All Posts

Hey Security, Developers Want to Write Secure Code

Here’s a post-show interview Mike Johnson conducted with Fredrick Lee (AKA “Flee”) (@fredrickl), CSO, Gusto for our June 4th, 2019 episode of the CISO/Security Vendor…

Live Event in Dallas 6/14/19: From Hiring to Buying: What Do CISOs Want?

I’m heading to Dallas in two weeks to host a salon-style discussion with a group of enthusiastic cybersecurity professionals of how we’re improving some of…

Defense in Depth: ERP Security

For most organizations, their ERP solution holds its crown jewels. Should custom and complex applications that trade such vital customer and corporate data be secured…

Great Demo! Let’s Schedule a Time to Ignore Your Follow Up

We’re playing hard to get on the latest episode of CISO/Security Vendor Relationship Podcast. This episode is hosted by me, David Spark (@dspark), producer of CISO Series…

Defense in Depth: Managing Obsolete (Yet Business Critical) Systems

Obsolete systems that are critical to your business. They’re abandoned, unpatchable and unmanaged. We’ve all got them, and often upgrading is not an option. What…

We Unleash Our Military Grade InfoSec BS Detector

We’re trying to clean up vendor pitches of unnecessary and outrageous claims so they can sail through to a CISO’s inbox. It’s our service to…

Defense in Depth: Cybersecurity Hiring

Everyone needs more security talent, but what kind of talent, how specialized, and what kind of pressure is hiring requirements putting on security professionals? Check…

What’s Worse?! “Culture of No” or No Culture?

We want to put an end to InfoSec negativity, but not at the sacrifice of the soul of the company. We’re weighing our options on…

Topic Takeover: Vulnerability Management

One program we initiated in 2019 is something called “Topic Takeover” where we delve into one topic, by creating a deluge of articles, videos, podcasts…

Hiring and Trusting Remote Cybersecurity Workers

Right after we recorded an episode of CISO/Security Vendor Relationship Podcast with Sean Catlett, CISO of Reddit, we turned on the camera for a little…

Defense in Depth: How CISOs Discover New Solutions

Are security professionals so burned out by aggressive cybersecurity marketing that they’re giving up on discovering new and innovative solutions? What are the best ways…

Our “What Not to Do” Security Selling Secret

We’re not always clear on what vendors should do when selling security products, but when we get a really bad email pitch, we’re very clear…

CISO Series Deconstructs the Verizon Data Breach Investigation Report (DBIR)

Today, Wednesday, May 8th, Verizon releases its highly anticipated Data Breach Investigation Report (DBIR). The CISO Series conducted a webinar with all the hosts for…

Defense in Depth: Is the Cybersecurity Industry Solving Our Problems?

Is the cybersecurity industry solving our problems? We’ve got lots of new entrants. Are they doing anything new, or just doing the same thing slightly…

CISO/Security Vendor Relationship Podcast Live at West Michigan IT Summit

The CISO/Security Vendor Relationship Podcast will be heading to Grand Rapids, Michigan to be the closing keynote at the 2019 West Michigan IT Summit. The…

We’re Gonna Run These Pen Test Exercises Until You Turn Purple

We learn to iterate our security stamina faster by bringing the attackers and defenders in the room together. We’re seeing purple on this episode of…

Defense in Depth: Vulnerability Management

So many breaches happen through ports of known vulnerabilities. What is the organizational vulnerability in vulnerability management? Check out this post and discussion and this…

Best Advice to Overcome Vulnerability Management Concerns

We’ve been concerning ourselves with vulnerability management lately. And so after publishing “25 Tips to Reduce the Frustration of Vulnerability Management” and a post by…

I’m Humbled to Tell You About My Prestigious Award

I’m not exactly sure what “humbling” means, but I’m going to use it to hopefully soften my braggadocio announcement. We discuss semantics and when it’s…

Defense in Depth: Privileged Access Management (PAM)

Where does privileged access management (PAM) fit in the order of operations? Check out this post and discussion and this one for the basis of our…

WEBINAR: What Every Security Practitioner Needs to Know about Security Sales

In the CISO Series’ ongoing effort to reduce frustration between buyers and sellers of security products, I’ll be moderating a round table discussion where we…

No Shirt. No Security. No Merger.

Sure, we’d like to merge with your company but geez, have you looked at your security posture lately? Uggh. I don’t know if I could…

Defense in Depth: Machine Learning Failures

Is garbage in, garbage out the reason for machine learning failures? Or is there more to the equation? Check out this post and discussion for the…

Garbage In, Garbage Out is NOT Why Machine Learning Fails

At the RSA 2019 Conference I spoke with Davi Ottenheimer (@daviottenheimer), product security at MongoDB, about where and why machine learning falls short. One might…