cybersecurity needs.
• We advocate for the continuous evolution of skills and knowledge within the cybersecurity field through collaboration and community engagement.

In this special edition recorded live at RSA Conference, Joseph Carson is joined by Gerasimos Marketos (gmar), Chief Product Officer at Hack The Box.

They explore how AI is reshaping cybersecurity skills, why traditional education is struggling to keep up, and how hands-on platforms are redefining how defenders and ethical hackers are trained. From real-world fraud detection to AI-powered CTF competitions, this episode dives into the evolving relationship between humans and machines in cybersecurity.

🔑 Key Themes & Topics

• AI vs Humans in cybersecurity competitions
• Why AI is an accelerator, not a replacement
• The evolution from traditional training → hands-on gamified learning
• Closing the cybersecurity skills gap
• Red, Blue, and Purple team upskilling
• AI governance, risk, and agentic threats
• The future of cybersecurity careers and hiring

⏱️ Chapters

• 00:00 – Introduction & RSA Conference insights
• 02:00 – GMar’s journey: Data → Fraud → Cybersecurity
• 06:30 – Who and What is Hack The Box?
• 10:30 – AI vs Humans: CTF research findings
• 13:00 – AI as a productivity multiplier
• 15:30 – Real-world example: AI winning competitions
• 16:00 – RSAC trends: AI everywhere
• 17:00 – AI governance & emerging risks
• 18:00 – AI for security vs security for AI
• 19:00 – Staying relevant in cybersecurity

🚀 Hack The Box Explained

Hack The Box is a cybersecurity upskilling platform offering:

• 🎓 Academy – Structured learning paths
• 🧩 Challenges & Labs – Hands-on environments
• 🏁 CTFs (Capture The Flag) – Competitive exercises
• 🏢 Pro Labs – Enterprise-scale simulations
• 🔎 Talent Search – Connecting skilled professionals with employers

It supports:

• Red Teams (Offense)
• Blue Teams (Defense)
• Purple Teams (Collaboration)

Resources:

https://www.hackthebox.com/

https://www.linkedin.com/in/gmarketos/

https://www.hackthebox.com/ai-augmented-cyber-workforce-report

Takeaways:

• In our latest episode, we explored the symbiotic relationship between artificial intelligence and cybersecurity, highlighting their mutual dependence.
• The insights gathered from the RCC conference emphasize the necessity of integrating AI to enhance cybersecurity measures effectively.
• We discussed the evolution of Hack the Box, illustrating its transition from a challenge-based platform to a comprehensive cybersecurity training ecosystem.
• The significance of continuous learning in cybersecurity was underscored, particularly in light of rapidly advancing AI technologies and their implications.
• We examined the results of our recent CTF events, showcasing how AI agents can enhance human capabilities in cybersecurity tasks and competitions.
• Lastly, we asserted the importance of maintaining foundational skills in cybersecurity, even as AI tools become increasingly prevalent in the industry.

Links referenced in this episode:

• hackthebox.com

Companies mentioned in this episode:

• Segura
• Hack the Box

In this episode, Fernando Montenegro shares his journey into the cybersecurity industry, insights on industry analysis, and the evolving trends shaping cybersecurity today. Discover how analysts bridge the gap between vendors, buyers, investors, and academia, and learn practical tips for engaging effectively with industry experts.

key Takeaways

• Role of industry analysts in cybersecurity
• Emerging trends in cybersecurity including AI and attack surface expansion
• Effective engagement with analysts for decision support
• Strategic cybersecurity budgeting and investment
• Influence of economics and incentives on security decisions

sound bites

"Understanding what's going on in the world"

"Good enough security can be effective"

"Workload AI versus workforce AI"

Chapters

00:00 Introduction to Security by Default Podcast

00:53 Fernando Montenegro's Origin Story

05:16 The Role of an Industry Analyst

08:55 Maximizing Value from Analyst Interactions

13:16 Understanding AI in Conversations

15:44 Choosing the Right Solutions

16:40 Decision-Making in Technology and Business

17:13 Trends in Cybersecurity and AI

18:26 Understanding Workload vs. Workforce AI

19:40 The Evolving Role of Security Professionals

21:43 The Strategic Importance of Cybersecurity

23:58 Incentives and Decision-Making in Security

25:53 The Shift Left Approach in Development

27:16 Budgeting for Cybersecurity Investments

30:47 Navigating Cybersecurity Budgets

32:26 Engaging with Analysts and Staying Informed

34:33 Curating Information in a Data-Driven World

36:55 Balancing Operational and Strategic Insights

37:51 Connecting with Analysts and Final Thoughts

Resources

LinkedIn Profile of Fernando Montenegro - https://www.linkedin.com/in/fsmontenegro/

Futurum Group - https://futurumgroup.com/

Obsidian Knowledge Management System - https://obsidian.md/

Book: Why Most Security Budgets Go to Waste by Ross Young - https://a.co/d/02BZPwdO

In this thought-provoking episode, Fernando Montenegro imparts his extensive expertise on the best practices for analysts within the cybersecurity industry. He begins by delineating the multifaceted role of an analyst, which encompasses serving as a conduit for communication between buyers, sellers, investors, and other relevant stakeholders. By elucidating the distinct motivations and concerns of each group, Fernando illustrates how analysts can effectively tailor their insights and recommendations, thereby enhancing the decision-making process for all parties involved. The dialogue further explores the significance of maintaining an open-minded approach during analyst interactions, as well as the necessity for analysts to remain well-informed about emerging trends and challenges in the cybersecurity landscape. Fernando identifies several pivotal trends, including the integration of artificial intelligence, the expansion of the attack surface, and the transition towards a more resilient approach to data protection. Each of these trends reflects the evolving priorities of organizations as they seek to mitigate risks and enhance their security postures. Through this episode, listeners are not only provided with actionable insights into the workings of an industry analyst but are also encouraged to consider the broader implications of their roles in shaping cybersecurity strategies. As Fernando articulates, the responsibility of analysts extends beyond mere data analysis; they must also facilitate meaningful dialogue among stakeholders to drive informed decisions that bolster organizational security in an increasingly complex digital landscape.

Join cybersecurity expert Joseph Carson and guest Gary as they explore innovative ways to make cybersecurity engaging, fun, and accessible. Discover how humor, storytelling, and community involvement can transform the industry and attract new talent.

Chapters

00:00 Welcome to the Cybersecurity Chaos

02:32 From Fear to Fun in Cybersecurity

05:27 The Journey of a Cyber Advocate

08:09 The Importance of Community and Collaboration

10:45 Bringing Laughter Back to Cybersecurity

13:13 Rebranding Cybersecurity for New Talent

16:00 The Power of Words in Cybersecurity

18:43 Innovative Approaches to Cyber Awareness

21:29 Lessons from Kids: Simplifying Cybersecurity

24:39 The Inner Child and Cognitive Dissonance

26:40 Gamification and Learning Innovations

28:19 Storytelling in Cybersecurity

29:15 Cybersecurity Starts at Home

30:36 Community Engagement and Employee Connection

32:14 The Importance of Acknowledgment

34:13 Finding Joy in Everyday Life

35:11 Humor as a Coping Mechanism

40:04 The Power of Positive Thinking

45:02 Mission Accomplished: Fun and Safety

Resources

Cyber Heroes Comics - https://cyberheroescomics.com/

Gary's LinkedIn Profile - https://www.linkedin.com/in/gary-berman/

The discourse presented in this episode unveils the intricate relationship between cybersecurity and the often overwhelming sense of fear, uncertainty, and doubt (FUD) that pervades the industry. I, Joe Carson, alongside our distinguished guest Gary, delve into the necessity of transforming the cybersecurity narrative from one steeped in anxiety to a more palatable and enjoyable experience. Gary, who identifies himself as the 'Forrest Gump of cybersecurity,' shares his unique journey into this field, characterized by serendipitous encounters with influential figures and organizations. His advocacy for making cybersecurity engaging is pivotal; he emphasizes the importance of humor and creativity in addressing serious issues that often deter potential talent from entering the field. This conversation highlights the vital need to celebrate successes and communicate effectively, ensuring that cybersecurity is perceived not merely as a defensive measure but as an exciting and essential component of modern society. As our discussion unfolds, we explore the concept of gamification in cybersecurity training, an innovative approach aimed at enhancing engagement and retention of critical security practices. We reflect on the common tendency to focus predominantly on the negative aspects of cybersecurity incidents, neglecting the positive outcomes and triumphs that deserve recognition. By employing storytelling techniques and leveraging humor, we can reshape the perception of cybersecurity, making it accessible and relatable to a broader audience. The episode culminates in a call to action for industry professionals to foster a culture of positivity and collaboration, thereby transforming the cybersecurity landscape into one that is not only secure but also inviting and enjoyable for all. In conclusion, this episode serves as a clarion call for change within the cybersecurity domain. We advocate for the rebranding of cybersecurity from an intimidating realm to one that is engaging, fun, and inclusive. By embracing creativity and humor, we can attract new talent and invigorate the existing workforce, ensuring a robust defense against the ever-evolving landscape of cyber threats. Join us as we embark on this journey of transformation, aiming to illuminate the path ahead in the fascinating world of cybersecurity, where safety and enjoyment can coexist harmoniously.

Takeaways:

• The podcast emphasizes the necessity of transforming the often fear-driven narrative surrounding cybersecurity into something more engaging and enjoyable for audiences.
• Through humor and storytelling, we can effectively communicate complex cybersecurity concepts, making them accessible to a broader audience, including children and families.
• The discussion highlights the importance of celebrating successes within cybersecurity, as these achievements often go unrecognized, leading to a narrative dominated by fear and negativity.
• The idea of rebranding cybersecurity as a fun and engaging field is critical for attracting new talent, especially in an era where other industries appear more appealing and entertaining.

Join Joseph Carson in this insightful episode as he interviews cybersecurity expert Chris Kubecka. They discuss critical infrastructure security, cyber warfare, geopolitical risks, and the evolving landscape of digital threats, providing valuable lessons for cybersecurity professionals and policymakers.

Key Topics

Cybersecurity in critical infrastructure

Geopolitical cyber threats and hybrid warfare

Evolving landscape of digital threats and resilience

Sound bites

"GPS jamming has been a massive challenge."

"Digital Empires: China, Europe, and the US."

"Radio communications are a vital fallback."

Chapters

• 00:00 Introduction and Background of Chris Kubecka
• 01:37 Cybersecurity Challenges in Critical Infrastructure
• 03:37 Evolving Nature of Cyber Threats
• 05:45 The Role of Drones in Modern Warfare
• 07:25 Hybrid Warfare and Global Diplomacy
• 10:10 The Shift in Global Cybersecurity Dynamics
• 12:18 The Importance of International Cooperation
• 14:33 Privacy and Ethics in Cybersecurity
• 16:50 Historical Context and Regional Cooperation
• 18:55 Cyber Attacks on Civilian Infrastructure
• 22:04 Personal Experiences in Estonia
• 24:10 Geopolitical Tensions and Cybersecurity
• 25:52 Challenges in Maritime Connectivity
• 28:16 Critical Infrastructure Vulnerabilities
• 30:22 The Role of Radio in Authoritarian Regimes
• 33:43 International Maritime Law and Cybersecurity
• 37:46 Recent Projects and Activism in Cybersecurity
• 39:51 Staying Informed in a Rapidly Changing Landscape

Resources

Chris Kubecka's LinkedIn - https://www.linkedin.com/in/chriskubecka/

Field Tested: How to Hack a Modern Dictatorship with AI - https://www.amazon.com/dp/B0C7F4XYZ

In this episode of the Security by Default podcast, host Joe Carson speaks with Ian Austin, co-founder of Pwned Labs, about his journey in cybersecurity, the evolution of learning in the field, and the challenges of Cloud and AI security. Ian shares insights on transitioning into cybersecurity roles, the importance of community engagement, and the need for continuous learning in an ever-evolving industry. They discuss the significance of gamification in training and the current trends in cloud security, emphasizing the importance of hands-on experience and collaboration.

Key Takeaways

• Ian Austin is a co-founder of Pwned Labs, specializing in cloud and AI security training.
• His journey in cybersecurity began with help desk roles and evolved into penetration testing.
• Creating content is a great way to learn and contribute to the community.
• Cloud security presents unique challenges that require ongoing education and adaptation.
• Gamification in training enhances engagement but should not overshadow practical learning.
• Community involvement is crucial for personal and professional growth in cybersecurity.
• Transitioning into security roles can be done from various backgrounds, including sysadmin and help desk.
• Continuous learning is essential in the fast-paced cybersecurity landscape.
• Mentorship can significantly impact career development and confidence.
• Cloud security is a growing field with increasing demand for skilled professionals.

Chapters

00:00 Introduction to the Podcast and Guest

00:40 Ian Austin's Journey in Cybersecurity

06:40 Transitioning into Security Roles

10:54 Evolution of Learning in Cybersecurity

16:19 The Importance of Community in Learning

22:58 Challenges in Cloud Security

28:46 Staying Updated in the Cybersecurity Field

Resources:

https://pwnedlabs.io/

https://www.linkedin.com/in/ian-austin/

In this episode of the Security by Default podcast, host Joe Carson welcomes Evil Mog, an expert in password cracking and cybersecurity. They discuss the importance of Hacker Jeopardy in making cybersecurity fun, the ongoing challenges with passwords, and the evolving role of AI in password cracking. The conversation also touches on incident response, the significance of documentation, and the future trends in cybersecurity, including the shift towards passwordless authentication and the impact of AI on both attackers and defenders.

Takeaways

• Hacker Jeopardy is a fun way to engage with cybersecurity.
• Teaching others helps reinforce your own knowledge.
• Passwords will remain a necessary evil in security.
• AI is enhancing password cracking methodologies.
• Documentation is crucial in incident response.
• The cost of hacking is increasing due to advanced techniques.
• Collaboration between red and blue teams is essential.
• Insider threats are on the rise in cybersecurity.
• Password management is fundamentally an asset management issue.
• Future trends indicate a shift towards passwordless authentication.

Sound bites

"Teaching helps you learn better."

"Security is about enabling the business."

"The cost of hacking is rising."

Chapters

• 00:00 Introduction to Evil Mog and Hacker Jeopardy
• 02:37 The Importance of Community and Teaching in Cybersecurity
• 05:22 Password Security: The Louvre Incident
• 07:59 The Evolution of Authentication Methods
• 10:35 Challenges in Asset Management and Password Management
• 13:15 Operational Technology (OT) Security Challenges
• 15:53 The Role of Documentation in Cybersecurity
• 18:42 AI in Cybersecurity: Automation and Password Recovery
• 21:52 AI in Password Cracking
• 24:56 Enhancing Human Capabilities with AI
• 27:18 The Evolution of Cybercrime
• 30:02 Trends and Predictions for Cybersecurity
• 34:41 Collaboration in Cybersecurity
• 37:24 The Future of Cybercrime and AI
• 40:59 Connecting with Evil Mog

In a thought-provoking dialogue, Joe Carson and Evil Mog engage in a profound examination of cybersecurity, particularly focusing on the critical role of password management in contemporary security practices. Evil Mog, a distinguished executive managing hacker at IBM and a key participant in various hacking competitions, brings invaluable insights to the discussion, blending his extensive expertise with anecdotes from the vibrant DEFCON community. The conversation underscores the often-overlooked aspect of humor in cybersecurity, showcasing how events like Hacker Jeopardy can serve as both a source of entertainment and a platform for learning and community building. The hosts delve deeply into the pressing issues surrounding password security, using real-world examples to illustrate the dire consequences of poor password practices. They analyze incidents, including the infamous Louvre heist, where a lack of foresight in password management led to significant breaches. This discussion highlights the critical need for organizations to adopt stronger authentication methods, such as passkeys and multi-factor authentication, while acknowledging the challenges that traditional passwords continue to pose in everyday scenarios. Carson and Mog emphasize the importance of balancing security with usability to prevent users from resorting to insecure workarounds. Looking ahead, the conversation shifts toward the future of cybersecurity, with the hosts expressing hope for continued advancements in password management technologies. They advocate for a proactive approach in adapting to new threats, underscoring the necessity of community collaboration and knowledge sharing among cybersecurity professionals. The episode concludes with a resounding reminder of the importance of staying informed and engaged in an ever-evolving landscape of cybersecurity risks.

Takeaways:

• The podcast emphasizes the importance of community engagement in cybersecurity, advocating for teaching others to enhance personal understanding and benefiting the broader community.
• Evil Mogg discusses the evolution of password security, highlighting the ongoing necessity for shared secrets despite technological advancements in authentication methods.
• The conversation reveals a critical perspective on the complexities of cybersecurity, particularly how simplifying security for users can lead to better compliance and protection.
• Listeners are encouraged to actively participate in events like Hacker Jeopardy to foster a fun and interactive approach to cybersecurity education and awareness.

In this episode of the Security by Default podcast, host Joe Carson speaks with Charles Chase about his journey into the cybersecurity field, focusing on identity security and privilege access management. They discuss the evolving trends in identity security, the importance of maintaining identity hygiene, and the impact of regulations like NIST 2 and DORA on organizational practices. The conversation also covers the shift towards passwordless security, the role of AI in identity management, and resources for those looking to enter the field. The episode concludes with reflections on the importance of identities in business and society.

Takeaways

• Charles Chase fell into cybersecurity from a military background.
• The importance of understanding what you don't know in identity security.
• Organizations often have dormant accounts that pose security risks.
• Regulatory bodies are pushing organizations to improve their identity security practices.
• The shift towards passwordless security is gaining momentum.
• AI is becoming a valuable tool in identity management.
• Identity hygiene is crucial for reducing risks in organizations.
• The commoditization of identity solutions allows smaller businesses to implement security measures.
• Engaging with customers is key to understanding their unique identity security needs.
• The future of identity management is focused on user experience and automation.

Keywords

cybersecurity, identity security, privilege access management, trends, best practices, passwordless security, AI in identity management, regulatory impact, identity hygiene, resources for cybersecurity

The podcast commences with an engaging introduction by host Joe Carson, who expresses his enthusiasm for sharing insights and knowledge with the audience. He introduces his guest, Charles, who possesses an extensive background in identity security and privileged access management. Charles recounts his journey into the cybersecurity industry, highlighting his initial experiences in the U.S. Air Force as a network engineer and the serendipitous nature of his entry into the realm of privileged access management. The conversation swiftly transitions to the evolving landscape of identity security, where both speakers reflect on the advancements in tools and practices that have emerged over the years. They discuss the significance of understanding the regulatory landscape and the implications it has for organizations striving to enhance their security posture. Charles emphasizes the necessity for organizations to proactively address their security vulnerabilities and to adopt best practices that mitigate risks associated with identity and access management. He shares anecdotes from his experiences working with various clients, illustrating the startling discoveries often made when analyzing their systems, including the prevalence of dormant accounts and orphaned identities that pose significant security risks. As the dialogue progresses, the speakers delve into current trends in identity security, particularly the move towards passwordless authentication methods and the integration of multifactor authentication solutions. Charles elucidates how organizations are increasingly prioritizing the security of their identity frameworks to comply with regulatory demands while ensuring the integrity of their operations. He shares insights on the importance of continuous learning and adaptation in the field of cybersecurity, noting that each organization's journey is unique, and tailored approaches are essential to address specific challenges. The conversation culminates in a discussion on the future of identity management, where both speakers express optimism about the potential of emerging technologies and the need for organizations to remain vigilant in their security efforts. Ultimately, the episode underscores the critical role that effective identity management plays in safeguarding organizational assets and maintaining trust in today’s digital landscape.

Takeaways:

• The conversation highlighted the significant evolution in identity security practices over the years, emphasizing the necessity of adopting modern tools and strategies.
• A recurring theme was the critical importance of addressing dormant and orphaned accounts to enhance overall security posture within organizations.
• Regulatory pressures have escalated, compelling organizations to prioritize identity management and security protocols to mitigate risks effectively.
• The speakers discussed the growing trend towards passwordless authentication and the integration of biometric solutions in identity security frameworks.
• The episode underscored the necessity of maintaining a proactive identity hygiene program to prevent security vulnerabilities.
• The importance of continuous education and awareness for professionals entering the identity and access management field was a key discussion point.

In this episode of the Security by Default podcast, host Joseph Carson engages with the Grugq, a cybersecurity expert and PhD student, discussing his journey into the field, the evolution of cybersecurity practices, and the complexities of information warfare. The Grugq shares insights on anti-forensics, the importance of understanding human behavior in cybersecurity, and the current landscape of cyber warfare, particularly in the context of the ongoing conflict in Ukraine. The conversation highlights the challenges and changes in the cybersecurity field, emphasizing the need for clarity and understanding in a chaotic information environment.

Takeaways

• The Grugq's journey into cybersecurity began with a Unix book.
• He transitioned from internships to freelancing in cybersecurity.
• Moving to Thailand helped reduce living costs while consulting.
• Understanding anti-forensics is crucial for effective cybersecurity.
• The rules of cyber warfare differ significantly from peacetime operations.
• Information warfare involves changing how people interpret information.
• The Grugq emphasizes the importance of human behavior in cybersecurity.
• Staying updated in cybersecurity requires monitoring current events and engaging with experts.
• The evolution of cybersecurity tools has made it easier for new actors to operate.
• The Grugq's PhD research focuses on the realities of cyber warfare.

Additional Resources:

https://x.com/thegrugq

https://github.com/grugq

Engaging with the multifaceted realm of Open Source Intelligence (OSINT) and Cyber Operations, this podcast episode presents an erudite dialogue featuring The Grugq, an esteemed expert in the field. The conversation is initiated by the host, who invites The Grugq to share his origin story, tracing his journey through the labyrinthine world of cybersecurity, beginning from his formative experiences with UNIX systems. The Grugq elucidates how he transitioned from being an independent security researcher to an academic, currently pursuing a PhD focused on cyber warfare. This episode delves into the complexities of operational security, the principles underpinning successful cyber operations, and the significance of understanding human behavior in the cybersecurity domain. The discourse further explores the dynamic interplay between OSINT and cyber operations, emphasizing the critical importance of meticulous analysis and strategic deception in contemporary cyber warfare. The Grugq articulates the evolving nature of threats in this space, and how adversaries utilize increasingly sophisticated techniques to obfuscate their activities. Throughout the episode, listeners are afforded a unique glimpse into the methodologies that underpin effective cyber operations, highlighting the necessity of adapting to the ever-shifting landscape of cybersecurity. Amidst the complexities of the cyber domain, The Grugq offers profound insights into the ethical implications of cyber operations, urging practitioners to consider the broader ramifications of their actions. This episode serves not only as a repository of knowledge but also as a call to action for cybersecurity professionals to reflect on the ethical dimensions of their work. By the conclusion, listeners are left with a rich understanding of the intersection of OSINT and cyber operations, equipped with the knowledge to navigate the tumultuous waters of the cybersecurity landscape with greater acumen and awareness.

Takeaways:

• The Grugq emphasizes the importance of understanding the principles of operational security and their historical context in the realm of cyber warfare.
• In the discussion, we explore the evolution of cyber operations, highlighting how the dynamics of war have shifted the focus from stealth to achieving mission objectives.
• A key takeaway is the recognition that modern cyber actors often utilize pre-existing techniques rather than creating new ones, complicating attribution efforts in cyber incidents.
• The podcast delves into the significance of information warfare, stressing that the ability to manipulate perceptions is as crucial as the actual data being presented.
• The Grugq shares insights on how the principles of access, humanity, and economy underpin successful cyber operations, framing them within the context of both offense and defense.
• We discuss the blurred lines in modern cyber conflicts, where traditional rules of engagement may not apply, particularly in ongoing large-scale cyber warfare scenarios.

In this episode of the Security by Default podcast, host Joseph Carson interviews Joe Sullivan, a prominent figure in cybersecurity. They discuss Joe's journey from a federal prosecutor to the Chief Security Officer at Facebook, exploring the challenges and expectations in transitioning from government to private sector roles. The conversation delves into the evolving landscape of cybersecurity, the impact of ransomware, and the importance of crisis management and preparedness. Joe shares valuable lessons for aspiring security executives and highlights the significance of understanding technology in leadership roles. The episode concludes with Joe's current projects, including his nonprofit initiative, Ukraine Friends, which provides laptops to children affected by the war in Ukraine.

Takeaways

• Security is possible for everyone.
• Joe Sullivan's journey reflects a unique path into cybersecurity.
• Transitioning from government to private sector presents challenges.
• Understanding corporate culture is crucial for success.
• Measuring success in cybersecurity requires clear metrics.
• Ransomware has fundamentally changed the cybersecurity landscape.
• Security leaders are increasingly reporting to CEOs.
• Crisis management is essential for organizational resilience.
• Aspiring security executives should focus on business understanding.
• Giving back to the community is a vital part of the cybersecurity profession.

Sound bites

• "Security is possible for everyone."
• "I got an MBA through osmosis."
• "The expectations were so high."

Chapters

• 00:00 Introduction to Security by Default Podcast
• 01:02 Joe Sullivan's Journey into Cybersecurity
• 05:10 Transition from Government to Private Sector
• 11:06 Navigating the Corporate Landscape
• 15:48 Measuring Success in Security
• 20:04 The Impact of Ransomware on Cybersecurity
• 28:01 The Evolving Role of Security Leaders
• 30:57 Understanding Business Strategy in Security
• 32:59 Risk Management and Business Partnership
• 33:52 Navigating Technology Risks
• 35:54 The Race for AI Innovation
• 38:03 Crisis Management and Preparedness
• 39:59 Building Resilience in Security Teams
• 42:16 The Importance of Response Training
• 44:10 Lessons from Emergency Services
• 47:41 Community Impact through Technology

Additional Resources:

https://www.joesullivansecurity.com/about

https://ukrainefriends.org/

https://www.linkedin.com/in/joesu11ivan/

https://en.wikipedia.org/wiki/Joe_Sullivan_(cybersecurity)

The discourse presented in this episode of the Security By Default podcast delves into the intricacies of cybersecurity through a rich narrative framed by the experiences of Joe Sullivan, a distinguished figure in the cybersecurity landscape. The conversation commences with a reflection on the current state of security in a world rife with chaos and challenges, emphasizing the necessity for clarity and preparedness in addressing security concerns. Sullivan recounts his unique journey into the realm of cybersecurity, marked by an initial aspiration to pursue law, which ultimately led him to blend his legal expertise with a burgeoning interest in technology. This intersection of law and technology is pivotal in understanding the evolution of cybersecurity practices, as Sullivan highlights the early days of his career at the Department of Justice, where he was thrust into the intricate dynamics of cybercrime prosecution. His narrative underscores the significant shifts in the cybersecurity landscape, illustrating how the role of cybersecurity professionals has evolved into one that requires not only technical prowess but also a profound understanding of business operations and risk management. As the discussion unfolds, listeners are introduced to the concept of operational resilience, a theme underscored by Sullivan's experiences at major corporations such as eBay, PayPal, and Facebook. He elucidates the necessity for security leaders to transition from a purely defensive posture to one that encompasses proactive crisis management and resilience building. Sullivan’s observations regarding the expectations placed upon security professionals in the private sector contrast sharply with his experiences in government service, where the pace and metrics of success differ markedly. This dichotomy serves to illuminate the complexities faced by modern security executives who must navigate not only the technical challenges of cybersecurity but also the imperative to align their strategies with broader business objectives. In conclusion, the episode encapsulates the essence of security as a multifaceted discipline that extends beyond mere technical solutions. Sullivan advocates for a paradigm shift in how organizations perceive and invest in security, urging a balanced allocation of resources towards both prevention and crisis preparedness. His insights serve as a clarion call for security professionals to engage more deeply with the business side of their organizations, fostering a culture where security is seen as an integral component of operational success rather than a mere compliance obligation. The conversation ultimately reinforces the notion that in the face of evolving threats, a proactive and well-prepared security posture is paramount for organizational resilience and success in an increasingly digital world.

In this episode of the Security by Default podcast, host Joseph Carson welcomes Ian Murphy, a cybersecurity expert and stand-up comedian. They discuss Ian's unconventional journey into cybersecurity, his experiences at the MOD and Symantec, and his transition to self-employment and comedy. Ian shares insights on the importance of storytelling in both cybersecurity awareness and comedy, as well as navigating online criticism and audience interactions. The conversation highlights the need for humor in serious industries and the value of real human connections.

Takeaways

• Ian's journey into cybersecurity was unplanned and unconventional.
• The importance of storytelling in both cybersecurity and comedy.
• Self-employment offers freedom but comes with challenges.
• Humor can be a powerful tool in serious industries.
• Navigating online criticism requires thick skin and perspective.
• Comedy is subjective, and not everyone will appreciate it.
• Real human interactions are essential in today's digital age.
• Learning from experiences is crucial for growth in any field.
• Networking and peer relationships are vital for success.
• Life is better when you find joy and laughter in everyday situations.

Sound bites

"I wanted to be a footballer."

"Comedy is subjective."

"You need to grow the fuck up."

Chapters

• 00:00 Introduction to the Podcast and Guest
• 00:56 Ian's Origin Story and Journey into Cybersecurity
• 06:29 Experiences at MOD and Symantec
• 10:44 Transitioning to Self-Employment and Freedom
• 14:27 The Switch to Stand-Up Comedy
• 22:05 The Impact of Humor in Cybersecurity Awareness
• 30:06 Audience Feedback and Social Media Interaction
• 31:54 The Power of Audience Engagement
• 34:49 Navigating Controversy in Comedy
• 37:43 The Art of Timing and Response
• 40:47 Comedy as a Reflection of Life
• 43:44 The Evolution of Comedy and Storytelling
• 49:53 Learning and Growth Through Comedy
• 53:50 Connecting with the Audience

Takeaways:

• The podcast emphasizes the importance of maintaining joy and humor in the cybersecurity field despite its often serious nature.
• We explored how humor can be a powerful tool in security awareness, making the subject more engaging for audiences.
• Ian shared his remarkable journey from mechanic to cybersecurity expert, illustrating the value of diverse experiences in shaping one’s career.
• The discussion highlighted the challenges of transitioning from corporate environments to freelance work, emphasizing the freedom and responsibility it entails.
• Both speakers reflected on the necessity of fostering human connections in the tech world, counteracting the isolation often felt in digital spheres.
• The podcast concluded with a call to action for listeners to embrace humor and creativity in their professional lives, enhancing both workplace culture and personal fulfillment.

In this episode of the Security by Default podcast, host Joe Carson engages with cybersecurity expert Alissa Knight, who shares her unique journey into the world of hacking and cybersecurity. They discuss the evolution of hacking, the challenges of API security, and the transformative impact of AI on the industry. Alissa emphasizes the importance of continuous learning and adapting to new technologies, while also reflecting on her career shifts and the significance of storytelling in cybersecurity marketing. The conversation highlights the need for organizations to invest in their employees' education and the future of cybersecurity innovation.

Takeaways

• Alissa started hacking at the age of 13, driven by curiosity.
• The early days of hacking were like the wild west, with fewer resources.
• A significant turning point in Alissa's life was her arrest at 17.
• Cybersecurity offers lucrative career opportunities for skilled individuals.
• API security is a growing concern as more services rely on APIs.
• AI is reshaping the cybersecurity landscape, creating new challenges and opportunities.
• Continuous learning is essential in the fast-evolving field of cybersecurity.
• Organizations must invest in training their developers in secure coding practices.
• Storytelling can be a powerful tool in cybersecurity marketing.
• The future of cybersecurity will heavily involve AI and automation.

Sound bites

"It was the wild, wild west."

"I was arrested on my school campus."

"This industry pays very well."

Chapters

• 00:00 Introduction to the Podcast and Guest
• 00:57 Alissa Knight's Unique Origin Story
• 05:30 The Evolution of Hacking and Cybersecurity
• 10:54 Turning Points and Career Shifts
• 16:10 The Impact of DDoS Attacks on Career Paths
• 20:57 The Importance of API Security
• 24:06 Hacking APIs and Security Vulnerabilities
• 27:52 The Evolution of AI in Coding
• 31:30 From Cybersecurity to Hollywood
• 36:32 Introducing ARIES: AI for Cybersecurity
• 39:03 The Importance of Continuous Learning in Cybersecurity

Resources

https://www.linkedin.com/in/alissaknight/

https://www.knightgroup.co/

https://microreels.com/

https://www.youtube.com/@AlissaKnightArchives

The Security By Default podcast presents an engaging dialogue between Joe Carson and Alissa Knight, a seasoned cybersecurity expert with a rich and unique background in hacking and security. Alissa recounts her journey into the cyber realm, beginning at the tender age of thirteen when her curiosity led her to explore the inner workings of technology. Her early experiences with bulletin board systems (BBS) and the hacking community shaped her understanding of cybersecurity, illustrating the evolution from the rudimentary practices of the past to the sophisticated techniques employed today. Alissa reflects on her misadventures, including a pivotal incident that resulted in her arrest at seventeen, which ultimately redirected her path towards a career in cybersecurity. This incident, rather than being a mere setback, served as a catalyst for her transformation, providing her with insights into the resilience required in the face of adversity. Throughout the discussion, Alissa emphasizes the importance of continuous learning and adaptation in the ever-evolving field of cybersecurity. She highlights the shift in focus towards API security and the challenges posed by artificial intelligence in code development. The conversation delves into the significance of secure coding practices and the necessity for organizations to invest in the education of their developers. Alissa's insights illuminate the critical nature of understanding the vulnerabilities that arise in modern applications and the imperative for cybersecurity professionals to stay abreast of these developments. The episode encapsulates a narrative of growth, resilience, and the pursuit of knowledge, encouraging listeners to embrace their journeys and strive for continuous improvement in the cybersecurity domain.

In this episode of the Security by Default podcast, Joseph Carson engages with David Muniz to explore the evolving landscape of cybersecurity. They discuss the importance of diversity in the field, the distinction between customer success and support, and the critical role of trust in business relationships. The conversation also delves into the Zero Trust paradigm, emphasizing the need for a human-centric approach in cybersecurity. David shares insights on staying updated in a rapidly changing industry and the significance of happiness in the workplace, concluding with thoughts on the human element in cybersecurity.

Keywords

cybersecurity, customer success, zero trust, trust in business, diversity in tech, human relationships, customer support, industry insights, happiness in work, staying updated

Takeaways

· Customer success focuses on long-term relationships, not just immediate problem-solving.

· Trust is a key component in building successful customer relationships.

· Zero Trust is about managing trust dynamically, not eliminating it.

· Customer success involves understanding what success means to the customer.

· Building trust requires consistent and reliable service.

· Human interactions are crucial in customer success, even in a digital world.

· Customer success can lead to increased revenue through renewals and up-selling.

· Trust in cybersecurity involves both technical and human elements.

· Effective customer success strategies can differentiate a company in the market.

· Balancing security with user experience is essential for customer satisfaction.

Sound bites

· "Customer success is about long-term relationships."

· "Trust is not just assumed; it must be earned."

· "Zero Trust is about managing trust, not eliminating it."

· "Success is defined by the customer's perspective."

· "Human interactions are crucial in a digital world."

· "Trust leads to increased revenue and loyalty."

· "Cybersecurity involves both technical and human elements."

· "Balancing security with user experience is key."

· "Customer success can differentiate a company."

· "Trust is a business differentiator."

Chapters

00:00 Introduction to Cybersecurity and Guest Background

04:10 The Importance of Diversity in Cybersecurity

08:41 Understanding Customer Success vs. Customer Support

12:52 Building Trust in Customer Relationships

17:15 The Role of Zero Trust in Cybersecurity

22:07 Understanding Zero Trust and Its Implications

27:33 The Dynamic Nature of Trust in Cybersecurity

32:01 The Human Element in Building Trust

Additional Resources

The Trust Paradox: A Cybersecurity Mindset for Human Relationships

https://www.linkedin.com/pulse/trust-paradox-cybersecurity-mindset-human-david-muniz-f9fzf

The Hidden ROI of Trust in Business and Cybersecurity

https://www.linkedin.com/pulse/hidden-roi-trust-business-cybersecurity-david-muniz-7r3jc

https://segura.security/

https://segura.security/blog

https://en.wikipedia.org/wiki/The_Power_of_Now

The podcast episode delves into the intricate subject of cybersecurity, emphasizing the necessity for clarity amidst the chaos that often accompanies it. The host, Joseph, expresses his enthusiasm for engaging with industry luminaries and cultivating thought-provoking discussions that aim to enhance the safety and security of organizations and individuals alike. Joseph is joined by David Muniz, a seasoned professional with a diverse background in computer science, project management, and cybersecurity. David recounts his unconventional journey into the field, highlighting how his academic pursuits led him to realize his passion for addressing issues related to fraud detection and risk management. The conversation gradually transitions to the importance of customer success within the realm of cybersecurity. David delineates the distinction between customer support and customer success, asserting that the latter is focused on understanding the customer's definition of success and facilitating their achievement of it. This involves a long-term commitment to building relationships and trust, as well as comprehending the various business objectives that drive customers to adopt cybersecurity solutions. The podcast underscores the need for a shift in perspective, viewing cybersecurity not merely as a technical challenge but as a fundamental business issue that necessitates the involvement of diverse stakeholders across an organization. Throughout the episode, a recurring theme emerges: the emphasis on trust as a cornerstone of effective cybersecurity practices. Both speakers advocate for a change in hiring practices, proposing that organizations should prioritize passion and willingness to learn over rigid certification requirements. As the discussion unfolds, the duo reflects on the evolving landscape of cybersecurity, addressing the concept of zero trust and the importance of a dynamic approach to risk management. They conclude by reiterating that the epitome of customer success is rooted in the cultivation of genuine relationships, where trust and open communication play pivotal roles, ultimately enabling organizations to navigate the complexities of cybersecurity with greater efficacy.

In this episode of Security by Default, host Joe Carson sits down with Michael Waite from Dune Security to explore how AI is reshaping cybersecurity and why it’s time to rethink traditional awareness training.

As cyber threats become more sophisticated, personalized, and AI-powered, organizations can no longer rely on outdated, one-size-fits-all learning models. Joe and Michael break down what modern cybersecurity training should look like, how to engage employees more effectively, and why empowering people both inside and outside the office is essential to strong defense.

What You’ll Learn

• How AI is transforming both cyber attacks and defensive strategies
• Why the volume and quality of phishing attempts continue to rise
• The limitations of traditional annual awareness training
• The shift toward personalized, role-based learning
• How real-time intervention improves security habits
• Why cybersecurity awareness must extend beyond the workplace
• Practical ways to engage employees and build a security-first culture
• The importance of collaboration and communication across teams
• How threat intelligence informs more effective training programs

Key Takeaways

• AI is rewriting the threat landscape.
• Attackers are faster, more convincing, and more scalable than ever.
• Generic awareness training is no longer enough.
• Personalization is essential to reducing real-world risk.
• Engagement drives stronger security culture and better outcomes.
• Cybersecurity begins at home, not just at work.
• Bite-sized, real-time lessons are more effective than long annual videos.
• Employees are part of the detection engine—and must be empowered accordingly.

Memorable Quotes

• “Cybersecurity doesn’t start in the office.”
• “The one size fits all approach is dead.”
• “We need to democratize security.”
• “Let’s give individuals the tools they need.”
• “We need to make cybersecurity more fun.”
• “This is my favorite thing to talk about.”

Episode Chapters

00:00 – Introduction to the Chaos of Cybersecurity

03:05 – The Impact of AI on Cybersecurity

09:40 – Best Practices for Cybersecurity Awareness

18:51 – Personalizing Cybersecurity Training

27:00 – Engaging Employees in Cybersecurity

29:20 – Resources for Further Learning

Additional Resources:

https://www.linkedin.com/in/mr-michael-waite/

https://www.dune.security/

https://www.dune.security/threat-intelligence-report

The dialogue commences with a cordial greeting, establishing a warm rapport between the host, Joe Carson, and his guest, Michael Waite. The podcast elucidates the dynamic and tumultuous landscape of cybersecurity, accentuating the incessant evolution of technological advancements and the corresponding threats that arise therein. Joe articulates a desire to dispel the chaos that often pervades the security realm, striving instead to illuminate the positive strides being made to foster a safer digital environment. Michael subsequently shares his professional journey, revealing a notable transition from a decade-long consultancy with Accenture to a foray into the cybersecurity sector. This pivot was serendipitously catalyzed by a chance encounter during a flight, wherein a conversation with a fellow passenger sparked the inception of his entrepreneurial aspirations in security.

In this episode of the Security by Default podcast, Joseph Carson and guest Satu Korhonen a passionate practitioner, researcher and founder of Helheim Labs delve into the intersection of AI and cybersecurity. They discuss the challenges and opportunities in creating trustworthy AI systems, the importance of collaboration between AI and cybersecurity professionals, and the role of regulation in ensuring AI safety. Satu shares her journey from education to AI, highlighting key moments and insights from her career. The conversation also touches on the EU AI Act, the importance of understanding AI's limitations, and the need for a balanced approach to AI development.

Key Takeaways

• AI systems are fundamentally probability-based, not perfect.
• Collaboration between AI and cybersecurity is crucial for safety.
• The EU AI Act focuses on human rights and risk management.
• Understanding AI's limitations is key to using it effectively.
• AI can enhance productivity but requires careful implementation.
• Training AI with both good and bad data improves its robustness.
• AI should serve humans, not the other way around.
• Hacking AI can reveal vulnerabilities and improve security.
• Community events like hacker camps foster innovation and learning.
• AI's role in society should be carefully considered and discussed.

Chapters

00:00:00 Introduction to AI and Cybersecurity

00:03:00 Satu's Journey into AI

00:09:00 Trustworthy AI and the EU AI Act

00:15:00 Challenges in AI and Cybersecurity Collaboration

00:21:00 The Role of Community and Events in AI

Resources:

https://hackai.quest/

https://helheimlabs.ai/

https://helheimlabs.ai/about-satu-korhonen/

https://www.linkedin.com/in/satu-m-korhonen/

https://why2025.org/

https://www.ccc.de/en/home

https://events.ccc.de/en/

https://disobey.fi/2026/

In a riveting dialogue with cybersecurity expert Satu Korhonen, we embark on a comprehensive exploration of the intricate dynamics between artificial intelligence and security vulnerabilities. Korhonen, whose journey into the cybersecurity realm was catalyzed by the surge of AI technologies around 2016, delves into the ethical challenges and potential risks posed by these advancements. She emphasizes the necessity of integrating security practices early in the AI development process, highlighting the perilous consequences of neglecting this crucial aspect. The conversation elucidates how AI systems, often perceived as independent entities, are inextricably linked to cybersecurity protocols. Korhonen shares her insights on fostering collaboration between AI developers and cybersecurity professionals, advocating for a unified approach to mitigate risks and enhance system reliability. As we dissect the role of frameworks like the EU's AI Act, the dialogue crystallizes around the importance of human rights considerations in AI deployment, urging the need for regulatory measures that prioritize ethical standards and accountability.

In this episode of the Security by Default podcast, host Joe Carson welcomes back Filipi Pires, Head of Identity Threat Labs & Global Product Advocate at Segura® to discuss the latest trends in identity threats and cybersecurity. They explore the evolution of attacks, particularly focusing on social engineering and the role of AI in both offensive and defensive strategies. Filipi shares insights from recent events, including the significance of BSides conferences in fostering community and knowledge sharing. The conversation emphasizes the importance of a zero trust approach and the need for continuous education in cybersecurity.

Key Takeaways

• The BSides community is essential for cybersecurity education.
• Attackers are increasingly using social engineering techniques.
• AI is being leveraged by both attackers and defenders.
• Zero trust is a critical framework for modern security.
• Organizations must implement multiple layers of protection.
• Credential theft is a major concern in identity threats.
• B-Sides events provide networking opportunities for newcomers.
• Cybersecurity Awareness Month is a time for reflection and improvement.
• The rise of AI in social engineering poses new challenges.
• Community-driven events like B-Sides foster collaboration and learning.

Chapters

• 00:00 Introduction to Security by Default Podcast
• 01:59 Understanding BSides Events
• 05:57 Current Trends in Identity Threats
• 11:50 The Evolution of Authentication Methods
• 14:57 The Rise of InfoStealer Malware
• 18:52 AI's Role in Cybersecurity Threats
• 21:13 AI in Cybersecurity: Defensive and Offensive Perspectives
• 24:36 The Role of APIs and Observers in Cybersecurity
• 26:06 Best Practices for Securing AI in Organizations
• 31:04 BSides Porto: Community and Event Insights
• 39:06 Future BSides: Expanding to Porto Alegre

Resources:

https://www.linkedin.com/in/filipipires/

https://segura.security/

https://www.instagram.com/filipipires.sec/

https://segura.security/events/filipi-pires

https://www.linkedin.com/showcase/identity-threat-labs/about/

https://labs.segura.blog/

About Segura®

Segura® is an Identity Security Platform built to help organizations secure privileged access, detect identity threats, and respond rapidly to attacks targeting human and machine identities.

Designed for hybrid and high-risk environments, Segura delivers identity threat detection and response (ITDR), secure remote access, and privileged session protection — ensuring that only verified users, devices, and applications can access critical systems.

From infrastructure and servers to cloud platforms and the supply chain, Segura provides unified visibility and control across every identity interaction. By combining advanced analytics, behavioural detection, and Zero Trust access principles, Segura empowers companies to prevent credential misuse, lateral movement, and privilege escalation before damage occurs.

In this episode of the Security by Default podcast, host Joe Carson engages with Pamela Victor Ibitamuno, a lawyer with a unique background in penetration testing. They discuss the critical intersection of cyber law and cybersecurity, exploring the challenges faced in prosecuting cyber crimes, the importance of understanding intent, and the need for adaptive legal frameworks in the face of rapid technological advancements. The conversation also delves into the role of AI in the legal field and how professionals can stay updated in this ever-evolving landscape.

Takeaways

• Pamela's journey from penetration testing to cyber law highlights the importance of understanding both fields.
• Legal professionals often struggle to grasp the technicalities of cybersecurity.
• Regulations may not effectively address the problems they aim to solve.
• Cyber crime often transcends borders, complicating prosecution efforts.
• Partnerships between tech companies and governments can enhance cyber crime prevention.
• Misconceptions about hacking can hinder legal processes.
• Intent is a crucial factor in determining the legality of cyber actions.
• The law is lagging behind technological innovations, necessitating updates.
• AI can streamline legal processes but cannot replace human empathy.
• Staying informed through conferences and subscriptions is vital for legal professionals.

Chapters

• 00:00 Introduction to Cyber Law and Its Importance
• 02:57 Pamela's Journey: From Penetration Testing to Cyber Law
• 06:08 The Intersection of Law and Cybersecurity
• 08:50 Challenges in Cyber Crime Prosecution
• 12:04 The Role of Intent in Cyber Crime
• 14:58 The Need for Adaptive Legal Frameworks
• 17:50 AI's Impact on Cyber Law
• 20:53 Staying Updated in Cyber Law
• 23:59 Conclusion and Future Outlook

The exploration of cyber law within the context of cybersecurity unfolds through a compelling dialogue between myself, Joe Carson, and Pamela Victor Ibitamuno, a legal expert whose background in penetration testing profoundly informs her perspective. Pamela recounts the genesis of her interest in cyber law, rooted in her experiences as a victim of cybercrime, which ignited her curiosity about the methodologies employed by cybercriminals. This personal narrative sets the stage for a broader examination of the systemic challenges that legal professionals encounter when attempting to navigate the complexities of cyber law. We delve into the critical interplay between legal frameworks and the rapidly evolving landscape of technology, emphasizing the necessity for laws that are not only reflective of current threats but also adaptable to future innovations. A salient point of our discussion revolves around the urgency of establishing cohesive regulatory measures that adequately address the dynamic nature of cyber threats. Pamela articulates the difficulties that arise when legal statutes lag behind technological advancements, particularly in the realm of international cybercrime. The conversation highlights the imperative for legal practitioners to possess a comprehensive understanding of the technical intricacies involved in cybersecurity to ensure effective prosecution and enforcement of laws. Furthermore, we explore the challenges of jurisdictional discrepancies that complicate the investigation and prosecution of cybercriminals, underscoring the need for enhanced international cooperation and standardized protocols to combat these global offenses. As we traverse the complexities of cyber law, we also consider the potential implications of artificial intelligence on legal practices. While acknowledging the advantages of employing AI to streamline legal processes, we emphasize the irreplaceable role of human judgment and empathy in delivering personalized legal counsel. The episode culminates in a thoughtful reflection on the future of cyber law, advocating for a legal system that evolves dynamically in response to technological advancements, thereby fostering a secure and just digital environment. This discussion illuminates the critical need for ongoing collaboration between cybersecurity experts and legal authorities to effectively address the multifaceted challenges posed by cybercrime.

In this episode of the Security by Default podcast, host Joe Carson engages with game designer Peadar, Gamification Lecturer at Tallinn University to explore the intersection of game design and cybersecurity training. Peadar shares his journey from teaching to game design, emphasizing the importance of using games to facilitate learning in complex subjects like cybersecurity. The conversation delves into the fundamental elements of games, the challenges of creating effective training games, and the need for conceptual transfer games that bridge the gap between technical and non-technical audiences. Peadar also discusses the future of cybersecurity training, the significance of soft skills, and the different player types in game design. The episode concludes with recommended resources for those interested in game design and cybersecurity.

Peadar Callaghan, Gamification Lecturer at Tallinn University, Digital Learning Games Lab, Digital Technologies Institute, Tallinn University.

Lecturer in Gamification, Learning Game Design, and Fundamentals of Game Design in the Digital Learning Games Master's program.

Key Takeaways

• Games can help people understand complex subjects.
• Cybersecurity is a business problem, not just an IT problem.
• Effective training requires engaging and simple game mechanics.
• Checkbox training is ineffective for real learning.
• Conceptual transfer games are essential for non-technical audiences.
• The average age of gamers is increasing, indicating a shift in demographics.
• Soft skills are crucial for effective communication in cybersecurity.
• Games can create a safe space for learning from failure.
• Understanding player types can enhance game design for training.
• The future of cybersecurity training lies in small-scale, experiential games.

Chapters

• 00:00 Introduction to Cybersecurity and Game Design
• 02:45 The Role of Games in Learning and Cybersecurity
• 05:52 Fundamental Elements of Game Design
• 09:00 Applying Game Mechanics to Cybersecurity Training
• 11:46 Challenges in Cybersecurity Training Games
• 14:38 Conceptual Transfer Games for Non-Technical Audiences
• 17:44 The Future of Cybersecurity Training
• 20:52 Understanding Player Types in Game Design
• 23:47 The Importance of Soft Skills in Cybersecurity
• 26:28 Recommended Resources for Game Design and Cybersecurity
• 29:24 Conclusion and Future Directions

Resources:

https://www.linkedin.com/in/peadar-callaghan-a218721a/

https://www.linkedin.com/school/tallinn-university/

https://www.tlu.ee/

Book - Reality Is Broken: Why Games Make Us Better and How They Can Change the World - https://a.co/d/hzvwYtf

Book - Game Design Workshop: A Playcentric Approach to Creating Innovative Games by Tracey Fullerton- https://a.co/d/5jnbDg6

The discourse encapsulated within the latest installment of the Security By Default podcast illuminates the intersection of gaming and cybersecurity, as host Joe Carson engages in a profound dialogue with Peadar, a distinguished game designer whose journey from education to cybersecurity amalgamates two seemingly disparate realms into a cohesive narrative. Peadar's evolution into the cybersecurity domain stems from his profound interest in how games facilitate learning and comprehension of complex topics, specifically within the cybersecurity landscape. Their conversation traverses the pivotal role of communication between technical experts and non-technical stakeholders, emphasizing the necessity for a shared lexicon that bridges the gap between these divergent groups. Peadar elucidates his belief that security has transcended its traditional confines as merely an IT concern, asserting its emergence as a fundamental business issue that necessitates collective understanding and collaboration across organizational hierarchies. Furthermore, the discussion delves into the fundamental components of game design, wherein Peadar asserts that a game is defined by its objectives, rules, feedback systems, and voluntary participation. He critiques the prevalent practices within cybersecurity training, advocating for the incorporation of engaging and accessible game mechanics that foster genuine understanding and behavioral change rather than rote memorization. Through the lens of his doctoral research, Peadar advocates for the development of conceptual transfer games that align technical knowledge with business implications, elucidating the significance of understanding the repercussions of cybersecurity threats on organizational operations. This episode lays bare the transformative potential of integrating game mechanics into training methodologies, positing that such an approach not only enhances engagement but also facilitates a deeper grasp of cybersecurity's critical nature. The conversation further unfolds as Peadar discusses various game dynamics and their implications for cybersecurity training. He critiques the tendency for training games to become overly complex, thereby hindering their effectiveness in engaging learners. By drawing on the principles of successful game design, Peadar emphasizes the need for simplicity and clarity, allowing participants to focus on the learning objectives without being overwhelmed by convoluted mechanics. He shares his perspective on the importance of experiential learning through games, advocating for smaller-scale games that serve as effective icebreakers, fostering receptiveness to deeper educational content. This notion resonates throughout the dialogue, highlighting the necessity for organizations to adopt a more nuanced and thoughtful approach to training that transcends traditional methodologies. In summation, this episode serves as a clarion call for the cybersecurity domain to embrace innovative pedagogical strategies through the lens of game design. By recognizing the multifaceted nature of cybersecurity as both a technical and business challenge, practitioners can cultivate an environment where learning is not merely a checkbox exercise but a dynamic, engaging experience that empowers individuals across all levels of an organization. Peadar's insights challenge the status quo, urging a reimagining of how we approach training and education within the cybersecurity landscape, making a compelling case for the integration of gaming principles to foster greater understanding and collaboration in an increasingly complex digital world.

In this episode of the Security by Default podcast, host Joe Carson interviews Christian Herrmann, also known as Iceman, who shares his journey into the world of RFID hacking. The conversation covers Christian's origin story, his passion for technology, and the challenges he faced while learning and developing his skills. They discuss the importance of community engagement, open-source contributions, and the evolution of hacking tools like Proxmark. The episode also touches on risk management in cybersecurity, the ethical implications of hacking tools, and the significance of finding balance in personal and professional life. Christian emphasizes the value of asking for help and surrounding oneself with supportive individuals in the tech community.

Takeaways

• Christian Herrmann, known as Iceman, shares his journey into RFID hacking.
• He emphasizes the importance of community engagement and open-source contributions.
• The evolution of Proxmark has significantly impacted the RFID hacking community.
• Tools used in hacking can have ethical implications that need to be considered.
• Risk management is a crucial aspect of cybersecurity and hacking.
• Finding balance between personal life and professional commitments is essential.
• Asking for help and engaging with the community can accelerate learning.
• Surrounding oneself with supportive individuals enhances personal growth.
• The importance of continuous learning and adapting in the tech field.
• Gamification can be an effective way to improve hacking skills.

Chapters

• 00:00 Introduction and Guest Background
• 01:23 The Journey into Hacking and RFID
• 09:23 The Thrill of Hacking and Career Development
• 20:03 Open Source Contributions and Community Engagement
• 30:54 Navigating Tools and Legal Considerations in Hacking
• 36:03 Conference Experiences and Community Engagement
• 42:00 Tools and Their Misinterpretations
• 44:25 Risk Management in Technology
• 46:06 Current Projects and Future Plans
• 49:40 The Importance of Hobbies and Balance
• 55:33 Learning from Failures and Community Support
• 01:02:22 The Value of Networking and Collaboration

Takeaways:

• The Proxmark 3 is an essential tool for anyone interested in RFID hacking, as it allows users to interact with various RFID card systems and understand their vulnerabilities.
• Christian Herman, also known as Iceman, shares his journey from personal challenges to becoming a prominent figure in the RFID hacking community, emphasizing the importance of resilience and curiosity in learning.
• The open-source nature of Proxmark 3 has fostered a collaborative environment where individuals can contribute to the tool's development, leading to more effective RFID hacking methods.
• Iceman discusses the significance of embracing failure and asking questions in the learning process, highlighting that persistence and community support are crucial for success in technical fields.
• The podcast emphasizes the need for ethical considerations and responsible use of hacking tools, as they can be misinterpreted and labeled as burglar tools depending on the user's intent.
• Listeners are encouraged to engage with the community through platforms like Discord, where they can seek assistance and share knowledge with others involved in RFID hacking.

Companies mentioned in this episode:

• Proxmark 3
• DEFCON
• bsides Talent
• Raspberry PI
• Dark Matter
• Flipper
• Chameleon

In this episode, Joe Carson speaks with George Kamide about the evolving landscape of cybersecurity, emphasizing the importance of community building, branding, and effective communication. They discuss how cybersecurity is no longer just an IT issue but a societal one, and how understanding user experience is crucial for success. The conversation also highlights the role of podcasts in educating the cybersecurity community and the challenges of building meaningful connections in a digital world.

Takeaways

• Cybersecurity is a societal problem, not just an IT issue.
• Branding is essential for standing out in a crowded market.
• Understanding user experience is critical for product success.
• Podcasts can provide valuable education and insights in cybersecurity.
• Building communities takes time and effort without immediate ROI.
• Effective communication is key to conveying value propositions.
• Listening to customers is more important than broadcasting solutions.
• Time is the most valuable resource we have.
• Engagement on social media should be curated and positive.
• Building relationships requires giving before asking.

Chapters

00:00 Introduction to Cybersecurity and Community Building

02:25 The Importance of Branding in Cybersecurity

08:54 User Experience and Customer Understanding

19:36 The Role of Podcasts in Cybersecurity Education

22:42 Building Communities and Navigating Social Media

The discourse presented within this podcast episode encompasses a profound exploration of the evolving landscape of cybersecurity and the critical importance of community building within this domain. The dialogue initiates with the host, Joe Carson, articulating his enthusiasm for engaging with leading figures in cybersecurity, wherein he aims to disseminate invaluable insights and best practices aimed at augmenting individual and organizational success in the field. The guest speaker, George, who boasts extensive experience in the cybersecurity sector, elucidates his unconventional journey into the industry, which was catalyzed by a background in anthropology and marketing, ultimately leading to his current role as the head of community at the CISO Society. This narrative serves as a testament to the multifaceted nature of cybersecurity, illustrating that it transcends traditional IT confines and necessitates a broader societal perspective. A salient theme that emerges throughout the dialogue is the imperative of effective communication in fostering robust cybersecurity communities. Both Carson and George emphasize the necessity of understanding the audience's needs and perspectives, underscoring that the success of any cybersecurity initiative hinges upon the establishment of meaningful connections and a dialogue rooted in mutual understanding and collaboration. George articulates the dangers of adopting a one-sided communication approach, which often leads to a disconnect between providers and practitioners. Instead, he advocates for a listening-first strategy that prioritizes the cultivation of relationships, ensuring that the communication is not merely a broadcast of solutions, but a collaborative dialogue aimed at addressing real-world challenges faced by practitioners. Furthermore, the episode delves into branding within the cybersecurity space, positing that brand identity is not merely a superficial concern but a fundamental element that influences perception and engagement. George provides insightful perspectives on how brands can differentiate themselves in a crowded market through authenticity and a clear articulation of their value propositions. By leveraging storytelling and a deep understanding of the audience's pain points, brands can foster trust and credibility, which are paramount in a sector often plagued by skepticism. The episode ultimately culminates in a call to action for listeners to engage in proactive community building and to embrace a mindset centered on empathy, collaboration, and continuous learning as they navigate the complexities of cybersecurity.

#Cybersecurity #MarketingChallenges #Podcast

Takeaways

• Zaira Pirzada's journey into cybersecurity was unintentional but evolved into a passion.
• Open source intelligence (OSINT) played a crucial role in Zaira's early career.
• Listening and learning from others is vital in the cybersecurity industry.
• The transition from analyst to CMO involves understanding market dynamics and customer needs.
• Unique value propositions are essential for startups to stand out in a crowded market.
• Data is a key asset in cybersecurity, influencing decision-making and strategy.
• Building trust and reliability is crucial in cybersecurity communications.
• Negotiation in cybersecurity is evolving with the introduction of AI and data valuation.
• Education and knowledge sharing are fundamental to success in the cybersecurity community.
• Continuous learning is necessary to keep up with the fast-paced changes in the industry.

The discourse presented in this podcast episode is a profound examination of the multifaceted nature of cybersecurity, featuring an engaging dialogue between the host, Joe Carson, and his esteemed guest, Zara Pirzada, the managing partner of Infinitus Management Consulting. The conversation commences with an exploration of Zara's unconventional journey into the cybersecurity domain, which was catalyzed by her academic pursuits in security policy and civil affairs. This formative background has endowed her with a unique perspective on the intersection of military and civilian dynamics in cybersecurity, particularly as it pertains to the emerging threats posed by asymmetric warfare in the digital realm. Zara elaborates on her transition from studying militant non-state actors to delving into the intricacies of governance, risk, and compliance (GRC), a field she notes serves as a pivotal entry point for many aspiring cybersecurity professionals. As the dialogue progresses, the hosts delve into the critical role of effective communication within the cybersecurity landscape, emphasizing the imperative for professionals to cultivate a shared understanding across diverse roles. This theme is further elaborated upon through the discussion of the evolving nature of cyber threats and the necessity for holistic security practices that transcend traditional silos. The conversation also touches upon the challenges associated with keeping pace with rapid technological advancements and the implications for organizational security posture. The episode culminates in a reflection on the significance of mentorship and knowledge sharing within the cybersecurity community, highlighting the collective responsibility of seasoned professionals to educate and empower the next generation of experts. Throughout the discussion, Zara's insights resonate with the audience, underscoring the importance of adaptability, collaboration, and continuous learning in navigating the complex cybersecurity landscape.

In this episode of the Security by Default podcast, host Joe Carson speaks with Secretary Harry Coker Jr. about his journey into cybersecurity, the importance of mentorship, and the challenges faced in leadership roles. They discuss the evolving role of AI in government and cybersecurity, the significance of resilience in the face of failures, and personal interests that help them unplug from their busy lives. The conversation emphasizes the need for clarity in chaos and the importance of learning from every experience.

Takeaways

• Bringing clarity to chaos is essential for success.
• Mentorship plays a crucial role in career development.
• Every day in leadership presents new challenges and opportunities.
• Learning from both successes and failures is vital.
• Trust but verify is a key principle in leadership.
• AI is transforming government operations and cybersecurity.
• Cyber resilience is becoming more important than ever.
• Personal interests help leaders to unplug and recharge.
• Success is often shared, while failure is solitary.
• The human element must remain in AI decision-making.

Chapters

00:00 Introduction to Cybersecurity and Personal Journeys

06:05 The Importance of Mentorship and Teamwork

11:48 A Day in the Life of a Cybersecurity Leader

17:51 Lessons Learned from Challenges and Failures

21:53 The Impact of AI on Cybersecurity and Governance

29:42 Personal Interests and Unplugging from Work

Resources

The following books and resources were mentioned:

1. "Character" by retired U.S. Army General Stan McChrystal - Harry Coker mentioned he started reading this book and found it insightful, particularly about self-awareness and challenging oneself.
2. "The Power of Now" - Joseph Carson mentioned this book as one he was recommended to read and was working towards.

The podcast episode features a compelling conversation between Joe Carson and Harry Coker Jr., focusing on the dynamic and often chaotic world of cybersecurity. Coker, who has a rich background in the field, articulates the importance of perceiving chaos as an opportunity for growth and innovation rather than a mere obstacle. He recounts his personal journey, which began in an era when technology was not as prevalent, and shares how his educational pursuits led him to a successful career in cybersecurity. This narrative emphasizes the significance of adaptability and the willingness to embrace change amidst rapid technological advancements. As the dialogue unfolds, Coker highlights the necessity for organizations to cultivate cyber resilience, advocating for a proactive approach that not only seeks to prevent breaches but also prepares for effective recovery from incidents. He stresses that in an age where cyber threats are pervasive, developing a resilient infrastructure is essential for safeguarding critical information. The discussion also delves into the role of mentorship and the importance of learning from both successes and failures in the cybersecurity landscape, illustrating how collaborative efforts can strengthen the industry's overall resilience. Towards the conclusion of the episode, the conversation shifts to the implications of artificial intelligence in government and society. Coker discusses the potential benefits and challenges associated with AI, urging for a balanced approach that maintains human oversight in decision-making processes. This multifaceted discussion illuminates the complexities of navigating cybersecurity in the modern era, providing listeners with valuable insights into the evolving landscape and the critical role of leadership, mentorship, and ethical considerations in shaping the future of the industry.

Takeaways:

• The podcast emphasizes the necessity of bringing clarity to chaos within cybersecurity, which is essential for making informed decisions.
• Harry Coker Jr. reflects on his unexpected journey into cybersecurity, highlighting the importance of mentorship and adaptability.
• The conversation addresses the critical role of cyber resilience, advocating for the understanding that compromises will occur, thus necessitating recovery strategies.
• The discussion reveals the growing influence of artificial intelligence on government operations, underscoring the need for ethical considerations in its deployment.
• There is a focus on the significance of accountability and leadership in the face of challenges and failures within the cybersecurity field.
• The dialogue concludes by reiterating the mission of making security accessible to all, reinforcing the belief that cybersecurity should not be a privilege of the few.

In this special edition episode of the Security by Default podcast, Mikko discusses his extensive career in cybersecurity, his transition to a new role in drone defense, and the innovative Museum of Malware that showcases the intersection of art and cybersecurity. He reflects on his journey, memorable experiences, and the importance of storytelling in engaging audiences

Takeaways

• Mikko's alternative career choice was journalism.
• He started in programming and transitioned to cybersecurity.
• Keynote speaking at Black Hat involves storytelling.
• Experience reduces anxiety in public speaking.
• The Omega virus was Mikko's first memorable malware.
• The Museum of Malware archives the history of cyber threats.
• The museum features art inspired by malware and cyberattacks.
• Mikko is transitioning to a drone defense company.
• He sees parallels between cybersecurity and drone defense.
• Mikko expresses gratitude for his 34 years in the cybersecurity industry.

Resources:

https://www.withsecure.com/en/experiences/museum-of-malware-art

In this episode of the Security by Default podcast, Joseph Carson and Evandro Goncalves discuss the critical topic of machine identities also known as non-human identities (NHI), exploring their definitions, challenges, and best practices for management. They delve into the complexities of managing non-human identities in cybersecurity, emphasizing the importance of visibility, risk management, and the principle of least privilege.

The conversation also highlights experiences from the NATO Lock Shield event, showcasing the real-world implications of identity security. Evandro shares insights on staying updated in the cybersecurity field and the importance of hands-on learning.

Takeaways

• The podcast aims to make security accessible to everyone.
• Machine identities are non-interactive identities used in IT environments.
• Organizations may have up to 80 machine identities for every human identity.
• Visibility and management of machine identities are significant challenges.
• Over-privileged accounts are a common issue in organizations.
• Applying the principle of least privilege is crucial for security.
• Communication and coordination are vital during cybersecurity events.
• Hands-on experience and laboratories are effective for learning new technologies.
• Staying updated with threat reports is essential for cybersecurity professionals.
• Networking through platforms like LinkedIn is beneficial for knowledge sharing.

Keywords

machine identities, cybersecurity, identity security,

non-human identities, security management, best practices, NATO Lock Shield,

visibility, risk management, zero trust

The dialogue presented in this episode transcends a mere discussion; it represents a comprehensive inquiry into the multifaceted nature of machine identities, as articulated by the esteemed Evandro Goncalves of Aseguru. The conversation meticulously unravels the intricate tapestry of machine identities, often referred to as non-human identities, emphasizing their pivotal role within the contemporary IT ecosystem. Evandro posits that the ratio of machine identities to human identities can reach an astonishing 80 to 1, a statistic that underscores the pressing need for organizations to develop robust strategies for managing these identities effectively. As the discourse unfolds, the speakers delve into the inherent risks associated with machine identities, highlighting the rapid operational pace at which these identities function, often rendering traditional security measures insufficient. The dialogue further explores the criticality of visibility in identity management, as Evandro advocates for the establishment of comprehensive monitoring solutions that can provide organizations with insights into their machine identity landscape. He discusses the transition from conventional password management techniques to more advanced methodologies, such as the implementation of ephemeral accounts and just-in-time access strategies. This transformative approach not only enhances security but also aligns with the operational intricacies of modern IT environments, wherein machine identities operate without human intervention. Additionally, the conversation touches upon the principle of least privilege, urging organizations to reassess their access control measures to prevent the common pitfalls of privilege abuse that can compromise security integrity. In conclusion, the episode serves as a vital resource for security professionals, offering a wealth of knowledge and practical insights into the evolving domain of machine identities. Evandro Goncalves’s expertise, coupled with the engaging dialogue, equips listeners with the necessary understanding to navigate the complexities of identity management in an increasingly digital world. This episode is not merely an exposition of the challenges; it is a clarion call for organizations to adopt proactive measures in safeguarding their digital assets against the myriad threats posed by the contemporary cyber landscape.

Takeaways:

• Evandro Goncalves elaborated on the evolving landscape of machine identities, emphasizing their significance in modern IT environments.
• The discussion highlighted that organizations may have up to 80 machine identities for each human identity, illustrating the complexity of identity management.
• Goncalves stressed the importance of visibility and accountability in managing machine identities to mitigate security risks effectively.
• One key takeaway was the necessity of adhering to the principle of least privilege to prevent over-privileged machine identities from becoming security liabilities.

In this episode of the Security by Default podcast, host Joe Carson interviews Hieu Minh Ngo, a former cyber-criminal turned cybersecurity advocate. Hieu shares his journey from a curious teenager in Vietnam to a successful hacker, his time in prison, and his eventual redemption as he now works to help others avoid the pitfalls he faced. He discusses the importance of honesty, mentorship, and using one's skills for good, emphasizing the need for awareness in cybersecurity and the potential for change in the lives of young hackers.

Takeaways

• Hieu Minh Ngo transitioned from a cyber-criminal to a cybersecurity advocate.
• His journey began with curiosity about computers and the internet.
• He faced severe consequences for his hacking activities, including imprisonment.
• Prison became a time for self-reflection and personal growth for Hieu.
• He emphasizes the importance of being honest with oneself.
• After prison, he was recruited by the Vietnamese government for cybersecurity work.
• Hieu now mentor’s young hackers to use their skills for good.
• He believes in the power of community and positive influences.
• Hieu encourages young hackers to participate in bug bounty programs.
• He stresses that good things will happen when you do the right thing.

Chapters

• 00:00 Introduction to Cybercrime and Transformation
• 11:56 The Journey from Hacking to Cybersecurity
• 23:48 The Dark Web and Identity Theft
• 29:46 Finding Purpose in Prison
• 31:41 The Journey to Redemption
• 35:59 Consequences and Redemption
• 37:27 Life After Prison: A New Beginning
• 42:31 Using Skills for Good
• 49:23 Awards and Recognition
• 51:22 Future Aspirations and Mentorship

The dialogue unfolds with an engaging introduction from the host, Joe Carson, who expresses his excitement about welcoming Hieu Minh Ngo, a guest with a compelling narrative. Hieu, a former cybercriminal turned cybercrime investigator, recounts his remarkable journey that began during his adolescence in Vietnam. His early curiosity about computers and the Internet led him down a dark path where he engaged in illegal activities on the dark web. He shares vivid memories of his past, including the thrill of hacking and the eventual consequences that landed him in prison for nearly seven years. Through introspective reflections, Hieu emphasizes the importance of honesty to oneself, a lesson he learned during his incarceration. Hieu's transformation is marked by his commitment to using his skills for good, as he now works with the Vietnamese government and engages in community outreach to educate others on cybersecurity. His story serves as a powerful reminder of the potential for redemption and the significance of guiding the next generation of hackers toward positive uses of their talents.

Takeaways:

• Hieu Minh Ngo's transformation from a cybercriminal to a cybersecurity investigator exemplifies the profound impact of personal change.
• The importance of fostering curiosity and learning in young hackers to guide their skills towards constructive paths.
• Engagement in bug bounty programs is essential for aspiring hackers to develop their skills ethically and effectively.
• The collaboration between former cybercriminals and law enforcement can significantly enhance crime prevention strategies.
• The role of community support in rehabilitation and personal growth is vital for individuals with troubled pasts.
• Raising awareness about cybersecurity can drastically reduce the incidence of cybercrime in society.

Takeaways

• Identity is a central theme in cybersecurity.
• Misconfiguration is a leading cause of security issues.
• Continuous learning is essential in the cybersecurity field.
• Tools should be used to understand techniques, not just for their own sake.
• Community engagement is vital for knowledge sharing.
• Phishing remains a simple yet effective attack method.
• Legacy software poses significant risks to organizations.
• Observability is crucial for effective security management.
• Respecting the journey in cybersecurity is important for growth.

Chapters

• 00:00 Introduction to Cybersecurity Journey
• 02:49 Exploring Cybersecurity Research and Trends
• 05:32 Tools and Techniques in Cybersecurity Research
• 08:34 Learning Through Capture The Flag Events
• 11:28 Identity Threats and Misconfigurations
• 14:16 Legacy Systems and Their Impact on Security
• 25:40 Understanding Use Cases in Security Permissions
• 27:36 The Principle of Least Privilege
• 29:31 The Complexity of Identity Management
• 30:28 Challenges in Observability and Access Control
• 32:16 Navigating Multi-Cloud Permissions
• 34:07 Tools for Enhancing Security Visibility
• 36:14 Continuous Learning in Cybersecurity
• 41:53 Community Engagement and Knowledge Sharing
• 45:32 Respecting the Journey in Cybersecurity

Companies mentioned in this episode:

• Segura
• Trend Micro
• Black Hat
• Defcon
• BSIDES
• AWS
• GCP
• Azure
• CrowdStrike

In this episode of the Security by Default podcast, host Joe Carson welcomes back cybersecurity expert Carlos Polop. They discuss Carlos's journey into the cybersecurity field, the creation and impact of HackTricks, and the role of AI in cybersecurity. Carlos shares insights on using large language models for hacking, the future of AI, and upcoming training courses.

The conversation emphasizes the importance of ethical hacking and the need for continuous learning in the rapidly evolving tech landscape.

Key Takeaways

• HackTricks was created as a personal resource for learning and sharing knowledge.
• The community has greatly benefited from HackTricks in their learning journeys.
• AI is revolutionizing the field of cybersecurity and coding.
• Large language models can assist in finding vulnerabilities and automating tasks.
• It's important to ask the right questions when using AI tools.
• Carlos is developing new training courses focused on cloud security and privilege escalation.
• Hacktricks AI is designed to help users with specific cybersecurity queries.
• The future of AI in cybersecurity is promising but requires ethical considerations.
• Continuous learning and adaptation are crucial in the cybersecurity field.

Chapters:

• 00:00 Introduction to Cybersecurity and Hacktricks
• 02:54 The Journey into Hacking and OSCP
• 05:54 The Impact of Hacktricks on the Community
• 08:58 Recent Projects and Innovations in Cybersecurity
• 12:00 The Role of AI in Cybersecurity
• 14:57 Automating Code Creation with AI
• 18:01 Future of Hacktricks and Upcoming Courses
• 20:53 Final Thoughts on AI and Cybersecurity

Resources:

https://book.hacktricks.wiki/en/index.html

https://training.hacktricks.xyz/

https://www.hacktricks.ai/

https://github.com/peass-ng/PEASS-ng

Links referenced in this episode:

• hacktricks.xyz
• hacktricks.ai

In this conversation, Joseph Carson and Martin Sandren delve into the evolving landscape of Identity Governance and Access Management (IGA). They discuss the significance of IGA in modern organizations, the challenges faced, and the impact of cloud solutions and AI on identity management. The conversation highlights the need for contextual and adaptive policies, the importance of interoperability, and the role of community engagement through conferences to stay updated in this rapidly changing field.

Key Takeaways

• IGA is essential for managing access and compliance in organizations.
• The shift to cloud-based IGA solutions has transformed the landscape.
• Contextual and adaptive policies are becoming the norm in identity management.
• AI is playing a crucial role in enhancing identity governance.
• Interoperability between systems is a significant challenge.
• Phishing attacks are increasingly sophisticated due to AI advancements.
• Zero trust principles emphasize reducing friction in access management.
• Shadow IT and shadow AI pose risks to organizational security.
• The signal-to-noise ratio in ITDR systems is a major concern.
• Engagement in conferences and communities is vital for professional growth in IGA.

Chapters

• 00:00 Introduction to Identity Governance and Administration
• 01:43 Understanding IGA vs. IAM
• 04:02 Challenges and Shortcomings of IGA
• 10:05 The Role of IGA in Modern Organizations
• 17:20 Modernizing IGA: Cloud Solutions and Innovations
• 19:07 The Acceleration of Cloud Adoption
• 21:01 Evolving Identity Management Landscape
• 22:53 AI's Role in Identity Governance
• 24:41 Managing Non-Human Identities
• 26:05 The Rise of Shadow IT and AI
• 28:37 Future of AI in Identity Management
• 30:35 Staying Updated in a Rapidly Changing Field

Resources:

Join an IdentiBeer meetup near you

https://identi.beer/

The exploration of Identity Governance and Administration (IGA) within this podcast episode reveals its paramount significance in the landscape of Identity and Access Management (IAM). The discussion is anchored by host Joe Carson, who introduces his guest Martin, a seasoned expert in the field, with a professional history that spans nearly 25 years. Martin's journey, which began as a computer lab administrator, culminates in his current role at IKEA, where he leads initiatives related to identity and access, thus providing a rich contextual foundation for the conversation. As the dialogue unfolds, Martin elucidates the distinctions between IGA and IAM, framing IGA as an essential framework for managing user identities and access rights in large organizations. He recounts the historical context of IGA's emergence, particularly its role in sectors requiring efficient user provisioning, such as hospitality and retail. The conversation further delves into the complexities introduced by modern technological advancements, such as cloud computing and the rise of remote work, necessitating a reevaluation of traditional IGA practices to enhance compliance and security. Martin emphasizes the critical importance of automation in IGA processes, which not only streamline operations but also mitigate risks associated with user access management. The latter portions of the episode engage in a critical analysis of the challenges organizations face today in implementing effective IGA strategies. Martin and Joe discuss the implications of emerging technologies, particularly artificial intelligence, in reshaping IGA practices by enabling adaptive policy frameworks that respond to the dynamic nature of user access. The conversation culminates in a forward-looking vision for IGA, advocating for a transition towards more context-aware and flexible governance structures. By the conclusion of the episode, listeners are left with a profound understanding of the vital role IGA plays in ensuring organizational integrity and security in an ever-evolving digital landscape.

Takeaways:

• The podcast emphasizes the importance of understanding the differences between Identity Governance Administration (IGA) and Identity and Access Management (IAM) in modern security frameworks.
• Listeners are encouraged to recognize the evolution of identity management systems towards more cloud-based solutions that enhance efficiency and adaptability for organizations.
• The discussion highlights the critical role of compliance and regulatory frameworks, such as GDPR, in shaping the landscape of identity management and security protocols.
• Both speakers reflect on the growing challenges posed by remote work and the necessity of adapting security measures to protect against evolving threats and vulnerabilities.
• The conversation underscores the significance of integrating artificial intelligence into identity management processes to streamline operations and improve security measures.
• Lastly, the podcast advocates for a balanced approach between productivity and security to minimize friction while ensuring robust access control within organizations.

In this episode, Joe Carson interviews Joe Grand, a renowned hardware hacker and educator. They discuss Joe Grand's journey into hacking, the importance of community and collaboration in the field, and the evolution of technology and security challenges over the years. Joe shares his early experiences with computers, his transition from engineering to hardware hacking, and the pivotal role of the Loft in shaping his career. The conversation also touches on the founding of @Stake (ATstake, Inc.) and the challenges of balancing passion with corporate expectations in the cybersecurity industry.

In this conversation, Joe Grand discusses his journey in the hacking community, including his experiences designing badges for Defcon, the importance of artistic engineering, and the impact of live hacking events. He shares insights on parenting in the digital age, the significance of legacy software security, and the challenges of vendor communication. Joe also highlights his current projects, the learning process through failure, and resources for aspiring hackers, culminating in a discussion about his involvement in a film related to cryptocurrency.

Takeaways

• Community and collaboration are vital in the hacking world.
• Hacking is a continuous learning process; you never know everything.
• Early experiences with computers often start with games and curiosity.
• The Loft provided a transformative experience for Joe Grand.
• Transitioning from engineering to hacking can be a natural progression.
• AtStake was a significant step in Joe's career, merging hacking with business.
• Finding purpose in teaching others about hardware hacking is fulfilling.
• The importance of viewing security from an adversarial perspective.
• Hacking and engineering can complement each other in unique ways. Joe Grand returned to design the Defcon badge after years away.
• He emphasizes the blend of art and engineering in hacking.
• Live events showcase the real-time problem-solving process in hacking.
• Parenting involves guiding children through the digital landscape.
• Not all hacks need to be groundbreaking to be significant.
• Legacy software security remains a critical issue.
• Effective communication between vendors and hackers is essential.
• Current projects focus on refining fault injection techniques.
• Learning through failure is a vital part of the hacking process.
• Documentation is crucial for replicating and building on work.

Chapters

• 00:00 Introduction to the Podcast and Guest
• 01:43 The Journey of a Hardware Hacker
• 05:16 The Importance of Community in Hacking
• 09:50 Early Experiences and Hacker Origins
• 14:41 Transitioning from Engineering to Hardware Hacking
• 18:16 The Loft: A Transformational Experience
• 23:51 From Passion to Career: The AtStake Journey
• 30:56 Finding Purpose in Teaching and Hacking
• 33:21 Reviving the Defcon Badge Design
• 34:47 Exploring Artistic Engineering in Hacking
• 35:44 The Impact of Live Hacking Events
• 37:33 Parenting in the Digital Age
• 39:28 Lessons from Hacking Time
• 42:48 The Importance of Legacy Software Security
• 46:37 Vendor Communication and Security
• 48:58 Current Projects and Future Directions
• 51:51 Learning Through Failure
• 54:54 Resources for Aspiring Hackers
• 58:56 The Intersection of Hacking and Film

Additional Resources:

https://grandideastudio.com/

https://www.youtube.com/watch?v=o5IySpAkThg

https://www.imdb.com/title/tt27307826/

The latest episode features an in-depth conversation with Joe Grand, a prominent figure in the realm of hardware hacking. Grand, who is affectionately known in the community as 'kingpin', shares his extensive journey from a curious young hacker to a seasoned professional dedicated to teaching and inspiring others in the field. The discussion is rich with insights about the evolution of hacking culture, the significance of community engagement at conferences, and the intrinsic motivations that fuel a hacker's passion for exploration and innovation. Throughout the dialogue, Grand emphasizes the importance of continuous learning and adaptation in a rapidly changing technological landscape, noting that the challenges faced by hackers today echo those from decades past. This episode serves as a testament to the resilience of the hacker community and the collaborative spirit that drives individuals to share knowledge and skills, ultimately fostering a safer digital environment for all.

Takeaways:

• The podcast explores the journeys of individuals in the hardware hacking community, emphasizing the importance of sharing knowledge and experiences.
• Listeners are encouraged to attend conferences and engage with fellow hackers to enhance their learning and stay inspired.
• The discussion highlights the significance of community support in overcoming challenges encountered in the hacking and engineering fields.
• Throughout the episode, the speakers reflect on the evolution of technology and the recurring security issues that arise with new innovations.

In this episode of the Security by Default podcast, host Joseph Carson speaks with cybersecurity expert Terence Jackson about the evolving landscape of cybersecurity, the challenges faced by CISOs, and the importance of data security and governance. They discuss the impact of AI on security practices, the role of the CISO as a risk manager, and the need for organizations to prioritize foundational security measures in a rapidly changing technological environment.

In this conversation, Terence Jackson and Joseph discuss the evolving landscape of cybersecurity, emphasizing the importance of asset management, the role of AI in business intelligence, and the need for a balance between security and user experience. They explore the future of CISOs in a world increasingly governed by digital intelligence and the necessity of continuous learning and community engagement in the cybersecurity field.

Key Takeaways

• The cybersecurity landscape is constantly evolving, with new challenges emerging.
• AI is transforming both the attack and defense sides of cybersecurity.
• Data security remains a critical concern for organizations.
• CISOs are increasingly seen as risk managers rather than just security officers.
• Governance and compliance are essential for effective data management.
• Organizations must prioritize identity and access management.
• The role of the CISO has become more strategic and board-level.
• Understanding data exposure risks is crucial for compliance.
• Foundational security practices are necessary for effective defense.
• Continuous learning and adaptation are vital in the fast-paced tech world. AI will play a crucial role in enhancing business intelligence.
• Effective asset management is foundational for organizational security.
• Zero trust must be balanced with zero friction for user experience.
• Creating a positive security culture is essential for engagement.
• CISOs will increasingly focus on data governance and business risks.
• The proliferation of AI agents presents new security challenges.
• Security should be integrated seamlessly into user workflows.
• Continuous learning is vital in the rapidly changing cybersecurity landscape.
• Community engagement fosters knowledge sharing and support.
• Focusing on the basics is key to effective cybersecurity.

Chapters

• 00:00 Introduction to Cybersecurity Journeys
• 02:17 Challenges in Cybersecurity Today
• 06:43 The Evolving Role of the CISO
• 11:06 Governance, Compliance, and Data Security
• 14:56 Prioritizing Security in a Fast-Paced World
• 19:39 The Role of AI in Business Intelligence
• 20:02 Importance of Asset Management
• 21:52 Zero Trust and Zero Friction Security
• 23:38 Creating a Positive Security Culture
• 24:27 The Future of CISOs and Digital Intelligence
• 29:32 Continuous Learning and Community Engagement

Additional Resources:

Connect with Terence: https://www.linkedin.com/in/terencejackson/

https://www.terencedjackson.com/

The podcast episode presents a profound and enlightening dialogue between two seasoned professionals in the realm of cybersecurity, highlighting the evolving role of Chief Information Security Officers (CISOs) in today's digital landscape. The conversation commences with an introduction to Terence, a veteran in the cybersecurity industry, whose extensive experience spans over two decades. He provides a candid glimpse into his early fascination with technology, tracing it back to his first computer, the Commodore 64, and his subsequent academic pursuits in information systems. This personal narrative seamlessly transitions into a professional discourse on the pressing challenges that CISOs face in the contemporary landscape, particularly in light of the rapid advancements in artificial intelligence (AI). The discussion delves into the critical importance of identity and access management, data security, and the perennial struggle of organizations to maintain robust cybersecurity postures amidst a backdrop of increasing threats such as ransomware. Terence articulates how the current AI transformation has not only intensified existing security challenges but has also underscored the necessity for organizations to adopt a forward-thinking approach to their cybersecurity strategies. Moreover, the dialogue shifts to address the integration of AI within cybersecurity frameworks, emphasizing the need for CISOs to leverage AI as both a defensive tool and a potential adversarial threat. The speakers explore the nuances of deploying AI responsibly while ensuring that ethical considerations and governance frameworks are firmly in place. The conversation culminates in a reflection on the fundamental principles that underpin effective cybersecurity practices, advocating for a return to the basics as a means of fortifying organizations against emerging threats. Ultimately, the episode serves as a clarion call for CISOs to embrace a mindset of continuous learning and adaptation, recognizing that the landscape of cybersecurity is inextricably linked to the broader context of societal safety and organizational resilience.

Takeaways:

• The ongoing transformation in AI has exacerbated long-standing issues related to identity and access management.
• CISOs are increasingly being viewed as enterprise risk managers rather than merely IT security officials.
• The evolution of digital agents necessitates robust governance to mitigate associated risks effectively.
• Data security remains a paramount concern, particularly in light of AI's impact on access to sensitive information.
• A focus on foundational cybersecurity principles is essential for developing effective defense strategies.
• The integration of security within organizational workflows must balance robust protections with user experience to avoid friction.