DrZeroTrust

In this conversation, Dr. Chase Cunningham and Eric Krohn discuss the evolving landscape of cybersecurity, particularly focusing on the impact of AI and Zero Trust principles. They explore the challenges small and medium businesses face in adopting new technologies, the importance of risk management, and the need for a collaborative approach between technology and business strategies. The discussion also touches on the recent funding trends in cybersecurity startups and the role of AI in enhancing security measures while addressing the human element in cybersecurity practices.TakeawaysThe AI boom is reshaping the cybersecurity landscape.Zero Trust is becoming a standard practice in security.Risk management strategies must evolve with technology.AI can enhance cybersecurity but requires careful implementation.Small and medium businesses face unique challenges in cybersecurity.Funding for cybersecurity startups is on the rise.Collaboration between tech and business is essential for success.AI can help simplify complex cybersecurity processes.Understanding the human element is crucial in cybersecurity.The future of cybersecurity will be driven by innovation and adaptability.

How does a company deal with AI sprawl? What is the "oh shit" moment when an enterprise realizes how much risk AI is introducing? Where can we fix this issue? Why was Reco 4 years ahead of the problem, and what have they learned as they took their solution to market? Lots of insight on this one with the co-founder of Reco!

In this conversation, Dr. Chase Cunningham, also known as Dr. Zero Trust, discusses various aspects of cybersecurity, focusing on recent data breaches, the implications for businesses, and the challenges faced by small and medium-sized enterprises (SMBs). He highlights the Victoria's Secret data breach as a case study, examines vulnerabilities in water utilities, and critiques the government's approach to cybersecurity funding and information sharing. The discussion also touches on the market dynamics surrounding cybersecurity firms like CrowdStrike and the implications of workforce changes within the Cybersecurity Infrastructure Agency (CISA).TakeawaysCybersecurity breaches can significantly impact business operations and stock performance.Organizations should proactively assess their connections to compromised entities.The government lacks effective reporting mechanisms for cybersecurity vulnerabilities.Small and medium-sized businesses are often left out of cybersecurity discussions.Congress needs to clarify definitions and incentivize cybersecurity participation among SMBs.Funding cuts to cybersecurity agencies can undermine national security efforts.CrowdStrike's market performance raises questions about accountability in cybersecurity.CISA is facing significant workforce challenges that may affect its effectiveness.Popular Chrome extensions can pose security risks by leaking sensitive data.Proactive measures are essential to mitigate cybersecurity threats.

In this conversation, Dr. Chase Cunningham and Michael Shieh from Mammoth Cyber discuss the evolution of Zero Trust security, focusing on browser security and AI's role in enhancing security measures. They explore the concept of data-first security, the significance of mobile security, and the future of Zero Trust in the context of increasing cyber threats. Michael emphasizes the need for a browser-centric approach to security, which allows for better control and visibility over user behavior and data access.TakeawaysMammoth Cyber focuses on browser-centric security solutions.The evolution of web applications has increased data leakage risks.AI tools are becoming integral to browser security.Data isolation allows users to access data without downloading it.User productivity should not be hindered by security measures.The attack surface for cyber threats is broader than ever.Browser security is essential for all users, not just enterprises.Phishing training is less effective than implementing browser isolation.Mobile security is crucial as users access company data on personal devices.The future of Zero Trust will heavily involve browser security solutions.

In this conversation, Dr. Chase Cunningham, also known as Dr. Zero Trust, discusses various pressing issues in cybersecurity, including the recent leadership changes at CISA, NATO's proposal for cybersecurity spending, market trends in cybersecurity IPOs, and the alarming number of exposed credentials. He emphasizes the importance of cybersecurity in business growth and critiques the healthcare sector's approach to cybersecurity investments. The conversation also touches on emerging threats and concludes with a call to action for the cybersecurity community to address these challenges.TakeawaysCISA's leadership changes raise questions about its effectiveness.NATO's inclusion of cybersecurity in spending targets is a significant development.Market trends indicate a shift towards IPOs in cybersecurity.The exposure of 184 million login credentials highlights ongoing security issues.Cybersecurity teams contribute significantly to business growth.Healthcare organizations prioritize IT security but struggle with implementation.Hackers are increasingly exploiting cloud services for attacks.CrowdStrike's lack of accountability raises concerns in the industry.The cybersecurity community must work together to address emerging threats.There is a need for greater transparency and accountability in cybersecurity incidents.

In this conversation, Dr. Chase Cunningham and Omer from Legit Security discuss a significant vulnerability discovered in GitLab Duo, an AI assistant integrated into GitLab. They explore how prompt injection techniques can be exploited to manipulate the AI into leaking sensitive source code and other confidential information. The discussion highlights the implications of AI context in security, the responsibility of companies to manage these risks, and the evolving landscape of AI-related attacks. Omer emphasizes the need for vigilance as new attack vectors emerge, making it clear that while GitLab has patched the vulnerability, the potential for future exploits remains.TakeawaysGitLab Duo is an AI assistant that helps manage code and projects.A vulnerability was found that allows for prompt injection attacks.Prompt injections can manipulate AI to leak sensitive information.The context used by AI can be exploited against it.Companies must take responsibility for AI outputs.GitLab has patched the vulnerability but risks remain.New prompt injection techniques are constantly emerging.AI systems are not truly intelligent; they follow programmed responses.The relationship between AI and security is evolving rapidly.Future attacks will likely focus on contextual vulnerabilities.

In this conversation, Dr. Chase Cunningham, also known as Dr. Zero Trust, discusses various aspects of cybersecurity, including the impact of ransomware attacks on businesses, the importance of strong password practices, and the emerging threats posed by ransomware as a service operations like Dragon Force. He highlights recent data breaches in retail, the significance of red teaming in cybersecurity, and the security risks associated with Chinese-made solar inverters. The conversation also touches on legislative responses to cybersecurity threats and a recent ransomware attack on Coinbase.TakeawaysLive streaming can be frustrating and often isn't truly live.Ransomware attacks can significantly impact stock prices.Investors can find opportunities in companies affected by breaches.Ransomware as a service is a growing threat in cybersecurity.Weak passwords are a common vulnerability in many organizations.Data breaches often lead to stolen customer information.Red teaming can help organizations identify vulnerabilities before they are exploited.Chinese-made devices pose potential security risks to critical infrastructure.Legislative measures are being considered to address cybersecurity threats.Companies like Coinbase are exploring alternative responses to ransomware demands.

In this conversation, Dr. Zero Trust shares his experiences from the RSA show, discussing the overall atmosphere, vendor interactions, and the introduction of the 10 Ring app for vendor reviews. He highlights certain vendors' threats and emphasizes the importance of data-driven analysis. The discussion also covers insights from a recent Gartner report on security controls and various cybersecurity incidents, concluding with reflections on the industry's future.TakeawaysRSA was interesting but had minimal value overall.The atmosphere at RSA included unusual elements like robot dogs and puppies.Some vendors are willing to threaten analysts for their opinions.Data-driven analysis is crucial in evaluating vendor performance.The 10 Ring app received positive feedback for vendor reviews.Gartner's report highlights misconfiguration as a major security issue.Organizations need to focus on continuous optimization of security controls.Recent cybersecurity incidents show the ongoing vulnerabilities in the industry.CrowdStrike is cutting jobs to scale its business amid market pressures.Basic cybersecurity hygiene is still not being followed by many organizations.

In this conversation, Derek Maki, head of product at Veracode, discusses the evolving landscape of application security, the impact of AI on code security, and the importance of prevention in the future of security practices. He shares insights from the RSA Conference and highlights Veracode's innovations in securing applications and managing risks in the software development lifecycle.TakeawaysVeracode has been a leader in application security since 2006.The rise of AI has not improved the security of code.Veracode's AI fix engine automates remediation of code weaknesses.Preventing malicious packages is a key focus for Veracode.Consumer security is becoming increasingly important.The RSA Conference showcases both noise and innovation in security.Seamless integration of security into developer tools is essential.Open source security is a growing area of concern.Threat intelligence can enhance security measures beyond application security.The future of security will emphasize prevention over detection.

In this conversation, Chase Cunningham and Dave Rand discuss the concept of Zero Trust security and how Faction Networks is innovating in this space. They explore the challenges of securing IoT devices, the unique approach of Faction in avoiding central key repositories, and the importance of encryption. The discussion also touches on the future of cybersecurity, the integration of AI, and the user experience in implementing these security measures.TakeawaysZero Trust is essential for modern cybersecurity.Traditional VPNs are inadequate for current security needs.IoT devices pose significant security challenges.Faction Networks uses a unique approach to key management.Encryption is a core component of Faction's security model.Micro-segmentation helps in isolating critical devices.AI can enhance security through anomaly detection.Privacy is a priority in Faction's design.User experience is crucial for security implementation.The future of cybersecurity will involve hardware and software integration.

In this conversation, Dr. Chase Cunningham and Scott Aldridge discuss the principles of the Visible Ops methodology and its application in cybersecurity. Scott shares his extensive background in IT and cybersecurity, emphasizing the importance of understanding and managing IT assets through effective change and configuration management. They explore practical techniques for implementing cybersecurity best practices, the significance of leadership support, and the challenges organizations face in adopting these practices. The discussion also touches on the value of partnering with managed service providers (MSPs) and the need for a proactive approach to cybersecurity, including the adoption of a zero trust model.TakeawaysYou can't control what you can't measure.Assume breach and prepare accordingly.Progress over perfection is key in cybersecurity.Best practices often aren't implemented effectively.Building cybersecurity expertise in-house is expensive.Partnering with an MSSP can be cost-effective.Integrity management is crucial for IT security.Leadership support is essential for cybersecurity initiatives.Compliance does not guarantee a good cybersecurity posture.Understanding your IT assets is foundational for security.

In this conversation, Dr. Zero Trust analyzes a recent incident involving the leak of tactical action plans by high-ranking officials through unsecured communication channels. He discusses the implications of this leak on national security, the classification of information, and the accountability of government officials. The conversation highlights the discrepancies in how classified information is treated among different individuals and the need for integrity and accountability in leadership roles.TakeawaysThe incident involved a leak of tactical action plans.High-ranking officials should use secure communication methods.The classification of information is often misinterpreted.There is a double standard in accountability for leaks.Leadership must hold themselves accountable for their actions.The integrity of government officials is crucial for national security.Past incidents of information leaks show a pattern of behavior.The consequences for lower-ranking individuals are harsher than for officials.Public trust in government is eroded by lack of accountability.The conversation emphasizes the importance of protecting classified information.

In this conversation, Dr. Chase Cunningham, also known as Dr. Zero Trust, discusses the intersection of cybersecurity and finance, focusing on market trends, vulnerabilities, and the implications of recent cybersecurity incidents. He emphasizes the importance of understanding the financial aspects of cybersecurity, including stock performance and investment strategies, while also addressing the challenges faced by government programs and the ongoing threats from ransomware and state-sponsored attacks.TakeawaysCybersecurity is becoming increasingly intertwined with financial markets.Investors should consider buying stocks after breaches for potential rebounds.Government cybersecurity programs face significant vulnerabilities.Microsoft has not patched a critical vulnerability for eight years.Legislative bodies are scrutinizing the DHS's response to cyber threats.Ransomware operations may have connections to state actors.Investment opportunities exist in the cybersecurity sector despite volatility.Fake updates are a common tactic used by ransomware gangs.Understanding the financial impact of cybersecurity breaches is crucial.Staying informed and proactive is essential for cybersecurity.

In this conversation, Dr. Chase Cunningham and Barry Mainz, CEO of Forescout, discuss the pressing issues surrounding cybersecurity, particularly in critical infrastructure, legacy systems, and the importance of a zero trust approach. They critique the Netflix series 'Zero Day' for its portrayal of cybersecurity threats and explore the current state of security in various sectors, including healthcare and airports. The discussion emphasizes the need for compliance, business continuity, and the integration of cybersecurity into business strategies. They also touch on the future of cybersecurity investments and the importance of considering schools as critical infrastructure.TakeawaysThe portrayal of cybersecurity in media can be exaggerated.Critical infrastructure is vulnerable and requires investment in security.Zero trust principles should be applied to OT and IoT systems.Legacy systems pose significant challenges for cybersecurity.Compliance requirements for OT and IoT are lacking compared to other sectors.Business continuity is a key driver for cybersecurity investments.Cybersecurity discussions should focus on business impacts, not just technical details.Heterogeneous environments require flexible security solutions.Airports vary in their cybersecurity readiness based on age and investment.Healthcare cybersecurity often reacts to breaches rather than preventing them.

SummaryIn this conversation, Dr. Zero Trust discusses various cybersecurity topics, including active malware campaigns, the risks associated with Veterans Affairs data, and the implications of recent data breaches. He also highlights legislative efforts to improve cybersecurity in the agricultural sector and the importance of cybersecurity for law firms. Additionally, he shares insights on investment strategies related to cybersecurity breaches and concludes with his upcoming travel plans and a new system he's trying for secure mobile use.Active malware campaigns are increasingly prevalent and require attention.Veterans Affairs data is at risk due to cybersecurity failures.Personal data breaches are common, and many individuals are affected.Legislative efforts like the Farm and Food Cybersecurity Act aim to address vulnerabilities.Cybersecurity is essential for law firms to protect sensitive data.Investing in companies post-breach can be financially beneficial.The importance of proactive cybersecurity measures cannot be overstated.Dr. Zero Trust is exploring new technologies for secure mobile use while traveling.Staying informed and secure is crucial in today's digital landscape.

In this conversation, Dr. Zero Trust discusses the current state of cybersecurity, focusing on leadership appointments, the confusion surrounding cyber threat naming, emerging threats, and the intersection of espionage and cybercrime. He critiques the lack of operational expertise in cybersecurity leadership, highlights the challenges posed by evolving cyber threats, and emphasizes the importance of understanding the implications of AI in cybersecurity operations. The discussion also touches on data privacy legislation efforts, ransomware trends, and the security vulnerabilities in the drone industry.TakeawaysLeadership in cybersecurity should prioritize technical expertise over political loyalty.The U.S. is currently losing the cyber war against adversaries.Confusion in naming cyber threat actors complicates response efforts.Emerging cyber threats are increasingly sophisticated and state-sponsored.AI can significantly enhance cybersecurity operations and efficiency.Data privacy legislation is often ineffective and redundant.Ransomware groups are evolving and becoming more organized.The cybercrime ecosystem is thriving with complex interconnections.Drones present significant security vulnerabilities that could be exploited.Public awareness of cybersecurity risks is crucial for protection.

In this conversation, Dr. Zero Trust discusses the current state of cybersecurity, focusing on leadership appointments, the confusion surrounding cyber threat naming, emerging threats, and the intersection of espionage and cybercrime. He critiques the lack of operational expertise in cybersecurity leadership, highlights the challenges posed by evolving cyber threats, and emphasizes the importance of understanding the implications of AI in cybersecurity operations. The discussion also touches on data privacy legislation efforts, ransomware trends, and the security vulnerabilities in the drone industry.TakeawaysLeadership in cybersecurity should prioritize technical expertise over political loyalty.The U.S. is currently losing the cyber war against adversaries.Confusion in naming cyber threat actors complicates response efforts.Emerging cyber threats are increasingly sophisticated and state-sponsored.AI can significantly enhance cybersecurity operations and efficiency.Data privacy legislation is often ineffective and redundant.Ransomware groups are evolving and becoming more organized.The cybercrime ecosystem is thriving with complex interconnections.Drones present significant security vulnerabilities that could be exploited.Public awareness of cybersecurity risks is crucial for protection.

In this conversation, Dr. Zero Trust, Anne Saunders, and Jack discuss the complexities of cybersecurity, particularly in the context of IoT and operational technology. They explore the vast attack surface presented by IoT devices, the challenges of securing these devices, and the importance of embedding security into the design of technology. The discussion also touches on regulatory frameworks, investment trends in cybersecurity, and the future of IoT security solutions. Takeaways IoT represents a significant attack surface for cybersecurity. Embedding security into device design is crucial. Data collection from IoT devices poses security risks. Regulatory compliance is becoming more stringent with NIS2. Investment in cybersecurity is often driven by immediate results. The cost of breaches can have a tangible impact on businesses. AI is changing the landscape of cybersecurity discussions. Supply chain security is a critical component of IoT security. Static credentials are a major vulnerability in cybersecurity. A holistic approach to cybersecurity is necessary for effective protection.

In this conversation, Dr. Zero Trust discusses various aspects of cybersecurity, including recent ransomware threats, the implications of AI and deepfake technology, and the importance of adopting a Zero Trust security framework. He also critiques the Biden administration's cybersecurity measures and highlights the ongoing challenges posed by stolen credentials and cyber threats. The discussion emphasizes the need for better security practices and the potential future risks associated with cyber warfare. Takeaways Life can throw unexpected challenges, like caring for family. Ransomware attacks are evolving, targeting cloud services. Strong passwords and two-factor authentication are essential. AI technology can be misused for scams and deception. OpenAI's models may exhibit unexpected language behaviors. Government measures against cyber threats may be insufficient. Stolen credentials remain a primary attack vector in cybersecurity. Zero Trust security is crucial for modern organizations. Cybersecurity is a growing market with increasing investment. Future threats may include drone warfare and cyber attacks on infrastructure.

In this conversation, Dr. Zero Trust discusses various aspects of cybersecurity, focusing on ransomware attacks, their impact on educational institutions, challenges in the cybersecurity workforce, emerging startups, government initiatives, financial implications of data breaches, and the effectiveness of cybersecurity labeling programs. The discussion highlights the need for proactive measures in cybersecurity and the importance of addressing non-human identity security challenges. Takeaways Ransomware attacks are on the rise, with significant impacts on organizations. Cybersecurity events have affected educational systems, compromising student data. There is a critical shortage of qualified cybersecurity professionals despite high demand. Emerging cybersecurity startups are receiving substantial funding but need to demonstrate efficacy. Government initiatives are being introduced to enhance cybersecurity measures. Data breach notification laws can increase borrowing costs for businesses. The Cyber Trustmark program may not effectively address cybersecurity concerns. Non-human identities pose significant security challenges that need to be addressed.

In this conversation, Dr. Zero Trust reflects on the state of cybersecurity as the new year begins, discussing the persistent issues of phishing, social engineering, and weak passwords that continue to plague the industry. He reviews significant cyber incidents from the previous year, including data breaches and legal developments, while also sharing personal reflections on his own goals and challenges faced in 2024. The discussion emphasizes the need for a strategic shift in cybersecurity practices and the importance of addressing foundational issues to prevent ongoing failures in the field. Takeaways The most prevalent methods of exploitation in cybersecurity are still phishing and social engineering. Weak passwords remain a significant security risk in 2024. Recent legal developments include a U.S. ban on data sales to adversarial nations. Cyber incidents continue to rise, with notable breaches affecting government and private sectors. Personal reflections reveal the importance of honesty in assessing one's goals and achievements. Organizations relying on outdated practices are more likely to face breaches. The concept of 'cyberflation' highlights the financial impact of cybersecurity failures on consumers. A strategic shift towards Zero Trust (ZT) is necessary for better security outcomes. The need for public awareness and legislative action in cybersecurity is critical. 2024 was marked by a lack of significant progress in cybersecurity despite increased awareness.

In this conversation, I discussed various aspects of cybersecurity, including the manipulation of narratives through social media, the implications of leadership structures within Cyber Command and the NSA, personal liability for cybersecurity leaders, emerging trends for 2025, and significant supply chain vulnerabilities. The discussion also reflects on the challenges faced by cybersecurity professionals and highlights key incidents from the past year. Takeaways Social media can easily manipulate narratives, impacting public perception. The dual leadership of Cyber Command and NSA raises concerns about authority and effectiveness. CISOs face increasing personal liability, affecting their role and decision-making. Ransomware incidents are expected to remain high, posing ongoing risks to organizations. Supply chain vulnerabilities can have cascading effects across industries. Generative AI poses new threats, enhancing the capabilities of malicious actors. Cybersecurity leaders are experiencing burnout, with many considering leaving their roles. The importance of reassessing functional dependencies in cybersecurity insurance is critical. Fortune 100 companies are significantly affected by recent vulnerabilities in web application firewalls. The year in cybersecurity was marked by significant breaches and challenges, indicating a need for improved practices.

In this conversation, I discussed various cybersecurity reports, highlighting the increasing risks associated with AI, human behavior, and organizational vulnerabilities. He emphasizes the need for better security practices, the implications of recent data breaches, and the importance of updated cybersecurity legislation. The conversation also touches on the failures of government agencies to secure communications and the need for accountability in cybersecurity funding. Takeaways Fridays are a better time for live streaming. There is a significant uptick in state-sponsored cyber attacks. Organizations are not configuring AI services securely. Human behavior poses a major risk in cybersecurity. Phishing attacks have a guaranteed click rate of 5%. Windows has a new zero-day vulnerability affecting multiple versions. Deloitte experienced a significant data breach. NIST emphasizes password length over complexity. Cybersecurity legislation in Canada is facing delays. The EU has identified substantial cyber threats to its member states.

In this conversation, I discussed various cybersecurity reports, highlighting the increasing risks associated with AI, human behavior, and organizational vulnerabilities. He emphasizes the need for better security practices, the implications of recent data breaches, and the importance of updated cybersecurity legislation. The conversation also touches on the failures of government agencies to secure communications and the need for accountability in cybersecurity funding. Takeaways Fridays are a better time for live streaming. There is a significant uptick in state-sponsored cyber attacks. Organizations are not configuring AI services securely. Human behavior poses a major risk in cybersecurity. Phishing attacks have a guaranteed click rate of 5%. Windows has a new zero-day vulnerability affecting multiple versions. Deloitte experienced a significant data breach. NIST emphasizes password length over complexity. Cybersecurity legislation in Canada is facing delays. The EU has identified substantial cyber threats to its member states.

In this conversation, I discussed the ongoing cybersecurity talent crisis, highlighting qualified individuals seeking employment and the systemic issues contributing to the hiring problem. He delves into recent cybersecurity incidents, their financial implications, and the impact of identity security on consumer behavior. The discussion also touches on government regulations and the need for innovative practices in cybersecurity, emphasizing the importance of proactive measures and collaboration in the industry. Takeaways There is a significant talent shortage in cybersecurity. Qualified individuals are struggling to find work in the industry. The hiring process needs to be more inclusive and flexible. Recent cyber incidents have financial repercussions for companies. Consumers are increasingly concerned about identity security. Government regulations are often bureaucratic and ineffective. Innovative practices like micro-segmentation are essential for cybersecurity. Companies must prioritize transparency and security in their software. The cybersecurity industry needs to adapt to evolving threats. Collaboration is key to addressing the hiring crisis and improving security.

In this conversation, Dr. Zero Trust and Kevin Brink discuss the challenges and innovations in implementing Zero Trust security frameworks, particularly within the Department of Defense (DoD). Kevin shares insights on the need for automation in Zero Trust assessments to overcome the limitations of manual processes, emphasizing the importance of empirical data for continuous evaluation. They explore the cost and scalability of Zero Trust solutions, as well as the value of assessing existing security measures against Zero Trust principles. Takeaways Automation is essential for effective Zero Trust assessments. Manual assessments are labor-intensive and unsustainable. Empirical data is crucial for validating security measures. Zero Trust can be applied across various industries, not just DoD. Breach and attack simulations provide quantitative data for assessments. Cost-effective solutions can scale based on organizational needs. Continuous monitoring is key to maintaining security compliance. Zero Trust frameworks can help identify areas of inefficiency. Integration with existing systems enhances the value of Zero Trust. Understanding the specific needs of an organization is vital for implementation.

In this conversation, I discussed various aspects of cybersecurity, including recent TSA regulations, stock market trends related to cybersecurity companies, emerging threats from AI-driven phishing scams, the importance of veteran employment in the cybersecurity field, rising salaries and stress levels among cybersecurity professionals, and the need for organizations to address vulnerabilities and improve their security measures. The discussion emphasizes the importance of proactive measures in cybersecurity and the potential for financial gain in the stock market following breaches. Takeaways The TSA is proposing new cybersecurity regulations for surface transportation. Investing in cybersecurity stocks can be profitable after breaches. AI is increasingly being used in sophisticated phishing scams. Veterans can fill the talent gap in cybersecurity roles. Cybersecurity salaries are rising, but so is job-related stress. Organizations need to patch vulnerabilities promptly to avoid exploitation. Emerging tools and resources can aid in cybersecurity efforts. The importance of reporting significant security concerns is emphasized. Cybersecurity professionals are seeking better work-life balance and training opportunities. Proactive measures are essential to combat evolving cyber threats.

In this episode of the Dr. Zero Trust podcast, hosts James Pham and Oz Wasserman from Opsin discuss the implications of generative AI in the context of cybersecurity and Zero Trust principles. They explore the evolution of AI, the risks associated with generative AI, and how Opsin aims to secure sensitive data while leveraging AI for productivity. The conversation highlights the importance of understanding the security landscape as generative AI becomes more integrated into enterprise environments.

I discussed various topics related to #cybersecurity, including CISA's new international cyber security plan, the appointment of a new CISO at UnitedHealthcare, the progress of federal agencies in implementing #zerotrust, and the evolving landscape of hacking influenced by #AI. The discussion also touches on a serious hacking incident involving The Walt Disney Company and food safety, insights into hacker motivations, and the vulnerabilities present in critical infrastructure. I really emphasized the need for effective leadership and actionable solutions to address these pressing cybersecurity challenges. #drzerotrust #happyhalloween Takeaways CISA's international cyber security plan aims to enhance global cooperation. UnitedHealthcare's new CISO faces significant challenges post-ransomware attack. Federal agencies are making progress on Zero Trust implementation. AI is changing the hacking landscape, making it more accessible. A former Disney employee's hacking incident raises serious food safety concerns. Insights from hackers reveal motivations beyond financial gain. Critical infrastructure vulnerabilities are alarmingly prevalent. Effective leadership is crucial for solving cybersecurity issues. Simple fixes can prevent major security breaches. The conversation highlights the importance of proactive cybersecurity measures.

In this conversation, I discuss the ineffectiveness of compliance violations and fines in changing corporate behavior regarding cybersecurity. I present data showing that fines are often negligible compared to company revenues, making them merely a cost of doing business. I argue for a reevaluation of negligence in cybersecurity and emphasizes the need for accountability, suggesting that without significant consequences, organizations will continue to prioritize profit over security. Takeaways Compliance violations are often seen as a cost of doing business. Fines do not significantly impact large corporations' revenues. Cyber insurance can offset the costs of compliance violations. Statistically, companies often see stock price increases after breaches. The current compliance framework does not enforce real change. Negligence in cybersecurity needs a clearer legal definition. Fines for violations should be more substantial to deter negligence. Government organizations often escape penalties for breaches. The data suggests a need for a shift in accountability measures. Compliance does not equate to actual security improvements.

In this conversation, I discuss various cybersecurity incidents and trends affecting organizations, including CrowdStrike's stock performance, foreign influence in U.S. elections, cybersecurity failures at Sellafield, and the impact of cyber incidents on critical infrastructure. The conversation also covers recent breaches at ADT and American Waterworks, challenges in healthcare cybersecurity, and T-Mobile's compliance issues. Throughout, I emphasizes the importance of robust cybersecurity measures and the ongoing threats faced by organizations. Takeaways CrowdStrike's stock has seen a resurgence after a breach. Foreign actors are actively trying to influence U.S. elections. Sellafield's cybersecurity failures have resulted in significant fines. Cybersecurity incidents in critical infrastructure lead to financial losses. Chinese hackers have targeted U.S. telecom companies for intelligence. ADT has experienced multiple breaches in a short time frame. American Waterworks reported unauthorized activity in its systems. Healthcare organizations are struggling with cybersecurity preparedness. MoneyGram faced a cybersecurity issue affecting customer data. T-Mobile is under pressure to improve its cybersecurity measures.

In this conversation, I discuss various cybersecurity topics, including investment strategies in cybersecurity stocks, vulnerabilities in vehicle security, the implications of AI vulnerabilities, the rise of cyber threats related to social media scandals, workforce development initiatives in cybersecurity, the risks posed by North Korean cyber actors, the disconnect between leadership and security teams regarding ransomware, political cybersecurity breaches, the critical state of cybersecurity in healthcare, and the increasing threats to aviation security.

Den Jones talks about why he is launching 909 Cyber for smb's and other businesses. He and I chat about how to address critical strategic shortfalls for organizations and he runs us through how he put Zero Trust in place while at Adobe! Don't miss this one!

The conversation delves into various pressing cybersecurity issues, including a recent attack on Hezbollah involving explosive pagers, the implications of cyber warfare, election interference by Iranian hackers, the severe impact of ransomware on healthcare, and the ongoing challenges of data privacy. The discussion also critiques the effectiveness of cybersecurity reports and the need for more substantial recommendations in the industry. takeaways The Hezbollah attack demonstrates the potential for cyber to cause physical harm. Ransomware attacks in healthcare have resulted in fatalities. Data privacy is an illusion in the digital age. Cybersecurity breaches often lead to stock market rebounds for affected companies. The sophistication of cyber attacks is increasing, requiring better defenses. Election interference remains a significant concern with foreign actors involved. Ransomware attacks can disrupt critical services and endanger lives. The value of personal data is often underestimated in legal settlements. Phishing scams are becoming more sophisticated and harder to detect. Cybersecurity reports need to provide actionable insights rather than generic advice.

In this conversation, Myself and Aaron Shah from Cybermaxx discuss the complexities of cybersecurity, emphasizing the importance of understanding both offensive and defensive strategies. We explore the dichotomy in cyber operations, the adversarial mindset, and the common misconceptions clients have about their risk levels. The discussion also covers the role of Managed Detection and Response (MDR) services, the challenges faced by small and mid-sized businesses, and best practices for effective cybersecurity management.

In this conversation, I discuss various topics including music licensing, the recent school shooting in Georgia, the impact of cyber security breaches on corporate reputation, the glitch in Chase Bank ATMs, the warning from Warren Buffett about cyber insurance losses, Chinese hackers exploiting software bugs, the launch of a cyber incident reporting portal by CISA, a bipartisan bill to strengthen healthcare cybersecurity, and a judge granting a request to suppress a cyber expert's efforts to warn the public.

In this podcast episode, DrZeroTrust discusses various cybersecurity topics, including a partnership between G2 and security vendors, a cryptocurrency scam that led to the collapse of a Kansas bank, weaknesses in the FBI's cybersecurity practices, a breach at National Public Data, the state of phishing training, the use of AI chatbots by police officers, new cybersecurity rules proposed by the FAA, a lawsuit against Georgia Tech over cybersecurity failures, and allegations that the Biden administration pressured Meta (formerly Facebook) to censor COVID-19 content. DrZeroTrust emphasizes the importance of contributing to the cybersecurity community and encourages individuals to think critically and conduct their own research.

In this conversation, I discuss various topics including the US Army's failed $11 million marketing deal with the UFL and Dwayne 'The Rock' Johnson, the state of ransomware in state and local government organizations, the Mimecast Global Threat Intelligence Report, the reliance on a few tech companies for critical aspects of the economy, the need for campaigns to report cyber breaches, the vulnerabilities in open source software, and the findings from the IBM Cost of a Data Breach Report.

Evgeniy, the author of a book on soft skills in technology sales, discusses the importance of soft skills in the tech industry. He emphasizes the need for curiosity, the ability to overcome fear, and the importance of practicing soft skills outside of work. Evgeniy also talks about the flaws in the way conferences are organized and suggests a more networking-focused approach. He advises against making assumptions and encourages asking questions to better understand others' needs. The conversation highlights the value of visualization and the power of listening. Get a copy here: https://www.softskillstech.ca/

What should we know about the "possible" DDoS hit on the Trump X broadcast? What does another breach of billions of records mean? Even if it's got criminal record and background information? Uh oh. And more on this one!

In this conversation, I interview Gentry Lane, CEO and founder of Nemesis Global, about cybersecurity and the challenges faced in the industry. They discuss the lack of leadership and strategy in national cybersecurity, the need for a global, interoperable system platform for early detection and threat recognition, and the ineffectiveness of current cybersecurity measures. Gentry emphasizes the importance of taking action and implementing radical changes to address the persistent aggression on critical infrastructure. She also highlights the need for technical expertise and a shift in mindset within leadership positions. Overall, the conversation calls for a more proactive and comprehensive approach to cybersecurity. Keywords: cybersecurity, leadership, strategy, critical infrastructure, early detection, threat recognition, technical expertise Takeaways The lack of leadership and strategy in national cybersecurity is a major challenge. There is a need for a global, interoperable system platform for early detection and threat recognition. Current cybersecurity measures are ineffective and require radical changes. Technical expertise and a shift in mindset within leadership positions are crucial for addressing cybersecurity challenges.

Was my full body scan MRI worth it? IBM's data breach report is out, what should we pay attention to. Did Crowdstrike's issue reveal more about how fragile our connected world is? And are Deepfakes protected speech? Lot's to discuss on this one!

What are Non-Human Identities, and why should we care? What does a 4 time CISO have to say about this issue? Does Zero Trust stand up to his scrutiny? Don't miss this one!

DDoS hosts get arrested, but is it really a legit punishment? Cisco has an issue with remote access and a level 10 vuln, uh oh! Deepfakes are up over 1000% in countries with elections in 2024! And Snowflake adds MFA, after their issue, hurray! Buckle up!

In this conversation I discuss the Confucius Institute, cybersecurity search engines, ransomware defense evasion tactics, the GOP platform on protecting critical infrastructure, the OpenAI breach, cybersecurity concerns in the automotive industry, the White House's push for increased cyber funds, and the healthcare industry's pushback against cybersecurity reporting rules. Takeaways Augusta, Georgia is not an exciting place to visit The Confucius Institute raises concerns about its funding and curriculum Cybersecurity search engines like Greyhat Warfare can provide valuable information Ransomware attackers are focusing on defense evasion tactics The GOP platform emphasizes protecting critical infrastructure from hackers OpenAI faced a breach but did not inform law enforcement The automotive industry is increasingly concerned about cybersecurity The White House is seeking increased cyber funds for federal agencies The healthcare industry is pushing back against proposed cybersecurity reporting rules

New "listening" sites in Cuba, uh oh. Is Temu a threat, it is from China. OpenSSH has some serious issues. Will the Supreme Court affect our cyber security posture? TeamViewer gets hit as well. Buckle up!

Did Microsoft's leadership really say they don't have to play by China's rules? Did they potentially lie in front of Congress? Have you ever read the book that is guiding Chinese cyber warfare strategy? I'll tell you where it is. Those important points and WHOLE lot more on this one.

US government contracts pay big fine for doing "no no's" on cyber, why isn't that happening more often? A crime related database was hacked and leaked, not good for those who filed complaints. Microsoft's CEO took a beating on Capitol Hill for the companies issues with security, ouch. And more on this one!

What does it mean to be Breach Ready? A CISO tells me all about his views on this. How should we think about micro-segmentation? Is it really that hard to do right? Where should controls be applied to help limit lateral movement? Can software really help you be ready for an 8K filing with the SEC?

What does it take to really get hit hard for a "cyber" crime? Deepfake the President and find out. Why is it a risk to have a single vendor running all government IT systems? And how does that seem like "fair" competition as required by law? What is skill based hiring for cyber and is that a good thing? Check this episode out!