Podcasts about firemon

Guest: Rich Mogull, SVP of Cloud Security at Firemon and CEO at Securosis Topics: Let's talk about cloud security shared responsibility.  How to separate the blame? Is there a good framework for apportioning blame? You've introduced the Cloud Shared Irresponsibilities Model, stating cloud providers will be considered partially responsible for breaches even if due to customer misconfigurations. How do you see this impacting the relationship between cloud providers and their customers? Will it lead to more collaboration or more friction? We both know the Jay Heiser 2015 classic “cloud is secure, but you not using it securely.” In your view, what does “use cloud securely” mean for various organizations today? Here is a very painful question: how to decide what cloud security should be free with cloud and what security can be paid?  You dealt with cloud security for a long time, what is your #1 lesson so far on how to make the cloud more secure or use the cloud more securely? What is the best way to learn how to cloud? What is this CloudSLAW thing? Resources: EP201 Every CTO Should Be a CSTO (Or Else!) - Transformation Lessons from The Hoff The Cloud Shared Irresponsibilities Model 2002 Trustworthy computing memo Use Cloud Securely? What Does This Even Mean?! EP145 Cloud Security: Shared Responsibility, Shared Fate, Shared Faith? No Snow, No Flakes: Pondering Cloud Security Shared Responsibility, Again! Cloud Security Lab a Week (S.L.A.W) Megatrends drive cloud adoption—and improve security for all Shared fate main page Defining the Journey—the Four Cloud Adoption Patterns Celebrating 200 Episodes of Cloud Security Podcast by Google and Thanks for all the Listens!

What's up everyone, today we have the pleasure of sitting down with Stephen Stouffer, VP, Digital Transformation & Innovation at SaaScend.Summary: Stephen shares practical and innovative examples of combining AI tools with iPaaS tools to do things like parsing email auto-responses and subcontracting tech support questions from family members. He's a fan of starting simple, gradually advancing to more complex solutions, all while maintaining a keen focus on ethical considerations and human interaction. We also cover growth potentials of having a stint in the agency world, is martech really for engineers and the benefits of thinking of emails like billboards on the highway. About StephenStephen started his career as a web developer before moving to a marketing analyst role where he got his first taste of marketing and sales alignment as well as marketing automationThis led him to a Marketing Automation Migration Manager role at Cheshire Impact where he managed over 25 platform migrations in less than a yearHe then worked in-house at a few software companies including iDonate, Thryv as well as FireMon – a security policy management platform where he served as Sr Manager of Marketing Operations and led all the magic behind each GTM programMost recently, Stephen's returned to his agency roots as VP of Digital Transformation and Innovation at SaaScend – a 20-person revenue operations agencyAutomating Parental Tech Support with AIStephen's journey into automating tech support for his mom using AI showcases a blend of ingenuity and practicality. Faced with an array of tech-related questions from his mother, from resetting routers to converting recipes into different metric units, he sought a solution that could offer simple, direct answers without the clutter of search engine results. Recognizing the ease with which texting comes to his parents compared to navigating the internet, Stephen ingeniously integrated Twilio with GPT, leveraging Tray.io as the intermediary. This setup allows text messages to transform into queries for OpenAI's API, which then sends back clear, useful responses.The beauty of this system lies in its simplicity and effectiveness. By funneling questions through a familiar medium—text messaging—Stephen's mom can now access a wealth of information at her fingertips. Whether she's looking for new restaurant suggestions after moving to a new area or needs quick answers for her culinary adventures, the AI assistant provides concise, relevant information. This approach not only empowers his mother to find information independently but also maintains their daily communication, highlighting the importance of family connections amidst technological solutions.Key Takeaway: Stephen's inventive use of AI for handling his mother's tech support inquiries demonstrates the transformative potential of integrating simple technologies to solve everyday challenges. This strategy not only streamlines the process of obtaining information but also enriches the user's experience by delivering tailored answers through a preferred communication channel.Making Use of Email Auto-responses with ChatGPT and Tray.ioStephen's presentation at Dreamforce was a bold exploration of AI's potential in streamlining email management, a topic ripe with complexities and nuances. Opting for the risky path of live demos, he engaged his audience directly, inviting them to submit various types of emails into an open text field. Utilizing Tray.io as his iPaas tool of choice, these inputs were then processed through OpenAI's API to classify the emails and execute appropriate actions based on their nature—whether setting up follow-up tasks, unsubscribing contacts, or updating records in Salesforce and Pardot.This daring demonstration not only showcased the practical applications of AI in automating mundane tasks but also ignited discussions on data compliance and ethical considerations in AI usage. Stephen's session highlighted the efficiency and adaptability of AI in handling massive volumes of email responses, providing a glimpse into the future of digital communication management. The success of this live demo, buoyed by flawless internet connectivity, underscored the reliability and transformative power of AI in enhancing operational processes within the tech ecosystem.Stephen's process for integrating auto-responses from email clients into GPT is remarkably straightforward. By designating a reply-to address in your automation platform, all auto-responses are directed to a specific inbox. From there you create a forwarding rule for all incoming emails in that inbox to another address provided by Tray.io. This address acts as an endpoint, channeling the email content directly into the iPaas tool for processing. From there you can prompt ChatGPT by bringing in the payload of those individual emails.Despite the simplicity of this setup, Stephen cautions about the volume of data being handled, highlighting the importance of managing the flow to ensure accuracy in parsing and prompt building. This method not only simplifies the initial step of data collection but also underscores the intricacies involved in refining AI to perform nuanced tasks like accurately unsubscribing contacts.Key Takeaway: Stephen's Dreamforce presentation exemplified the innovative use of AI in automating useful tasks that are often left behind because of the manual nature. His live demo reinforced the potential of AI to transform mundane operational tasks into automated, intelligent workflows, setting a precedent for future applications in business and technology.Unveiling the Early Stages of AI in Marketing OperationsStephen's insights into the maturity of the martech market, particularly regarding the integration of AI into marketing operations, highlight a crucial phase of development that many professionals are navigating. His observations, shared after captivating the audience at Dreamforce, shed light on the novelty and potential of AI to revolutionize marketing practices. Stephen emphasizes that we are at the beginning of this journey, with much of the excitement and innovation concentrated in regions like North America, notably ahead of other areas such as Europe and Australia. This disparity showcases the varying pace of technological adoption across the globe, reminding us that advancements like marketing automation, now seen as standard in some parts, are just gaining traction elsewhere.Stephen points out a common misconception within the industry: the belief that AI's application is limited to those with deep technical expertise, such as data engineers. This notion, he argues, often overshadows the simpler, yet profoundly impactful uses of AI that can benefit marketers at all levels. For instance, AI's capability to generate email subject lines or assist in content ideation represents an accessible entry point for professionals seeking to leverage technology to streamline their workflows.The enthusiasm Stephen encountered post-Dreamforce, where attendees expressed astonishment at AI's capabilities, underscores a widespread underestimation of AI's current role and potential in marketing. This reaction suggests a gap between the perceived complexity of AI applications and the practical, immediate benefits they can offer. Stephen's approach to demystifying AI—highlighting straightforward applications and encouraging experimentation with basic tasks—provides a valuable roadmap for professionals looking to embrace AI without feeling overwhelmed.Through his experience, Stephen advocates for starting small with AI, focusing on automating simple tasks that can significantly enhance efficiency and creativity. This strategy not only makes ...

CISA's (Cybersecurity and Infrastructure Security Agency's) strategic plan was just recently released and focuses on four key areas: cyber defense, risk reduction and resilience, operational collaboration, and agency unification. What can we learn from this work? Where does it fall short? How is this elevating or helping the practice of cybersecurity in the US, and around the world? Join our host, Ken Kadet, as he talks about this and more with Paul Calatayud, Co-Founder & Chief Strategy Officer at Onada, and former CSO at Palo Alto Networks and the CTO at Firemon.

Rich Mogull, SVP of Cloud Security at FireMon, joins Corey on Screaming in the Cloud to discuss his career in cybersecurity going back to the early days of cloud. Rich describes how he identified that cloud security would become a huge opportunity in the early days of cloud, as well as how cybersecurity parallels his other jobs in aviation and emergency medicine. Rich and Corey also delve into the history of Rich's involvement in the TidBITS newsletter, and Rich unveils some of his insights into the world of cloud security as a Gartner analyst. About RichRich is the SVP of Cloud Security at FireMon where he focuses on leading-edge cloud security research and implementation. Rich joined FireMon through the acquisition of DisruptOps, a cloud security automation platform based on his research while as CEO of Securosis. He has over 25 years of security experience and currently specializes in cloud security and DevSecOps, having starting working hands-on in cloud over 12 years ago. He is also the principle course designer of the Cloud Security Alliance training class, primary author of the latest version of the CSA Security Guidance, and actively works on developing hands-on cloud security techniques. Prior to founding Securosis and DisruptOps, Rich was a Research Vice President at Gartner on the security team. Prior to his seven years at Gartner, Rich worked as an independent consultant, web application developer, software development manager at the University of Colorado, and systems and network administrator.Rich is the Security Editor of TidBITS and a frequent contributor to industry publications. He is a frequent industry speaker at events including the RSA Security Conference, Black Hat, and DefCon, and has spoken on every continent except Antarctica (where he's happy to speak for free -- assuming travel is covered).Links Referenced: FireMon: https://www.firemon.com/. Twitter: https://twitter.com/rmogull Mastodon: [https://defcon.social/@rmogull](https://defcon.social/@rmogull) FireMon Blogs: https://www.firemon.com/blogs/ Securosis Blogs: https://securosis.com/blog TranscriptAnnouncer: Hello, and welcome to Screaming in the Cloud with your host, Chief Cloud Economist at The Duckbill Group, Corey Quinn. This weekly show features conversations with people doing interesting work in the world of cloud, thoughtful commentary on the state of the technical world, and ridiculous titles for which Corey refuses to apologize. This is Screaming in the Cloud.Corey: Welcome to Screaming in the Cloud. I'm Corey Quinn. My guest today is Rich Mogull, SVP of Cloud Security over at FireMon now that I'm a bit too old to be super into Pokémon, so I forget which one that is. Rich, thanks for joining me. I appreciate it.Rich: Thank you. Although I think we need to be talking more Digimon than Pokémon. Not that I want to start a flame war on the internet in the first two minutes of the conversation.Corey: I don't even have the level of insight into that. But I will say one of the first areas where you came to my notice, which I'm sure you'll blame yourself for later, is that you are the security editor behind TidBITS, which is, more or less, an ongoing newsletter longer than I've been in the space, to my understanding. What is that, exactly?Rich: So, TidBITS is possibly the longest-running—one of the longest-running newsletters on the internet these days and it's focused on all things Apple. So, TidBITS started back in the very early days as kind of more of an email, I think like, 30 years ago or something close to that. And we just write a lot about Apple and I've been reading about Apple security there.Corey: That's got to be a bit of an interesting experience compared to my writing about AWS because people have opinions about AWS, particularly, you know, folks who work there, but let's be clear, there is nothing approaching the zealotry, I think I want to call it, of certain elements of the Apple ecosystem whenever there is the perception of criticism about the company that they favor. And I want to be clear here to make sure I don't get letters myself for saying this: if there's an Apple logo on a product, I will probably buy it. I have more or less surrounded myself with these things throughout the course of the last ten years. So, I say this from a place of love, but I also don't wind up with people threatening me whenever I say unkind things about AWS unless they're on the executive team.Rich: So, it's been a fascinating experience. So, I would say that I'm on the tail end of being involved with kind of the Mac journalist community. But I've been doing this for over 15 years is kind of what I first started to get involved over there. And for a time, I wrote most of the security articles for Macworld, or a big chunk of those, I obviously was writing over a TidBITS. I've been very lucky that I've never been on the end of the death threats and the vitriol in my coverage, even though it was balanced, but I've also had to work a lot—or have a lot of conversations with Apple over the years.And what will fascinate you is at what point in time, there were two companies in the world where I had an assigned handler on the PR team, and one was Apple and then the other was AWS. I will say Apple is much better at PR than [laugh] AWS, especially their keynotes, but we can talk about re:Invent later.Corey: Absolutely. I have similar handlers at a number of companies, myself, including of course, AWS. Someone has an impossible job over there. But it's been a fun and exciting world. You're dealing with the security side of things a lot more than I am, so there's that additional sensitivity that's tied to it.And I want to deviate for a second here, just because I'm curious to get your take on this given that you are not directly representing one of the companies that I tend to, more or less, spend my time needling. It seems like there's a lot of expectation on companies when people report security issues to them, that you're somehow going to dance to their tune and play their games the entire time. It's like, for a company that doesn't even have a public bug bounties process, that feels like it's a fairly impressively high bar. On some level, I could just report this via Twitter, so what's going on over there? That feels like it's very much an enterprise world expectation that probably means I'm out of step with it. But I'm curious to get your take.Rich: Out of step with which part of it? Having the bug bounty programs or the nature of—Corey: Oh, no. That's beside the point. But having to deal with the idea of oh, an independent security researcher shows up. Well, now they have to follow our policies and procedures. It's in my world if you want me to follow your policies and procedures, we need a contract in place or I need to work for you.Rich: Yeah, there is a long history about this and it is so far beyond what we likely have time to get into that goes into my history before I even got involved with dealing with any of the cloud pieces of it. But a lot about responsible disclosure, coordinated disclosure, no more free bugs, there's, like, this huge history around, kind of, how to handle these pieces. I would say that the core of it comes from, particularly in some of the earlier days, there were researchers who wanted to make their products better, often as you criticize various things, to speak on behalf of the customer. And with security, that is going to trigger emotional responses, even among vendors who are a little bit more mature. Give you an example, let's talk about Apple.When I first started covering them, they were horrific. I actually, some of the first writing I did that was public about Apple was all around security and their failures on security disclosures and their inability to work with security researchers. And they may struggle still, but they've improved dramatically with researcher programs, and—but it was iterative; it really did take a cultural change. But if you really want to know the bad stories, we have to go back to when I was writing about Oracle when I was a Gartner analyst.Corey: Oh, dear. I can only imagine how that played out. They have been very aggressive when it comes to smacking down what they perceive to be negative coverage of anything that they decide they like.Rich: Yeah, you know, if I would look at how culturally some of these companies deal with these things when I was first writing about some of the Oracle stuff—and remember, I was a Gartner analyst, not a vulnerability researcher—but I'm a hacker; I go to Blackhat and DEF CON. I'm friends with the people who are smarter than me at that or have become friends with them over the years. And I wrote a Gartner research note saying, “You probably shouldn't buy any more Oracle until they fix their vulnerability management process.” That got published under the Gartner name, which that may have gotten some attention and created some headaches and borderline legal threats and shade and all those kinds of things. That's an organization that looks at security as a PR problem. Even though they say they're more secure, they look at security as a PR problem. There are people in there who are good at security, but that's different. Apple used to be like that but has switched. And then Amazon is… learning.Corey: There is a lot of challenge around basically every aspect of communication because again, to me, a big company is one that has 200 people. I think that as soon as you wind up getting into the trillion-dollar company scale, everything you say gets you in trouble with someone, somehow, somewhere, so the easiest thing to do is to say nothing. The counterpoint is that on some point of scale, you hit a level where you need a fair bit of scrutiny; it's deserved at this point because you are systemically important, and them's the breaks.Rich: Yeah, and they have improved. A lot of the some of the larger companies have definitely improved. Microsoft learned a bunch of those lessons early on. [unintelligible 00:07:33] the product in Azure, maybe we'll get there at some point. But you have to—I look at it both sides a little bit.On the vendor side, there are researchers who are unreasonable because now that I'm on the vendor side for the first time in my career, if something gets reported, like, it can really screw up plans and timing and you got to move developer resources. So, you have outside influences controlling you, so I get that piece of it. But the reality is if some researcher discovered it, some China, Russia, random criminals are going to discover it. So, you need to deal with those issues. So, it's a bit of control. You lose control of your messaging and everything; if marketing gets their hands in this, then it becomes ugly.On the other hand, you have to, as a vendor, always realize that these are people frequently trying to make your products better. Some may be out just to extort you a little bit, whatever. That's life. Get used to it. And in the end, it's about putting the customers first, not necessarily putting your ego first and your marketing first.Corey: Changing gears slightly because believe it or not, neither you nor I have our primary day jobs focused on, you know, journalism or analyst work or anything like that these days, we focus on these—basically cloud, for lack of a better term—through slightly different lenses. I look at it through cost—which is of course architecture—and you look at it through the lens of security. And I will point out that only one of us gets called at three in the morning when things get horrible because of the bill is a strictly business-hours problem. Don't think that's an accident as far as what I decided to focus on. What do you do these days?Rich: You mean, what do I do in my day-to-day job?Corey: Well, it feels like a fair question to ask. Like, what do you do as far as day job, personal life et cetera. Who is Rich Mogull? You've been a name on the internet for a long time; I figured we'd add some color and context to it.Rich: Well, let's see. I just got back from a flying lesson. I'm honing in on my getting ready for my first solo. My side gig is as a disaster response paramedic. I dressed up as a stormtrooper for the 501st Legion. I've got a few kids and then I have a job. I technically have two jobs. So—Corey: I'm envious of some of those things. I was looking into getting into flying but that path's not open to me, given that I have ADHD. And there are ways around it in different ways. It's like no, no, you don't understand. With my given expression of it, I am exactly the kind of person that should not be flying a plane, let's be very clear here. This is not a regulatory thing so much as it is a, “I'm choosing life.”Rich: Yeah. It's a really fascinating thing because it's this combination of a physical and a mental challenge. And I'm still very early in the process. But you know, I cracked 50, it had always been a life goal to do this, and I said, “You know what? I'm going to go do it.”So, first thing, I get my medical to make sure I can actually pass that because I'm over 50, and then from there, I can kind of jump into lessons. Protip though: don't start taking lessons right as summer is kicking in in Phoenix, Arizona, with winds and heat that messes up your density altitude, and all sorts of fun things like that because it's making it a little more challenging. But I'm glad I'm doing it.Corey: I have to imagine. That's got to be an interesting skill set that probably doesn't have a huge amount of overlap with the ins and outs of the cloud business. But maybe I'm wrong.Rich: Oh God, Corey. The correlations between information security—my specialty, and cloud security as a subset of that—aviation, and emergency medicine are incredible. These are three areas with very similar skill sets required in terms of thought processes. And in the case of both the paramedic and aviation, there's physical skills and mental skills at the same time. But how you look at incidents, how you process things algorithmically, how you—your response times, checklists, the correlations.And I've been talking about two of those three things for years. I did a talk a couple years ago, during Covid, my Blackhat talk on the “Paramedics Guide to Surviving Cybersecurity,” where I talked a lot about these kinds of pieces. And now aviation is becoming another part of that. Amazing parallels between all three. Very similar mindsets are required.Corey: When you take a look at the overall sweep of the industry, you've been involved in cloud for a fairly long time. I have, too, but I start off as a cynic. I started originally when I got into the space, 2006, 2007, thinking virtualization was a flash in the pan because of the security potential impact of this. Then cloud was really starting to be a thing and pfff, that's not likely to take off. I mean, who's going to trust someone else to run all of their computing stuff?And at this point, I've learned to stop trying to predict the future because I generally get it 180 degrees wrong, which you know, I can own that. But I'm curious what you saw back when you got into this that made you decide, yeah, cloud has legs. What was that?Rich: I was giving a presentation with this guy, Chris Hoff, a good friend of mine. And Chris and I joined together are individual kind of research threads and were talking about, kind of, “Disruptive Innovation and the Future of Security.” I think that was the title. And we get that at RSA, we gave that at SOURCE Boston, start kind of doing a few sessions on this, and we talked about grid computing.And we were looking at, kind of, the economics of where things were going. And very early, we also realized that on the SaaS side, everybody was already using cloud; they just didn't necessarily know it and they called them Application Service Providers. And then the concepts of cloud in the very early days were becoming compelling. It really hit me the first time I used it.And to give you perspective, I'd spent years, you know, seven years as a Gartner analyst getting hammered with vendors all the time. You can't really test those technologies out because you can never test them in a way that an enterprise would use them. Even if I had a lab, the lab would be garbage; and we know this. I don't trust things coming out of labs because that does not reflect operational realities at enterprise scale. Coming out of Gartner, they train me to be an enterprise guy. You talk about a large company being 200? Large companies start at 3000 to 5000 employees.Corey: Does that map to cloud services the way that AWS expresses? Because EKS, you're going to manage that differently in an enterprise environment—or any other random AWS service; I'm just picking EKS as an example on this. But I can spin up a cluster and see what it's like in 15 minutes, you know, assuming the cluster gets with the program. And it's the same type of thing I would use in an enterprise, but I'm also not experiencing it in the enterprise-like way with the processes and the gating and the large team et cetera, et cetera, et cetera. Do you think it's still a fair comparison at that point?Rich: Yeah, I think it absolutely is. And this is what really blew my mind. 11 or 12 years ago, when I got my first cloud account setup. I realized, oh, my God. And that was, there was no VPC, there was no IAM. It was ephemeral—and—no, we just had EBS was relatively new, and IAM was API only, it wasn't in the console yet.Corey: And the network latency was, we'll charitably call it non-deterministic.Rich: That was the advantage of not running anything at scale, wasn't an issue at the time. But getting the hands-on and being able to build what I could build so quickly and easily and with so little friction, that was mind-blowing. And then for me, the first time I've used security groups I'm like, “Oh, my God, I have the granularity of a host firewall with the manageability of a network firewall?” And then years later, getting much deeper into how AWS networking and all the other pieces were—Corey: And doesn't let it hit the host, which I always thought a firewall that lets—Rich: Yes.Corey: —traffic touch the host is like a seatbelt that lets your face touch the dashboard.Rich: Yeah. The first thing they do, they go in, they're going to change the rules. But you can't do that. It's those layers of defense. And then I'm finding companies in the early days who wanted to put virtual appliances in front of everything. And still do. I had calls last week about that.But those are the things that really changed my mind because all of a sudden, this was what the key was, that I didn't fully realize—and it's kind of something that's evolved into something I call the ‘Grand Unified Theory of Cloud Governance,' these days—but what I realized was those barriers are gone. And there is no way to stop this as people want to build and test and deploy applications because the benefits are going to be too strong. So, grab onto the reins, hold on to the back of the horse, you're going to get dragged away, and it's your choice if your arm gets ripped off in the process or if you're going to be able to ride that thing and at least steer it in the general direction that you need it to go in.Corey: One of the things that really struck me when I started playing around with cloud for more than ten minutes was everything you say is true, but I can also get started today to test out an idea. And most of them don't work, but if something hits, suddenly I don't have the data center constraints, whereas today, I guess you'd call it, I built my experiment MVP on top of a Raspberry Pi and now I have to wait six weeks for Dell to send me something that isn't a piece of crap that I can actually take production traffic on. There's no okay, and I'll throw out the junky hardware and get the good stuff in once you start hitting a point of scale because you're already building on that stuff without the corresponding massive investment of capital to get there.Rich: Yeah well, I mean, look, I lived this, I did a startup that was based on demos at a Blackhat—sorry, at a Blackhat. Blackhat. Did some demos on stage, people were like, “We want your code.” It was about cloud security automation. That led to doing your startup, the thing called DisruptOps, which got acquired, and that's how I ended up at FireMon. So, that's the day job route where I ended up.And what was amazing for that is, to add on to what you said, first of all, the friction was low; once we get the architecture right, scalability is not something we are hugely concerned with, especially because we're CI/CD. Oh, no, we hit limits. Boom, let's just stand up a new version and redirect people over there. Problem solved. And then the ability to, say, run multiple versions of our platform simultaneously? We're doing that right now. We just had to release an entirely free version of it.To do that. It required back-end architectural changes for cost, not for scalability so much, but for a lot around cost and scheduling because our thing was event-driven, we're able to run that and run our other platform fully in parallel, all shared data structures, shared messaging structures. I can't even imagine how hard that would have not been to do in a traditional data center. So, we have a lot of freedom, still have those cost constraints because that's [laugh] your thing, but the experimentation, the ability to integrate things, it's just oh, my God, it's just exciting.Corey: And let's be clear, I, having spent a lot of time as a rat myself in these data centers, I don't regret handing a lot of that responsibility off, just because, let's not kid ourselves, they are better at replacing failed or failing hardware than I will ever be. That's part of the benefit you get from the law of large numbers.Rich: Yeah. I don't want to do all of that stuff, but we're hovering around something that is kind of—all right, so former Gartner analyst means I have a massive ego, and because of that, I like to come up with my own terms for things, so roll with me here. And it's something I'm calling the ‘Grand Unified Theory of Cloud Governance' because you cannot possibly get more egotistical than referring to something as your solution to the biggest problem in all of physics. The idea is, is that cloud, as we have just been discussing, it drops friction and it decentralizes because you don't have to go ask somebody for the network, you don't have to ask somebody for the server. So, all of a sudden, you can build a full application stack without having to call somebody for help. We've just never had that in IT before.And all of our governance structures—and this includes your own costs, as well as security—are built around scarcity. Scarcity of resources, natural choke points that evolved from the data center. Not because it was bad. It wasn't bad. We built these things because that's what we needed for that environment at the data center.Now, we've got cloud and it's this whole new alien technology and it decentralizes. That said, particularly for us on security, you can build your whole application stack, of course, we have completely unified the management interfaces in one place and then we stuck them on the internet, protected with nothing more than a username and password. And if you can put those three things together in your head, you can realize why these are such dramatic changes and so challenging for enterprises, why my kids get to go to Disney a fair bit because we're in demand as security professionals.Corey: What does FireMon do exactly? That's something that I'm not entirely up to speed on, just because please don't take this the wrong way, but I was at RSA this year, and it feels like all the companies sort of blend together as you walk between the different booths. Like, “This is what you should be terrified of today.” And it always turns into a weird sales pitch. Not that that's what you do, but it at some point just blinds me and overloads me as far as dealing with any of the cloud security space.Rich: Oh, I've been going to RSA for 20 years. One of our SEs, I was briefly at our booth—I'm usually in outside meetings—and he goes, “Do you see any fun and interesting?” I go—I just looked at him like I was depressed and I'm like, “I've been to RSA for 20 years. I will never see anything interesting here again. Those days are over.” There's just too much noise and cacophony on that show floor.What do we do? So—Corey: It makes re:Invent's Expo Hall look small.Rich: Yeah. I mean, it's, it's the show over at RSA. And it wasn't always. I mean, it was—it's always been big as long as I've been there, but yeah, it's huge, everyone is there, and they're all saying exactly the same thing. This year, I think the only reason it wasn't all about AI is because they couldn't get the printers to reprint the banners fast enough. Not that anybody has any products that would do anything there. So—you look like you want to say something there.Corey: No, no. I like the approach quite a bit. It's the, everything was about AI this year. It was a hard pivot from trying to sell me a firewall, which it seems like everyone was doing in the previous year. It's kind of wild. I keep saying that there's about a dozen companies that exhibit at RSA. A guess, there are hundreds and hundreds of booths, but it all distills down to the same 12 things. They have different logos and different marketing stories, but it does seem like a lot of stuff is very much just like the booth next to it on both sides.Rich: Yeah. I mean, that's—it's just the nature. And part of—there's a lot of reasons for this. We used to, when I was—so prior to doing the startup thing and then ending up at FireMon, I did Securosis, which was an analyst firm, and we used to do the Securosis guide to RSA every year where we would try and pick the big themes. And the reality is, there's a reason for that.I wrote something once the vendors lied to you because you want them to. It's the most dysfunctional relationship because as customers, you're always asking, “Well, what are you doing for [unintelligible 00:22:16]? What are you doing for zero trust? What are you doing for AI?” When those same customers are still just working on fundamental patch management and firewall management. But it doesn't stop them from asking the questions and the vendors have to have answers because that's just the nature of that part of the world.Corey: I will ask you, over are past 12 years—I have my own thoughts on this, but I want to hear your take on it—what's changed in the world of cloud security?Rich: Everything. I mean, I was one of the first to be doing this.Corey: Oh, is that all?Rich: Yeah. So, there's more people. When I first started, very few people doing it, nobody knew much about it outside AWS, we all knew each other. Now, we've got a community that's developed and there's people that know what they're doing. There's still a shortage of skills, absolutely still a shortage of skills, but we're getting a handle on that, you know? We're getting a bit of a pipeline.And I'd say that's still probably the biggest challenge faced. But what's improved? Well, it's a give-and-take. On one hand, we now have strategies, we have tools that are more helpful, unfortunately—I'll tell you the biggest mistake I made and it ties to the FireMon stuff in my career, in a minute; relates directly to this question, but we're kind of getting there on some of the tool pieces.On the other hand, that complexity is increasing faster. And that's what's made it hard. So, as much as we're getting more skilled people, better at tooling, for example, we kind of know—and we didn't have CloudTrail when I started. We didn't have the fundamental things you need to actually implement security at the start of cloud. Most of those are there; they may not be working the way we wish they always worked, but we've got the pieces to assemble it, depending on which platform you're on. That's probably the biggest change. Now, we need to get into the maturity phase of cloud, and that's going to be much more difficult and time-consuming to kind of get over that hump.Corey: It's easy to wind up saying, “Oh, I saw the future so clearly back then,” but I have to ask, going back 12 years, the path the world would take was far from certain. Did you have doubts?Rich: Like, I had presented with Chris Hoff. We—we're still friends—presented stuff together, and he got a job that was kind of clouding ancillary. And I remember calling him up once and going, “Chris, I don't know what to do.” I was running my little analyst firm—little. We were doing very, very well—I could not get paid to do any work around cloud.People wanted me to write shitty papers on DLP and take customer inquiries on DLP because I had covered that at the Gartner days, and data encryption and those pieces. That was hard. And fortunately, a few things started trickling in. And then it was a flood. It completely changed our business and led to me, you know, eventually going down into the vendor path. But that was a tough day when I hit that point. So, absolutely I knew it was the future. I didn't know if I was going to be able to make a living at it.Corey: It would seem that you did.Rich: Yeah. Worked out pretty well [laugh].Corey: You seem sprightly to me. Good work. You're not on death's door.Rich: No. You know, in fact, the analyst side of it exploded over the years because it turns out, there weren't people who had this experience. So, I could write code to the APIs, but they'll still talk with CEOs and boards of directors around these cloud security issues and frame them in ways that made sense to them. So, that was wonderful. We partnered up with the Cloud Security Alliance, I actually built a bunch of the CSA training, I wrote the current version of the CSA guidance, we're writing the next version of that, did a lot of research with them. They've been a wonderful partner.So, all that went well. Then I got diverted down onto the vendor path. I had this research idea and then it came out, we ended up founding that as a startup and then it got, as I mentioned, acquired by FireMon, which is interesting because FireMon, you asked what we did, it's firewall policy management is the core of the company. Yet the investors realize the company was not going in the right direction necessarily, to deal with the future of cloud. They went to their former CEO and said, “Hey, can you come back”—the founder of the company—“And take this over and start moving us in the right direction?”Well, he happened to be my co-founder at the startup. And so, we kind of came in and took over there. And so, now it's a very interesting position because we have this one cloud-native thing we built for all these years. We made one mistake with that, which I'll talk about which ties back to your predicting the future piece if you want to go into it, but then we have the network firewall piece now extending into hybrid, and we have an asset management moving into the attack surface management space as well. And both of those products have been around for, like, 15-plus years.Corey: No, I'm curious to your thoughts on it because it's been one of those weird areas where there's been so much change and so much evolution, but you also look at today's “OWASP Top 10” list of vulnerabilities, and yeah, they updated a year or so ago, but it still looks basically like things that—from 2008—would have made sense to me when I'm looking at this. Well, insomuch as they do now. I didn't know then, nor do I now what a cross-site scripting attack might be, but other than that, I find that there's, “Oh, you misconfigured something and it winds up causing a problem.” Well, no kidding. Imagine that.Rich: Yeah. Look, the fundamentals don't change, but it's still really easy to screw up.Corey: Oh, having done so a lot, I believe you.Rich: There's a couple of principles, and I'll break it into two sides. One is, a lot of security sounds simple. There's nothing simple at scale. Nothing simple scales. The moment you get up to even 200 employees, everything just becomes ridiculously harder. That's the nature of reality. Simplicity doesn't scale.The other part is even though it's always the same, it's still easy to think you're going to be different this time and you're not going to screw it up, and then you do. For example, so cloud, we were talking about the maturity. I assumed CSPM just wasn't going to be a thing. For real. The Cloud Security Posture Management. Because why would the cloud providers not just make that problem go away and then all the vulnerability assessment vendors and everybody else? It seemed like it was an uninteresting problem.And yet, we were building a cloud security automation thing and we missed the boat because we had everything we needed to be one of the very first CSPM vendors on the market and we're like, “No, no. That problem is going to go away. We'll go there.” And it ties back to what you said, which is it's the same stuff and we just outsmarted ourselves. We thought that people would go further faster. And they don't and they aren't.And that's kind of where we are today. We are dramatically maturing. At the same time, the complexity is increasing dramatically. It's just a huge challenge for skills and staffing to adjust governance programs. Like I think we've got another 10 to 20 years to go on this cloud security thing before we even get close. And then maybe we'll get down to the being bored by the problems. But probably not because AI will ruin us.Corey: I'd like to imagine, on some level, that AI could be that good. I mean, don't get me wrong. It has value and it is transformative for a bunch of things, but I also think a lot of the fear-mongering is more than a little overblown.Rich: No, I agree with you. I'm trying to keep a very close eye on it because—I can't remember if you and I talked about this when we met face-to-face, or… it was somebody at that event—AI is just not just AI. There's different. There's the LLMs, there's the different kinds of technologies that are involved. I mean, we use AI all over the place already.I mean my phone's got it built in to take better pictures. It's a matter of figuring out what the use cases and the, honestly, some of the regulatory structure around it in terms of copyright and everything else. I'm not worried about Clippy turning into Skynet, even though I might make jokes about that on Mastodon, maybe someday there will be some challenges, but no, it's just going to be another tech that we're going to figure out over time. It is disruptive, so we can't ignore that part of it.Corey: I really want to thank you for taking the time to speak with me. If people want to learn more, where's the best place to find you that isn't one of the Disney parks?Rich: That really is kind of the best place to find—no. So, these days, I do technically still have a Twitter presence at @rmogull. I'm not on there much, but I will get DMs if people send those over. I'm more on Mastodon. It's at @rmogull defcon.social. I write over at FireMon these days, as well as occasionally still over Securosis, on those blogs. And I'm in the [Cloud Security Slack community 00:30:49] that is now under the banner for CloudSec. That's probably the best place if you want to hit me up and get quick answers on anything.Corey: And I will, of course, include links to all of that in the show notes. Thank you so much for taking the time to speak with me today. I really appreciate it.Rich: Thanks, Corey. I was so happy to be here.Corey: Rich Mogull, SVP of Cloud Security at FireMon. I'm Cloud Economist Corey Quinn and this is Screaming in the Cloud. If you've enjoyed this podcast, please leave a five-star review on your podcast platform of choice, whereas if you've hated this podcast, please leave a five-star review on your podcast platform of choice, along with an angry comment talking about how at Dell these days, it does not take six weeks to ship a server. And then I will get back to you in six to eight weeks.Corey: If your AWS bill keeps rising and your blood pressure is doing the same, then you need The Duckbill Group. We help companies fix their AWS bill by making it smaller and less horrifying. The Duckbill Group works for you, not AWS. We tailor recommendations to your business and we get to the point. Visit duckbillgroup.com to get started.

Show Description: Justin Stouder is the Chief Technology Officer of FireMon, a software development company focused on improving security operations and outcomes. He is also the founder of Summitwise, which provides high-altitude and high-impact leadership experiences. In this interview, Justin provides networking tips and career lessons, based on his path through financial services, software, and IT. He also explains how to define your core values and let them guide you through your personal and professional life. Justin also discusses how to make yourself more valuable, whether it is through public speaking, leading through a non-management role, or initiating meaningful conversations with other professionals. We end the show discussing how a company can improve its company culture and attract top talent, especially if it is a hybrid or remote company. To learn more about FireMon or Justin's business Summitwise, learn more below: FireMon (https://www.firemon.com/) Summitwise (http://www.summitwise.com/) Show Highlights: 4:15-26:30: Justin reflects on his career path through financial services, software, and IT. He highlights key networking lessons and best practices he learned along the way, which allowed him to progress through multiple leadership roles. 26:30-33:30: Justin discusses his CTO role with FireMon, things new leaders can do to be more self-aware, and how an organization can define and execute its core values. 33:30-51:45: Justin provides anecdotal lessons on how to overcome fear of public speaking, how he prepares for his presentations, and what all great speeches have in common. 51:4-1:07:00: Justin explains the mission behind "Summitwise" mountain experience for high-performing leaders, including what leaders can do achieve a healthy headspace for idea creation. We also cover how you can be a leader in your organization without the job title. 1:07:00-1:20:15: We ask Justin about the future of remote work, how hybrid/remote companies can maintain a healthy culture, and how to attract top talent at these types of companies. 1:20:15: We end the show by asking Justin how he wants to be remembered.

Matthew meets with David Lennon, the Director of Enterprise Solutions at FireMon. They talk about managing firewall rules, cyber threat maps, and the importance of having good cyber hygiene. They also discuss Firemon's move to cloud security operations, specifically focusing on access control for users.

Roaming Mantis, the FBI, Magecarts, CloudMensis, FreePBX, Russia, and liquid-cooled laptops, we also have a special guest, Rich Mogull from Firemon on this episode of the Security Weekly News. This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/swn for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly   Show Notes: https://securityweekly.com/swn224

Roaming Mantis, the FBI, Magecarts, CloudMensis, FreePBX, Russia, and liquid-cooled laptops, we also have a special guest, Rich Mogull from Firemon on this episode of the Security Weekly News. This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/swn for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly   Show Notes: https://securityweekly.com/swn224

Roaming Mantis, the FBI, Magecarts, CloudMensis, FreePBX, Russia, and liquid-cooled laptops, we also have a special guest, Rich Mogull from Firemon on this episode of the Security Weekly News.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn224

This week, Tim Woods, VP Technology Alliances at Firemon, joins BSW to discuss how centralized policy management can provide the visibility, enforcement, and compliance of policies across hybrid cloud environments. In the leadership and communications section, 10 Signs of a Good Security Leader, Toxic Leadership: The Four Horsemen of the Apocalypse, Know Them, 3 Ways to Take Control of Your Cyber Security Career in 2022, and more! With an ever expanding perimeter, how do organizations address the challenges of hybrid cloud? New threats, increased complexity, and continued fragmentation of security responsibilities makes it harder than ever.   Show Notes: https://securityweekly.com/bsw259 Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

This week, Tim Woods, VP Technology Alliances at Firemon, joins BSW to discuss how centralized policy management can provide the visibility, enforcement, and compliance of policies across hybrid cloud environments. In the leadership and communications section, 10 Signs of a Good Security Leader, Toxic Leadership: The Four Horsemen of the Apocalypse, Know Them, 3 Ways to Take Control of Your Cyber Security Career in 2022, and more! With an ever expanding perimeter, how do organizations address the challenges of hybrid cloud? New threats, increased complexity, and continued fragmentation of security responsibilities makes it harder than ever.   Show Notes: https://securityweekly.com/bsw259 Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

With an ever expanding perimeter, how do organizations address the challenges of hybrid cloud? New threats, increased complexity, and continued fragmentation of security responsibilities makes it harder than ever. Tim Woods, VP Technology Alliances at Firemon, joins BSW to discuss how centralized policy management can provide the visibility, enforcement, and compliance of policies across hybrid cloud environments.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw259

With an ever expanding perimeter, how do organizations address the challenges of hybrid cloud? New threats, increased complexity, and continued fragmentation of security responsibilities makes it harder than ever. Tim Woods, VP Technology Alliances at Firemon, joins BSW to discuss how centralized policy management can provide the visibility, enforcement, and compliance of policies across hybrid cloud environments.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw259

It doesn't matter how much security technology you have, how much you spend on security: security outcomes are achieved by doing all the little things right. You can spend $10M on network security technology from any vendor, but you will fail to effectively secure your enterprise if you don't properly manage the policy enforced by those firewalls. That sounds really simple, but simple doesn't scale. If you only have a few firewalls with policies consisting of tens of rules, it may be simple. But imagine an enterprise that has 2,000 firewalls, each firewall has a policy with an average of 500 rules, each rule has an average of 15 objects, each source and destination object represent an average of 50 IP addresses. This enterprise is managing, 2,000 firewalls, 1 million rules, 125 million connections, representing over 300 billion access paths. And just 1 wrong rule could expose the network to compromise.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw254

It doesn't matter how much security technology you have, how much you spend on security: security outcomes are achieved by doing all the little things right. You can spend $10M on network security technology from any vendor, but you will fail to effectively secure your enterprise if you don't properly manage the policy enforced by those firewalls. That sounds really simple, but simple doesn't scale. If you only have a few firewalls with policies consisting of tens of rules, it may be simple. But imagine an enterprise that has 2,000 firewalls, each firewall has a policy with an average of 500 rules, each rule has an average of 15 objects, each source and destination object represent an average of 50 IP addresses. This enterprise is managing, 2,000 firewalls, 1 million rules, 125 million connections, representing over 300 billion access paths. And just 1 wrong rule could expose the network to compromise.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://securityweekly.com/bsw254

Managing firewall rule reviews, especially for PCI-DSS, can be complex but it doesn't have to be. Hear from Jeff Styles as he talks about how you can automate this process to keep you compliant and secure.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw264

Managing firewall rule reviews, especially for PCI-DSS, can be complex but it doesn't have to be. Hear from Jeff Styles as he talks about how you can automate this process to keep you compliant and secure.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/esw for all the latest episodes! Show Notes: https://securityweekly.com/esw264

Rich joins us to discuss the differences in managing security policies between on-premises network environments and the cloud and the impacts that has on companies that are 100% cloud-based. He'll also be discussing the additional considerations that these organizations need to consider if they are considering SASE and SD-WAN to expand network access for their users.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw730

Rich joins us to discuss the differences in managing security policies between on-premises network environments and the cloud and the impacts that has on companies that are 100% cloud-based. He'll also be discussing the additional considerations that these organizations need to consider if they are considering SASE and SD-WAN to expand network access for their users.   This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw730

This week, we start the show off with the Security News for this week: Was It Russia?, Blocking software updates, crowd-sourced attacks, protecting FPGAs, moving Linux to modern C, Nvidia hit, the split of cyber criminals, Namecheap banning, Anonymous declares war, the Alan framework, and leaving your Docker port exposed... & more! Next up, we welcome Alissa Torres, Senior Threat Hunter at Palo Alto Networks, to explain how to “Hack the Hiring Process”! Last up, the a pre-recorded interview featuring Rich Mogull from FireMon, to discuss The Unique Challenges of Companies Born in the Cloud!   Show Notes: https://securityweekly.com/psw730 Segment Resources: Alissa's class with Antisyphon InfoSec Training **Advanced Endpoint Investigations** - https://www.antisyphontraining.com/advanced-endpoint-investigations-w-alissa-torres/ Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/psw for all the latest episodes! Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

This week, we start the show off with the Security News for this week: Was It Russia?, Blocking software updates, crowd-sourced attacks, protecting FPGAs, moving Linux to modern C, Nvidia hit, the split of cyber criminals, Namecheap banning, Anonymous declares war, the Alan framework, and leaving your Docker port exposed... & more! Next up, we welcome Alissa Torres, Senior Threat Hunter at Palo Alto Networks, to explain how to “Hack the Hiring Process”! Last up, the a pre-recorded interview featuring Rich Mogull from FireMon, to discuss The Unique Challenges of Companies Born in the Cloud!   Show Notes: https://securityweekly.com/psw730 Segment Resources: Alissa's class with Antisyphon InfoSec Training **Advanced Endpoint Investigations** - https://www.antisyphontraining.com/advanced-endpoint-investigations-w-alissa-torres/ Visit https://securityweekly.com/firemon to learn more about them!   Visit https://www.securityweekly.com/psw for all the latest episodes! Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Kristen is an experienced executive sales leader with a demonstrated success in building teams, large-scale transformation, strategy, program execution, operational excellence, solution selling, acquiring new markets, and accelerating growth. FireMon is the leading network security policy management company that delivers continuous security for hybrid enterprises through a powerful fusion of vulnerability management, compliance, and orchestration. In her role, Kristen leads a team of business development reps and territory sales managers. Prior to joining FireMon, Kristen was the VP of the North America Inside Sales organization for HPE, where she was responsible for building a best-in-class, high-performing sales culture. Kristen serves as the President of the Dallas Chapter for the American Association of Inside Sales Professionals (AA-ISP) and is a proud member of the Executive Advisory Board for the Sales Program at University Texas Dallas. Kristen is a Magna Cum Laude graduate of Bentley University, where she earned a B.S. in Marketing and Spanish. Send in a voice message: https://anchor.fm/salescommunity/message

Today, we're speaking with Kristen Twining, Vice President Of Business Development/Inside Sales at FireMon.   Kristen leads two teams and she's actively recruiting.   So what is her role? What role does BD and Inside sales play? How is Kristin finding and nurturing sales talent  What's her take on the growth of Digital Sales? What does it mean to her to be a coach to her team?   All this and more on today's episode.   Check it out now!

After getting by with a home-grown partner automation tech stack, FireMon switched to an Impartner professional partner automation platform. Doing so helped the company scale globally and better serve partners worldwide, says Alex Iversen, Director of Field and Channel Marketing. In this Lessons from the Edge Video (LFTE), Iversen describes FireMon's history and footprint in the channel, and its steps to stimulate more through-channel marketing with Impartner Channel Evangelist T.C. Doyle. Don't miss the conversation.

Today we are talking to Tim Woods, the VP of Technology Alliances at FireMon.  And we discuss how FireMon is bringing simplicity to enterprise cyber security, why you should never be afraid to make mistakes, and what the future looks like for enterprise network security. All of this, right here, right now, on the Modern CTO Podcast!

Overview:This week, we've got another great episode for you with Kristin Twining, VP of business development and inside sales for FireMon. She spent most of her career at Hewlett Packard Enterprise where she started off as an individual contributor, then moving into leadership, and ultimately running the inside sales organization at FireMon. We talk about lessons field sales can learn from inside sales and about how to manage a career and a family.What You'll Learn Kristin's remarkable career in salesLessons from inside sales mid-pandemicKristin on the future of salesHow to succeed at home and at work Follow in Kristin's footstepsShow Agenda and TimestampsShow Introduction [00:10]About Kristin Twining and FireMon [2:03]Lessons from inside sales mid-pandemic [18:50]Kristin on the future of sales [23:04]How to succeed both at home and at work [26:32] Follow in Kristin's footsteps [33:36]Sam's Corner [37:25] 

Overview: This week, we've got another great episode for you with Kristin Twining, VP of business development and inside sales for FireMon. She spent most of her career at Hewlett Packard Enterprise where she started off as an individual contributor, then moving into leadership, and ultimately running the inside sales organization at FireMon. We talk about lessons field sales can learn from inside sales and about how to manage a career and a family. What You’ll Learn Kristin's remarkable career in sales Lessons from inside sales mid-pandemic Kristin on the future of sales How to succeed at home and at work Follow in Kristin's footsteps Show Agenda and Timestamps Show Introduction [00:10] About Kristin Twining and FireMon [2:03] Lessons from inside sales mid-pandemic [18:50] Kristin on the future of sales [23:04] How to succeed both at home and at work [26:32] Follow in Kristin's footsteps [33:36] Sam’s Corner [37:25]

Evil Corp seems to have been shuffling through some newspaper sites. Don’t take the gangs’ communiqués at face value, but some appear to be trolling for unprotected MongoDB databases. A look at Taurus, an information-stealer being sold in criminal-to-criminal markets. Chinese law and online security. The EARN-IT Act is being debated. Justin Harvey on “Smishing”. Our guest is Jeff Styles from FireMon on COVID-19 increasing misconfiguration risks. And there’s trouble in Tilted Towers. For links to all of today's stories check out our CyberWire daily news brief: https://www.thecyberwire.com/newsletters/daily-briefing/9/128

All links and images for this episode can be found on CISO Series (https://cisoseries.com/defense-in-depth-hybrid-cloud/) The consistency of your security program becomes a challenge once you introduce the cloud. Controls and visibility are not necessarily transferable. How do you maintain the control you want in a hybrid environment? Check out this post for the basis for our conversation on this week’s episode which features me, special guest co-host Taylor Lehmann (@BostonCyberGuy), vp, CISO, athenahealth, and our sponsored guest, Chris Meenan (@chris_meenan), director, offering management and strategy, IBM Security. Chris Meenan, director, offering management and strategy, IBM Security, David Spark, producer, CISO Series, Taylor Lehmann, vp, CISO, athenahealth. Thanks to this week's podcast sponsor, IBM Security. IBM Security offers one of the most advanced and integrated portfolios of enterprise security products and services. The portfolio, supported by world-renowned IBM X-Force research, provides security solutions to help organizations stop threats, prove compliance, and grow securely. IBM operates one of the broadest and deepest security research, development and delivery organizations. It monitors more than two trillion events per month in more than 130 countries and holds more than 3,000 security patents. On this episode of Defense in Depth, you’ll learn: Moving to the cloud, like any other technology initiative, is a business decision. What controls are you ceding over to the cloud provider? What service level agreements (SLAs) and performance measurements do you have for the provider? Be realistic about what’s going to be done if a service provider violates the SLA. You’re not going to all of a sudden dump the provider. You’re going to put some types of corrections in place. Make sure you know what those are and how that can be handled, realistically. Understand your shared responsibility in the cloud. According to a report by FireMon on hybrid cloud use and adoption, about one-third do not fully understand the shared responsibility model of the cloud. Start slow. While you may need to go with multiple cloud providers to fill distribution and requirements, begin with one and learn from that experience. Use cloud adoption as an excuse to join forces with your privacy team to understand where data is being placed and what control you have over it. Cloud providers are not interchangeable like a utility. Cloud providers are chosen based on the services they offer.  

All links and images for this episode can be found on CISO Series (https://cisoseries.com/trust-me-were-using-advanced-ai/) We're looking for a good reason to trust your AI on the latest CISO/Security Vendor Relationship Podcast. This episode was recorded in front of a live audience at Evanta's CISO Executive Summit in San Francisco. It is hosted by me, David Spark (@dspark), producer of CISO Series and founder of Spark Media Solutions and Mike Johnson. Our guest this week, is Jimmy Sanders (@jfireluv), head of information security, Netflix DVD. Mike Johnson, Jimmy Sanders, head of information security, Netflix DVD, and David Spark Thanks to this week's podcast sponsors: Trend Micro, SentinelOne, and FireMon.  FireMon provides persistent network security for hybrid environments through a powerful fusion of real-time asset visibility, continuous compliance and automation. Since creating the first-ever network security policy management solution, FireMon has delivered command and control over complex network security infrastructures for more than 1,700 customers. Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information. Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud environments, networks, and endpoints. For more information, visit www.trendmicro.com. Are you looking to leave legacy antivirus? Proactively protect every device in realtime with AI. Deploy SentinelOne for EPP, EDR, IoT, and container security today. Autonomous technology is the future. We deliver it now across your endpoints, servers, cloud workloads, and IoT devices. What we’ve got here is failure to communicate Is the privacy message getting out to the right people? I argue we need to go to the source and we're not. I was at Dreamforce, the Salesforce conference, and I got the sense I was the only person of the 100K people there that didn't want to be scanned. This crowd is obsessed with the collection of personal data given this conference is mostly about how do I create greater understanding from personal data. Are we as security people in a bubble in this privacy conversation? We need to go to the source of the people who are actually collecting the data and I'm getting the sense we're not getting through. Are we making the situation better or worse? We've talked a lot about AI on this show, and many vendors are selling intelligent solutions, but the factor that seems to hang up usage is trust. Cyber professionals don't think twice about trusting their AI-powered spam filter, but so many other tools are met with skepticism. What's missing from the vendor side and what trust barriers are practitioners putting up? What should the barometers be for trusting AI? What's Worse?! Two bad types of people wanting to do you harm. Which one is worse? Is this the best solution? Should you hire staff from companies that have fallen victim to cybercrime? According to a study by Symantec and Goldsmiths, University of London, as reported by ZDNet, more than half of respondents said they don't discuss breaches or attacks with peers. And more than a third said they fear that sharing breach information on their organization would negatively impact their future career prospects. I would think that asking a prospect, "Have you lived through a breach and how did you handle it?" would be very revealing. Mike? Security Squares: Where CISOs Put Vendors in Their Place A brand new game that asks CISOs how well do they know the vendor landscape? It’s time for the audience question speed round Our audience has questions, and our CISOs will have answers.  

In the Enterprise News, hundreds of laid off by Symantec as part of restructuring plan, Infection Monkey Industries first Zero Trust Assesment Tool, Shape Security eyes IPO after raising 51 million at 1 billion evaluation, Lacework secures $42 Million and adds new president, board members and customers, and FireMon announced the introduction of FireMon automation, and more! Full Show Notes: https://wiki.securityweekly.com/ES_Episode154 Visit https://www.securityweekly.com/esw for all the latest episodes!

In the Enterprise News, hundreds of laid off by Symantec as part of restructuring plan, Infection Monkey Industries first Zero Trust Assesment Tool, Shape Security eyes IPO after raising 51 million at 1 billion evaluation, Lacework secures $42 Million and adds new president, board members and customers, and FireMon announced the introduction of FireMon automation, and more! Full Show Notes: https://wiki.securityweekly.com/ES_Episode154 Visit https://www.securityweekly.com/esw for all the latest episodes!

This week, in our first segment, John Strand talks Attacking AWS: Elastic Map to Reduce Clusters! In the Enterprise News, hundreds laid off by Symantec as part of restructuring plan, Infection Monkey Industries first Zero Trust Assesment Tool, Shape Security eyes IPO after raising $51 Million at a $1 Billion evaluation, Lacework secures $42 Million and adds new president, board members, and customers, FireMon announced the introduction of FireMon Automation, and more! In our final segment, we talk Cloud Security, and what security products you need in the cloud!   Full Show Notes: https://wiki.securityweekly.com/ES_Episode154 Visit https://www.securityweekly.com/esw for all the latest episodes!   Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

This week, in our first segment, John Strand talks Attacking AWS: Elastic Map to Reduce Clusters! In the Enterprise News, hundreds laid off by Symantec as part of restructuring plan, Infection Monkey Industries first Zero Trust Assesment Tool, Shape Security eyes IPO after raising $51 Million at a $1 Billion evaluation, Lacework secures $42 Million and adds new president, board members, and customers, FireMon announced the introduction of FireMon Automation, and more! In our final segment, we talk Cloud Security, and what security products you need in the cloud!   Full Show Notes: https://wiki.securityweekly.com/ES_Episode154 Visit https://www.securityweekly.com/esw for all the latest episodes!   Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Russia says shrapnel from America’s war on that nice company Huawei is “destroying the world.” Russia also tells Tinder to fork over user pictures and messages. A Recorded Future study outlines the case for regarding Huawei as a security risk. US Customs and Border Protection discloses a breach of images collected at a border-crossing point. Crooks are taking advantage of Gmail features. Notes on recent mergers. And the top ten bugs bug hunters are finding. Johannes Ullrich from SANS and the ISC Stormcast podcast on the GoldBrute botnet. Guest is Tim Woods from FireMon reflecting on the past year under GDPR. For links to all of today's stories check our our CyberWire daily news brief: https://thecyberwire.com/issues/issues2019/June/CyberWire_2019_06_11.html  Support our show

On this episode of IoT Time Podcast, Ken Briodagh, editorial director at IoT Evolution (iotevolutionworld.com), sits down with Reggie Best (reggie.best[at]firemon[dot]com), president and Chief Product Officer, Lumeta at Firemon(firemon.com), to talk about network and IoT security, from the endpoints at the edge to the cloud and everywhere in between. Please check out "IoT Time: Evolving Trends in the Internet of Things," a book by Ken Briodagh about the ongoing influences shaping the IoT. To get a copy, it is available on Amazon for $14.99 (a.co/d/8neDtlu). Don't forget to subscribe! To become a sponsor of IoT Time, please email kbriodagh@tmcnet.com or tweet @KenBriodagh.

In this DevOps chat we speak with our old friend Tim Woods, VP of technology alliances at Firemon. Firemon's mission has moved beyond the management of the firewall to managing your security. Recent acquisitions have enabled them to offer comprehensive security management across the entire hybrid environment. Tim and I discuss the current state of technology and what large enterprises are looking for their hybrid environments. Great conversation!

Symantec boosts security with Javelin Networks, ThreatQuotient integrates Verified Breach Intelligence from Visa, FireMon delivers hybrid cloud security with new visibility and orchestration, StackPath partners with Sectigo, and we have some acquisition & funding updates from Veracode, Shape Security, Thoma Bravo, and more! Full Show Notes: https://wiki.securityweekly.com/ES_Episode114 Visit http://securityweekly.com/esw for all the latest episodes!

Symantec boosts security with Javelin Networks, ThreatQuotient integrates Verified Breach Intelligence from Visa, FireMon delivers hybrid cloud security with new visibility and orchestration, StackPath partners with Sectigo, and we have some acquisition & funding updates from Veracode, Shape Security, Thoma Bravo, and more! Full Show Notes: https://wiki.securityweekly.com/ES_Episode114 Visit http://securityweekly.com/esw for all the latest episodes!

This week, Paul and Matt Alderman interview Harry Sverdlove, Chief Technology Officer at Edgewise to talk about Zero Trust Segmentation! In the Enterprise News this week, Symantec boosts security with Javelin Networks, ThreatQuotient integrates Verified Breach Intelligence from Visa, FireMon delivers hybrid cloud security with new visibility and orchestration, StackPath partners with Sectigo, and we have some acquisition & funding updates from Veracode, Shape Security, Thoma Bravo, and more!   Full Show Notes: https://wiki.securityweekly.com/ES_Episode114 Visit https://www.securityweekly.com/esw for all the latest episodes! Visit https://www.activecountermeasures/esw to sign up for a demo or buy our AI Hunter!   Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

This week, Paul and Matt Alderman interview Harry Sverdlove, Chief Technology Officer at Edgewise to talk about Zero Trust Segmentation! In the Enterprise News this week, Symantec boosts security with Javelin Networks, ThreatQuotient integrates Verified Breach Intelligence from Visa, FireMon delivers hybrid cloud security with new visibility and orchestration, StackPath partners with Sectigo, and we have some acquisition & funding updates from Veracode, Shape Security, Thoma Bravo, and more!   Full Show Notes: https://wiki.securityweekly.com/ES_Episode114 Visit https://www.securityweekly.com/esw for all the latest episodes! Visit https://www.activecountermeasures/esw to sign up for a demo or buy our AI Hunter!   Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Today we are going to demonstrate how to capture the attention of customers and prospects with great marketing campaigns. Campaign budgets are limited and these campaigns need to generate revenue. The emerging best practice for planning campaigns requires a scientific approach to dial in the results. Today’s show provides the definitive guide to campaign planning from the first step through the entire campaign planning process. To assess your overall Marketing Strategy, spend a few minutes leveraging SBI's new Revenue Growth Diagnostic tool to pinpoint keys to your success.  Our guest is Michael Callahan the Chief Marketing Officer for Firemon, one of the hottest cyber security firms performing enterprise security management. Firemon helps organizations with complex IT environments keep the bad guys out by providing a single view of what's going on in someone's infrastructure. Today we are going to demonstrate how to capture the attention of customers and prospects. Why this topic? Every market has a “sweet spot.” Campaigns (and their budgets) generate revenues when focused directly at this “sweet spot.” Campaigns that are not hyper-targeted do not. To generate a return on marketing campaign dollars requires a clear objective, timeline, budget, accurate lists, correct media mix and compelling calls to action. To facilitate the conversation, we will display SBI’s campaign planning tool on the screen to provide structure to the conversation.   In the first segment of the program, Michael will describe how to develop campaign objectives, timelines, budget and expected results for each campaign. The conversation extends to the approach for defining the addressable markets and how do you allocate campaign resources (i.e., people, money, and time) against the “sweet spot” in the addressable markets.  Michael demonstrates how to ensure that marketing campaigns have clear value proposition and the process for reviewing creative.  There are multiple program types that a marketing team can run in a campaign, and Michael breaks down the approach to the different types of campaigns including:  Awareness, Cross sell, New logo, Competitive replacement, Renewals, Migration, and Nurture. The best practice is to focus on one.  Michael outlines the mix of activities and how to sequence them correctly, as well as how to create compelling offers to drive response.  Michael describes how to assign enough content assets and map the assets to the buyers’ journey. The importance is described in this quote:  “People simply don't have time to figure things out. You may have rock-solid proof, logic-built message – and there's no way that anybody could ever dispute any part of it. But it's so complicated that no one knows what you're talking about and they just move on, because they have a million things to do – furthermore, there's other people in your space that are saying it more clearly. People have choices, you must give them a reason to choose you, and you can't expect them to figure it out. You've got to be really clear.” Finally, Michael describes how to create provocative campaigns that are differentiated and drive your campaign message.  This is a can’t miss video for every marketing leader to review and share with your team. 

In today's podcast, we hear that the FBI and the Department of Homeland Security have warned that Hidden Cobra actively pursuing DDoS campaigns. Microsoft patches remaining ShadowBrokers' exploits, even in deprecated systems. The US Congress votes to sanction Russia for election influence operations. Those operations have a long, long history, going back to the 1930s at least. Electrical and natural gas sectors work to protect themselves against CrashOverride. Emily Wilson from Terbium Labs reminds us not to forget the basics. Michael Callahan from Firemon shares survey data suggesting that IT pros spend too much time fixing their coworkers personal devices. Mergers and acquisitions seem to be followed by layoffs—Hexadite is said to be the latest case.

HP debuts new IoT devices, Bitdefender’s second BOX is here, FireMon announces support for Check Point R80, and more. Full Show Notes: http://wiki.securityweekly.com/wiki/index.php/ES_Episode28 Visit http://securityweekly.com/esw for all the latest episodes!

Michael Santarcangelo joins Paul and John to discuss cyber insurance. In this week’s news, HP debuts new IoT devices, Bitdefender’s second BOX is here, FireMon announces support for Check Point R80, and more!

HP debuts new IoT devices, Bitdefender’s second BOX is here, FireMon announces support for Check Point R80, and more. Full Show Notes: http://wiki.securityweekly.com/wiki/index.php/ES_Episode28 Visit http://securityweekly.com/esw for all the latest episodes!

Michael Santarcangelo joins Paul and John to discuss cyber insurance. In this week’s news, HP debuts new IoT devices, Bitdefender’s second BOX is here, FireMon announces support for Check Point R80, and more!

On this week’s episode of Smart Companies Radio with host, Kelly Scanlon, you’ll meet Gary Fish, CEO, and Founder of Fishtech Labs; Founder, former CEO, Chairman of the Board of Fishnet Security; and Founder and Chairman of the Board, Firemon. Fish will be recognized November 10th as Regional Entrepreneur by UMKC’s Henry W. Bloch School of Management. Find out what keeps this serial entrepreneur going, what motivates him and what’s next on the horizon. You’ll also meet Jeff. Hornsby who assumed the role of Executive Director of the Regnier Institute for Entrepreneurship and Innovation in 2014 and is Chair of the Department of Global Entrepreneurship and Innovation in He’ll discuss this year’s award recipients and take a look at the 31 YEARS OF FEARLESS ENTREPRENEURS who teach and inspire other budding entrepreneurs to live fearlessly. To hear shows with host Kelly Scanlon, please visit our archives. Learn more about your ad choices. Visit megaphone.fm/adchoices

Carahsoft Adds Okta ID, FireMon acquires FortyCloud, Why Juniper Networks, Inc. stock soared today, and much more, here on Enterprise Security Weekly! Full Show Notes: http://wiki.securityweekly.com/wiki/index.php/ES_Episode20 Visit http://securityweekly.com/esw for all the latest episodes!

Carahsoft Adds Okta ID, FireMon acquires FortyCloud, Why Juniper Networks, Inc. stock soared today, and much more, here on Enterprise Security Weekly! Full Show Notes: http://wiki.securityweekly.com/wiki/index.php/ES_Episode20 Visit http://securityweekly.com/esw for all the latest episodes!

Carahsoft adds Okta ID, FireMon acquires FortyCloud, why Juniper Networks stock soared today, and much more. Stay tuned!

Carahsoft adds Okta ID, FireMon acquires FortyCloud, why Juniper Networks stock soared today, and much more. Stay tuned!