We are awash in technologies, ideas, and processes. So much to look at. So much to learn. Where should we be paying the most attention to drive the security practice and the business forward?
Check out this post for the discussion that is the basis of our conversation on this week’s episode, co-hosted by me, David Spark, the producer of CISO Series, and Dan Walsh, CISO, Datavant. Joining them is Sneha Parmar, former information security officer, Lufthansa Group Digital.
Got feedback? Join the conversation on LinkedIn.
Huge thanks to our sponsor, Doppel
Full Transcript
Intro
0:00.000
[David Spark] We are awash in technologies, ideas, and processes. So much to look at, so much to learn. Where should we be paying the most attention to drive the security practice and the business forward?
[Voiceover] You’re listening to Defense in Depth.
[David Spark] Welcome to Defense in Depth. My name is David Spark. I’m the producer of the CISO Series. And joining me as a guest co-host, it is none other than the CISO of Datavant, Dan Walsh. Dan, thank you so much for joining us.
[Dan Walsh] David, great to be here today.
[David Spark] That is the sound of Dan’s voice. You’ll hear a lot more of it just a little later. But first, let me mention our sponsor. Our sponsor is Doppel: Defend what’s real, disrupt what’s not. We’re going to be talking about just that a little bit later in the show. Very intriguing little tease. You’re going to hear more about it. But first, let’s talk about our topic at hand.
So Generative AI didn’t start with GPT-3. That was just the moment it went to the moon. LLM has been around for a long time, but no one quite knew when they’d become the next big thing. Now, Ross Haleliuk of Venture in Security, was wondering what trends should we be paying attention to that most are possibly ignoring here?
Most of the advice was rather hopeful, and this was the post that Ross had on LinkedIn. And I wish this was happening, or I hope someone was developing a solution for this problem. I hear this a lot. You know, “This needs to happen,” or, “Someone needs to do this,” throwing the problem in someone else’s face. So Dan, it sounds more like a list for VCs and entrepreneurs to be paying attention to when people say, “I wish this was out there.” Yes, I mean, that’s usually a good sign.
[Dan Walsh] Yeah, I think so. I mean, I think a lot of the startups that you saw be very successful 15 years ago or so were in a response to a new chapter of technology emerging. You saw Palo Alto buy a bunch of companies that had successful exits in the cloud security space, and that’s now a very mature space.
And I think with some of these new technologies, LLMs, AI, Web 3.0, artificial intelligence, you’re seeing a similar trend. And sometimes it’s not just the new technologies, but sometimes it’s the new technology coupled with the old problems, right? Old problems like access control and things like that.
[David Spark] Very good. Well, I’m thrilled to have our guest who’s going to be joining us. Getting through this whole milieu of new tech and what we should be paying attention to, it is the former information security officer at Lufthansa Group Digital, Sneha Parmar. Sneha, thank you so much for joining us.
[Sneha Parmar] Thanks, David. Happy to be here.
How can we go faster?
2:36.377
[David Spark] All right. Before I read these quotes, pretty much the show is just people mentioning technologies or capabilities they would like to see. So here are a couple right now. Jesse Webb, CISO of Avalon Healthcare Solution said, quote, “AI augmented developer teams can truly enforce secure coding practices so that we don’t see the same flaws over and over and over again.”
And Tony Turner of Frenos said, quote, “Supply chain transparency that goes much farther than just SBOM,” end quote. All right, these are a couple right here. They seem pretty awesome. Yeah, we would like more secure coding and we would like more supply chain transparency. I think you got to be on board with that. Yes, Dan?
[Dan Walsh] Yeah, of course. I mean, why wouldn’t you be? Having that complete transparency around the supply chain is a utopian dream that every security leader has. But I think when you try to get real with it, it’s very difficult. And I don’t even know that we’ve been successful with SBOM right now as it stands without Web 3.0.
[David Spark] It’s a complete lack of standardization. If we don’t have any form of standardization, I don’t see how we could have that kind of transparency or anything. That seems like a pipe dream, like you just said.
[Dan Walsh] Well, we don’t have it defined appropriately, in my opinion. How do you define SBOM? You’re going to go to CISA’s website and look at the definition there? I mean, there’s third-party implications or dependency implications, so what is a true software [Inaudible 00:04:06] materials?
Is it simply the source code? What about the infrastructure. What about APIs? So really, we have a ways to go there. And while I think some of this new technology can help accelerate the parts of it, I still think we’re missing the whole of it to begin with.
[David Spark] All right. Let me throw this to you, Sneha. Going further than SBOM, I think it does sound utopian. I mean, a bazillion security problems would be solved if there was more knowledge here. But also, the issue with regards to more secure coding. Because there’s always been this fear that AI is actually creating the opposite of secure coding. It’s creating lazy coding with security holes. What’s your take?
[Sneha Parmar] Going back to just supply chain, I would say, as Dan mentioned, that we are missing the whole because there’s so much of legacy infrastructure. And initially, when things were starting up, it wasn’t built in terms of, “Okay, we have a high availability,” or, “There could be a downtime where we could replace some of it.”
And so what’s currently happening is it’s not just a Software Bill of Materials, but infrastructure, network segmentations, and everything which comes to life. And that is where all the security problem lies. Because it’s not just one solution, and that makes it even more and more difficult to solve.
From the secure coding perspective, you did get it right. So right now, there are a lot of advancement with AI in terms of coding, but there are also the increase in risks which we see. Because if there is bunch of code which kind of then gets replicated everywhere, but that has a flaw, and if there are no detections or technical controls involved, that could just replicate everything.
And it also creates a lot of, I would say, not lazy, but maybe we’re just not paying that much attention because we want to go fast. So we want to automate, and the speed is what matters. So we might reduce the quality of it.
This isn’t just a security issue.
6:03.718
[David Spark] Ymir Vigfusson of Keystrike said, “Cyber insurance, as it grows, will increasingly get to incentivize purchases for products that provide actual security, not just the optics of security.”
Well, heck. I hope that’s happening now.
[Laughter]
I hope it’s not in the future.
Barry Rabkin said, “The continual diminishing of the amount of cyber insurance coverage that insurance carriers will sell, with an associated tightening of terms, conditions, and restrictions of the coverage they do sell.”
That is a very real fear.
And George Al Koura, CISO at Ruby said “Cyber insurance and critical industry compliance legislative mandates were driving a shift in society towards a more educated and scrutinized approach to data management,”
All right. Well, interesting takes here about insurance, where I definitely see these trends happening right now as well. But the one that Barry says here gets a little scary, doesn’t it?
[Sneha Parmar] Yeah, very much so. Because ideally, the way we used to do cyber insurance previously, it’s very different than… I would say 2023, 2024, and then 2025, there’s just a huge difference there. And the shift is needed because it’s a lot more focused right now on data.
So if we have a regular definition of crown jewels and whatnot, it was very much systems as well as data storage, but also now data in transit. Whatever AI is interacting with and how secure that is, the transparency itself, that is difficult, I would say, from insurance perspective to math. But that’s something which I think would drive the change on both sides. And not to mention the regulations make it a lot more harder.
[David Spark] All right, Dan, I throw this to you. I have felt that insurance can play a very strong role in moving, essentially, the ball forward in security in that, look, if they make demands, organizations, like what regulations do, will start having to move in that direction. Don’t you think insurance has a great powerful part to play here?
[Dan Walsh] I think it can. I think it does. It is a regulator. It’s a regulating force for sure. I think the challenge with it is it’s very easy to show surface-level controls to get your rates where you want them to be. And I think that cyber insurance, like the regulators, is going to be in a constant state of catch-up in trying to stay ahead of this.
I think the one interesting thing to me about this whole “This isn’t a security issue” is the quote by George. He talks about data management. So what we’re doing now is… In the past, before AI and LLMs, you could be 90% accurate with your data, you had the human there for the contacts, and they could manage through that very successfully. Now, you’re going to be going faster with a machine, and that bad data or that poor data hygiene is going to accelerate a bad outcome potentially.
[David Spark] Yeah. I mean, the thing is, maybe we were buoyed by it because we’re seeing a lot of these DSPM tools out there that are coming to the front, and they solely exist because AI has been able to catalog and essentially tag all this data, and could conceivably solve a lot of these sort of data management concerns that we’ve had. Maybe the regulations can tighten a little bit more of what you need to know, what you have, where it’s gone kind of a thing. Yes, Dan?
[Dan Walsh] Absolutely. I mean, you think about in traditional data you had the 20-plus years data loss prevention DLP. So you think about that as the numerator of the equation. But your DSPM is all the data that’s not in transit, that’s sitting in some data store, either unstructured or structured, and that is like the sleeping giant.
Maybe it’s sitting there for 20 years in some old database, and then the guy who was maintaining or girl who was maintaining it leaves, and all of a sudden that database gets vulnerable and you have no idea that it’s been sitting there the entire time. And now you have a security breach. And so, yes, AI-enabled DSPM is something that’s super valuable, and it’s definitely a hot topic within the security leadership community.
[David Spark] Sneha, your take on essentially data management, getting tighter controls just because we have the capability to understand it better.
[Sneha Parmar] I 100% agree with Dan, because the biggest problems we see in terms of attacks is ideally a data breach, and then a disruption of the organization, be it ransomware or so. But still the lucrative thing for attackers to attack, and the company to protect, is data.
And there’s just mounds and mounds of unstructured, unclassified data which we are sitting on, and it’s really, really hard for a security team… It has always been harder for security teams to know it all because there’s Legacy, there’s new stuff coming up, new architectures spinning up.
And AI, I’m hoping [Laughs] that there’s a chance that we could solve this problem. At least even if the security teams have the visibility into 90%, we could fix a lot of stuff with that. And there is a huge, huge rise in the DSPM. So yep, betting on it.
Sponsor – Doppel
10:46.246
[David Spark] Before I go on any further, let me tell you about our spectacular sponsor, and that is Doppel. Now, Doppel is the first social engineering defense platform purpose-built to dismantle impersonation threats before they actually cause harm.
Now, while Legacy Tools focus on detection and alerting, Doppel goes further using AI and infrastructure correlation to link phishing emails, fake domains, deep fakes, and impersonation campaigns across channels. From executive protection to brand impersonation takedowns, Doppel doesn’t just flag threats, it disrupts them at the source.
Every attack fuels their shared Threat Grid, giving every customer the benefit of collective intelligence. The result? Faster disruption, stronger resilience, and fewer opportunities for adversaries to profit. That’s what you want. So Doppel makes digital deception unprofitable, protecting your people, your reputation, and your revenue in a world where social engineering is now the biggest threat to enterprise security. So you want to learn more? You got to go to the website and that is Doppel.com. Let me spell that for you. It’s Doppel.com. Go check them out.
Why is this so darn hard?
12:01.410
[David Spark] Raj Krishnamurthy of ComplianceCow said, quote, “OpenTrust in which every service can advertise its own security context, and every consumer of that service can determine if it should do business with it, or ignore or escalate.” That’s interesting. So that leans back to our discussion earlier about third parties.
David Mundy over at Tuskira said, quote, “Consumers actually caring about and demanding accountability in data security could lead to trust frameworks, such as blockchain, to verify authenticity of engagement, which will add layers of security to most everyday digital interactions.” The whole concept of the community pressure, I am, by the way, intrigued by. I don’t think we get enough of it.
And Ingemar Dvorsky of SentinelOne said, quote, “Data privacy and handling of the data that you provide and use with AI tools. Imagine how much data you give out, but yet have no transparency of what data that you are sharing. So having a data privacy key vault or something where you can decide what data you share with applications.”
By the way, I can mention that one of our guests, Davi Ottenheimer, works for a company called Inrupt that is trying to build this new web where data privacy is essentially the core layer of this. I think the reason we don’t get enough people complaining about it is they don’t understand it and understand how messed up it is. Do they, Dan?
[Dan Walsh] No. This is where… I hope you don’t think I’m a conspiracy theorist. Don’t you love when guests say that, David? I mean, if you think about it, Google, Microsoft, right now, Microsoft owns a large portion of open AI, Facebook, all those companies are billion, trillion-dollar companies because they use people’s data. And that’s how they’ve monetized it.
So now we have this rise of AI, and most of those Web 2.0 leaders [Inaudible 00:14:02] are getting into that space. And so I do think it’s going to be very difficult for us to all of a sudden now draw a line with privacy when that is exactly how they became so successful in the first place. And really, that funding will continue to develop innovation in AI. So I think that’s the first thing.
I think the second thing is what Raj talks about in terms of OpenTrust is really what we were talking about earlier with SBOM, right? Wouldn’t it be great if we had this trusted network where I know everything about you? I know your source code, the infrastructure you’re running, the vulnerabilities you have in your environment, your policies, your control adherence, all these things.
And if I can understand that, yes, there’s some good and there’s some bad, but I have to take the good with the bad because I know overall that you are a trusted partner and we have that dynamic exchange of information. That’s like the nirvana of course, right?
But because we don’t have that, and because data is going to be king, data is essentially now like a new type of asset when we think about it from a CISO or a security leader point of view, all these things kind of sort of coming together is what makes this very difficult.
[David Spark] What about a grand campaign about privacy that is, I guess, run by some kind of nonprofit group? Think about it. Anti-smoking campaigns and wearing-your-seatbelt campaigns took years, if not decades, to get on board. This could be a long, long campaign for people to implement, or essentially for the businesses to implement, privacy and also for people to show that they care about it putting pressure on the business. Your take on this, Sneha? Is that the way to go, or is there some other completely other method? I just throwed that out there. It is a long, long effort though.
[Sneha Parmar] I would also agree to that because there have been campaigns [Inaudible 00:15:45] I would say a [Inaudible 00:15:46] compared to the seatbelt campaign or anti-smoking campaigns. But what I have noticed, maybe I could be wrong, but what I’ve noticed from consumer perspective is they actually feel like setting up an MFA itself is a huge, huge blocker because it would slow them down, or, “That’s just too much and I don’t want to do it. I just want one click and everything is cool, and everything should be done.”
Except when it comes to banking. Because then it’s money involved. So then they are like, “No, I need more security.” But on other stuff, be it social media or be it personal information, confidential information, your healthcare or passport, it totally depends person to person.
You would see the change in the narrative that they have had before, but also with a lot of campaigns and details, they would have questions. But ultimately, when it comes down to putting on the controls from personal perspective, be it MFA or having a VPN or whatsoever, they kind of digress from doing that because that’s time consuming.
So one way would be a security is trying its best, but ideally, what we have to figure out is how to make it even more user-friendly, or change that idea that with one click everything is secure. But you should always have two or three doors. Like for your home, you would have two or three locks to make it harder for the attackers to get in. It’s the same way for your data. And that’s not set in yet.
So that is where I think a huge campaign would help. But a combined country wide or worldwide campaigns would help there a lot. Because the privacy laws are different in every country and every continent, and so it’s seen differently. And a lot of people are like, “Yeah, I don’t care. I’m in the U.S.,” or, “Oh, I don’t care. I’m in the E.U.”
[David Spark] Well, there’s no question GDPR forced privacy issues here at the U.S.
[Sneha Parmar] Yeah, the California Privacy Law. Yeah.
[David Spark] Yeah. And the California Privacy Law too. So when you have big places where you have to do business, you’ve got to do business in Europe, you kind of have to do business in California, that’s what pushes… Dan, you’re nodding your head?
[Dan Walsh] Yeah. I mean, I don’t think it’s by accident that the U.S., all the big data companies were launched in the U.S., it’s always a pendulum swing, right? Then it swung over to Europe and they were like, “No, thanks. GDPR.” And then it swung back to California like, “You know, maybe we should pay attention to what they’re doing over in Europe. Let’s do this California Privacy Law.”
What needs to be considered?
18:10.413
[David Spark] The last comment comes from Fernando Montenegro of The Futurum Group. And he actually has a comment about just the industry of cybersecurity in general and just sort of careers in that as well. Quote, “Evolution of roles and responsibilities for security within organizations tied to multiple factors, including career progressions, rising regulatory landscape, and cognitive overload.” All things we talk about multiple times on this show, Dan.
And I think one of the sort of the concerns in cybersecurity, and you’ve been in it a long time, you know this, is how you show you’re doing a good job. It seems that if we can start connecting it to more stuff to show things are getting done and the security program is moving forward, the business sees the value of it, and then the individuals are seeing the value of it, and managers are seeing the values of the individuals, I would assume that that would be an ideal situation, you as a manager, would love to see going forward. Yes?
[Dan Walsh] Yeah. Absolutely. One of the things that I’ve been thinking a lot about within the last couple of years is how can AI enable me as a security leader to lower the cost per control? So we have access controls in our environment, or we have other types of technical control. I’m not going to list all of them, of course.
But as I’m spending my money, and AI has this promise of utopia where it’s going to eliminate all this work and you’re just going to be served by the AI robots… I’m a little bit facetious there, but can AI meaningfully reduce the cost of my program? [Distortion 00:19:50] these automated SOC analysts that are going to help my team, and I don’t have to hire tier-one SOC analysts anymore.
Because they’re going to do a lot of the basic one-on-one security operation tasks freeing up my tier-two analysts to do something else. That should lower the cost of that control for monitoring my environment. Yeah, I think really that’s the promise of it, and that’s how I would encourage folks to keep themselves grounded around all this hype.
[David Spark] All right. Sneha, you yourself, same situation in terms of sort of showing the value to the business and showing the value of individual team members, what are the hooks that you would like to see that aren’t there?
[Sneha Parmar] I would say it should also reduce the cost of communication and overload that goes into the entire security team when you want to present certain metrics to the boards or even to, let’s say, your peers from product or tech, where you highly rely on them to put on or establish the controls, but they are not there. I would want to see a change in that as well.
Because right now teams are overloaded, and it’s a lot of friction and constant communication over time, be it vulnerabilities or fixing or metrics itself. It would be really cool to see that change. And what Fernando mentioned here, the roles and responsibilities, I have noticed that in a lot of organizations, everybody actually thinks that it’s just security team’s job to secure. But that’s not true.
We rely on each and every employee to do the basic security, maintain the security hygiene, maintain the data hygiene, systems hygiene. And this is where we could benefit a lot from AI. Because ideally, this is all done manually right now of constant meetings, constant follow-up, constant rollouts, and constant assessments of controls, policies, and everything. That’s where I would see the use of AI helping security team a lot and taking off that cognitive overload.
Closing
21:49.723
[David Spark] Well, that brings us to the tail end of this program. Where I ask the two of you, and I’m going to start with you, Sneha, to tell me which quote was your favorite and why. So looking back at the quotes, essentially it’s who sort of brought up the trend that you think is the one that’s most needed or the one that you think is definitely going to be happening.
[Sneha Parmar] My favorite would be from Ingemar Dvorsky because data privacy, as we just discussed, it’s just of huge importance and we need to move the needle there because it’s just the biggest risk we could have as an organization considering data is the main asset which we need to secure.
[David Spark] All right, very good. Dan, your favorite quote?
[Dan Walsh] I think my favorite quote is from Tony Turner that says Supply chain transparency that goes much farther than just SBOM.” I don’t think that the SBOM promise has been realized. I think AI can help with that. I’m hopeful that it can take us beyond that. But this entire concept, the really understanding yourself or supply chain is very critical and will help us to keep up with the speed of AI.
[David Spark] Very good points. All right, well, that brings us to the very, very end of our show. Thank you so, so much, Sneha, for joining us today. We love having you on the show. And Dan, love having you as a co-host as well. So love to do that again.
Huge thanks to our sponsor, and that would be Doppel. Remember, go to Doppel. They are the ones who will help you with social engineering efforts used against you which, well, it’s a big deal we know right now. Defend what’s real, disrupt what’s not. Go to the website, Doppel.com. Go check it out. Get help with essentially social engineering attacks. It’s tough out there. It’s really tough. And always, I want to thank our audience. We greatly appreciate your contributions and for listening to Defense in Depth.
[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site, CISOseries.com, where you’ll also see plenty of ways to participate, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.