Adopting Zero Trust

Live at ZTW2025: Cyberwire Daily’s Dave Bittner + Dr. Zero Trust

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.
Live from ThreatLocker’s Zero Trust World (ZTW), cybersecurity heavyweights Dave Bittner, host of CyberWire Daily and Dr. Chase Cunningham AKA Dr. Zero Trust shared their unfiltered thoughts on the state of cybersecurity, AI, and government regulations. From the shifting landscape of compliance enforcement to the role of hitting critical mass of AI in both defense and cybercrime, we can expect an extraordinary level of change in the years ahead.
01:37 Cybersecurity Landscape Overview
01:58 Government and Cybersecurity
02:39 Leadership and Appointments in Cybersecurity
03:47 Future of CISA and Compliance
06:41 Managing Cybersecurity News
14:54 The Role of LLMs in Cybersecurity
16:22 Global Perspective on AI and LLMs
18:47 Reflecting on Past Technological Predictions
20:18 The Double-Edged Sword of AI and Surveillance
24:21 The Dark Side of Technological Advancements
26:17 Debating the Term 'AI' and Its Implications
28:43 Historical Anecdotes and Unanswered Questions

Rapid fire update: Silk Typhoon and DOJ's indictment of twelve Chinese nationals

New intelligence: Silk Typhoon, formerly tracked as HAFNIUM, is a China-based threat actor most recently observed targeting IT supply chains in the US. Today, we released a new report in conjunction with the Department of Justice's action against twelve Chinese nationals that includes mercenary hackers, law enforcement officers, and employees of a private hacking company. This group has been charged in connection with global cyberespionage campaigns. Dive into our latest blog for all the details.
 

Predicting the year of cybersecurity ahead (minus regulations)

It’s mid-February, but somehow, we’ve already been through what feels like a year's worth of change in the cybersecurity and regulation world. Beyond the standard incidents, outages, and attacks… there have been obvious impacts that have downstream effects. Regardless of regulatory changes, which we’ll cover as those impact our space, AZT brought together a few minds who have thoughts on the year ahead.
To properly kick off season four, we have the privilege of chatting with two wonderful guests:
Lawrence Pingree, VP of Technical Marketing at Dispersive, but you are more likely to know his name from his time at Gartner. However, he has a varied background ranging from CTO to security engineer, so don’t let that marketing line in his title fool you.
Oliver Plante, VP of Support at ThreatLocker, has around 15-20 years of IT under his belt. He also has seen a thing or two when it comes to implementing new cybersecurity strategies
 
03:21 Predictions for the Year Ahead
04:06 Zero Trust and Least Privilege
05:40 The Future of Cyber Defense
07:21 AI and Cybersecurity
08:41 Threat Intelligence and Preemptive Defense
09:50 Challenges and Innovations in Cybersecurity
14:23 The Role of AI in Cyber Attacks
26:18 Quantum Computing: Threat or Savior?
29:31 Passwordless Security: The Future
30:57 Challenges of Deepfake Technology and Passwordless Security
33:03 Blockchain and Its Applications in Security
35:33 Debate on Password Management Practices
38:03 User Responsibility and Security Automation
47:50 Government's Role in Cybersecurity
57:14 Future of Cybersecurity and Zero Trust

Kicking Off Season 4 of Adoption Zero Trust (AZT)

Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.
Neal and I are excited to welcome you back to AZT as we kick off our fourth season. After four years of trying out different formats and episodes, including at least an entire season terrorizing vendors for slapping Zero Trust on their box as if it were something you could buy, we’re ready to narrow our focus a bit.

The key to growing a cybersecurity career are soft skills

In this episode of 'Adopting Zero Trust (AZT)', host Neal Dennis and producer Elliot Volkman delve into the often-overlooked realm of soft or 'non-tech' skills in cybersecurity.
This week, we chat with Courtney Hans, VP of Cyber Services at AmTrust Financial Services, and Evgeniy Kharam, author of Architecting Success: The Art of Soft Skills, who help us explore how non-technical skills are vital in shaping the careers of cybersecurity professionals.
Our guests share the importance of effective communication, emotional intelligence, and adaptability. The hosts and guests share personal anecdotes, training tips, and the necessity of bridging technical prowess with essential soft skills to improve stakeholder engagement and career advancement. The episode emphasizes the value of being comfortable with discomfort and soliciting feedback to enhance one’s professional journey in cybersecurity.

Behind the scenes of cybersecurity media and reporting

Season 3, Episode 15: We gather a panel of journalists, communications, and a researcher to discuss how cybersecurity news and incidents are reported.
You can read the show notes here.
In the world of cybersecurity journalism, you can broadly divide it into four competing forces: reporters, communications teams, researchers, and readers. Each requires the other to accomplish its goals, but they all have very different priorities and goals.
Journalists have a duty to inform the public about security-related events.
Communication teams have a duty to inform the public about related incidents and research, but in a controlled setting.
Researchers help provide answers to communication teams and journalists.
Readers want to be informed of information that impact them, and their habits shape what kind of reporting is invested in the most.
This week we explore some of these dynamics by bringing together a panel representing comms, journalism, and research to discuss the game of tug-of-war during incident response and incident reporting.
Danny Palmer was a long-standing cybersecurity reporter at ZDNet prior to recently joining DarkTrace, Josh Swarz is the Senior Communications Manager at Microsoft focusing on threat intelligence, our host Neal Dennis is former NSA and has lived many lives around either keeping secrets or uncovering them, and producer Elliot Volkman has been a reporter for two decades and works with Josh on elevating research at Microsoft Threat Intelligence.

GRC tool or spreadsheets, that is the question | GRC Uncensored Preview

In our final preview episode of GRC Uncensored, we explore a particularly bipolar debate: do you need a GRC tool to manage compliance, or will spreadsheets suffice?
After this, we will be back to our regularly produced AZT episodes. The last episodes of our pilot for GRC Uncensored can be found on your favorite podcast app or newsletter on Substack.

Podcast Preview: GRC Uncensored and the commoditization of compliance

We are interrupting our regularly scheduled podcast series to introduce you to a new series we developed: GRC Uncensored.
This pilot season will elevate conversations about GRC that are often buried under millions of dollars in marketing spend. No boring talks about controls or frameworks, just unfiltered discussions with auditors and practitioners in the GRC space. We'll be back to our regular AZT episodes in a couple of weeks.
-----
In the first episode of 'GRC Uncensored,' hosts Troy Fine, dubbed the 'GRC Meme King,' and Elliot Volkman, alongside guest Kendra Cooley dive into the complexities of Governance, Risk, and Compliance (GRC) in cybersecurity. The discussion unravels the 'love-hate' relationship many security professionals have with compliance frameworks like SOC 2, exploring how they have become commoditized and possibly devalued over time.
The conversation touches upon the challenges security practitioners face in conveying the true value of GRC to businesses, the potential pitfalls of 'SOC in a box' offerings, and the broader implications of compliance becoming a 'check the box' exercise. Moreover, the episode delves into the broader regulatory landscape and the ongoing debates about the role of government regulations in cybersecurity compliance. This candid dialogue sets the stage for future episodes that promise further to dissect the nuances of cybersecurity audits and standards.
00:00 Welcome to GRC Uncensored
01:34 Introducing Kendra Cooley
02:05 Love-Hate Relationship with GRC
03:16 The SOC 2 Debate
04:33 Challenges with SOC 2 Audits
09:10 The Value of SOC 2 in the Industry
12:04 The Evolution of Compliance Frameworks
20:39 False Sense of Security in Compliance
24:46 The Buzz Around AI and Quantum
25:10 Staying Updated as a Security Professional
26:45 Challenges in Penetration Testing and Vendor Assessments
27:37 Compliance and Its Impact on Security
30:10 Government Regulations and Their Effectiveness
32:23 The Complexity of Privacy Laws
38:29 The Role of GRC Teams in Risk Management
42:30 Concluding Thoughts and Future Episodes

How to prepare your operations team for Zero Trust

Welcome back to Adopting Zero Trust! In this episode, hosts Elliot Volkman and Neal Dennis are joined by Rob Allen, Chief Product Officer of ThreatLocker, to dive deep into the operationalization of Zero Trust. Despite covering various aspects over three seasons, this crucial topic is addressed thoroughly.
They explore pre-adoption preparation, aligning organizational actions, and the importance of education in security. Additionally, the conversation highlights the 'assume breach' perspective and how concepts like default deny and least privilege are essential. With real-world examples and anecdotes, they provide actionable insights on implementing Zero Trust strategies effectively. Tune in to learn about the foundational steps necessary to transition into a Zero Trust environment.
This is the first of a three-part mini-series, so stay tuned as we explore more aspects of how to prepare your organization for adopting a Zero Trust strategy.

Log4j Continues to act as Organizational Vulnerability

Season 3, Episode 13: Cato Network’s Etay Maor provides fresh research on the abuse of unpatched log4j libraries.
Catch this episode on YouTube, Apple, Spotify, or Amazon. You can read the show notes here.
This week on Adopting Zero Trust (AZT), we highlight a significant cybersecurity risk focused on the notorious Log4j vulnerability and the growing concern around shadow IT. Featuring expert insights from Etay Maor, the Chief Cybersecurity Strategist at Cato Networks, the conversation initially looks into the persistent exploitation methods, the importance of knowing one’s cybersecurity environment, and strategic approaches to mitigating risks.