×

The Future of Asset Management

Asset management is a growing area in the Cyber Security industry. On Episode 12 of The Cyber Security Matters Podcast we were joined by Huxley Barbee, a CISSP and CISM. He is currently a Security Evangelist at runZero, which is the latest role in a glowing career in the cyber security industry. We spoke to Huxley about the advancements he’s seeing in the asset management sector, including his predictions for the future.

How do you see Asset Management evolution over the next few years?

There have been a number of technological trends that have caused a divergence of environments. For example, smart speakers like your Alexa are changing our home environments, because this tech used to be simple, non-connected devices. Now they’re connected to the internet, which exposes you to a higher risk. There’s also been a rise of ‘bring your own device’ culture, where people bring their own phones and tablets to the corporate network. There’s also the move to cloud associated with the DevOps revolution. 

A lot of companies will see the cloud as a way of transforming their capabilities to both lower costs and increase speed and agility. Folks are empowered to just spin up new computing devices left and right, but the old devices are not actually decommissioned, so you have a sprawl of this attack surface out in the cloud as well. There are also more and more mergers and acquisitions happening, where a purchasing company has to take on the risks and vulnerabilities in the target company. All these different trends have led to this divergence of environments where companies are not just protecting their corporate IT assets, but also their OT, the factory, their IoT devices, your personal devices, the cloud and whatever else goes on in remote employees homes. 

Because of a need to find talent, organisations have started looking at a wider geographic spectrum, and a rise in this ‘work from home’ culture became compounded by the pandemic. That is now also part of what cyber security needs to protect. Over the last 20 years, this evolution of assets has resulted in a decentralisation of control. Meanwhile, it’s the same security team that’s being expected to protect all that. There are numerous statistics out there about how the number of devices connected to the internet is going to continue to go up. Security teams will be more and more challenged, which is a fundamental problem. If you don’t have this foundational capability of knowing what you have, you are absolutely not protected. We’re going to have to see some change in order to address this growing challenge. 

How can the industry address those issues? 

There are a number of different approaches that have been tried over the last 20 years. There’s the use of agents and authenticated active scans, but they don’t solve the problem of unmanaged devices. If you can put software on a machine, then it probably needs managing. There are other vendors who try and pull data from multiple other sources to try and cobble together some sort of asset inventory. The trouble is, if they’re pulling from limited data sources, they’re not really solving the problem of unmanaged devices either. There’s also a passive network monitor, which theoretically can learn about more devices on the network, but its ability to identify those assets correctly is limited, because it’s only looking at network traffic to make that determination. There’s another approach, which is using an unauthenticated scanner with a security research-based approach for fingerprinting alongside API integrations. We found that this is the winning combination to help you get both breadth and depth of your assets, no matter where they are, no matter what type they are. 

To learn more about asset management, tune into The Cyber Security Matters Podcast here

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Dangers of Unsecured Data

On Episode 11 of The Cyber Security Matters Podcast we spoke to the incredible Dr. Rebecca Wynn about how we can all manage our privacy online. Dr. Wynn is an experienced global CISO and privacy expert, often named as one of the top women in Cyber Security. She has led large security teams in the investment and medical sectors and is currently consulting enterprise clients on their security strategies. 

Can you tell us about the challenges covid posed for the healthcare sector from a security perspective? 

Before covid we had a centralised workforce that was covered by certain policies and protocols within the business. Once people started working remotely, and in some cases in other countries, that situation changed. We were outsourcing our data protection and people didn’t have the same protections at home. People started working in shared spaces with people outside of the organisation. With these new conditions, companies need to look at how they are protecting their sensitive information, as well as that of their clients. 

One thing I did is look at cyber liability insurance. I met with external certification organisations, and we identified the safeguards I could put in place. I took our top 15-20 clients and walked them through our findings, and the majority of them asked me to quickly rebuild their security with a strategic plan, technical plan, and operational plan. It was a long process, and it cost me a lot of sleep, but we’ve helped protect people now. 

When you talk about the changes we’re seeing from covid, we’re still seeing fallout from leaders who didn’t realise the additional residual risks that they were accepting. One thing I do notice consistently, is people not sharing the information that you need to know or telling colleagues what their blast radius is in the organisation. It’s all about managing risk. That’s the one thing I still see from a younger generation, they don’t know how to communicate that risk and things along those lines. CISOs don’t want to be the scapegoat officer, so we need to be more watchful than we were before. 

How do you see the concept and the practical application of privacy evolving in this data-driven society?

One of the biggest problems with data privacy is developing a global set of privacy regulations. There’s so much red tape that you have to get through at the moment because everywhere has different legislation. 

Another challenge is that data is being created but it’s not tagged. Does it have sensitive information in it? We wouldn’t know. If we could tag information with expiration dates and a level of privacy, we could handle it better. If you’re talking about healthcare, you should be able to say ‘it’s printed on this day, and it will absolutely expire in seven years’. The other thing is that once that data is created somewhere, it’s in your environment. Data gets shared through companies’ internal systems, which is a massive problem unless you can embed some sort of privacy key. If you could do that it would act like a GPS signal in your database. You could follow that, expire it or see if the data went to someone who’s not supposed to get it. That’s the kind of thing you need to do if you want to get a handle on privacy. 

One of the scariest things right now is when people are creating avatars and stuff like that. To do that you upload 23 of your pictures, and then your biometrics are out there. People aren’t thinking about where their data goes when they do that. 

It’s really hard to be invisible in the world today. Even if I’m not personally on social media, if someone takes my picture and tags me in it, I’m there anyway. They’re commingling their data with mine, and so on. It’s scary how much of our data is out of our control. 

To hear more about how our data is being used, tune into The Cyber Security Matters Podcast here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Impact of Distributed Ledger Technology on the Cyber Security Industry

On The Cyber Security Matters Podcast we were delighted to be joined today by Marco Pineda, an international CISO with a particular specialism in the finance industry. Episode 10 saw us unpacking Marco’s 20 years of experience in information security and talking about the security impact of DLTs. Read on for his insights into the changes coming to the industry following recent concerns around blockchain and crypto. 

What does distributed ledger technology (or DLT) and its applications mean for the future of the global financial industry?

As far as DLT is concerned, you need to understand what the application is. They’re great technologies for environments with a low trust atmosphere, such as cross-border cooperation or between companies where you need an intermediary to provide that trust. It’s a very interesting kind of technology. One of the best uses of DLTs is cross-border customs and documentation for bills of trading. Each government has their own systems, and people need to know how to get documents across that each government will trust. 

What are the security challenges that these technologies present?

It’s mostly the distribution, but understanding and the maths behind it is certainly a challenge too. There’s the additional concern that your system might be sitting on top of other systems that you don’t control at all. That’s an interesting risk facet that might be unique to the DLT area, because if I put a ledger out there, by definition, somebody else is managing that ledger. They’ve got their own machine. They’re taking care of it themselves. It’s their copy of it. I haven’t yet heard a good risk analysis on what that actually means for a company. 

How can security frame itself more positively to help enterprises reach their financial goals, instead of being viewed as a cost centre?

We can take a cue from our colleagues who are trying to see how they fit in with the overall business strategy. You need to show your value to the company, which comes from looking at your portfolio of services / products, and seeing how they can support the business’ strategy. Take some initiatives here and there, offer people proposals. At the end of the day, you need to prove your direct business impact. That means doing things like protecting documents so that your business can ship information and do secure collaboration. Those are the things that security professionals can do that helps a business directly. Get creative, take a look at what your skill sets are, what your services have, and see how they might be able to support the business in their goals. 

To hear more about the impact of Cyber Security in your business, tune into the full episode of The Cyber Security Matters Podcast here

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Unpacking Vulnerability Management 

On Episode 9 of The Cyber Security Matters Podcast we spoke to Jennifer Cox, the Head of Communications at Cyber Women Ireland, about her work with vulnerability management in the sector. Jennifer is a multi-award winning advocate for women in tech, using her knowledge to mentor women as they join the workforce. She also speaks at global events, bringing her expertise to a wider audience. 

Read on for Jennifer’s insights on vulnerability management in the Cyber Security industry.

What do you think are the three big takeaways on vulnerability management?

At the core of vulnerability management, you need to be able to identify where you’ve got problems. It’s not just laptops, it’s every device that’s possibly connected to the internet. You need to focus on what’s important to remediate first. Vulnerabilities are growing almost exponentially, but the teams that handle those issues aren’t growing the same way. The challenges are not always exclusive to the products that we sell – many times you’ve only got two people on the team, but 40,000 vulnerabilities that you need to fix. 

How do you think vulnerability management is changing in today’s world? 

What’s changed most dramatically since COVID is this overnight remote workforce. Companies no longer have control over every single device on the network, and more and more people are bringing their own device into the office. Companies still need to make sure that those devices are secure. When people are at home they often have wide open home networks. We’re improving education around vulnerabilities and teaching individuals how to put better practices in place at home. People forget that web applications are also vulnerability risks, so they haven’t included them when they’re doing the assessment of their mobile devices, which is a huge factor. Having a team to do vulnerability management within the team is probably the biggest change. 

What do you think is the biggest obstacle to vulnerability management as a whole?

Hands down it’s budgets and bodies. When you don’t get reports about anything going wrong and being fixed by the cybersecurity team, you often don’t appreciate that the team is doing a really great job. If you’re hearing from your cybersecurity team, then there’s a problem – they’re either understaffed or under-educated so they’re struggling to cope. That silence is a problem, because when companies are trying to strip back budgets, they’ll look at reducing that team because it’s quiet. That’s actually the worst thing that they can do, because that’s the team that’s protecting them the most.

The challenge has been resources all the way along. We don’t have enough people to remediate all these issues. What you’ll do in that case is educate your team on prioritisation using a scoring system called ‘CVSS score’. We also have an algorithm that we use called vulnerability prioritisation rating. It takes the CVSS score and a multitude of other different things into account. Based on all of these things, it tells us what is most likely to become a problem over X number of days. The struggle is that of 40,000 vulnerabilities, 30,000 of those are critical. I can’t remediate 30,000 vulnerabilities in a weekend, but that’s the only time I’m allowed to do it. Add to that things like needing a 99.9% uptime, restarting the server after patches, and that becomes a challenge in itself. 

To hear more about vulnerability management and the work that Jennifer is doing to improve diversity in the industry, listen to The Cyber Security Matters Podcast now. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Diversification of the Cyber Security Industry

On Episode 5 of The Cyber Security Matters Podcast we spoke to Sean Blenkhorn about his experiences in the Cyber Security industry. Sean has worked in cyber for over 20 years, and during that time he has held a variety of strategic leadership roles, from heading pre-sales to taking on Chief Product Officer and Chief Experience Officer positions. Sean is currently Worldwide VP of Sales Engineering for Axonius, where he takes a proactive role in encouraging diversity in the sector, both in the upcoming technologies and in his teams. 

Do you see the diversification and expansion of the security market as a trend is set to continue?

The macroeconomic conditions we’re seeing today will have an impact on that, undoubtedly. We’ll continue to see companies tighten their belts and have to make tough decisions from time to time. There may even be tightening around companies that are getting investment from the VC or private equity firms. However, the industry will continue to grow. Even given all of the macro economic conditions, we’re still seeing good growth compared to businesses outside of technology or security. It’s not as fast as what we want to see, but it’s still crazy growth. You have to keep things in perspective. Tech is the future, and people will want to protect that.

There are still so many opportunities and technologies out there to look at and get involved with. Innovation happens in the startup world, which is where you see diversification come in. People from all over are having these ideas and disrupting the market with their new tech. Typically the model is that the smaller companies innovate, then the larger companies acquire that innovation and take it to the broader market, hopefully in a way that doesn’t destroy the innovation. That’s the way the industry evolves.

How can we diversify the people within the cyber security profession?

It’s going to happen by continuing to break down the barriers. Organisations need to put a real effort into creating diversity. It’s people like myself who are in managing roles and leadership roles that need to focus on diversity. You need to look at your team and understand what’s going to be valuable, and having that diversity of opinions, views and experiences is really important. It’s not just limited in terms of women getting into the roles, but also enabling them to climb the ladder within an organisation. Diversity thrives when leadership organisations put commitment into diversity in that way too. 

We need to build the future generation and we need to have the teams and resources ready to come up behind us. We’re working with educational institutions and working with our teams to make sure that when we’re working with recruiting firms and internal recruiters that we put real emphasis on looking for diversity in our candidates. It starts from the top down, but there’s also the bottom up route of making sure that we’re supporting the next generation of kids. We need to be showing them what those opportunities are in this industry, and that there’s opportunity for everyone. We have to promote diversity at the grassroots level as well.

To hear more news and insights into the cyber security industry, tune into The Cyber Security Matters Podcast from neuco now.

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Including Women in the Cyber Security Industry

Diversity is at the forefront of discussions in recruitment, and in Episode 7 of The Cyber Security Matters Podcast we spoke to Karla Reffold about how we can diversify the sector. Karla is the General Manager at Orpheus Cyber, a Board Advisor and American Cyber Award judge. She has also founded and sold two award winning businesses in the cybersecurity industry, hosted her own podcast, and was one of the top three finalists in the Entrepreneur of the Year category at the Cyber Security Women of the Year awards in 2022. Read on to hear her perspectives on improving representation in the Cyber Security industry. 

Do you think you’ve faced barriers in the industry that your male counterparts haven’t?

It’s hard to know when things aren’t explicit. One of the stories that I tell is from a couple of years ago, when I’d sold the business. I worked in the company that bought us and one of my new colleagues said, ‘You leave early every day to pick your kids up, it must be nice being part time.’ I worked every evening and I was in the office earlier than almost everybody else; I worked a lot of hours. That comment really annoyed me, and I called him out on it. I complained about it and he apologised, but the feeling was that it wasn’t a big deal, I should get over it. I definitely felt that from then on I was seen as a little bit difficult, and that’s really unfair. 

I’m glad I spoke out about it, because there are other people that weren’t in a senior position who wouldn’t have felt that they could say anything. I do feel a responsibility, given that I have a platform and some seniority, to call those things out, even when it’s uncomfortable or they seem small. That one stands out to me, maybe not as a barrier but like one of those negative experiences.

Do you think big vendors and individuals within cybersecurity do enough to tackle the lack of diversity in our market?

I’m not sure vendors do, I think teams do when their clients care about it. What’s interesting now is that you’re seeing a lot of the VCs and private equity firms ask about your diversity stats. They see it as a risk, that’s a really interesting change. Money drives these decisions. It’s relatively easy to stick a load of women in marketing, HR and maybe sales. That’s partly reflective of where the market is right? You can’t always hire people that don’t exist. I don’t see the drive coming from vendors as much as I see it coming from internal security teams.

How has the representation of women changed since you started your career?

It’s definitely improved. I joke that I don’t want it to improve too much because I don’t want to queue for the bathroom. It’s changed across the board. There’s a lot of young women who are studying something cyber related. I think the biggest change for me in the last couple of years has been how many men support diversity initiatives and how many men talk about things. If you’re a man, particularly if you’re a parent, you can now talk about picking your kids up or dropping them at school and I needing some flexibility. That really makes it safe for everybody to do that. I’ve seen some really big positive changes in that way.

What else do you think can be done to encourage minorities into the sector more broadly?

Consider what images you’re using. I haven’t used that image of a man in a hoodie in a dark room for five years, because it’s telling people what we are as an industry. Let’s not have that type of image. That makes a difference. Get rid of degrees as one of your requirements. If you’re getting 300 applicants, you are looking for ways to rule people out rather than rule them in, but white men are earn engineering degrees at 11 times the rate of black women here, so if you’re putting degrees into your hiring process, you are just building in economic discrimination. We know that affects different races differently, so get rid of that. Think about your culture too. Stop making this a recruitment problem. It’s not just ‘Hey, recruitment company, go find me a diverse list of candidates’. It’s actually considering what do you do with those people once you’ve got them. How inclusive is your culture? And how do you make everybody feel like they can be authentic at work? Those are my three quick takeaways.

To get more in-depth about diversity in the industry, tune in to The Cyber Security Podcast here

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Creating Gender-Diverse Communities in the Cyber Security Industry

On The Cyber Security Matters Podcast we often talk about diversity. On Episode 8 of the podcast we spoke to Alexandra Godoi, the Information Security GRC Lead at Oxfam, about the work she does to actively improve gender diversity in the industry. Alexandra was named as one of the Top 30 Female Cyber Security Leaders of 2022, thanks to her work as a speaker and panellist at conferences and her role in increasing awareness around the need for cybersecurity in the world of NGOs. 

Read on to learn more about reducing the gender imbalance in our industry!

What do you think can be done to increase women’s voices and presence in a company?

Designs should influence a company’s decisions in developing products. It’s not just about listening to the women in your company, because they might not have a full picture. Go through that route of participatory design, which is where you go and ask the community, ‘What do you think about this? How would this impact your life? Do you have any concerns?’ Actually talk to people – that will help everybody move towards having security and privacy by design. We have a lot to learn from each other. 

What do you think it means to be a woman in cyber?

I don’t particularly see myself as a woman in cybersecurity, I’m just somebody that works in cybersecurity who cares about human rights issues. I don’t think we should focus on this disparity between men and women, because I’m not doing anything differently than my male counterparts. We’re all here to do our jobs.

What can be done to help address the digital gender gap and internet access imbalance?

There are different aspects that we can look at when we’re talking about the digital gender gap. One of the points that I’ve seen being made is the fact that there are not enough women in STEM, for example, but it runs deeper than that. It depends on the context and where in the world we’re talking about. A good example is that in India and Pakistan, access to technology like mobile phones is reserved to the man of the house. Because of this, women don’t have access to the digital space in the way that their male counterparts do. 

The way technology is designed also puts a lot of pressure on the end user. You are expected to know how a computer works, you’re expected to know what a virus is and how to protect yourself, you’re expected to know that you need to set up strong passwords. Not everybody has access to the same level of education around those topics. Putting that pressure on the end user is not a fair point to start with, because you’re making the assumption that everybody who uses technology has access to equal opportunities.

Diversity is being used as a checkbox by tech giants. How do you think they can better level that diversity playing field?

Creating industry standards for security could be a way to push diversity as a non-political agenda. It is slightly political, because we’re talking about human and digital rights, but it is a way to push for more inclusivity. If we come up with a standard that means security risks are taken into consideration from the get-go, we should push for that, because it removes the pressure from end users and makes the digital space more equitable. 

To hear more about the work that Alexandra and Oxfam are doing to promote human rights in the Cyber Security space, tune into the full episode of The Cyber Security Matters Podcast here

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Securing the API Industry 

On Episode 6 of The Cyber Security Matters Podcast we sat down with Chuck Herrin, the CTO of industry leading API security business WiB. Chuck has over 15 years of experience in senior and board level IT security roles, and now sits as an advisory board member for multiple organisations in the cyber security space. He’s acted as an attacker, defender, and most recently a builder. With so much knowledge and expertise in the space, we were fascinated to hear his insights into the API industry.  

What is your take on the state of the API security space at the moment? 

It’d be great if there was some API security. I’m being flippant, but it’s another example of history repeating. The most recent example of this phenomenon is when we knew for 10 to 15 years that adoption of the cloud was inevitable. There are so many benefits and cost savings, we all knew it was going to happen. For some reason, defenders didn’t try to figure out how to do it safely. They resisted the change. We saw all kinds of issues and eventually had to catch up. People are still really worried about cloud issues. I saw an article that said around 94% of companies anticipate having a cloud breach in the next 12 months.  

API’s are experiencing the same phenomenon. The adaptation is inevitable because the benefits are massive. There’s no way that we aren’t going to rapidly continue to adopt API and micro service based architectures. The point of business isn’t security, the point of business is delivering value. If you aren’t adopting APIs and micro services, you’re gonna be out-competed and you won’t survive, and if you adopt it incorrectly or insecurely, you’re exposing your back end systems, data and business logic. Adoption right now is rapidly outpacing security.  

We’ve been doing threat modelling for 20-25 years, and we know that you need to know your assets, actors, interfaces and actions in any environment or ecosystem. Then you see who’s doing what to what, via what, and the AI and API interface. Lots of API’s are completely unmanaged and unmonitored. APIs and their adoption made it around the world before security teams got their boots on. Now we’re frantically trying to help companies catch up and keep up. It’s like a one legged man chasing a rabbit, the longer it goes on, the further apart they’re getting. While we’re working really hard to solve these problems at a macro level, it’s only getting worse. We’re not catching up.  

Where do you see the API security space in 10 years time? 

I really hope that we can close these blind spots and treat API security the way we should.  API’s exist to make developers jobs easier, and they do a great job of that, but if you don’t know what’s exposed to the outside world, you can’t monitor it or manage it. We’ll catch up eventually because we have to.  

What I’m hoping for in the interim period is that we don’t have massive national crises, critical infrastructure implications or life safety issues. There are safety issues at the individual level where people’s data is exposed. Bad actors could figure out how to abuse these API’s and target API abuse at political figures.  We have critical infrastructure issues with with water treatment, or the power grid, or nuclear plants where a lot of companies that have been around a while are going to introduce APIs to their systems and there will be a risk. I worry about those attack surfaces more as a citizen than a software vendor, because if something goes wrong there we’re going to have to figure this out as a species. I hope we can address these security risks before that happens. 

To hear more about the state of the API industry and Chuck Herrin’s work in protecting it, tune into the full episode of The Cyber Security Matters Podcast.  

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Indian Cyber Start-Up Scene 

On our first episode of The Cyber Security Matters Podcast, we were delighted to be joined by Girish Redekar, Co-Founder of Sprinto.  

His trajectory is incredible – from starting, scaling, and exiting RecruiterBox through to now growing Sprinto, all in less than a decade. 

We hope you enjoy listening to this episode as much as we did recording it.  

Why is India such a major innovation hub for the startup/cybersecurity space? 

“Great question. So, I’m definitely not an expert in the area. But basically, whatever I know, is just viscerally connecting with other Founders that I see in the ecosystem.  

And one of the things that’s really happening in India, is that there is a sudden exponential increase in just the sheer number of startups that you see in the space. They’ve entered mainstream, so to speak. So, you take a national daily and there’s basically a page which is dedicated to startups and the funding rounds that have happened and what’s going on over there.  

So, I remember the time when we started our previous company, which was back in 2008. And I didn’t know that what I was doing was a startup, we thought we were just doing a business and the word startup hadn’t entered our vocabulary yet.  

Fast-forward to about 14 years later, it’s really definitely entered the mainstream. You know, mindspace people talk about it, it’s very common – my neighbour next door in my apartment is another startup founder.  

Especially in some places like Bangalore and Pune and Gurgaon and some places, there are startup hubs, and it’s very common for you to find startups over there. And that sort of brushes over any aspect of startups. So, you have a very thriving consumer startup business. But we have a lot of b2b startups as well.  

And that touches on cybersecurity as well. So, I’m seeing a lot of interesting Cybersecurity startups coming from in the country, including those who are working in spaces like privacy. Some of them were working in spaces related to password protection, and so on, so forth. Therefore, that sort of grabs on to pretty much all the spaces that you can think of that makes sense in a b2b software scenario!” 

To listen to the full episode of The Cyber Security Matters Podcast click here.  

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Future of the Cyber Security Industry

On The Cyber Security Matters Podcast we were joined today by Isabel Bardley-Garcia. She is the Director of Information Security at Helion Energy, driving company wide security strategies, programmes and initiatives. They are currently building the world’s first fusion generators and enabling a future with unlimited clean electricity. Isabel has over 18 years of experience in the cybersecurity sector, including leading and driving the transformation and automation of National Cybersecurity consulting services. With all of that experience, Isabel has some fascinating views on the evolution of the cybersecurity industry, the highlights of which are below. 

How have you seen the role of security and risk management within cyber security mature and evolve during your career?

The role of security and risk management has gone from being just a compliance issue, either to a regulation like Sox or GLBA, or standard like PCI DSS due to more companies, and especially the government, taking it seriously. It’s more about protecting the organisation from major losses, crippling interruptions, or even failures of the organisation, and also about helping organisations to grow and to succeed. We’ve gone from doing things because we’re told to do it to doing something because it makes sense to actually do it.

Do you think that cybersecurity is taken more seriously in 2022, rather than the early 2000s of them when you were first starting out?

Back in the early 2000s it was very frustrating to be an information security consultant, or just a cybersecurity professional. Like I said, companies didn’t really take it that seriously if they didn’t have a regulation or standard. As professionals, we saw the attacks and we had to protect our companies against them. When we saw that the attackers or the threat actors were getting bolder and more sophisticated, our companies and even the government at that time felt further and further and further behind in this cyber warfare, to the point that many of them denied it was even happening. They were like an ostrich with their head in the sand. They just didn’t believe that they would be targets, because they sold blouses instead of missiles. They didn’t think they had anything that the threat actors wanted, and even the government thought of warfare as a physical thing and not a cyber thing. We were watching it all happen, and it was very frustrating. 

20 years later, after so many breaches and after learning about all the foreign actors from different countries who are trying to cripple other nations, down to their infrastructure, to steal intellectual property. The regular threat actors who are trying to steal intellectual property to sell credit cards, social security numbers, personal identifiable information for identity theft… they’re still there, but having breaches is being taken more seriously. It’s reactive more than proactive, and now more and more companies, as well as the government, have really gotten into beefing up their security. They’re seeing it more as a risk management issue instead of a compliance issue. 

We still have a way to go, because there’s still a lot of companies that have that old mentality that is still very pervasive. Some companies still think that they can just offshore or push off securities, saying ‘we have service providers taking care of that, we have third parties taking care of that, we don’t have to worry about it’. Now we’re getting more and more breaches, where the third parties are being breached in order to be able to get to their whole client base. That’s starting to be taken more seriously, and companies are being more proactive, which is a great direction to go to. We’re still a couple of decades behind, so we need to hurry this up.

How do you see the industry developing in 10 years time?

I think that with all the different frameworks that we have now, companies don’t really have much of an excuse to not know what they’re supposed to be doing. And a lot more of them are taking those frameworks and implementing them into their own organisations, and they’re using the risk assessment management approach a lot more than just checking the box for whatever compliance, so it’s become more holistic. Companies are becoming more educated as to what cybersecurity is and how it pertains to their company, the C level are educating themselves about it, and realising that it’s not an IT problem, that it really is a risk management problem. Even boards of directors are bringing on people with security experience to advise them. It’s becoming more mature and more known in companies. 

The way that I see this going for the cybersecurity profession is that cybersecurity roles are going to become more focused and better defined. I think that the workforce framework is going to really help with that. We won’t have cybersecurity professionals being asked to perform three or more roles, so the firewall administrator isn’t also expected to be the database administrator, they’re just strictly the firewall administrator. A lot of the burnout we’re having in the profession is that we were expecting our professionals to wear many different hats that are very different from each other. From an education perspective, we’re going to start having more places of education with a wider variety of more mature cybersecurity degrees and training programmes to choose from. I’m hoping that by that time, cybersecurity will be its own separate department with its own head that then reports to like the CEO, or legal or something that makes a bit more sense than like the CIO. 

From a vendor perspective, it’s going to keep growing, we’re going to get more tools and platforms. Because the buyers are going to be a lot more sophisticated in their knowledge of threats, vulnerabilities, control frameworks and how it pertains to their domain’s responsibility, they’re going to be a lot more discerning and selective in their purchasing decisions. They’re going to be looking for products that fix a specific problem, which then will force the vendors to start focusing on the core functions of their products instead of trying to build them all-in-ones. Vendors are going to have a harder time getting people to buy the shiny new thing, because the sophistication of the buyers will be much greater by that time. 

To hear more about the future of the cybersecurity industry and Isabel’s unique perspectives, listen to the full episode of The Cyber Security Matters Podcast here.

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

The Importance of a Capability Model

On Episode 3 of The Cyber Security Matters Podcast we were delighted to be joined by Caleb Barlow. He’s an entrepreneur with a technical background and he’s equally comfortable presenting at TED talks or primetime news as he is consulting the board of a major health care provider. As VP of threat intelligence at IBM, he built one of the largest incident response platforms, including the world’s first immersive cyber range. He went on to be President and CEO of supply chain security business Redspin, helping them become the DoD’s first approved third party assessor, at the same time as taking the helm at parent company Synergist Tech, a cyber services firm with an emphasis on health care. He’s currently heading up his own business, Cylete, where he advises private equity firms on the right cyber businesses to target. It’s an impressive professional history! 

We covered topics from diversity in the industry to the ways that Covid has impacted the landscape of cybersecurity. Here are some of the highlights from that conversation. 

What one piece of advice would you give someone entering the industry?

This is an industry that has a language to it, and you really need to understand that language to be credible. This is an industry where information has a shelf life, because attacks and defences are constantly changing. I mean, this is not an industry that you could easily pack up and leave for a year or two and come back, because everything’s going to have changed. What I tell people is they have to stay informed of the news of the industry every single day. I think of it like Game of Thrones, right? If you’re a Game of Thrones fan, the first few episodes, you have no idea what’s going on. It takes a season or two before you start to get that all these things are connected. I think the cybersecurity industry is the same way. Whether it’s through the cyber wire or your podcast or a threat feed, you have to stay informed about this stuff, and you have to do it every day. What I’ve always said to my teams is that if you haven’t read the news, don’t come into work today. I test because if you don’t know what the latest attack was and what it means, and you get asked by a customer, you’re totally not credible.

How has the term critical infrastructure broadened in recent years?

I think we need to redefine it. When most people talk about critical infrastructure, they refer to health care, energy, finance… It’s a very World War Two mentality in terms of ‘what is critical infrastructure’. Let me ask you this, at the start of the pandemic, what did you really need? I don’t know about your household, but the critical infrastructure in my household was getting access to goods and materials during a supply chain crisis and being able to communicate with friends and colleagues and being able to send my kids to school. One of the things we have to do is realise that the pandemic brought us a whole new way to work and a whole new way to educate, so our critical infrastructure has to change. We’ve got to look at cloud providers like Microsoft, Amazon and Google; that’s critical infrastructure. Now, we’ve got to look at things like zoom, which is how my kids went to school and how I went to work. It’s an absolutely critical infrastructure. I couldn’t care less about my phone system, I need my Zoom. Suppliers that deliver things like Amazon and Instacart and large retailers that were able to keep supply chains moving like Walmart – they were critical. A lot of what we have to do is really rethink how we think about critical infrastructure and what critical infrastructure is. 

You’ve made high profile media appearances over the years and also specialised in consulting the C suite on information security, is there a major or unifying message that you strive to get across?

It’s really all about having a capability model versus just having procedures and documentation. You need to build capability in four key areas. The first is obviously cybersecurity skills and incident response. Number two – and this is surprising to most people – is communication skills. If you don’t know how to communicate internally, externally, with your partners and with your customers, things aren’t going to end well. If, during a crisis, you can’t communicate what to do, people are going to fill that void with their own speculation. I would argue that the vast majority of high profile breaches we’ve seen over the last 10 years are down to poor communication. Lacklustre communications in decision making causes more damage than the threat actor in most companies, because people either don’t communicate, which is a decision in and of itself, or they communicate bad data, not knowing what to say and how to say it, or they go sideways with regulators. The third area you need is legal, and the fourth capability you need (and this is the tough one), is business resiliency skills. On any cybersecurity response team, it is critical to have business skills that can understand what can the business handle, what alternatives might we have and how could we stand up the business in another way. Our threats aren’t any different than a fire or a flood or a natural disaster. You have to think about resiliency if you can’t get access to your IT systems.

What do you see as the prospects for cyber during the next decade? 

The simple fact of the matter is that we are still in an industry where we do not have enough people to fill the open jobs. The need for those skills only continues to grow. We are starting to solve some of the problems though, we’re starting to become a more diverse industry, which is great. Some of the pipeline of getting skills is starting to get solved, but like any industry, the next round of innovations may, in some cases, be repeats of things we’ve seen before. Ultimately what I do think we’re likely to see now is kind of the second generation of companies starting to step in. A great example of this would be as the EDR market moves to XDR, we’re starting to see the next generation companies coming in and solving the same problem but with a very different business model. Like any industry, those optimization companies will probably be the ones that win in the long term as the industry turns over.

To hear more about the future of the cyber security industry, tune into the full episode of The Cyber Security Matters Podcast here.

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Accessing the Cyber Security and Intelligence Industry

In our second episode of The Cyber Security Matters Podcast we sat down with intelligence specialist AJ Nash. He is the VP of intelligence for external cybersecurity company ZeroFOX, and he spoke to us about his journey through the Intel sector and how that’s lead him to where he is today. Read on for his perspectives on accessing the cyber security and intelligence industry. 

How did you first get into the Cyber Intelligence industry?

That’s a good question, and like a lot of people, I didn’t have a straight path. It wasn’t intentional, but I frankly don’t know if there’s a single thing in my career that’s got me here. I originally joined the Air Force, my intent was to be a police officer and go to law school, and my test did relatively well. I was in the Air Force for nine and a half years, then I medically retired and moved into defence contracting. And so I started doing traditional Intel work in counterterrorism, counterinsurgency, things like that. 

I was recruited for an opportunity. I had an interview with a defence contractor, and I literally interrupted them about five minutes into the interview, and said ‘I think I’m in the wrong room’, because all we were talking about was maths, science, computer science, operations research and cybersecurity. I didn’t know anything about most of the stuff. I told them ‘I’m an intel guy, where’s the terror? Where are the bombs?’ And they said, ‘No, no, we got people for all these things. What we need is some intel folks, we’re trying to build a new concept for how to do intel analysis specifically for cyber, and we need to have experts. We need people who can translate this to make sure this is useful.’ That ended up becoming what we called at the time cyber intelligence preparation of the battlespace. 

It was a great opportunity, and I accidentally got into cyber and helped work and develop that programme with amazing, smart, brilliant people. I was one of the folks who helped write the book along with my five or six colleagues. A couple of folks did the training. This ended up becoming foundational training for contracts at NSA and Cyber Command for a lot of cyber work. And so I learned a lot from a lot of people much smarter than myself. And that’s how I ended up in cyber, which was very much accidental like I said. So you know, from a career standpoint, it’s great to do terror and terrorists, there was certainly funding there, and then you go into cyber and it was a lot of funding there too. And so that led to a career doing cyber intelligence work at the agency and cyber command. I went into the private sector also by accident to be honest. A friend of mine convinced me to join LinkedIn, although I had never had a social media account for obvious reasons with my career, I would have been immediately compromised. That was always fun! But somebody recruited me through LinkedIn, and I moved to the private sector. 

I had a really winding path from a kid who’s gonna be a competent lawyer to a guy who does cyber intelligence work with one of the greatest companies in the world. So I’m a lucky guy, they say you put yourself in the right position. Maybe I own a little bit of it, but people have helped me along and I’ve just ended up in really good spots. 

We talk a lot about barriers to entry into cybersecurity. Is security intelligence still a good route into the industry? 

I guess it was for me. Intelligence is enduring, Intel feeds everything. I don’t think it’s going anywhere, so I think it’s a great way to work in this industry. I don’t know if it’s the easiest way to get in, necessarily, but for folks who are coming out of government and military we’ve already got the background and experience. That’s actually where private sector companies probably should be hiring their first Intel leaders. For those who are in university right now, wondering ‘how do I get into cyber?’, it may or may not be the easiest route, because again, only maybe 10% of companies out there have Intel teams, but there is a lot of demand. So if they’ve done the research, if they’ve got the education to back it up, and they can make the pitch, there’s opportunity there. But I also think there’s nothing wrong with somebody who’s coming in and wants to be a SOC analyst or do threat hunting or incident response, they’re all great ways to get in, as long as people understand those are different careers. If you want to transition from one of those to Intel, it isn’t just changing a title and moving desks. There’s some study and work that needs to go into that. From what I’ve seen, most folks who are getting into cyberspace are not coming in through Intel.

Is diversity improving within cybersecurity?

I think diversity is better now than it was, but we have a long way to go. So you know, I think if you go look at any panel discussion, chances are you’re gonna find four white guys on it. If you look at most Intel teams, most cyber security teams, the majority of them are likely to be white males especially in the US and UK areas. But I do think it’s changing. Our teams are great – we have three senior directors on the team, two women and a guy. They do all happen to be white, but one was an immigrant, so we’re not all Americans. I think part of the challenge is the talent that we still have to grow, right? There’s still a challenge in many ways, women are still not being encouraged enough as girls to go into STEM, so there’s still a lot of cultural challenges. The trouble we have is where do you hire the people from if they don’t go through the funnel, if we don’t build people with these skill sets? I think we really need to encourage young people, all ages, races, genders, to, you know, to embrace technology and embrace these opportunities. And we need to put funding in place for them and give them opportunities to do it so that we have more diversity across the board. So that’s a challenge. For people in my position, if you’re hiring folks, you have to keep in mind, I don’t want 10 people on my team that are the same person 10 times over. There’s a value to it for the team standpoint. I think a lot of folks are putting a lot of effort into this. But it’s hard, and it’s a long way to go. So better, yes, but not nearly good enough yet.

You mentioned a few really interesting things there about potential barriers to entry into the sector. So what would you say are the barriers to entry? And what practical steps can we take to reduce those?

Access to education is a barrier. I’ve talked about this around the world. There’s a privilege that I’ve had to get where I am, and certainly access to education has been there. I think we have to develop programmes that give people opportunities, regardless of their socio-economic standing. There are there are great programmes that do these things, other mentorship programmes, and there are other education programmes, that give people some of these options, but we need more of that. We’re seeing at least in this industry a move away from the bias towards everybody having to have a degree. Certifications are really valuable, and being able to demonstrate you have a skill is really valuable. On the other side, I know self taught people who are brilliant but they have a hard time getting the interview. I think folks are trying to do a better job of saying, ‘let’s get them in the room. They say they can do things, let’s test them out.’ We can be more creative in our education, but also much more creative in our hiring. 

I think that the biggest barrier to entry right now is still having the resources, funding and opportunity to get the education, skills or certifications needed. We then need to have the creativity on the hiring side to look beyond a paper and a resume and say, ‘who is this person? What do they bring to the team? Can we give them a position and a shot?” That is tough because we’re for profit companies, and a lot of companies don’t want to invest in training, they would prefer to hire somebody who’s plug and play, because it saves them time and energy and money. I think we have some challenges to solve in that area as well, especially as we keep saying that we’re 3 million people short in cybersecurity, and the number goes up every year, so it’s gonna take a collective effort to get there. Some of that might involve the industry buckling down and saying ‘we’re gonna hire people we know are qualified, we’re going to train them up.’ I think we’re seeing some of those areas improve as well.

What one piece of advice would you give to someone who is entering the cybersecurity industry? 

My one piece of advice is to be bold. I think a lot of people self-select themselves out of opportunities. Confidence is a challenge. Imposter syndrome is real – I can attest to it. I think be bold, and don’t undersell yourself. If it’s something you think you can do, and you want to do it, even if your resume says nothing about it, try to throw your hat in the ring, Try to get into the interview, try to have a discussion. The worst thing that could happen is you’re right where you left off. You gotta go do the thing, right? Try to get in there and find a way and be persistent with it. If you don’t get it one time, try another time, you know, talk to people. That includes things like just reaching out to somebody on LinkedIn. Don’t stop yourself by thinking ‘that person is really important, they don’t have time for me’. Reach out! That’s how I did a lot of it. I built a lot of my connections just by saying ‘let’s have a conversation’. Now people do that with me, I have had tons of folks reach out to me. They always seem surprised when I answer and I say ‘yeah, let’s have a conversation instead of a call.’ And people seem shocked by that. Listen, I’m not that important. I’ve got time for you, and if it’s something I can help with I will. I think a lot of people think that these people with these great titles and great roles and great amazing things won’t be interested. But you reach out, and you realise they’re awesome, and they’re happy to talk to you, they want to help. If you’re not bold, you don’t ask the question. So what if they don’t answer and move on to the next person? A lot of them will, though. People want to help each other. My best advice is always to be bold. 

To hear more from AJ Nash and other industry experts, tune into the Cyber Security Matters podcast from neuco here. 

We sit down regularly with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

What challenges does the internet being the network now create in the cyber security space

In episode #77 of The Tech That Connects Us, we were delighted to be joined by John Spiegel, CTO at Axis Security.  

In this episode we unpacked everything from his career trajectory through to the nitty gritty world that is cybersecurity. 

We hope you enjoy this episode as much as we did recording it. 

What challenges does the internet being the network now create in the cyber security space? 

“Oh, my, the internet really is is the is the is the future for connectivity.  

And it’s good and it’s also bad. The good is that you have this ubiquitous connectivity out there that for the most part is is inexpensive.  

If you think about the cost per megabit of an internet line versus an MPLS line, it’s significant. And, as a result, it’s enabling this incredible amount of productivity from companies. 

You don’t have to do constant maintenance, or patch upgrades, and the ability to access that from anywhere is amazing. But, on the other hand, we have this challenge of if businesses can get to any application at anytime, anywhere.  

The same thing is true for the bad cyber actors, you know, they can easily get into your network. Maybe because you misconfigured everything or something or maybe you know, you left something open. And that’s that’s a huge challenge.  

What I’m excited about is this rise of this concept called zero trust. And I know there’s a lot of marketing around it.  But it’s probably, in my mind, the most important thing that has happened. we had an opportunity to interview interview John Kinder bog a few days ago, he was one of the fathers of, of zero trust.  

And, his whole journey started because he started working on a pix firewall. And, he did not like the concept that there was one side that was untrusted and one side was untrusted. And he’s like, “come on, this is a computer. A computer is not a human.” You know, we built a society built on trust.  you know, we trust one another that, you know, when you pay for something you trust that person.  

Every interaction you do is built on this concept of trust. Computers don’t understand trust, they are built of silicone, rare metals, and they think in zeros and ones, trust is not a concept for them. So, that kind of started sparked him on this journey of zero trust.  

And if you think about how wins are built and what I did with SD win what I did in my past, building out these networks, these global networks for Columbia, sportswear and others.  

And I spent my career building these these artefacts, artefacts of of trust, and to me that was completely wrong. I should have gone a different way. And I think the future about branch connectivity is not good. it’d be about interconnections between a branch and, and a location, it’s going to be about building islands.  

Essentially companies are going to be building these islands. And the connections going out are going to be these almost you could say “zero trust” connections out to a SaaS application, or it’s a remote worker. Those sorts of things!” 

To listen to the full episode, click here. 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Risk & Compliance in the Cyber Security Industry 

In episode #69 of The Tech That Connects Us, we were excited to be joined by Chris Strand, Chief Risk and Compliance officer at CyberSixGill. 

With 20 years of experience, he’s a subject-matter expert in cyber risk and compliance and a regular conference speaker, most recently holding a Chief Compliance Officer role. 

Earlier in his career, Chris founded and built the global compliance and risk strategy arm of carbon black, which became a fast-growing and critically important business unit. 

We hope you enjoy this episode as much as we did recording it. 

How has the relationship between risk compliance and securities changed over the past few years?  

I’ve experienced the good and the bad with this – a bit of both. I would say, “they’ve” – and it’s not by choice, but they have converged. And this is where I say there’s the good and the bad. There are a lot of folks in the industry that for obvious reasons, see the Risk and Compliance angle as a negative thing.  

And I understand why –  they’ve grown together, out of necessity. You fast-forward to today, and there are a lot of regulations, in fact, there’s too many regulations and frameworks, it’s confusing and mind-boggling. But, it’s still a necessity. 

Look at the state of the security industry right now. I mean, we’re under a barrage of threats, they’ve grown more than I could ever imagine when I started out in my career. So, you know, with that, you can observe almost a 45-degree angle of increase in the number of regulations, frameworks, and mandates; the privacy laws that we see  the national and regional types of mandates around privacy and data that have grown. So, they’re all in one place, because we have a need to try to measure our effectiveness to protect that data.  

And again, I don’t view it as a negative, but sometimes it is a negative because we’re under such threat, right? It’s sort of like, why do you have five locks on your door now, whereas, you know, 10 years ago, you only had one – and now we do this because there have been more break-ins, it’s the same thing. We don’t like to see the world becoming a more dangerous place.  

How have you found getting back into things such as conferences?  

So, I found it extremely refreshing. I think most of us are social creatures. And I actually tend to be a very introverted person. I’m uncertain if that would surprise people because I love being in front of people, but on the other hand, I am a bit of an introverted person. So, it’s sort of a weird mix. But,  since I’ve been able to get out in back into the public, back face to face and speaking with people, I can never look back.

I mean, it’s the most refreshing thing I’ve ever experienced, and a very surprising feeling as well, it was a euphoric feeling at the time! 

What has the ubiquity of cloud platforms and services for enterprises meant in terms of risk management? 

It’s thrown a wrench into risk management for sure. Because the accessibility of the cloud alone, I mean, there are so many security themes that we can talk about such as the move to the cloud, and what’s happened over the last five, six years or so. It’s definitely created a lot of stress for risk managers that are trying to work with what they used to see as closed systems.  

But one of the main themes that have become a huge thing and has helped evolve and create a lot of data privacy laws is the fact that data now is much more accessible than has ever been with the cloud.  

Now, that data is way more accessible, there are so many different threat vectors to that data that we’ve never ever had before we’ve never had to deal with. So, it’s made risk managers’ lives much more difficult, because there are a million more variables that you have to consider when you’re measuring the threat to that data.  

What major lessons do you feel that organisations need for this decade to better manage risk and compliance? 

When I think of lessons, it’s hard for me to say what a particular lesson is because I don’t want to sound like I’m preaching to organisations, and to say, you know, you should have learned this, you should have been doing this from day one etc.  

But I do think that there are a few lessons that we can look at. And one of the big things is, and this is very hard to talk about with different businesses is the transparency of their business process.  

The more transparent you can be with how secure your data is, the easier it can be to find faults. But, you’re basically asking someone to talk about their weaknesses.  

And businesses think “I don’t want to make it sound too weak”. Because, hey, if I’m an assessor, and I’m in an assessment with a retailer, let’s say, you know, and I’m asking them, where are all your faults and such? They’re thinking, Hmm, I don’t know if I want to tell you this. Because the minute I do, what if this gets out? What if I don’t trust this individual? Right? What if we don’t have a trusting relationship between us, and this gets out, and my brand gets damaged.  

But, the lesson is to be transparent as it’s done good for many organisations. 

To listen to the full episode click here. 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Risk & Compliance in the Cyber Security Industry

In episode #69 of The Tech That Connects Us, we were excited to be joined by Chris Strand, Chief Risk and Compliance officer at CyberSixGill.

With 20 years of experience, he’s a subject-matter expert in cyber risk and compliance and a regular conference speaker, most recently holding a Chief Compliance Officer role.

Earlier in his career, Chris founded and built the global compliance and risk strategy arm of carbon black, which became a fast-growing and critically important business unit.

We hope you enjoy this episode as much as we did recording it.

How has the relationship between risk compliance and securities changed over the past few years? 

I’ve experienced the good and the bad with this – a bit of both. I would say, “they’ve” – and it’s not by choice, but they have converged. And this is where I say there’s the good and the bad. There are a lot of folks in the industry that for obvious reasons, see the Risk and Compliance angle as a negative thing. 

And I understand why –  they’ve grown together, out of necessity. You fast-forward to today, and there are a lot of regulations, in fact, there’s too many regulations and frameworks, it’s confusing and mind-boggling. But, it’s still a necessity.

Look at the state of the security industry right now. I mean, we’re under a barrage of threats, they’ve grown more than I could ever imagine when I started out in my career. So, you know, with that, you can observe almost a 45-degree angle of increase in the number of regulations, frameworks, and mandates; the privacy laws that we see  the national and regional types of mandates around privacy and data that have grown. So, they’re all in one place, because we have a need to try to measure our effectiveness to protect that data. 

And again, I don’t view it as a negative, but sometimes it is a negative because we’re under such threat, right? It’s sort of like, why do you have five locks on your door now, whereas, you know, 10 years ago, you only had one – and now we do this because there have been more break-ins, it’s the same thing. We don’t like to see the world becoming a more dangerous place. 

How have you found getting back into things such as conferences? 

So, I found it extremely refreshing. I think most of us are social creatures. And I actually tend to be a very introverted person. I’m uncertain if that would surprise people because I love being in front of people, but on the other hand, I am a bit of an introverted person. So, it’s sort of a weird mix. But,  since I’ve been able to get out in back into the public, back face to face and speaking with people, I can never look back. 

I mean, it’s the most refreshing thing I’ve ever experienced, and a very surprising feeling as well, it was a euphoric feeling at the time!

What has the ubiquity of cloud platforms and services for enterprises meant in terms of risk management?

It’s thrown a wrench into risk management for sure. Because the accessibility of the cloud alone, I mean, there are so many security themes that we can talk about such as the move to the cloud, and what’s happened over the last five, six years or so. It’s definitely created a lot of stress for risk managers that are trying to work with what they used to see as closed systems. 

But one of the main themes that have become a huge thing and has helped evolve and create a lot of data privacy laws is the fact that data now is much more accessible than has ever been with the cloud. 

Now, that data is way more accessible, there are so many different threat vectors to that data that we’ve never ever had before we’ve never had to deal with. So, it’s made risk managers’ lives much more difficult, because there are a million more variables that you have to consider when you’re measuring the threat to that data. 

What major lessons do you feel that organisations need for this decade to better manage risk and compliance?

When I think of lessons, it’s hard for me to say what a particular lesson is because I don’t want to sound like I’m preaching to organisations, and to say, you know, you should have learned this, you should have been doing this from day one etc. 

But I do think that there are a few lessons that we can look at. And one of the big things is, and this is very hard to talk about with different businesses is the transparency of their business process. 

The more transparent you can be with how secure your data is, the easier it can be to find faults. But, you’re basically asking someone to talk about their weaknesses. 

And businesses think “I don’t want to make it sound too weak”. Because, hey, if I’m an assessor, and I’m in an assessment with a retailer, let’s say, you know, and I’m asking them, where are all your faults and such? They’re thinking, Hmm, I don’t know if I want to tell you this. Because the minute I do, what if this gets out? What if I don’t trust this individual? Right? What if we don’t have a trusting relationship between us, and this gets out, and my brand gets damaged. 

But, the lesson is to be transparent as it’s done good for many organisations.

To listen to the full episode click here.

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

What are the major IT data challenges currently facing enterprises and governments?  

In episode #62 of The Tech That Connects Us, we were excited to be joined by Hash Basu-Choudhuri. He is the current GM at Cribl, and has held advisory and senior roles across the world, mostly in the EMEA region. 

We touched on his career so far, as well as specific topics around data challenges, crypto, and D&I.  

We hope you enjoy this episode as much as we did recording it. 

What would you say are the major IT data challenges currently facing enterprises and government? 

“Just complexity, look at the rate of change, I think if you look at the rate of change from 2000, it was not that high. Things weren’t being innovated at the rate they’re being innovated today.  

The problem today is that every three years there’s a new cycle riding. You had the mobile cycle, the cloud cycle, now you have the container cycle. And now, we’re moving into completely trustless environments using blockchain technology.  

Airbnb disrupted travel, and not even seven years later, Airbnb is probably going to get disrupted by blockchain! I think the biggest challenge is that.” 

How has the UAE handled COVID differently to other parts of the world? 

“This is a great question. So, this has literally been a business case study in probably how to do it right. The UAE has looked at the impact, looked at the facts, looked at the science, and been ahead of the game.  

I deal a lot with Emirates Airlines and Dubai airports. I would say 70 to 80% of the world’s vaccines fly through Dubai, because they’re manufactured in India. This is their distribution hub. And then from here, Emirates Airlines repurposed god knows how many planes into vaccine carriers. And then from here, they’re distributed globally. So, they’ve got the distribution for the world sorted.” 

What novel cybersecurity challenges does the growth of cryptocurrency prevent present? 

“When you’re talking about cryptocurrency, it gives you immense power, you do not have to trust the third party, there is no centralised system. But the problem with security from a blockchain perspective is that you are responsible for your keys, for your wallet, for your assets right now.  

Sounds simple, but how do you secure it? You just have to be very, very careful with the way you manage such assets. There are a couple of tech players out there that are trying to solve it with escrow accounts, and the ability to have extensive multi-party certificates.” 

What is your assessment of how well tech industries are tackling diversity? 

“So for me, obviously, you know, I fall into that category. But for me, it’s not about this, It’s about the diversity of thought. My background is not going to be exactly the same as your background.  

But, if you can attract talent and have multiple different mindsets, it’s good for business. Look at your target audience, which is the world, right? If you want mass adoption, it’s everyone. So, you kind of have to mirror that. And you can’t mirror it if you don’t have a diversity of thought.  

I think a lot of these companies are leading with just hard metrics. And it’s like a sales process, right? You can do metrics one, two, and three, and you don’t do anything at the end of that, right? When really, it’s the way you interpret that data. It’s the way you apply it. And it’s really what you do with it once you have met those targets.  

I think a lot of companies are just laser-focused on “we need to have this many Asians this many, you know, blah, blah, blah” right. And I don’t particularly like the topic because I think it’s an over-rotation, it should always be merit-focused. And it should always be diversity of thought that you get from it over anything else.” 

You can listen to the full episode here.

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Cyber Security Key Trends. neuco’s annual 2022 key trends report.

What’s in store for the Cyber Security industry?

2022, where’s it going to go, what does it have in store?

We’ve collated key trends from some of the influential figures across the 4 sectors we recruit into – Cyber Security, Connectivity, Content & Media and Satellite & NewSpace.

We’ve spoken to experts from companies such as Sky, Orbit Fab, Casa Systems, and A5G Networks.

If you want to find out what we think will be the key trends for cyber security this year, then just click the link below to download now!

Click here to download now.

What does the threat landscape look like right now for OT?

Joining us for episode 50 of The Tech That Connects Us was David Brown Vice President and General Manager, International Sales – ZeroFOX. We heard his insights on the OT domain – where he’s headed up both IPOs and acquisitions, what really keeps CISOs up at night, alternative models for industry events, how to recognise the potential in new hires and that’s just the tip of the iceberg.

One question Jake Sparkes and John Clifton put to David was ‘What does the threat landscape look like right now for OT?’ Here’s what he had to say.

“There’s no doubt that there are more types of attacks now on OT. We’re seeing ransomware popping up a lot more commonly, or at least we’re hearing about that more now. 

One of the interesting bits about OT is actually when you look at the infrastructure it’s built on. I’d still say that Windows NT and XP are probably the most prevalent operating systems in an OT environment around the world. 

So what does that mean? It means that there’s a tonne of exploits available straight off the internet, you don’t need to be that smart. But if you work up through the levels of sophistication and if we’re talking about large organisations they’ve got quite a sophisticated security posture. 

The two things that I think are really interesting at the moment in that space is the consolidation of the technology to see what’s going on in your OT network. Because if you are a CESO or an information security director then you’ve got more flashing lights than you know what to do with. You may also have an ageing workforce without the domain expertise to understand what’s going on. 

So I think there’s going to be a bigger drive for how do you consolidate all that stuff into a single pane of glass, there’ll be a drive to provide either AI or a managed service that provides recommended actions and remedial work for the top three to five actions that the organisation needs to be focused on. And those actions will be evidenced by what’s going on outside in the rest of the world. 

The second thing that’s of interest at the moment is risk. So you’re seeing now there are new bills going through in the US, and CESOs are looking at what’s the risk across all of my platforms IT and OT. A drive for this is that it’s not been so easy to understand what’s going on with OT, because you’ve had all these flashing lights and an unconnected system, with a lot of tech but it’s just not connected.  

The reason they want to know what their risk is because there’s also a developing insurance market where a number of insurers are getting together and looking at how they can take IT and OT cyber risk and turn that into a sellable product. When we look at the potential of that market it’s probably 30-40 times the size of the complete OT market. What I can see we will get to in the next 2-3 years is a similar system to the black boxes currently being used by vehicle insurers, so you’ll have a premium and it will vary depending on your attitude to risk and your controls that are in place across the whole estate. That then allows organisations to make an economic decision because you might say I will stand the increase in premium which justifies me doing these things across my plant. 

This then becomes a very much return on investment decision. It’s not about fear, uncertainty and doubt it’s actually about economic imperative.” 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

Is the Cyber Security industry getting cloud security wrong?

Joining us on episode 47 of The Tech That Connects Us was Trish Cagliostro Head of Worldwide Alliances at Wiz. Trish joined Laurie Scott and Andrew Ball. They only scratched the surface in a conversation that spanned Cloud Security, threat intelligence, the partner landscape, Cyber’s diversity challenge, the joys of softball and much more!

Trish is a thought leader in the cyber security industry, so whilst we had her on the podcast we needed to find out if the industry was getting cloud security wrong as is mentioned by commentators in the industry. Here’s what Trish had to say. 

“Cloud security is hard. It’s hard and it’s a little bit different from what the rest of the industry says. Cloud security isn’t so much of a problem for the born in the cloud companies, such as Netflix, they’re fine. Where this does become an issue is when a traditional enterprise goes to the cloud. Organisations go to the cloud for innovation, the costs savings are nice, but it’s the elasticity and the ability to endlessly expand and instantly expand globally that is powerful. 

However, the way these traditional organisations go to the cloud typically looks like this. They look at their applications on-premise, they go with what’s easy and upload some VMs into the cloud and expect to take their on-premise security structure with them. 6 months then go by, and the customer is thinking that they can’t innovate and they aren’t saving much money. So they want to look at what they can do differently from here. They’ll then start to refactor some of their applications, containerise, embrace some more modern application architecture, replatform and kick the Oracle legacy databases to the curb. 

Now the organisation will have a stopping point on their cloud adoption, they have their legacy on-premise tools supporting the legacy workloads. So now they need to go out and use some cloud-native services as all the cloud providers have cloud-native services. But they’ll have some very different types of computing that are very different in the cloud than they are on-premise. Then there’s the idea of a managed service which comes with the complication of the shared responsibility model. So at this point, the company will be looking at different tools from different vendors for niche cloud security. This is where the breach happens, all of a sudden, there are three separate data silos, the traditional on-premise tools, the cloud-native services from the cloud providers and the new types of security tools that were brought in to deal with the new types of cloud computing. 

So now these organisations still can’t innovate, they’re probably spending just as much money as they were in the first place, Then the cloud provider comes in and says ‘let me tell you about serverless’. The whole model is then broken. So in this instance, I don’t think it’s fair to blame the cyber security industry. It’s a shared responsibility between the industry and the customers as well, to think differently about security in the cloud. 

I meet with partners all the time, and they’ll say to me ‘Okay got it, it’s the same way we dealt with data centre security. But you can’t think that way. You have to think of a customer and the entire cloud journey they’re going on, and then understand how to build a security strategy that supports them across that. 

The other part of this is beyond just helping them with the security strategy and explaining that the customer will need to have an unusually long term vision with this and that we need to be transparent, understanding and really dig into what we’re doing in the cloud. A lot of time to the customers it’s not obvious, they’re normally using a managed service and think they’re good. You need to have a clear understanding of what your responsibilities are as a vendor, then make sure you have the controls and mitigation in place to account for what’s really important.  

I really do think that when we think about this we can’t just think about it in phases, we have to think about it holistically through the journey. 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

What are the Emerging Marketing Trends Within Cyber?

On episode 42 of The Tech That Connects Us John Clifton and Jake Sparkes were joined by global Cyber marketing expert Reuben Braham

In the episode, we heard Reubens thoughts on the marketing trends that are emerging in the cyber industry. 

“Anything that we talk about regarding marketing trends, is actually a bit different to what we’d be talking about 18 or 19 months ago before we had the COVID 19 pandemic. 

Before the pandemic, it was different because we could travel and meet people face to face and be present. What I’m seeing now is that the world is ready for a more hybrid model of business, so our marketing needs need to focus on gearing up and being part of the virtual events and conversations, we’re having over Zoom right now. It’s something that is now more acceptable even for business meetings with CEOs, CMOs etc. So, we have to be ready for a hybrid business model.  

On the other side, we need to understand that people are going to be hit with a lot of virtual requests and that ‘Zoom fatique’ is real. All the different vendors and suppliers will want to have virtual briefings which will start to take its toll on our customers. 

The best strategies I’m seeing currently are around creating thought leadership content that can be circulated to your target audience, companies need to be building more blogs, building more thought leadership content and educating your market. 

When you’re building content you should be focusing on your perfect customers, understanding their pain points and doing your best to help them by being consultative with your approach. 

As a marketing department, you must be doing targeted research, and then use an account-based marketing approach, not just a shotgun approach trying to hit everybody. If you can build a library of very good content that can educate your audience and continue to educate them then that’s something that will have a massive impact on your business. 

In my first 6 months at Cyberint, our first task has been to build up our content library, I really believe that creating great engaging content will work wonders for not only engaging with your current and potential clients, but it’ll really help with our website SEO. Once you’ve built up that library of content potential customers will understand that you’re a player in the marketing, and they’ll start to differentiate your business from the competition.  

Virtual meetings and virtual events are starting to have their toll on people, and people would rather consume content at their leisure rather than at a set time. 

There’s also a lot to be said too for building out good automation and allowing 70-80% of your customers journey to be done through marketing automation. The more content you can give your potential client the more they’ll know about you and the more they’ll see you as the business to work with over your competition.” 

Every Wednesday we sit down with some of the biggest names in our industry, we dedicate our podcast to the stories of leaders in the technologies industries that bring us closer together. Follow the link here to see some of our latest episodes and don’t forget to subscribe.     

UNICORN-UCOPIA. – $1bn Cyber Valuations we’ve seen this year

Investors have been chomping at the bit so far in 2021, creating a record-breaking* 12 galloping Unicorns to fight global cyber criminals.

Most recently, the end of April saw Vectra AI join the club, winning $130M in their latest funding round and a valuation of $1.2B.

In other news, UK stallion Darktrace went public, after a very thorough examination of its dental records.

*“A record was set in the first quarter of 2021, with 12 cybersecurity unicorns created globally, which is more than double the previous quarterly ” PitchBook (Private market data provider)

Vectra gains $130M funding and $1.2B valuation

Vectra AI, a cyber security, threat detection and response firm has announced an additional $130m round of funding.


Darktrace shares jump 32% in IPO

Cambridge-based cyber security company Darktrace and its backers raise £165m in London debut.


A unicorn on steroids

Wiz raises $130 million series B to reach $1.7 billion valuation a year after its launch


Aqua Security hits unicorn valuation after completing $135 million series E

The Israeli cybersecurity company has stayed ahead of the cloud revolution, refuses to be sold and has it eyes on some acquisitions of its own.


Orca Security raises $210 million, becomes ‘unicorn’ with $1.2 billion valuation

Google’s growth fund leads investment in the Tel Aviv-based cybersecurity firm set up 2 years ago by former execs of Check Point Software Technologies.


New unicorn Axonius raises $100M to expand its cybersecurity asset management platform

Cybersecurity asset management startup Axonius Inc. today revealed it has raised $100 million in new funding on a unicorn valuation of above $1 billion.


Automation for the people

Snyk raises $150 million at $1 billion valuation for AI that protects open source code.


Lacework Banks $525 Million as Cloud Security Market Heats Up

Lacework, a five-year-old cybersecurity company that automates security across enterprise cloud deployments, has reached unicorn status with the closing of a $525 million round of Series D financing.


These latest additions mean that there are now 31 Cyber Security Unicorns due to go public.

So what’s behind these huge valuations, is it set to continue – and what does it mean for the Cyber market in general?

Rather than dampen cyber spending, the rapid digitalisation caused by the pandemic has revealed worrying gaps in IT Infrastructure – further exposed by the accelerated move to Cloud and home working.

And it’s this exponential growth in demand that is causing investors to feel bullish and make sure they are on the right side of these major technological shifts.

Cyber is a huge growing market with healthy competition and – so far –  few monopolies to keep a lid on sky-high valuations, so the trend certainly seems set to continue.