We all know what gets our attention in cybersecurity. But those big ticket flashy items are often not what pay the biggest dividends. What are the simple, sometimes unsexy security controls that actually have a big impact?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Edward Contreras, senior evp and CISO, Frost Bank. Joining us is our sponsored guest, Rob Allen, chief product officer, ThreatLocker.

Join the conversation on LinkedIn

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:00.000

[David Spark] We all know what gets our attention in cybersecurity, but those big-ticket flashy items are often not what pay the biggest dividends. What are the simple, sometimes unsexy security controls that actually have a big impact?

[Voiceover] You’re listening to Defense in Depth.

[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of CISO Series, and joining me as my co-host for this very episode, it’s none other than Eddie Contreras, senior EVP and CISO over at Frost Bank. Eddie, say hello to the audience.

[Edward Contreras] David, thank you for having me back yet again.

[David Spark] Well, also thank the audience, too, for being here. Audience, thank you for being a continued listener of this show.

[David Spark] Yes, and telling all your friends to listen. By the way, if you don’t listen to our whole oeuvre of programming, may I suggest you go give it a listen sometime? It can all be found at CISOseries.com. Our sponsor for today’s episode is ThreatLocker, the world’s leading zero-trust platform.

Allow what you need. Block everything else by default, including ransomware and rogue code. And here’s what’s even cooler about ThreatLocker. We’re going to be at Zero Trust World in March. Specifics on that coming up later in the show. But first, let’s talk about our topic at hand.

Eddie, cybersecurity can feel like the wellness industry. There’s always something new you need to get healthy. But no matter what’s “new,” the basics of diet, sleep, and exercise is what you should do first.

The same is actually true in cyber. Unlike our physical health, cyber health’s “simple tactics” are not always so readily apparent. And examples I gave were regular cleanup of security exceptions of firewall rules, geo-blocking countries you’ll never do business with, and conditional access policies that block suspicious sign-ons.

While most would rather just pay to have their problems go away – this is not, by the way, unique to cyber – a core part of security is uncovering these simple measures and implementing them. I’m assuming you’ve seen this throughout your career, Eddie, yes?

[Edward Contreras] There’s so many phrases you can apply here – the basics, blocking and tackling, low-hanging fruit; my all-time favorite, the fundamentals. You have to understand if it was so easy, we wouldn’t have breaches, right? It’s a challenge for everybody, but it’s the same thing as if you’re driving a car and that simple oil light comes on.

You know you got to change it, but does everybody change it when the light comes on? I’ll go 5 more miles, 100 more miles, 5,000 more miles, and then what happens? You get a blown engine. So, yeah, it’s not always that easy.

[David Spark] No, it isn’t that easy. And by the way, sometimes the lights don’t light up as simply as the check engine light. [Laughter] It would be nice if it was that clear and let us know how much further we can go. Our guest for today’s episode, we’ve had him on many times before, we love having him on.

It is the chief product officer over at ThreatLocker, our sponsored guest, none other than Rob Allen. Rob, thank you so much for joining us.

[Rob Allen] Thank you for having me, David. It’s a pleasure to be here.

[David Spark] By the way, we’re going to be on stage together in a month at Zero Trust World.

[Rob Allen] So, we are? Yes. Something to look forward to, David. The last one was quite a lot of fun.

[David Spark] We’ll do it again.

Sometimes there’s a really easy solution.

3:21.435

[David Spark] Howard Holton, who’s the CEO over at GigaOm, said, “AGDLP, add users to a global group, add the global group to the domain local group, add permissions to the domain local group. So, you shouldn’t apply permissions to a user. You should apply permissions to a well-defined role, then apply the role to the group and add the user to the group.

Much easier to remove the permissions, remove them from the role group, much easier to see what permissions you are allowing, name the group something specific, much easier to troubleshoot why user one can or can’t do what user two can do, compare group role membership.

It’s easy to set up, although it sounds complicated what I just said,” by the way, that’s my aside, “Easy to audit, and it separates user audit from permissions audit.” That’s very important.

And Jonathan Waldrop, CISO over at Acoustic, said, “[Inaudible 00:04:20] and access management has to be on the list. It’s the least sexy security problem. When done well, no one notices. When it’s done poorly, everyone notices.” I think Jonathan sets it up very nicely, and Howard just goes through a very detailed comment.

Yeah, just user groups, not specific individuals. Yes, Eddie, that has got to be a basic right there.

[Edward Contreras] It’s a basic, and I know the first quote was really like a 101 on how to do Active Directory configuration, but if you’re talking to business units, and this is really where the light is shined into this corner, when you’re talking to business units that sometimes get affectionately called shadow IT, where they’re the ones that are providing their own access to their own applications, and they’re not integrated into like the enterprise platform.

That’s where these issues start to come up, and they come up very quickly. And I love that last quote by Jonathan. When it’s done great, no one knows. No harm, no foul. It’s just very transparent, no friction. But if it’s not done great, oh my goodness, not only do you hear about it, there’s audit reports.

Worst-case scenario, there’s a breach. Everything can go wrong if you don’t get this step right. And while it looks complicated, there are people that can do this in their sleep. But we don’t always allow the people that have the skillset to do it in their sleep.

We sometimes let people that don’t have that skillset to do it on their own, and that’s where that complication starts to emerge itself.

[David Spark] Rob, I’m going to set you up here. This whole thing about group permissions, this is very core to architecture with ThreatLocker, isn’t it?

[Rob Allen] Yes and no. I mean, first of all, I would say Howard’s an incredibly clever guy, and what he suggested is just basic common sense, just applying roles or permissions to roles rather than individual users. It just makes sense. And it’s not as difficult as you made it sound, David, frankly, because it is actually really straightforward.

What I would say, however, and again, a lot of this comes back to unnecessary elevated permissions. What I would say is that privilege escalation, you should probably assume that privilege escalation is going to happen in the same way you could say you should probably assume a breach is going to happen.

But privilege escalation is a pretty common, oh, it’s a fundamental part of basically any attack or any breach, and you should assume it’s going to happen and act accordingly. So, yes, you should absolutely set up things, as Howard very sensibly suggested, to give users the minimum permissions they need to allow them to do their jobs.

But equally, you should assume that privilege escalation is going to happen and act accordingly.

Why is this so darn hard?

6:49.226

[David Spark] James Sparenberg of Insight Global said, “Patching/upgrades – regular, rhythmic, predictable, and timely patching – think about the number of times you’ve seen XYZ Corporation compromised because an exploit that the software maker patched back in March was exploited, and that’s how the bad guy got in.

Drop all the excuses, put out the effort, and patch/upgrade. Roy Ludmir of CalCom said, “Secured configuration and hardening, especially of critical assets such as servers and particularly domain controllers and internet-facing servers. Enforcing a robust baseline such as Center for Internet Security benchmarks is quite a challenging thing to do, but it will reduce the attack surface significantly.” Rob, these are just two good fundamentals here, yes?

[Rob Allen] Absolutely, 100% agreed with both. Both are good ideas. Both are things that should be done. Again, both in isolation if they are all you’re doing, you’re going to have a bit of trouble. But no, patching is a perfectly sensible thing to do.

You should patch, and yes, there are absolutely examples of organizations that get compromised because they missed a patch or didn’t patch something they should have. Similarly, secure configurations using CIS, for example, is again a really good idea and absolutely should be done.

Not always as easy as it might be to know whether or not you’re actually matching these benchmarks, but the point is that they are both two pieces of a bigger jigsaw. They are both, in isolation, good things to do. But again, just focusing on patching, and patching being all of your focus, is not conducive to no breaches.

It probably means you are going to get breached because you’re not looking at something else you should be looking at. As I said, similarly, secure configuration absolutely should be done, as many of the CIS benchmarks that you can adhere to, then absolutely it’s a good idea.

But again, if that’s all you’re focusing on, you’re going to have a problem because it is part of a bigger picture.

[David Spark] Right. And I think we’re all kind of in agreement on that. I mean, I don’t think anyone thinks any one of these tips is the full solution.

[Rob Allen] You’d be surprised. I’ve spoken to people who believe that reducing unnecessary admin privilege, so basically taking away local admin rights from users is going to save them from ransomware.

[David Spark] So, I do agree with that.

[Rob Allen] Genuinely, it’s not going to save you.

[David Spark] Yes, I do agree with that. There are people that believe if you just do this, then 98% of your problems are gone. I have heard that line. Going to you, Eddie, on this. These seem simple, although we do know that the number of patches you have to do is at an overwhelming level, not physically possible to do it all, and I think that’s why we hear about cases of a vulnerability not getting patched.

And then basic security hardening, I guess it doesn’t happen just because we don’t know everything we’ve got. Is it just volume is the reason these things don’t succeed?

[Edward Contreras] It’s a good question, right? And this is where if you can self-reflect, and security professionals tend to do that sometimes, is there culpability on our end here? The way that I look at this is prioritization. If everything is an emergency, nothing’s an emergency because then where do you start?

So, if you unpack these two quotes a little bit, intertwine them a little bit, if you’re saying maybe your domain controllers are a little bit higher priority, maybe you’re external facing. If you can start to apply patches, and you can give guidance as to where to start that, then at least the teams know where to tackle first.

And so, you’re always going to have some trailing progress, and that’s normal in life. The goal is to tell your teams, “Okay, based on this risk, and if we have 10,000 servers, and you can’t patch all 10,000 at one time, where should you focus on first?” And helping them prioritize can actually start to focus on those high-risk areas with just not spreading across like a smooth peanut butter slab, right?

It’s just like, okay, we’re going to get certain portions of this covered before we cover the whole bread.

[David Spark] Rob, I want to go to this one line that James Sparenberg said – regular, rhythmic, predictable, and timely patching. That does sound like the solution, but you talk to anyone in security, A, the thing they love about it and the thing that scares them is that every day is different.

So, it’s kind of hard to have regular, rhythmic, predictable, and timely patching if you’re living in a dynamic world, no?

[Rob Allen] It’s absolutely impossible. You have no idea when a CBE is going to be announced. You have no idea when patches are going to be released for a particular piece of software. I mean, automatic patching is the ideal and what you want. But again, at the risk of being a downer on the conversation, the difference between any piece of software that you or I are running right now and any previous piece of software that you or I may have run is that the bugs that were in the previous piece of software have ostensibly been fixed, but you can be absolutely guaranteed and sure that the software that we are using right now is equally full of holes, has got just as many if not more bugs.

I mean, I’m talking to you on Chrome. How often do vulnerabilities in Chrome get released? How often are the new versions of Chrome? I mean, it’s almost daily at this point. Patching is absolutely a good idea, but it’s not going to solve all your problem.

It’s only going to solve that small sliver of the total number of breaches that are caused by vulnerabilities in software, which I think, and I’m going to make up – well, sorry, I’m not deliberately going to make up a statistic here – but I did read something recently where they said something between I think it was 15 and 20 percent of breaches are caused by unpatched software or vulnerabilities in software.

[David Spark] I mean, that wouldn’t surprise you. I mean, it is a percentage because we do hear it. [Laughter]

[Rob Allen] Undoubtedly a percentage.

[David Spark] Yes.

[Rob Allen] But I’m pretty sure that the percentage was somewhere in that vicinity, it was relatively low in the grand scheme of things, but obviously important, should be dealt with, but equally assume what is patched is still full of holes and act accordingly.

[David Spark] I think you agree with me, being that things are dynamic, things happen all the time. I’m just going to ask you the same exact question, Eddie, that I asked Rob is that it sounds great – regular, rhythmic, predictable, and timely patching – but man, the dynamic nature of cybersecurity throws a wrench in that all the time, I got to assume.

Yes?

[Edward Contreras] Everybody knows when patch Tuesday is, you know there’s a date there, but a well-written standard is going to tell you, you got to test first. Every patch needs a test. Ask CrowdStrike. You want to test something before you just roll it out.

And those are the scenarios where if, even though you have a regular cadence, there’s still the other elements, the business elements. If every system worked as intended by and designed as the delivery of what Microsoft sends you, great, but then apply business product, apply business applications, third parties.

Nothing works out of the box anymore. You have to test everything.

Sponsor – ThreatLocker

13:27.145

[David Spark] CISO’s hear “zero trust” everywhere, but very few conferences actually teach you how to implement it. Zero Trust World 2026 in Orlando does exactly that. Join us. Yeah, I mean us. CISO Series will be there March 4th to the 6th, 2026, in Orlando for a fully immersive experience with hands-on hacking labs, ransomware analysis sessions, and practical workshops that show you how to roll out zero trust in the environments you actually manage, whether it’s hybrid, remote, or just good old-fashioned messy.

You’ll leave with practical playbooks for reducing attack surface, locking down privileges, and maintaining zero trust without overwhelming your team.

And if that was not enough, I will be there. Yes, CISO Series will be there doing a live episode of the CISO Series Podcast at Zero Trust World again this year. We did it last year. It was a ton of fun. We’ll be there again on the morning of Friday, March 6th, 2026, right there on the main stage.

Now here’s a great thing – CISO Series listeners get $200 off with the code ZTWCISO26 if you go to the website ztw.com. ZTW stands for Zero Trust World. So, ZTWCISO26 at ztw.com. So, remember that code and think, but guess what? You don’t need to remember the code, but it’d be nice if you wrote it down.

What you should remember at bare minimum is go to our website for the blog post. We’ll have all that information there. Just enter it in and you will get your $200 off. So, register today and I will see you at Zero Trust World 2026.

Where do we begin?

15:13.881

[David Spark] Ben Habing of Kroll said, “Least sexiest is tracking your assets – hardware, software/services, vendors, identities, stacks, etc. – and the associated security architecture. Everything else hinges on those two key tenets. If I don’t know what I have, less so how it’s built, I don’t have a chance of stopping any attack inside or out.

Everything else is throwing stuff at a wall, hoping it’ll stick. Meanwhile, people walk in through an open door, logical or otherwise.” And Amy Chaney of Citi said, “Hygiene controls, if done many cycles back, would have limited and or prevented almost all of the recent decade’s successful attacks.

Example – is the configuration management database accurate and fully described? Are all data flows known, de-risked, controlled, and observed? Is access granted only for understood business purpose, least privilege, and available only when required?

Do we only put sensitive data into secured environments sandbox to production?” Again, great advice here, and I’ll just start with Ben. We’ve heard this a bazillion times, and nobody can argue with it. If you don’t know what you have, you can’t secure it.

I mean, that’s got to be the starting point. Yes, Eddie?

[Edward Contreras] It has to be, right? You think about certain statements – can you finish this sentence? If you don’t have a denominator, if you don’t know everything, then how are you going to finish that algorithmic problem that you’re trying to solve for, which is 100% do you have everything complete?

So, if you don’t know your environment, if you don’t know what’s there. And even the follow-on to that is not only do you have to know what’s there, do you know who manages it, who owns what’s there? It’s even worse sometimes to know, oh, I have a really good visibility of all my assets, but I don’t have owners assigned to these assets.

So, I think those go in tandem, but they wouldn’t be CIS 1 and 2 for a reason if they shouldn’t be everywhere, right? I mean, think about that. [Laughter]

[David Spark] Right, I forgot. They are the first two in those controls. Rob, hygiene controls, and Amy talking about configuration management database, you have the Defense Against Configuration or DAC tool. Was there an eye-opening moment that you guys started to create that?

I mean, you must have just seen hygiene problems going out of whack for your customers, yes?

[Rob Allen] Yeah. Well, I mean, there’s a couple of different sides to it. Like the genesis of that product for us was a way of checking our own configuration or configuration of our own product to make sure that there was nothing that could be problematic in how people had set it up.

But then we realized there was implications or other things that we could be checking alongside our own product, which is where DAC came from. The one thing I would take somewhat of an issue with is saying that anything would have prevented almost all of the most recent cyber attacks or the decades of cyber attacks.

I don’t know if I agree with that. Again, there’s no magic bullet here. There’s no wand that people can wave that’s going to prevent all cyber attacks. They come in all different shapes and sizes and forms and entry points and everything. So, saying one thing is going to solve all of these problems, I think is slightly incorrect.

[David Spark] And again, I think we’re all in agreement, but the question was asked, “Just give us some advice on what are these simple things,” so people were really creating a listicle of them. And I know like we agree that there are some people, they truly believe that their industry is the number one and it solves 98% of the problems.

[Rob Allen] We’re not even talking about vendors or products specifically here. It’s just the point that was made there. It’s hygiene controls done many cycles back would have limited or prevented all or almost all successful cyber attacks.

[David Spark] Oh, yes. Okay.

[Rob Allen] That’s what I have issue with. Not that anybody is saying there is a silver bullet. I’m equally saying there is no silver bullet. There is no magic wand that you can wave that will solve or prevent all of the, or almost all of the successful cyber attacks.

But again, that’s not to say that configuration hygiene and having strong configurations is not a good idea. Again, it’s part of the bigger jigsaw, it’s part of the bigger picture. Absolutely it is something that should be done. Ideally, you want it to be done automatically.

It’s not something that you want to have to check on 10,000 or 20,000 or 100,000 machines in an organization because there’s a lot of work involved in that. So, you want it to be something that happens automatically, ideally daily, because if configuration does drift or something becomes, you know, that was configured correctly today is out of configuration or out of compliance tomorrow, you want to know about that so you want to be able to resolve it.

So, having it, as I said, automatically and regular is the ideal scenario.

Sometimes it’s really not that difficult.

19:56.036

[David Spark] Robin Oldham of Cydea said, “”Completely non-technical – finance callbacks to known good numbers to verify new/[Inaudible 00:20:12] payees.” And Emma Kelly of SafePaaS said, “Segregation of duties, making sure no single person can both initiate and approve sensitive actions like account creation, code deployment, or financial transactions.

This dramatically reduces insider risk and can limit the blast radius of compromised accounts.” Eddie, this sounds just like having good processes in place, that is a conversation with cyber, but all departments have to think about this, yes?

[Edward Contreras] If you read Robin’s statement, while it’s so short and simple, there’s so much to unpack there, and you hit the nail on the head. When you talk about a process, do you have an approved process? Now, the process that happens within my organization or any organization that I’ve been a part of compared to Rob’s organizations or anyone that he’s been a part of, they’re different, and they’re different for a reason.

Everybody knows the process. It’s when you circumvent the process that risk starts to get introduced. So, if you’re saying something as simple as, “We should only connect to a server through a jump box.” Well, yes, there’s 500 ways you can connect to a server, but if your process is go through the jump box, anybody circumventing your process then becomes something to look at.

And so, I think you have to understand when you’re building out a program, when you’re managing these types of risks, those processes, they’re key. And a lot of times they’re not technical, they’re just procedural.

[David Spark] I’ll give you an example of a process that I just dealt with, not revealing the individuals, but I was handed a piece of paper, printed with a lot of sensitive information on it, extremely sensitive. And I had to travel a distance with this piece of paper that had ludicrous sensitive information.

I was just thinking, if this thing’s in my backpack and I lose my backpack, a lot of people are screwed. And I was thinking, could I have that information on a file that I will then encrypt and then password protect and not have on a piece of paper?

And then when I get home, I’ll print it out on a piece of paper, and I’ll put it away somewhere safe. And I had to discuss that process. It’s not that difficult. I saw the scenario of what happens if I lose my backpack? Oh, my God. You’ve had to have these conversations before where people try to do something simple, thinking it’s easy, and then all of a sudden creating a horribly open security issue.

Rob?

[Rob Allen] Absolutely. I mean, I have, well, not quite personal, but I’ve got experience from my past life before ThreatLocker. A company that I worked with back home in Ireland fell to the old reliable of CEO’s email gets hacked, email gets sent to the finance department to transfer money to this bank account in a hurry.

Accounts person or finance person duly obliges, and it was actually over a quarter of a million dollars was sent to God knows where, never to be returned. So, that’s another really simple, really basic example of a good process or procedure, which is if you get an instruction, you pick up the phone and you verify.

And it’s real world. This actually happened. Organization lost a ton of money over it. By the way, they did have cyber insurance and the cyber insurance company said, “We’re not going to pay out because that is the dumbest thing we’ve ever heard.”

[David Spark] [Laughter]

[Rob Allen] There are procedures and processes in place for a reason, and you didn’t follow them. So, therefore, good luck with your search for your $250,000. It ain’t coming back. So, yeah, it’s a perfect example. It’s absolutely sensible and very much does help.

[Edward Contreras] There’s a real-world example that most of us are familiar with. It’s near term memory, right? If you think anybody who looked at the MGM ransomware event and you’ve done a root cause analysis, ultimately, once you get back to the very first step, someone didn’t follow the process at the help desk and they reset a password.

And it was a simple process that had they followed it, a lot of headaches would have been avoided, and that’s where, again, a process could have been a savior.

[David Spark] And here’s another thing. It’s interesting you mentioned this, and I’ve seen, I think Chris Hadnagy, I’m butchering his last name, but he writes a lot about social engineering, and he does a lot of physical pentests. And one of the things that he has noticed is you can make a process that’s professional and polite and also secure.

They don’t have to be mutually exclusive. Have you seen examples of this, Rob? Like, it’s a process that requires, I need this information, I want to help you, but I need this information; otherwise, I can’t reset your password or do whatever.

[Rob Allen] There’s a multitude of different examples. I mean, a lot of them you don’t even notice. I mean, in dealing with my bank, I’d often send them an email saying, “I need you to do X, Y, and Z,” and they’ll always pick up the phone, they’ll ring, they’ll verify, they’ll make sure it’s me.

I mean, that’s probably the simplest or my basic example of a process or a procedure. And if they don’t pick up the phone, if they don’t speak to me, then the thing that I asked to be done is not going to happen. So, it’s just a fact of life now, but it doesn’t need to get in your way.

It’s just you understand that I have to follow these steps in order for a thing to happen.

[David Spark] I noticed that like Israelis who have been brought up with a security culture, this is extremely ingrained in their processes as well. Eddie, so what have you seen in terms of a process where it’s secure, but you can still be professional and polite?

[Edward Contreras] Yeah. And if you think, anybody who’s ever bought a house or a car, there is a process at the end of that. You could automatically digitize the majority of that. You could make this so seamless, but we don’t. We don’t do that for a reason.

There’s a house tied to the end of that agreement. There’s a car loan tied to the end of that agreement. So, everybody knows in that process, at some point in time, you’re going to sit in somebody’s office. You might get a really nice pen from your escrow company.

[David Spark] [Laughter]

[Edward Contreras] You may have a really good conversation with the sales manager at the car dealership, but there’s a process at the end of that for a reason. Even Tesla, if you buy a Tesla car, as easy as they make it, ultimately you go into the building and you have a finishing process there.

So, it’s tedious, but I think you can make it to the point where everybody’s expecting it, it’s anticipated, and it doesn’t have to be heartburn.

[Rob Allen] On that point, probably the most stressed I’ve ever been in my entire life was when we were going through the process of buying a house here. I think at the time, I was in Germany. So, there was like a nine-hour time difference between here and there.

I had to do whatever I had to do. Large amounts of money were being transferred. I was getting emails from all involved, but just the act of actually transferring large amounts of money to something that fundamentally I’d received as an email. So, is it real?

Is it not real? Not going to lie, I did not sleep very much that night. And I wouldn’t mind, I actually rang the company the following morning, I said, “Did you get it?” and they said, “Oh, yeah, we got it a few hours ago.” I was like, “Well, thanks for letting me know.”

[David Spark] [Laughter]

[Rob Allen] They didn’t. But yeah, it is absolutely nerve wracking.

[David Spark] I’ll tell you two quick stories. One, a security level that I created when I was dealing with the escrow company because I didn’t know them because it was through my agent. I remember having a video call and this, by the way, predates the spectacular deepfakes, so I don’t know if anyone could pull this off anymore, but I remember having a video call with my agent and the escrow person and literally just asking my agent, “Do you recognize this person?” That’s it.

[Laughter]

[David Spark] And that was the sole point of that call. And they go, “Yes, we’re good and everything’s fine.” But in regards to the car, Eddie, and this was what sealed the deal for us. The reason we got this one car, this one dealership was the only one that was willing to drive the car to my house, and I signed it on my kitchen table.

[Edward Contreras] Oh, nice.

[David Spark] Yes. Negotiate that for your next new car.

[Laughter]

[David Spark] I didn’t actually have to go into the dealership.

[Edward Contreras] There’s levels to this, David. You’re at a different level. [Laughter]

[David Spark] There you go.

Closing

27:59.543

[David Spark] All right. We’ve come to the portion of the show, Rob, where I’m going to ask you, which quote was your favorite and why.

[Rob Allen] So, I did like Ben from Kroll’s comment about least sexiest being tracking your assets. Now, it’s not the quote per se, but it is the concept or the idea behind what he’s saying, which is if you don’t know about it, you can’t control it. You can’t do anything about it, basically.

And that is something that plays out every single day. Microsoft’s digital defense report last year had a statistic, and this is an actual real statistic, which was 92% of cyber attacks or successful attacks leveraged unmanaged devices. So, that is pretty much exactly what Ben is talking about, which is unmanaged devices, whether it be people’s personal devices or I bring my computer in from home or personal phones or whatever the case may be, just random things sitting on the network being leveraged by attackers.

So, again, if you don’t know what’s out there, it is literally step one, whether it be from a software inventory perspective, which is obviously something that is of relevance or interest to us, or whether it’s a hardware inventory perspective. If you don’t know about it, you can’t protect it.

[David Spark] Excellent. All right, Eddie, same question to you, your favorite quote and why.

[Edward Contreras] Ben came in number two for me. Jonathan, though, does take it for me this episode, and it’s really the last part of his quote. “When done well, no one notices. When done poorly, everyone notices.”

[David Spark] And he was talking about identity and access management.

[Edward Contreras] Exactly, right. But you can use that across the industry as a whole. That’s the challenge with our industry here. It’s an uncelebrated industry. A lot of what you do goes unnoticed, and for good reason.

[David Spark] But I’m going to just say this, both of you as managers, I think what’s kind of key is letting the rest of the company know what a kick-ass job your team is doing.

[Edward Contreras] Absolutely, absolutely. Get that support from the top down where you don’t have to celebrate volume, but you can celebrate small wins and then have them champion your team. That goes a long way.

[David Spark] You’ve done that, yes, Rob?

[Rob Allen] Yeah, absolutely. I mean, look, as Eddie said, and it’s a really good point, is that I have to confess that particular quote from Jonathan did jump out to me as well – when it is done poorly, everyone notices. When it’s done well, nobody notices.

So, it is somewhat of a thankless task. It’s a thankless role. I mean, you don’t get judged on how many breaches you prevented. Very often, you get judged on the breaches that happen. So, every win, every small win, every positive should be at least acknowledged if you’re not going to get that much credit for it.

But again, if nobody knows about it, you’re definitely not going to get credit for it. So, yeah, it makes absolute sense and is good wherever possible to tell people about the good things that you’re doing.

[David Spark] I would also amend Jonathan’s quote and say when it’s done poorly, everyone blames you.

[Laughter]

[David Spark] It’s not just notices. The blame comes in like a lightning bolt. It comes in fast. q

[Rob Allen] This is true. This is true, unfortunately.

[David Spark] All right. Well, I want to thank my co-host, Eddie Contreras. Thank you so much. And also, Rob Allen. I want to also thank ThreatLocker. Remember, go to threatlocker.com/CISO. You know what? Do me a favor, throw the /CISO at the end. When you do that, it’s the simplest way to let them know that you heard about them from us, the CISO Series.

Just go to threatlocker.com/CISO. It’s literally four extra characters. It’s not that hard. You can do it. Look at them for any zero-trust model you’re building out. Take a look at what they’re doing at ThreatLocker. All right, Rob. Any last words from you?

I know you’re always hiring over at ThreatLocker, mostly in Orlando, correct?

[Rob Allen] Yes, mostly in Orlando. That would be fair to say.

[David Spark] Anything else you’d like to say?

[Rob Allen] Quicker now, hopefully. So, we had a small issue where we were kind of growing out of the building that we were in. We now have a totally new building, which has lots of room, so hiring is very much back on the agenda. So, yeah, there’s lots of opportunities.

We’re looking at doubling staff in probably the next couple of years.

[David Spark] Oh, my God.

[Rob Allen] Yeah.

[David Spark] Holy moly.

[Rob Allen] So, yeah, any number of different opportunities. Looking for good people, clever people, keen people, interested people, cool people sometimes. All the people, really.

[David Spark] Sounds good. Well, I’m assuming people can reach out to you if they go to look at the job board on threatlocker.com?

[Rob Allen] Threatlocker.com/careers.

[David Spark] Careers. And then also do /CISO just to let them know.

[Rob Allen] /CISO as well. Wait, wait. I wonder what would happen if you went threatlocker.com/CISO/careers?

[David Spark] Possibly you’ll get a 404 error.

[Rob Allen] Hmm. Maybe we should make a special /careers just for you, David.

[David Spark] Go right ahead. So, people don’t get 404’d from this. All right.

[Rob Allen] Fair.

[David Spark] Thank you very much, Rob. Thank you very much, Eddie.

[Rob Allen] Thank you, David.

[David Spark] And thank you to our audience. As always, we greatly appreciate you contributing and listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.