Security Insights: Recent Episodes
securityinsights
Is shadow AI today as great a risk as shadow IT was over the last decade?
And have we learned the security lessons from previous IT transformations, including BYOD and the cloud?
In this episode, we discuss why unauthorised and uncontrolled AI tools pose growing threats to both security and data confidentiality. And we look at how agentic AI brings a whole new set of risks, as systems create their own connections without human oversight.
How can cybersecurity leaders ensure the safe development of AI, without creating a whole new attack surface?
Our guest is Simon Gooch, field CIO at Saviynt.
Previously a director of security at Accenture, Simon has more than 25 years direct experience of cybersecurity and governance.
Interview by Stephen Pritchard.
According to the NCSC, there were over 200 attacks against UK critical national infrastructure last year. Some three quarters of these are thought to be linked to state actors.
On the surface, that number of attacks might seem small. But their impact could be significant. Attacks against power, water and transport can quickly bring the country to a halt. And no advanced economy can operate for long without banking and telecoms services.
And the cyber risks faced by CNI operators are worsening, not least because of AI. As our guest explains, AI doesn't have to be smarter. It's enough that it's fast, works at scale, and doesn't need to take a break.
This, in turn, demands a different response from cyber defenders, including their own sovereign AI capabilities.
Our guest is Rob Demain, founder and CEO at e2e-assure.
In this episode, we hear how security researchers and law enforcement worked together to disrupt Tycoon 2FA, a phishing as a service group.
How did they discover, and then counter the group's activities? And what were the results?
Our guest is Robert McArdle, director of forward threat research at TrendAI.
In this episode we welcome back the Cyber Agony Aunts, Amelia Hewitt and Rebecca Taylor.
As the UK's Cybersecurity and Resilience Bill works its way through Parliament, has the debate about cyber resilience changed? What does a resilient organisation look like? And above all, how do we create one, without putting cybersecurity professionals under extreme pressure?
As Amelia and Rebecca explain in their second book, Resilient You, we need to take control of our own resilience and wellbeing, even as we try to build those more robust operations.
Cybersecurity has its share of innovators, inventors and, of course, entrepreneurs.
Benny Czarny created OPSWAT more than 20 years ago, to develop a common language for security applications. Today, the business is best known for its “firewall of data” approach to detecting and removing malware.
In the first of an occasional series of interviews with founders, we speak to Czarny about his journey as an entrepreneur and as a business leader in cybersecurity. And we discuss his new book, Cybersecurity Upside Down.
Security researchers have found millions of hard-coded secrets, in plain text, across both public and private code repositories.
These include credentials, API keys, AI tokens and MCP configuration files.
And AI is making the problem worse, with AI-assisted commits adding to this "secrets sprawl".
Unless developers control how they manage secrets in their code, we are leaving the door open to malicious actors. And the growth of non-human identities (NHIs) only makes it worse.
Our guest is Dwayne McDaniel, principal developer advocate at GitGuardian, which recently published their research into secrets sprawl.
How can cybersecurity professionals "engineer" resilience? And why is an effective community an increasingly important part of our defence against cyber attacks?
In this episide, editor Stephen Pritchard caught up with Ameet Jugnauth, president of ISACA's London Chapter at their recent conference.
They discuss building resilience, why we have reached a tipping point in boards' understanding of cyber risk and why, despite a growing threat landscape, Jugnauth's outlook for the industry is positive.
How do you live through a cyber attack, and recover from it?
What lessons can you learn?
And why is resilience moving up the cybersecurity agenda?
In this special episode, we speak to Edwin Moraal, CISO at Dutch public safety body Veiligheidsregio Noord- en Oost-Gelderland (VNOG), about his experiences. And he's joined by Tim Pfaelzer, Veeam GM for EMEA, whose team helped with the recovery.
However prepared you think you are, there are always lessons to learn.
Soon, quantum computers will be able to decrypt "production grade" encryption, putting both privacy and security at risk.
But how close is "Q Day", and is a cryptographically relevant quantum computer a realistic prospect?
Is it something malicious actors will be able to obtain, and if so, how would they use it and what threat does that pose to confidentiality of our files, as well as our communications?
Our guest today is Moona Ederveen, an author, speaker and consultant who has been studying the impact of quantum computing on security.
Here, she discusses the scale of the threat, the steps organisations need to take to mitigate it, and why cybersecurity teams need to act with urgency.
Listeners can also access the Post-Quantum Preparedness Framework mentions in the episode here.
DDoS attacks have posed a threat since the late 1990s. And distributed denial of service attacks have proven to be hard to prevent, and to deter.
Security teams are better at detecting and blocking DDoS attacks than they were. But malicious actors have not stood still.
They are now using complex, multi-vector attacks rather than relying on volume alone; they are using AI to design attacks, and compromised IoT devices to launch them, according to research from NETSCOUT.
In this episode, we look at how DDoS is evolving, and what CISOs can do to reduce their impact.
Our guest is Darren Anstee, CTO for security at NETSCOUT.
In this CISO interview, we discuss the role of a CISO in a global technology services business, the changing threat landscape -- from geopolitics to the growth of AI -- and the importance of skills, learning and cybersecurity education.
Our guest is Mike Baker, vice president and global chief information officer at DXC Technology.
Above all, he says, the CISO's role is to build a resilient team.
Interview by Stephen Pritchard.
Over the last few years, we’ve seen the resurgence of geopolitics as a driver for cybersecurity, especially in Europe. But the return of war to the continent is just one factor changing CISOs’ views of risk.
In this Insights Interview, we discuss developments in the threat landscape with Haider Pasha, CSO for EMEA at Palo Alto Networks, following the company’s recent Ignite event in London.
As he describes it, Europe faces its own pressures, as malicious actors exploit differences between countries, their policies and even cultures.
But security leaders in Europe, and elsewhere, also face challenges from AI, quantum computing, and a fragmented and increasingly complex regulatory landscape.
So how do security teams close those gaps?
Interview by Stephen Pritchard.
What, exactly, is threat intelligence? And how do CISOs use it?
Security teams now have access to multiple sources of information on threats and threat actors. These come from industry, from law enforcement, and even their own networks and SOCs.
But how effective is it against an ever-changing roster of adversaries? And how do CISOs become informed consumers of intelligence?
We invited Rafe Pilling, director of threat intelligence at Sophos, to discuss how threat intelligence has developed, in the context of some of the recent attacks and threat groups.
What is digital sovereignty, how does it relate to data sovereignty, and to resilience?
In this CISO Interview, we speak to Kim Larsen, CISO at Keepit, a service provider specialising in protecting data for SaaS applications.
With a career spanning policing, government and the private sector, he has witnessed the growing influence of geopolitics on cybersecurity. And he suggests both businesses and public sector bodies need to think about not just where their data are, but how to guarantee access to their technology if the worst does happen.
Interview by Stephen Pritchard
The cybersecurity skills gap might be narrowing. According to the latest Cybersecurity Workforce Study, from ISC2, CISOs are less concerned about the number of cyber professionals in their organisations. Instead, the focus is on whether they have the right mix of skills, to take on an increasingly complex threat landscape.
We go through the results of the research, and what it might mean for cybersecurity professionals at all points in their careers, with ISC2's COO, Casey Marks.
Interview by Stephen Pritchard
In the first episode of Series 7 of Security Insights,we welcome back Charl van der Walt, head of security research at Orange Cyber Defense.
We discuss the key findings of his team's 2026 Security Navigator report, how AI is tipping the balance of power in favour of malicious actors, and why resilience and agility should be on the CISO's agenda for this year.
Cybersecurity is about building resilient organisations. But this is impossible without resilient people.
Cyber defence is often a highly pressured working environment. And it can be lonely too. But if teams are unable to function at their best, attackers will exploit this.
In the second of our two episodes on cyber resilience, we look at its human side.
Our guests are Rebecca Taylor, threat intelligence knowledge manager and human intelligence researcher at Sophos, and Amelia Hewitt director of cyber consulting at Principle Defence. They're also known as the Cyber Agony Aunts.
They discuss steps organisations, and individuals, can take to improve their resilience with Stephen Pritchard.
Cybersecurity is changing its focus.
Increasingly, it is less about defence and more about resilience.
Organisations have to be able to withstand and recover from an attack. It's no longer about preventing breaches: the sheer volume of cyberattacks means that is no longer possible.
Instead, security teams and boards should assume an attack will happen, prepare keep the organisation operating during an incident, and aim to recover as quickly as possible.
Our guest is James Blake, VP of global cyber resilency strategy and consulting services at Cohesity.
He argues that this means integrating business continuity and disaster recovery with cybersecurity. And organisations should rehearse for cyber incidents, training staff to operate under what can be extreme pressure.
A good playbook, Blake suggests, is not enough.
Interview by Stephen Pritchard.
This year has not been easy for cybersecurity teams.
Businesses continue to face cybercrime and state-sponsored attacks, especially ransomware.
AI is proving to be a double-edged sword, helping both defenders and malicious actors.
And there are the ongoing issues of skills, recruitment and retention.
How, then, do cybersecurity professionals navigate their way through all these challanges? And what should they prioritise for 2026?
For this episode, we're pleased to welcome back Chris Dimitriadis, chief global strategy officer at ISACA.
Interview by Stephen Pritchard
Critical infrastructure is on the front line of the war in Ukraine.
And as the conflict approaches its fourth year, there is little sign of that changing.
Strikes against infrastructure, though, are only part of the picture. Since Russia’s full-scale invasion, and even before, Ukraine’s defenders have waged an equally intense, but less visible, cyber war.
What lessons can we draw from Ukraine’s experience?
And how can states and businesses protect their critical national infrastructure during war and conflict? And how do the public and private sector deal with the prospect of both kinetic and cyber threats?
We discuss this with Mihoko Matsubara, author, associate fellow at the International Institute of Strategic Studies and chief cybersecurity strategist at NTT Corporation.
A growing number of organisations now offer "bug bounties", paying hackers or security researchers rewards for finding vulnerabilities.
But how do these programmes operate, and how do CISOs ensure that they are run ethically? What are the risks of inviting researchers to hack your organisation? How do bug bounties stack up against other methods of security testing?
And what are the benefits to security researchers themselves, as the programmes cannot work without hackers?
We cover the pros and cons of bug bounties with Ottilia Westerlund, hacker engagement manager at bug bounty platform Intigriti, and herself a former software engineer and published security researcher.
DDoS – or distributed denial of service attacks – remain a serious source of disruption across the internet.
DDoS attacks continue to grow in their frequency and volume. And increasingly, they’re aligned to geopolitical events.
A driver is sites offering “DDoS for hire”. The groups behind these sites even offer DDoS as a service attacks for free. But cybercrime groups are making use of AI too.
This is leading to what researchers at NETSCOUT describe as a “digital battlefield", with DDoS attacks overwhelming underprepared defenders.
Our guest is Richard Hummel, director of threat intelligence at NETSCOUT.
Is cybersecurity's skills crisis one of its own making?
And why have initiatives to close the skills gap made relatively little impact?
In this episode, our guests Thom Langford, of Rapid7, and Lee Munson, of the ISF, discuss career changes, hiring practices, certifications and what needs to change with editor Stephen Pritchard
Education is increasingly in the crosshairs for malicous actors. Along with other public sector bodies, schools, colleges and universities are being targeted for the information they hold, as well as for extortion and ransom.
What, then, can leaders in the sector do to bolster their defences, especially when budgets are under pressure?
Our guest is Joe Rooke, director of risk insights at Recorded Future’s Insikt Group.
In this episode, we discuss whether vulnerability scores are still a viable tool when it comes to measuring cyber threats.
Both CVEs and CVSS are core security tools. But, our guest this week argues, they are often misused. In a worst case scenario, they add little to effective defence, and can divert security teams from the real threats.
Tod Beardsley is VP of security research at runZero, is on the board of the CVE Project, and is a former official at CISA.
More than three quarters of security breaches result from human behaviour.
But as an industry, we focus far more on technical security measures, than on the human element.
Human risk management sets out to change this. Its proponents aruge that by measuring what people do on networks and systems, we create a much clearer picture of risk.
In fact, they say, the risks posed by people should be on the business' risk register.
And it's only with that picture that we can implement the controls, and measures such as security awareness and training. But human risk management goes far beyond anti-phishing campaigns.
Our guest is Ashley Rose, co-founder and CEO of Living Security.
With a background in both marketing and psychology, she’s setting out to help organisations move away from focusing on devices, and to a human-centric view of security.
Artificial intelligence is often described as a "black box". We can see what we put in, and what comes out. But not how the model comes to its results.
And, unlike conventional software, large language models are non-deterministic. The same inputs can produce different results.
This makes it hard to secure AI systems, and to assure their users that they are secure.
There is already growing evidence that malicious actors are using AI to find vulnerabilities, carry out reconnaissance, and fine-tune their attacks.
But the risks posed by AI systems themselves could be even greater.
Our guest this week has set out to secure AI, by developing red team testing methods that take into account both the nature of AI, and the unique risks it poses.
Peter Garraghan is professor at Lancaster University, and founder and CEO at Mindgard.
Interview by Stephen Pritchard
Non-human identities now vastly outnumber human actors on the internet, perhaps by as many as 50 to one.
APIs, online devices and service calls now dominate internet traffic, and access requests.
And this is only set to increase, with the rise of AI and AI agents.
Could we even see "robot wars" as AI agents take on AI defenders?
A lack of visibility, and a lack of control over machine identities is not just putting systems and networks at risk.
It is changing the whole concept of identity.
Now, it's no longer a question of who has access to our systems and data, but what. And the consequences for cybersecurity are far reaching.
Our guest is Art Gilliland, CEO at Delinea. Interview by Stephen Pritchard
Managing cybersecurity is increasingly about managing risk.
It's not possible to stop every attack or prevent every breach. So CISOs need to link the likelihood and impact of an incident to the damage it does to the organisation.
But do security teams understand business risk? And do business leaders fully appreciate the threat from cyber attacks?
Our guest is Richard Seiersen, chief risk technology officer at Qualys, as well as a researcher, author, entrepreneur and former CISO.
Can a book hold the answers to our cybersecurity challenges?
Perhaps not. But a new book from the Information Security Group at Royal Holloway, University of London, sets out to act as a primer on cybersecurity.
The target audience is both those setting out on a career in the sector, or general readers who want to understand the core principles of cybersecurity.
The book is called Cyber Security Foundations: Fundamentals, Technology and Society, published by Kogan Page. In this episode, we ask three of it authors how it came into being, and how a written text can keep pace with a fast-changing security landscape.
Verizon's Data Breach Investigations Report is one of the longest-running research studies in the industry.
This year's report is the 18th and tracks over 20,000 incidents and 12,000 breaches.
What changes are we seeing, and what can CISOs learn from the data?
Our guest is Ashish Khanna, who runs the security solutions and consulting practice at Verizon Business. Interview by Stephen Pritchard
In this episode, we look at the growth of the cybersecurity industry in Northern Ireland.
What are the reasons for its success, and why does cyber play an important part in Northern Ireland's post-industrial future? And why should CISOs look there for a source of talent?
Our guest is Simon Whittaker, chair of the steering committee for NI Cyber, and CEO of Vertical Structure, now part of Instil.
Our guest this week is Mandy Andress is CISO at Elastic.
Elastic describes itself as a “search AI company”, and is very much at the forefront of modernising enterprise technology.
A host of businesses use Elastic's tools behind the scenes to manage their data, for security and, of course, for AI.
As CISO, Mandy Andress has the dual responsibilities of keeping Elastic secure, and advising customers on security.
In this CISO interview, we hear about her route into cybersecurity and the pressures of dealing with the increasing intensity, or velocity of cyber attacks.
And we discuss why CISOs need to be more aware than ever of their role in providing security not just within their own organisations but across national infrastructure, and the wider economy.
Dr Claudia Natanson is CEO at the UK Cyber Security Council.
The Council, which is funded by the Government's Department for Science, Innovation and Technology, acts as an umbrella body for a range of professional bodies in cybersecurity.
It is the organisation behind chartered status for cybersecurity professionals, sets standards and publishes an ethics code, and acts as a voice of the industry: quite a broad mission for an organisation that is only a few years old.
The Council is, though, very well placed to assess the health of the cybersecurity industry across the UK. And, as Dr Natanson says, it faces a number of challenges, including recruitment, retention, diversity, and ensuring organisations understand what they need from their cybersecurity teams.
But what, exactly, does pouring the perfect pint of Guinness have to do with a successful career in cyber?
Interview by Stephen Pritchard
Our guest for the 125th episode of Security Insights is James Bore.
A well-known industry figure and speaker on cybersecurity, James runs the family consultancy firm Bores. He's also an author, book publisher, cyber skills trainer and volunteer.
In this Insights Interview, he shares his forthright -- and sometimes controversial -- views on the way forward for cybersecurity, with editor Stephen Pritchard.
Does cybersecurity blame the victim? What is the relationship between trust and security? And why is investment in security sometimes a bad thing?
Are CISOs leaving the industry in droves?
One survey suggests that as many as one in four senior cybersecurity leaders plans to leave the profession.
The causes include growing responsibilities, increasingly severe threats and ever-greater regulatory burdens.
The result is stress and burn out, with CISOs constantly fighting fires. As one of our guests says, CISOs suffer from an "invisibility of success".
So what can we do? The first step is to recognise the problem; the second is to help CISOs build both organisational and individual resilience.
Our guests are Darren Williams, founder and CEO of BlackFog, which commissioned the research, and Peter Coroneos, founder of mental health not for profit Cybermindz.
How far should you push security tests?
Sometimes, the answer is "to the limit".
In this episode we look at stress testing in cybersecurity. Putting systems under pressure is the only true way to check that they will work, as intended, during a cyber attack.
But how does stress testing differ from pentesting and cyber exercises? How far is too far, and how do security teams capture the right lessons from the testing process?
Our guests are Chris McKean, solutions specialist at NetApp, and Simon Edwards, founder and CEO at SE Labs.
Ransomware remains one of the greatest cyber threats to organisations. Certainly, it is the threat at the top of most boards' agendas.
The reasons are clear enough: ransomware damages reputations, as well as the balance sheet. in the worst case scenario, a business might never recover from an attack.
And ransomware itself is becoming more sophisticated, and so more dangerous. Groups have moved on from simple phishing and RDP attacks to exploiting zero days. And they are as likely to threaten to release confidential information, as they are to encrypt it.
As our guest suggests, ransomware has moved from an attack on availability to an attack on confidentiality.
When it comes to advising on the ransomware threat, few are better placed than Raj Samani. Senior vice president and and chief scientist at Rapid7, Raj is also chief innovation officer at the Cloud Security Alliance, a special adviser at the European Cybercrime Centre and a co-founder of No More Ransom.
Here he discusses the changing ransomware threat, and how organisations should act when they are attacked, with Stephen Pritchard.
What happens when a cyber attack hits? What is it like to be in the eye of the storm, and how can security teams prepare?
A cyber attack is inevitably a highly stressful situation for everyone involved. But planning and exercising goes a long way to at least manage that stress.
Our guest for this episode is Dan Potter, senior director for resilience and cyber drills at Immersive Labs. He also has over 15 years' experience working in resilience in the financial services sector.
As he says, no playbook or incident response plan will be fully effective, unless the business takes the time to test it - and learn the lessons from the exercises they run.
In a new series of interviews with cybersecurity leaders, we meet Jack Mersey, CISO at Westbury Street Holdings.
In an in-depth interview, he discusses threats -- from nation states to business email compromise -- security awareness and culture, and the challenges of ensuring security to a highly distributed business with 26,000 people and over 1000 sites that operates around the clock.
How does a CISO gain the confidence, and support, of colleagues from baristas and chefs to general managers and finance teams?
How can a security team operate internationally and keep headcounts low?
And how can cybersecurity leaders ensure security does not become a blocker?
Interview by Stephen Pritchard
Hacktivist groups have been around almost as long as the public internet.
But their make up, and their goals, have changed.
Hacktivism is no longer about "hacker" or counter culture or protest. Instead, it appears increasingly aligned with political objectives.
And some of today's groups at the very least aligned to, if not sponsored, by nation states.
Perhaps hacktivism is no longer the right term. Researchers are now talking about groups that set out to undermine trust in both the online and physical worlds, and carry out what some security researchers call “cognitive warfare”.
As part of its 2025 Security Navigator report Orange Cyberdefense tracked one hacktivist group in detail. Our guest is their head of security research. In this episode, he tells editor Stephen Pritchard what his team have discovered, from watching one particular group, and a renewed interest in hacktivism more broadly.
AI poses risks to security, through possible flaws in the applications themselves, and by AI being used by threat actors to develop malware and improve their targeting.
But there’s also plenty who argue that AI offers a chance to improve security. Certainly there are plenty of vendors promoting AI-enhanced versions of their products, promising to react faster, and pick up more threats.
Which side, though, will win out? And should cybersecurity professionals fear AI, or see it as an ally?
Our guest this week is Jon France, CISO at ISC Two. On the back of the organisation’s recent Cybersecurity Workforce Study, he discusses AI, good and bad, with editor Stephen Pritchard.
Is stress unavoidable, if you work in cyber?
And does workplace stress in the industry threaten security?
Stress and burnout among cyber teams are now a real worry for CISOs. And our guest for this episode argues that they should be a concern for boards too.
Stressed-out operators underperform and make mistakes. Burned out staff are more likely to leave, forcing firms to spend more on hiring and training replacements.
So how should employers spot the signs of stress? And what can we do as individuals to avoid burn out?
Our guest is Katie Maycock, of GYST Wellbeing.
Geopolitics is increasingly influencing cybersecurity.
The growth of online espionage, the potential for attacks by state actors, and governments turning a blind eye to cybercrime are all increasing risk.
At the same time, our growing dependency on connectivity, in government, in critical infrastructure and for day to day business, makes cyberspace an attractive target.
But it's not always been this way. In the early days of information and IT security, nation state threats were rare.
But, as Steve Durbin, CEO of the Information Security Forum points out, a lot has changed over the last few decades, and especially in the last few years.
In this Insights Interview editor Stephen Pritchard asks whether we are now more at risk than ever, if the current level of cyber threats could spill over into a more overt conflict and whether organisations have the resources to operate in a more dangerous world.
There's a lot being said (and written) about deepfakes.
And there is no doubt that they can now be very convincing, to the point where they can deceive the human eye.
But are deepfakes just a bit of fun, or do they pose real security risks? Do the dangers lie in manipulating public opinion through fake news, or can deepfakes be used to breach security systems.
Our guest, Dr Andrew Newell, academic researcher and chief scientific officer at iProov, argues that both are happening. Security teams need to take steps to block deepfakes from compromising identity systems, but we all need to guard against their wider influence.
Interview by Stephen Pritchard
Software as a service, or SaaS, has been a huge success. There are now some 30 thousand SaaS applications on the market worldwide. These cover everything from niche requirements to running entire businesses.
The SaaS revolution has certainly brought benefits to businesses.
But are SaaS applications secure and robust enough? Supporters of SaaS argue that their applications are actually safer and more resilient than locally-run IT.
However, Cloud vendors, including SaaS companies, rely on the shared responsibility model. In simple terms, they look after the infrastructure, but the customer is responsible for their data.
This can leave organisations with real problems, if their data is inaccessible, or even deleted.
This could be down to human error, malicious actions, such as a ransomware attack, or even a SaaS provider failure.
Our guest today is Simon Taylor, Founder and CEO of HYCU. He believes that SaaS users need to take more control of their data, even when it's in a SaaS application.
Europe's cybersecurity industry is worth some $50bn and is growing at 10% a year.
It's also pretty fragmented – at least when it comes to vendors. Europe -- even more so than the US -- is now ready for market consolidation.
Some of that is being driven by acquisitions by the large technology firms, as they look to broaden their cybersecurity offerings.
But firms, and their investors, are looking for scale.
And CISOs are looking for simplicity and greater security. Could vendor consolidation achieve this? And what is the role of cybersecurity "platforms" as the industry changes shape?
Our guest is Mark Smith, of advisory firm Houlihan Lokey.
Interview by Stephen Pritchard.
Conventional security training leaves a lot to be desired.
So what can CISOs do, to deliver training and security awareness in a way that is effective, and engaging?
Over the last few episodes we've discussed both the psychology, and human factors, around cybersecurity. To finish the series, in this programme we will look at experiential learning, or learning by doing.
Our guest is Amy Stokes-Waters. She delivers exactly that, by running escape rooms for organisations who want to improve security awareness, but want to move away from slide-heavy courses, and checkbox compliance. She's also written a paper on experiential learning in cybersecurity.
But does it work? She discusses cyber escape rooms, learning theory, and the pros and cons of measurement with editor Stephen Pritchard.
How do we manage the risks posed by human behaviour?
In this, the second of our short series exploring the links between human behaviour and security, we look at the emerging field of human risk management.
The statistics are quite frightening: 90 per cent of security breaches involve human error or social engineering.
But how do we, at a business level, categorise those risks? If we don’t understand the risks, we can’t reduce them.
A better understanding of where the risks are – and which behaviours are risky – makes it easier to design counter measures, such as training.
Our guests this week are Lev Lesokhin and Charlotte Jupp, of OutThink – an firm that’s pioneering human risk management.
We discuss what human risk management involves, and how security teams can make use of it, without crossing privacy boundaries.
How important is human behaviour in cybersecurity? How well do we know our people, and do we understand the risks posed by individuals' actions?
Research suggests that the overwhelming majority of cyber breaches start with human error or poor practice. But despite investments in security training and security awareness, we still make mistakes.
Over the next three episodes, we will examine some of the human factors around cybersecurity, including human risk management, and how we change behaviour.
We'll start the series by looking at the psychology of cybersecurity, as well as how to measure change.
Our guest is Dr Thea Mannix, a neuroscientist and head of research at Praxis Security Labs
Our guest for this episode is Tim Freestone, of Kiteworks. He’s a long-standing expert in data protection and data privacy. And he's been following the growth of AI, and what it means for data privacy, security and confidentiality.
Even data specialists have been surprised by the rapid take up of generative AI and its benefits. But do we have the measure in place to guard against the potential security risks it brings?
It is not just malicious hackers who make AI tools such as chatbots a risk. Even something as simple as pasting information into a generative AI tool can cause problems. And he argues that we need to apply security's zero trust approach to AI too.
Interview by Stephen Pritchard
Any advanced economy relies on the smooth running of its infrastucture.
And whether it’s transport, logistics, healthcare, the banking system, manufacturing – even food production – industrial and operational systems are what keeps it all running.
Those systems are now being targeted by malicious actors. Both state-sponsored and criminal groups are looking closely at operational technology and industrial systems.
Recent research suggests that many, if not most, of the groups attacking critical national infrastructure are linked to national intelligence agencies. And that raises some difficult questions about how both businesses, and their governments, should respond.
Our guest is Mark Magpie Graham, technical director for threat intelligence at Dragos, who carried out the research.
It's hard to put an exact figure on ransomware attacks. All the available research shows incidents continue to grow year on year, and that the vast majority of cyber incidents are now ransomware or other extortion attacks.
But could more transparency and information sharing help defend against ransomware?
If more organisations disclosed attacks, we would have a clearer picture of the problem and be able to respond more quicky to new techniques or attack vectors.
That's the argument put forward by this week's guest.
Sabeen Malik is vice president of global government affairs and public policy at Rapid7. She has put together a ransomware disclosure framework, based around the "3 Cs" of capabilities, context, and collective action.
She tells Stephen Pritchard how it works, and why it could help.
The idea of cyber war is not new; researchers first suggested the concept 30 years ago.
Since then, there's been a debate on what cyber war means and what can be done to prevent it.
Some experts even suggest cyber war is already happening, even if it is mostly in the shadows.
For Peter Kestner, the rise of cyber attacks and an increasingly volatile geopolitical situation were just two of the reasons to examine cyber warfare in more detail.
Peter is both a keen student of history, and a cybersecurity professional with over 25 years' experience in consulting in the sector.
He decided to combine the two interests, and the result is his new book, "The Art of Cyber Warfare".
Peter believes that by looking into conflicts in the past, we can learn valuable lessons about how warfare, and especially cyber warfare, might develop. But history can also teach us how to improve our defences, against adversaries who are as comfortable attacking civilian as government or military targets.
- Please note this episode contains some stronger than usual language.
The CISO’s role is changing; that is clear enough.
Indeed, constant change and the need to adapt is always a feature of cybersecurity.
And that’s why our guest this week lists curiosity as one of the key attributes for a cybersecurity career.
Mani Nagothu is field CISO at SentinelOne. Before that she headed up IT security for an energy company. That followed a career as a consultant.
But she didn’t start out in cybersecurity, but as an engineer. And the CISO’s role itself is becoming less technical, and more business focused, she says.
In this episode Mani talks to Stephen Pritchard about her career so far, what it takes to be successful as a CISO, and why greater diversity is the key to strengthening our security teams, and so our defences.
The cybersecurity skills gap is a problem that won't go away.
Worldwide, there are close to 3.5 million vacancies in the industry. The problem seems to be worsening, not least because we are all doing more business online.
And moves to recruit and retain more staff, as well as to widen the talent pool, take time.
In the immediate term this leaves CISOs with gaps to fill. One option is outsourcing. Another is to use “on demand” cyber specialists. But how do these options work with building larger and more effective in-house teams?
Do they go hand in hand, or are the two measures likely to conflict?
In the second of the second of our three part series looking at the evolution of the CISO role, we speak to Victoria Parker, advisory professional services manager at Orange CyberDefense.
We discuss how external experts can help organisations secure their environments now - but how CISOs still need to invest in their own teams, and that critical talent pipeline.
What is a chief business security officer, and what do they do?
IT and data security are increasingly important. But so too are physical security and resilience.
The chief business security officer, though, is a fairly new addition to the security team.
Over the next three episodes of the Security Insights podcast, we’ll look at the changing role of the CISO, the role interim or outsourced security professionals can play in plugging the skills gap.
We’ll cover the role of interim and virtual CISOs, and whether outsourcing parts of security can make up for a growing skills gap.
But first, we ask Anaïs Beaucousin, Chief Business Security Officer at ADP International, about her role, the threats and risks she manages, and what is needed to make the most of a broader security team.
Ransomware now accounts for the vast majority of cyber attacks.
But regulators and law makers are increasingly concerned about the money being paid out to ransomware groups -- often, it is used to fund further crime.
Should paying ransoms be banned? Would a ban improve security, or make matters worse? And what steps can organisations take, to cut the risk of falling victim to a ransomware attack in the first place?
Our guest this week is Ian Thornton Trump, CISO at Cyjax. He believes that calls to ban ransomware are misplaced; a ban gives firms fewer options when it comes to responding to an attack. And fines for paying ransoms is further punishing victims of cybercrime.
He discusses the development of ransomware, why it is so dangerous, and how to counter it with Stephen Pritchard.
In this episode, we look at why a lack of robust identity controls are one of the biggest causes of cloud security failures.
Cloud operators, at least the larger ones, now have robust security in place. But that security is there, first and foremost, to protect their business. The "shared responsibility model" means that users are responsible for their data and applications.
The problem, as our guest this week identifies, is that senior managers fail to understand that point, and expect the cloud to fix everything.
It won't, and as Jennifer Cox, member of the global engineering team at Tenable, and director for Ireland of Women in Cybersecurity, warns "it always makes me a bit nervous when people think that something is foolproof".
Are passwords now a security risk? And if they no longer work, what should replace them?
In this episode, we speak to https://www.linkedin.com/in/johncapps/at VIDA Digital Identify, and Ev Kontsevoy, CEO of infrastructure access firm Teleport.
They argue that relying on "secrets" and data to prove identity no longer guarantees security. Alternatives, including zero trust, hold out a lot of promise. But moving to zero trust needs the whole organisation behind it -- it's as much about culture as technology.
How are the threats to critical national infrastructure evolving, and how do we counter them?
And are we seeing a shift from attacks based on data and ransomware, towards disruption.
In this episode, we welcome back a previous guest, Trevor Dearing.
Trevor is Director of Critical Infrastructure at Illumio.
Trevor’s work is increasingly focused on resilience, and helping organisations to survive and recover from attacks.
We discuss how organisations in the CNI space need to improve their ability to react to, and survive, a cyber attack.
After all, a failure to do so could cause widespread economic and social disruption.
The EU’s Digital Operational Resilience Act, or DORA, comes into force in January 2025. So there is not much time for affected organisations to prepare.
DORA sets out to improve cybersecurity — or ICT risk management — across the EU’s financial services sector.
The Act covers both regulated firms and what the EU terms “critical third parties” in their supply chains. In fact managing third party risk is a big part of DORA, along with measures such as improved resilience testing, incident management plans, and strict reporting requirements.
Our guest is DORA expert and director of consulting firm SECFORCE Rodrigo Marcos.
The UK Government's Department of Science, Innovation and Technology (DSIT) is consulting on a new code of practice for business leaders, which aims to "improve cyber resilience across the UK economy".
But how will this operate, and will another code of practice -- alongside a host of existing laws and industry regulations -- help organisations be more secure?
We discuss this with our guest Amanda Finch, CEO of the Chartered Institute of Information Security.
Listeners can find out more about the proposed Code of Practice and the consultation on the UK Government's cyber security site.
As many as a third of serious vulnerabilities could be in web applications. But securing web apps, APIs and web-based interfaces is a challenge.
In this episode, we look at why vulnerabilities have seen a steady uptick over the last few years, how identifying and securing vital web applications is essential to enterprise security, and why a fixation on technical CVEs does little to boost defences.
Plus, why both security pros and reporters like a pie analogy.
Our guest is Alex Kreilein, vice president for product security at Qualys. Interview by Stephen Pritchard.
Listeners can also view the Qualys research on the firm's blog.
What are the key security challenges for 2024? And how will CISOs address them?
In our first episode for Series 5, Security Insights is joined again by Chris Dimitriadis, Chief Global Strategy Officer at ISACA.
He explains why AI both poses risks, and offers benefits, why the cyber skills shortage is not going away, and how cybersecurity's voice needs to be heard by the board.
Interview by Stephen Pritchard.
In our final episode of this season, and indeed for this year, we look at some of the key trends in cybersecurity during 2023. And we discuss some of the steps CISOs might need to take, to safeguard their organisations in 2024.
Our special guest is the CEO of the Chartered Institute of Information Security (CIISec), Amanda Finch.
Nothing seems able to stop the growth of cybercrime. And ransomware, above all, has woken up boards to the threat.
But there is more to cybercrime than ransomware, and the drivers behind online crime are varied too. And the scale of the problem means that few, if any, organisations can tackle it alone.
Our guest this week is security expert, chief scientist at Rapid 7 and Europol EC3 adviser Raj Samani. He talks to Stephen Pritchard about why cybercrime is far more than an IT security issue, and why a range of responses will be needed to reduce the threat.
Could quantum computing threaten our day to day security, and even the fabric of the internet? Researchers are increasingly concerned about the risks quantum technology poses to encryption.
Organisations need to act now, if they are they are to secure their data and their operations, argue this week's guests.
Ramy Shelbaya is CEO and co-founder of Quantum Dice. That’s a business spun out of Oxford university’s quantum optics lab – and which is now using quantum mechanics to create a self-certifying quantum random number generator.
And Axel Poschmann is a cybersecurity expert with a background in both the industry and academia. Currently, he works at PQShield, another business with links to Oxford, and which specialises in quantum-resistant cryptography.
We asked them to explain why quantum threatens security, and what CISOs can do about it.
Interviews by Stephen Pritchard
The upcoming European Cyber Resilience Act sets out to boost security for anything with “digital elements”.
The Act will apply to hardware and software. The idea is to make it easier to update devices, and to fix any vulnerabilities.
Why, then, has a group of cyber security professionals written an open letter to the European Commission asking them to change a key part of the proposed rules?
Experts are concerned that, by requiring organisations to disclose vulnerabilities within 24 hours, the Act could increase, rather than reduce, risks.
Our guest today is Christine Bejerasco, CISO at WithSecure and one of the signatories of the letter.
We asked her to set out the background to the Act, and why so many security professionals fear it could have unintended consequences.
Interview by Stephen Pritchard
As many as 96 per cent of vulnerabilities in open source software are because developers use an outdated, or unpatched version of the code.
And this matters, because open source is now the building block of almost all enterprise software, web applications, and even the code that runs consumer technology.
But open source can be secure. It just needs developers, and the organisation they work for, to think about security throughout the software lifecycle.
With guest Brian Fox, CTO and co-founder at Sonatype.
The cybersecurity industry faces an ongoing -- and some say worsening -- skills gap.
Both the private and public sectors need more skilled security professionals, as more operations go online. And there is only so much the education system, or training within the business, can do to solve the problem.
So do we need to rethink how cybersecurity operates? Perhaps it is time for the industry to undergo its own digital transformation, and look at automation to take the load off human professionals.
Our guest is Marie Wilcox, board director at the Chartered Institute of Information Security and also security evangelist at Panaseer.
Most boards -- and certainly all CISOs -- now understand that it is not if a cyber attack happens, but when.
None the less, organisations are not doing enough to ensure that they can continue to operate during a cyber attack, and recover from it.
And the latest UK Government Cyber Security Breaches survey goes further, suggesting that not only are organisations failing to invest in cyber security, but in some cases, are going backwards. They are paying less attention to the basic "cyber hygiene" measures that can help prevent breaches in the first place.
Our guest this week is Prof. Steven Furnell, professor of cyber security at Nottingham University,a senior member of the IEEE, and one of the researchers for the Cyber Security Breaches survey.
In this episode he discusses the pressures that could be prompting organisations to cut back on security, comparisons between cyber and "physical" crime, the need for awareness and resilience and what we need to do in a world where cyber attacks are now endemic.
Interview by Stephen Pritchard
Healthcare is coming under an increasing volume of cyber attacks, especially since the pandemic.
And attacks are spreading to smaller health care outfits, such as ambulance services, suppliers to the health care system, and the pharmaceutical industry.
Much of this is being driven by ransomware, but we are also seeing more complex attacks.
How can healthcare organisations protect themselves?
Our guest is Trevor Dearing, Director of Critical Infrastructure at Illumio, who reports that a growing percentage of his work now involves the health sector.
Is cyber war a risk that only governments can deal with? Or should enterprises be prepared to mount their own defences?
In this episode we speak to Prof Richard Benham, a UK Government adviser on cyber security, the first professor in cyber security management, Patron of The National Museum of Computing at Bletchley Park, and non-executive director at Emerge Digital.
He believes that, in some ways, a cyber war has already started. He speaks to editor Stephen Pritchard about the reasons why, and sets out what organisations can do to protect their digital assets and infrastructure.
The cloud is now a mainstream technology across both the public and private sectors. Its flexibility and scaleability are attractive to organisations of all sizes, and early concerns about security have been addressed.
Or have they?
There is growing evidence that data breaches and attacks, such as ransomware, are exploiting gaps in cloud security.
All too often, this is because security measures have not been deployed, or cloud resources are misconfigured.
And bad actors can exploit those gaps, possibly within just minutes.
Research by vendor Qualys, for their Totalcloud Security Research Insights report, found that in some cases, close to two thirds of cloud instances were misconfigured, and half of internet facing assets were not patched.
In his episode, Paul Baird, Qualys’ EMEA CTSO, discusses the findings – and explores what might be behind them – with editor Stephen Pritchard.
Without trust, we can’t have security. But the growth of the digital economy, and the wider online world, is changing our idea of trust.
A lot of the ways we identified and trusted the people, and organisations in the physical world are not easy to replicate online.
And, as well as removing the human traits that help us to establish trust – from eye contact or a handshake, to a tone of voice – it's becoming harder to identify if another person is who they say they are. In fact, it's now hard to be sure if they are a person at all.
Digital trust is one answer. And our guest this week is an expert in the field. Rolf von Roessing is one of the lead authors of ISACA's digital trust framework. And, as he explains to Stephen Pritchard, understanding digital trust will be ever more important to any organisation that operates in the digital world.
Biometric technology promises both security and convenience: there's a reason the leading smartphone makers have adopted face ID, or fingerprint scanners.
But improvements in computing power and AI, as well as more powerful sensors, have opened up entirely new fields, such as remote surveillance.
Are we comfortable with systems that can pick out a face from a crowd?
And how do we feel about artificial intelligence making decisions about those images, such as whether someone’s actions look suspicious?
Our guest is one of the leading experts on these issues. Tony Porter was formerly the UK Surveillance Camera Commissioner, and a former senior police officer. He’s now the chief privacy officer at Corsight – a developer of facial recognition software.
He argues that surveillance, biometrics and even AI will make us more secure – but only if we can secure the technology itself.
Interview by Stephen Pritchard
This week's episode is an insider's account of exactly what it takes to review, and build up, an business' cyber defences.
When John Stenton took over as head of IT at housing provider Thrive Homes, he admits technology was a "bit of a mess". And a lot needed to be done, both to review security and to reassure the board.
Thrive Homes is fairly typical of the type of mid-sized organisation that didn't see itself as being in the cyber front line. But, as Stenton explains, any organisation can be a target especially when they are handling seven-figure property transactions.
Here, he talks about his decision to bring in an outside consultancy, the work they did, and the impact this had on Thrive's security capabilities. And we are also joined by Kerry Jones from that partner, DigitalXRAID, where she is head of compliance and information security.
Interview by Stephen Pritchard
Cybersecurity is about technology, processes and above all, people.
And with CISOs' growing emphasis on resilience in the face of cyber attacks, perhaps it is time to look at the human factors involved in combatting and recovering from an incident.
How can we help our teams make the right decisions, and cope under pressure?
In this episode, we look at an investigation into workforce resilience, carried out by Osterman Research for Immersive Labs. Our guest is Immersive Labs' VP of Cyber, Max Vetter.
The next few years will see the European Union introduce new laws governing cybersecurity.
These include the Cyber Resilience Act, and DORA.
DORA -- or the Digital Operational Resilience Act -- looks to improve overall ICT resilience in the financial services sector. But as our guests this week point out, its impact is likely to be felt by other sectors too.
The Cyber Resilience Act is more broadly based, and sets out baseline security requirements for both hardware and software or, as the text states, anything with a digital element.
Security Insights editor Stephen Pritchard discusses the background to the new laws, and what they mean for business with CREST EU council chair, Rodrigo Marcos Alvarez, and Dominik Samociuk, of Future Processing and the Silesian University of Technology, Poland.
In our second podcast from CREDTCon Europe 2023, we catch up with Rowland Johnson, CREST President.
CREST is a non profit organisation focused on building standards in cyber. This includes accreditation of companies and certification of individual cybersecurity professionals.
The cybersecurity sector faces a number of challenges: professionalisation, improving diversity, dealing with a stubborn skills shortage and the potential, and potential threats, of AI.
So how does the industry — and the organisations it serves — move from what Johnson describes as a “market failure” to a collaborative world based on a network of trust?
And how can cybersecurity professionals harness technology to do more?
Interview by Stephen Pritchard
In this second part of our analysis of nation state cyber attacks, we look at how threats are evolving, and how increasingly private businesses are their targets.
According to research by analysts Forrester, nation state attacks are becoming both more frequent, and more severe. And attackers have widened both their objectives, and their methods.
But can organisations, especially in the private sector, defend themselves against these attacks? Forrester has put together a model setting out one way to do just that.
Our guest is Allie Mellen, senior analyst covering cybersecurity at Forrester, and lead author on the research, which is summarised here.
Over the last few years, security professionals have become increasingly concerned about where software, and software components, come from.
A growing number of significant security breaches have been caused by vulnerabilities in the software supply chain.
But should we now start to look beyond just software, and look at data too?
Jon Geater thinks we should. The keynote speaker at this year’s CRESTCon Europe, Jon is co-founder at RKVST and co-chair if the IETF’s supply chain integrity, transparency and trust working group.
Here, he discusses with editor Stephen Pritchard how we need to go beyond just software bills of materials and start to look at documents and data too, if we are to prevent disruption to the business.
Any system that is connected to the public internet is at risk of cyber attack. And any system that connects to a network or other system connected to the internet, is also at risk.
This poses dilemmas for operators of critical infrastructure. Devices and applications developed to run on standalone infrastructure, often with specialist operating systems, are not designed to work safely online.
How, then, can organisations operating critical national infrastructure, protect their systems from cyber attack and still benefit from connectivity to the outside world, as well as the economies of off the shelf technology?
Our guests today are both experts in protecting health care systems.
Jonathan Langer is COO Claroty Medigate, which focuses on securing the Internet of Things in health care.
And Adam Zoller is cyber security lead for Providence, a system of compassionate healthcare providers on the west coast of the United States.
They joined editor Stephen Pritchard to discuss why attackers target CNI and health care technology, where the weak spots lie, and how organisations can improve their security without disrupting vital business operations.
ISACA today is one of the principal organisations providing accreditation and skills training for infosecurity professionals.
But that's not all it does. The organisation is involved in standards as well as developing developing tools for secure and software development and driving areas such as digital trust.
That puts ISACA in a very good position to take the pulse of the cybersecurity industry. Our guest for this episode is Chris Dimitriadis, who is their Chief Strategy Officer.
In a wide ranging interview, he discusses the growth of nation state threats and cybercrime, the industry’s focus on ransomware, and how organisations need to pay more attention to response and recovery from a cyber attack. We also cover the need for better collaboration between firms, and government to counter cyber threats.
And, of course, we look at industry’s on-going skills crisis.
Nation state attacks are now an unavoidable part of the cybersecurity landscape.
And increasingly, these attacks are either targeting commercial organisations, to gather intelligence, steal intellectual property or simply for political or diplomatic leverage.
Even if there is no specific hostile intent, businesses and public sector bodies risk being caught in the spill over from attacks aimed elsewhere.
Can organisations defend themselves against an attacker with the resources of a nation state behind them? And how does the nation-state threat rank against other risks?
Our guest this week is Rafe Pilling, principal security researcher at Secureworks’ counter threat unit. He is also a specialist in nation state attacks, with a focus on Iran and the Middle East.
In this episode he breaks down the modus operandi of attacks originating from, and targeting, that region. But, he suggests, there are defensive measures organisations can take that will protect against both nation state attacks and other threats, such as ransomware.
Interview by Stephen Pritchard
The cybersecurity industry has long complained of a skills shortage.
But is the industry itself at least partially to blame?
From recruitment processes to training, development and retention, and a lack of diversity, there is certainly work to be done. And with no let up in cyber threats, and a growing demand for skilled staff, this needs to be tackled with urgency.
Our guests this week are setting out to do that. Sally Walker is a former director of cybersecurity at GCHQ. She is now neurodiversity champion at WithYouWithMe, a social impact company looking to change the way we hire staff across the technology industry. And she is joined by former police officer Jim Fox, now a security consultant at Capita.
Is data privacy still something businesses need to worry about?
With financial pressures, rising inflation, the continuing aftermath of the pandemic and the ongoing challenge of recruiting skilled people – especially for technical roles – it would be understandable, if privacy had slipped down the agenda.
Our guest this week, though, argues that it is wrong to overlook privacy concerns and data protection.
Camilla Winlo is head of data privacy at Gemserv. She points to new legislation, the need to use data to create competitive advantage and even the growth of AI as reasons to pay attention to data privacy.
So should it still be a board level concern?
Over the last few months, AI has attracted even more attention than usual. Much of this is driven by OpenAI's ChatGPT tool, which allows anyone to create convincing, "human sounding" text from just a web browser.
But GPT-3 and generative AI can be misused, and could make it easier to carry out cybercrime or create fake news. Although ChatGPT has safeguards built in, the tools to create natural language text are becoming cheaper.
Security researchers at Finnish firm WithSecure put this to the test, in an EU supported project. They used a range of scenarios to see how "prompt engineering" could be misused, and how we can guard against it.
Our guest is WithSecure's intelligence researcher, Andy Patel. The full research report is also available for download.
IT security and business resilience are often viewed as separate disciplines. But both are now squarely board-level issues.
The challenge for IT directors and cybersecurity leaders, though, is that teams, technologies and practices exist in their own silos. This makes it harder for a business to defend itself, and harder for it to recover if defences are breached.
Our guest this week is Elizabeth Green. She is European advisory and cyber leader at Dell Technologies. Her background is in data and data protection – joining Dell when it acquired storage vendor EMC – so she has a deep understanding of both the need to protect data, as well as the need to link data protection and recovery.
She is also an advocate for greater diversity in cybersecurity and the wider tech industry – without that diversity, organisations will always be more vulnerable than they should be.
It’s often said that the cybersecurity and data privacy worlds rely too much on checkbox compliance exercises – and fail to get to grips with the real issues that put data and systems at risk.
But how true is that? Organisations face both increasing threats and increasing regulatory burdens. And often, CISOs and other business leaders lack a true picture of good practice.
This has prompted security researchers at Panaseer to develop a series of real-world security benchmarks.
The research came up with 18 steps, that look more deeply at security standards and controls. The paper also sheds light on why some organisations still fail to carry out basic cyber hygiene measures, and how businesses can improve.
We asked the report’s author, Charlotte Jupp, to explain the ideas behind the research.
In this episode we look at the continuing threats to critical national infrastructure, or CNI.
National infrastructure is under attack from both nation state actors, and from ransomware gangs and other crime groups.
And, as the war in Ukraine has shown, energy and power generation is especially vulnerable. Are we set to see more politically motivated cyber attacks, and are we likely to see more use of cyber warfare, alone or in combination with conventional military tactics?
Our guest this week is Jon Moran, a law enforcement veteran and former incident response consultant. He is now technical director at Tufin, where he is a close watcher of CNI and the risks it faces.
In this extended episode, we review the key cybersecurity events of 2022, and analyse likely developments, and priorities, for 2023.
We look at Log4J, ransomware and "wiper" malware; the geopolitical situation and how the war in Ukraine is impacting cyber security, and the ongoing challenge of the industry's skills shortage.
And we review CISOs' priorities for the coming year, changes in both the threat environment and the regulatory landscape, and discuss security teams will need to handle ever more complex relationships as they look to protect supply chains.
Our guests are Sue Milton, of ISACA, and ISC(2)'s Jon France. Interviews by Stephen Pritchard.
Russia's invasion of Ukraine has brought war to the European continent once again.
And the conflict has, inevitably, brought an increase in cyber attacks against both Ukraine and its supporters.
That those attacks have not done more damage, or achieved a higher profile, is largely down to the defensive capabilities both of Ukraine and NATO.
But increasingly Russia is trying to combine cyber with physical attacks on critical infrastructure in Ukraine. How can states defend themselves against these blended attacks, and new vectors such as wiper malware? And what can NATO, and other countries, learn from Ukraine's experience?
Our guest this week is Lauri Almann. He was working at Estonia's Ministry of Defence when his country came under cyber attack in 2007. He is now co-founder and chairman of CybExer, a company that runs cyber attack simulations for NATO and other governments, as well as industry.
Here, he analyses what we have seen so far in Ukraine, and what it means for cybersecurity in the West.
According to cybersecurity researchers, attackers are turning to new and dangerous methods to carry out phishing attacks.
As security teams have improved their defences, especially around email, so the attackers have adapted too. They are using fake web apps, blog posts and even exploiting the way search engines operate, to spread malware.
In this episode we speak to Ray Canzanese, the director of Netskope’s Threat Labs and the organisation behind the research. He explains the new attack vectors, and how we can counter them, to Stephen Pritchard.
Over the last few years 5G networks have expanded quickly, offering faster speeds and greater capacity than previous wireless networks.
And although take up has been fastest among consumers, businesses and the public sector are looking to 5G as well, as it offers a boost in both performance and flexibility.
Applications include the internet of things, logistics and transportation, as well as telemedicine and public safety.
But 5G could also come with a significant security impact. It offers a greater attack surface, and organisations will need to adapt if they are going to run most, perhaps all, of their business processes outside the conventional perimeter.
This week’s guest — Nathan Howe, VP of emerging technology and 5G at cloud security company Zscaler — sets out some of the risks associated with 5G, and how organisations can put it to use without compromising security.
With the skills crisis in cyber now well established, organisations are having to look beyond the conventional methods to fill vacancies.
Expanding the pool of potential talent is a key to this.
Until recently, though, little attention was paid to neurodiversity, and the idea that neurodivergent candidates -- including people with ADHD and autism -- can be highly effective cyber specialists.
But neurodivergent people face challenges entering into the workforce. Often, very bright and talented people face long-term unemployment, as conventional recruitment and career pathways are not adapted to their needs.
In this episode, we hear from two business leaders who are trying to change this. Rob Demain is CEO and founder of e2e-assure, and Emma Philpott is CEO of IASME.
We asked them about the work they have being doing with neurodivergent applicants, and employees, and the results they have seen,
Cybersecurity spending seems to be on a never-ending upward curve. But this spending, spending, which analysts put at US$150bn annually, doesn't seem to reduce the number of cyber threats.
Could it be that we need a new approach to security?
Our guest this week is Jason Hart, CTO, EMEA at Rapid7. He argues that the problem is that we are spending money, but are not making security part of the culture, or central to how we do business.
In this episode, we look at whether a new approach could both make organisations safer, and produce a return on investment from all that spending.
Over the last six to twelve months security researchers have seen a shift in the pattern of cyber attacks, as the impact of the pandemic has largely been replaced by a focus on the Russian invasion of Ukraine.
Security firm NETSCOUT runs one of the largest monitoring projects for DDoS attacks. They have, for example, seen falls globally in DDoS activity, but an increase in the EMEA region.
Deterring and prosecuting those behind the attacks is as hard as ever, argues Richard Hummel, ASERT Threat Intelligence Lead, at NETSCOUT.
But, he says, there are steps organisations can take to counter the threat, and to keep critical online services working.
Passwords are still a cornerstone of web security, especially for consumer-facing sites.
But convincing consumers, and firms, to use stronger passwords remains a struggle
Steven Furnell is a senior member of the IEEE, and professor of cybersecurity at the University of Nottingham.
For the last 15 years, he has been tracking the password policies of leading web and ecommerce sites. Do they, for example, allow weak or easy to guess passwords?
And how easy do they make it for users to pick stronger passwords, or to use alternatives such as multi-factor authentication?
The answers have implications, not just for security online, but for the way we use passwords in business too.
Interview by Stephen Pritchard
How can we control cyber risks? And how do cyber risks stack up, against the other challenges facing business?
Cyber threats have risen steadily over the last few years, and the move to digital business has created its own security challenges.
But at the same time, conventional risks have not gone away. Only recently we've seen wildfires and floods. And we are still feeling the after effects of the global pandemic.
How does an organisation balance physical threats and cyber risks, against the need to become more efficient and to grow? And how do we measure the risks we have to accept? Our guests this week are Pauline Losson, director of cyber operations, and Todd Carroll, CISO, at CybelAngel.
Interview by Stephen Pritchard
Is there a "hiring gap" in cybersecurity?
Over the last few episodes on Security Insights, we’ve looked more deeply at the skills skills shortage. But is the problem as much down to matching candidates to roles, as it is finding the right people?
And are organisations failing to do enough to develop the staff they do recruit, and so ensuring they stay?
In week's episode, our guest Michael Smith, field CTO at Neustar Security Services, argues that the issue goes beyond skills alone. And firms need to invest more in security, and in their staff, to keep up with the move to digital business.
Interview by Stephen Pritchard
How early do we need to start to awaken interest in cybersecurity, and indeed technology, as a career?
In this week's episode, VMWare's senior security advocate, Karen Worstell, argues that we might need to go back as far as early years education. Then, of course, we need to maintain and develop that interest, as a young person moves through education and on to their career.
And there's also more industry can do, from developing people at the starts of their careers to improving the levels of built-in security in any connected device, she says.
In the second part of our series on the cyber skills crisis, we take a deeper look at the challenges around recruiting entry level staff – and the knock on effect that has on finding mid-tier and experienced hires.
Our guest this week is Tia Hopkins. Based in New York, she is field CTO and chief cyber risk strategist at eSentire.
In addition, Hopkins teaches cyber security, is working on her PhD, and is CEO of Empow(H)er Cybersecurity, which mentors women of colour in the cyber security industry.
How, then, do we encourage more people to join the cyber security world. Should we, as Hopkins says, hire for aptitude, rather than experience? And how do we look beyond the CV?
Interview by Stephen Pritchard
UK businesses are short of skilled cybersecurity professionals, and the number of vacancies is in the tens of thousands.
Worldwide, the shortfall is in the millions.
But what are the reasons? Is it cultural, problems with education, a lack of diversity?
And what is the impact on organisations in the public and private sector?
Over the next few weeks, Security Insights will attempt to answer at least some of these questions.
Our first guest in the series is Deryck Mitchelson, former Director of National Digital and Chief Information Security Officer at NHS Scotland, and now global CIO and CISO at Check Point.
When IT director Tony Mendoza found his company under attack by a ransomware group, there was no playbook for how to respond. He and his team had to react -- at speed -- to a rapidly developing situation.
Fortunately his organisation, technology vendor Spectra Logic, survived the attack and was able to restore its data. But he learned some hard lessons about managing a crisis, building defences and, above all, why it pays to accept that an attack will happen.
In this episode, Mendoza recalls his experience to Security Insights editor, Stephen Pritchard.
Smaller businesses are no means immune to cyber attack.
In fact, there is growing evidence that criminal groups are targetting smaller businesses.
One reason is the changes to working practices brought on by the pandemic, with more remote access and the use of consumer IT. And smaller firms are being used as a way to infiltrate the supply chains of their larger customers.
What, though, can smaller companies do to improve their security?
Improved training, clearer IT policies and better use of security tools, including those that come with SaaS suites, all help according to this week's guest.
Lee Wrall is founder at Everything Tech, an IT services firm based in Manchester. He also believes passionately that smaller companies can be secure, withe the right planning and support. He spoke to Security Insights' Stephen Pritchard.
In the current climate, operators of critical infrastructure are finding themselves in the front line.
And it is not just the obvious and traditional fields of CNI, such as energy or transport, that are under threat. The banking system, healthcare, manufacturing and food supply are all part of geopolitical risk, and at risk of cyber attack.
So just how vulnerable is critical infrastructure to cyber attack? And how should governments and industry work together to improve security?
Our guest this week is security and risk consultant Mathieu Gorge. He also runs the Vigitrust Global Advisory Board think tank. He speaks to Security Insights' editor Stephen Pritchard
We apologise for the audio quality in parts of this episode.
In this episode we look at the risks and threats facing the cloud, with Ray Canzanese, director at Netskope’s Threat Labs.
The firm has just released its latest Cloud and Threat Report, and Canzanese talks through some of the highlights, including the use of PDFs and search engines to deliver malware, and the (mis)use of cloud storage.
How do organisations prepare for cyber attacks? Does “red teaming” work? And how close are we to cyber war?
Over the last few years, more firms have turned to red team security testing, putting their organisations through realistic attack simulations. But how do we balance the cost and time these tests demand, with the wider needs of the business?
Our Insights Interview guest this week is Reuven Aronashvili, founder and CEO of Israeli cybersecurity company CYE. Today, he works with large enterprises globally to help them tackle the most difficult cyber challenges.
Before that, he was one of the founders of Israel’s Red Team intelligence unit. As such, he has some unique insights into the line between a hacking incident and cyber terrorism and cyber warfare – and how close we are to crossing it.
Interview by Stephen Pritchard.
Nearly everyone in cyber talks about people, process and technology. But often, the people side is mentioned only in passing.
But it is people that determine how well an organisation handles a cyber attack, and how quickly it recovers. Processes and technology are vital, of course. But as our guest this week says, behind every piece of wire, there is a human being.
Rebecca McKeown is the director of human sciences at Immersive Labs. A psychologist who has worked with militaries, aviation, governments and organisations involved in critical national infrastructure, she argues that we’re not investing sufficiently in the human side of security response.
And she also discusses the results of a recent report into the way firms prepare their people for cyber incidents, the Cyber Workforce Benchmark report.
Interview by Stephen Pritchard
Distributed denial of service attacks -- or DDoS -- are up 14 per cent on 2019's figures, according to research by security firm NETSCOUT.
And attacks are becoming more complex, with some using as many as 26 different vectors.
At the same time, there is a massive online market for DDoS attacks, with a terabit-class attack costing as little as $6500. Sites on the dark web even offer criminal hackers free trials of their wares, so the barriers to entry are effectively zero.
What, then, can security teams do to counter the DDoS threat? And could governments do more? Our guest this week is Richard Hummel, ASERT Threat Intelligence Lead at NETSCOUT. He discusses this, and more, with editor Stephen Pritchard.
Are we underestimating the security threats to mobile devices – and indeed the threats to mobile infrastructure?
Organisations of all sizes now depend heavily on mobile devices. But, although mobile security rarely makes the headlines, the risks posed by ever more powerful devices, and networks, are all too real.
In fact, this week's guest argues that mobile devices were never designed to operate on corporate networks.
Andy Brown is the CTO at Mobliciti. His firm’s been running mobile infrastructure for enterprises since 2009, and he monitors the mobile threat closely. He discusses how the way mobile technology has changed the way we work, and what that means for cybersecurity, with Stephen Pritchard.
Stolen or compromised identities have been an attack vector for years, if not decades. Even now, organisations are failing to protect against compromised identity. Identity is one of security’s critical weak spots. But why is this?
Once an attacker breaches defences, it is still too easy for them to move laterally, and to attack higher value targets, or as we've seen recently, attack an organisation with ransomware.
Our guest this week is chief security architect and formally the chief deception officer at Attivo, Carolyn Crandall
She argues that it is changing technology and changing work patterns, with the need to access information anywhere, and at any time, that is making these attacks both more common, and more damaging.
Interview by Stephen Pritchard
What happens if your personal devices are stolen? Few victims of theft recover their goods. But the loss of the hardware might only be the start of their problems.
There is a growing black market in stolen devices, but also in tools that can unlock them, to steal credentials or to attack other networks. People who lose a device can be a victim twice over, if hackers then use their own property to target their identity.
In this week’s episode, security researcher Adalsteinn Jonsson explains how this is exactly what happened to his partner, and how the incident prompted him, to undertake their own investigations. He, and fellow researcher at cyber security company Cyren, Magni Reynir Sigurðsson, take up the story.
Interview by Stephen Pritchard
Is ageism a problem in cybersecurity, and IT?
The pandemic has accelerated a trend that observers were already warning about: older staff are leaving IT security. And with them, their knowledge and experience leaves too.
What then can be done to encourage older workers to stay in the industry? Is ageism a problem, and if it is, how do we counter it?
This week’s guests are inter-generational diversity expert and author, Henry Rose Lee and Gernot Hacker, from cybersecurity firm Appgate. Appgate recently commissioned a focus group study looking at attitudes to age in cyber security, as they explain.
Interview by Stephen Pritchard
The Internet of Things continues to grow at pace. But are its security flaws being addressed?
Industrial, operational technology and consumer devices are increasingly connected, but security is too often an afterthought, with flaws such as default passwords and insecure firmware. And many IoT devices are hard to patch, if they can be upgraded at all.
The result is an expanding attack surface, that risks undermining the benefits of IoT technology. But could 2022 be the year this is changes? The UK has introduced a voluntary code of practice, Secure By Design, and the Product Security and Telecommunications Infrastructure Bill should become law this year.
Our guest this week is John Moor, MD at the IoT Security Foundation. He discusses the risks posed by the technology, and how manufacturers, governments and end users can help to solve it, with Security Insights' editor Stephen Pritchard.
In this programme, Security Insights invites a selection of industry experts to look back at 2021, and to give their outlook for cybersecurity in 2022.
This episode's guests are:
Piers Wilson, director, Chartered Institute of Information Security
Dr Ian Pratt, Global Head of Security at HP
David Carroll, MD, Nominet Cyber
Jamie Collier, cyber threat intelligence consultant, Mandiant.
Episode edited by Stephen Pritchard
Respect In Security was founded earlier this year to tackle harassment and inappropriate behaviour in the cybersecurity industry.
And negative behaviour, online and face to face, is all too common.
Security Insights invited Respect In Security's co-founders, Lisa Forte and Rik Ferguson, to explain their mission - and why making the industry safer and more inclusive ultimately benefits everyone.
Interview by Stephen Pritchard
Can digital technology help people around the world who lack access to a documented identity?
Over a billion people worldwide lack access to basic papers, such as a birth certificate or passport. This makes it hard to access services such as health and education. For states, it makes it hard to prevent fraud, or detect crime.
Our guest this week is Julie Dawson, head of regulatory and policy at Yoti, a digital ID provider. She speaks to editor Stephen Pritchard about the identity gap, and also whether security companies should also have a social purpose.
The idea of building security in to new hardware and software products from the outset has gained ground over the last few years.
And the move to "shift left" and introduce security by design has gained ground, following growing concerns about supply chain attacks.
One way to achieve this is through threat modelling. Threat modelling is not, itself, new: Microsoft did pioneering work on it in the Nineties. But it is now being adopted by bodies such as NIST, with the goal of reducing zero-day vulnerabilities.
Our guest in this episode is Stephen de Vries. Co-founder and CEO of IriusRisk, he has worked on threat modelling for over a decade. He explains why organisations should add it to their security toolkit.
Criminal groups are increasingly turning their attention to cyber, a trend that picked up pace during the pandemic.
One reason is that technical skills are no longer needed to launch a cyber or phishing attack. Instead, anyone can buy malware, zero day exploits and phishing templates on the dark web.
This has led to an active market in vulnerabilities, and a wider range of crime groups and nation state actors buying in sophisticated exploits.
But why is cybercrime evolve in this way? And what does it mean for cybersecurity teams, and does it need a different response from organisations, and governments?
Our guest is Jack Chapman, VP threat intelligence at Egress. He’s been monitoring the growth of cyber crime as a service, as crime groups move their attentions online. We asked him what it means for security teams, and how they can counter this growing threat.
Ransomware continues to threaten organisations of all sizes.
And although cybersecurity teams are improving their ability to detect and block ransomware attacks, some will make it through.
How, then, should we deal with the aftermath? In this episode we look at the 30 days after am attack, and the impact of ransomware attacks on operations and reputation, and how businesses can recover.
As our guest this week -- Ed Williams, from Trustwave SpiderLabs -- argues ransomware needs attention from the highest levels of the business. But blocking it, and recovering from it, also means paying attention to the essentials of security.
Interview by Stephen Pritchard
After a tumultuous 18 months, cybersecurity is by no means alone in taking stock.
Which of the changes introduced to deal with the global pandemic are here to stay? And how have changes to the way we work impacted how we manage security in a world that is, if anything, riskier?
The Chartered Institute of Information Security has just released a report covering all this, and more.
In this episode, Security Insights talks to CIISec director, and report lead author, Piers Wilson about the outlook for the profession, and the challenges we still face.
Universities and research institutes saw an upswing in cyber attacks during the pandemic.
But even before 2020, the sector was finding itself under increasing threat, from ransomware, espionage, and also because of underinvestment in technology and training.
Our guests in this episode are Allie Mellen, an analyst covering security and risk, at Forrester, and previously an academic researcher at MIT, and Mark Wantling, the CIO at Salford University. They discuss the threats, and possible solutions, with Security Insights editor Stephen Pritchard.
Universities and academic research institutions are under growing threat from cyber attack, driven by the rise of ransomware, Covid-19, and those on the search for intellectual property.
But could collaboration help secure a sector that is vital to the UK's economic prosperity?
As universities prepare for the start of the new academic year, Security Insights editor Stephen Pritchard discusses this, and more, with Professor Kevin Curran, senior member of the IEEE and Professor of Cyber Security at the University of Ulster.
Are paper documents a hidden security risk?
According to one survey, two out of three people print sensitive work documents at home.
But losing paper records could put an organisation in breach of the GDPR, and cause significant reputational damage.
Controlling access to printed documents, and their secure destruction, is enough of a challenge in the workplace. But add in widespread home working, and the problem becomes all the greater.
Could a clean desk policy at home be the answer? Mike Cluskey, MD of Go Shred, thinks so. In a wide-ranging conversation, he joined Security Insights' Stephen Pritchard to talk about document security, Benji the Binman, and why we still like to work on paper.
Researchers at The Alan Turing Institute are tackling one of the most pressing challenges of the digital world: trusted identity.
How can we develop a version of identity that works for governments, businesses and individuals, is easy and cost effective to apply, reliable and works at scale?
And how can robust identity counter the growing threats online?
The Alan Turing Institute is the UK’s national institute for data science and artificial intelligence. And it is working on a four year project, Trustworthy digital infrastructure for identity systems, to address exactly these questions.
Security Insights invited the project's lead, Professor Carsten Maple, to explain more.
According to the National Centre for Cyber Security, ransomware is the greatest cyber threat to UK business.
And globally, ransomware is both increasing, and becoming more damaging.
What are the reasons, and what can businesses, and governments, do to tackle it? In this episode, Security Insights invited three experts, Forrester analyst Steve Turner, security consultant James Bore, and James Rees, CISO and director of consultancy at Razorthorn, to discuss the threat, and some possible solutions.
The discussion is hosted by Security Insights editor, Stephen Pritchard.
The healthcare and pharmaceutical sectors are leading the fight against the Covid-19 pandemic.
But, even as doctors work to treat seriously ill patients, and researchers develop and refine treatments and vaccines, there are others who are setting out to disrupt medical facilities, steal clinical and R&D data, spread disinformation and commit fraud.
Why is healthcare now in the cybersecurity front line, and what can security professionals, governments, and even individuals do to protect it?
Andrew Hollister is deputy CISO and VP for labs at LogRhythm. He has been monitoring the impact of cyber attacks on the sector during the pandemic, and he spoke about the challenge, and some potential solutions, to Security Insights editor Stephen Pritchard.
Phishing, attacks on email servers and business email compromise are all very real threats.
Yet email infrastructure often attracts less attention from security teams than other applications.
Despite the growth of other collaboration tools, including video conferencing and tools such as Slack and Teams, email remains central to most organisations' operations. And, as statistics on phishing show, it can be a weak link in cybersecurity.
In this episode, Matt Bromiley, senior principal consultant at Mandiant and Stephen Reynolds, a director at Libraesva, discuss some of the recent threats affecting email, including vulnerabilities in Exchange Server, business email compromise, phishing, and how to defend against them all.
Critical infrastructure is on the front line of cybersecurity.
An attack on power, sanitation, healthcare, or even the banking system, could be catastrophic. But it could happen.
Back in the 1990s, ethical hacker Joe Carson was already concerned about how a power outage could disrupt medical services.
Then, it was the Y2K bug that worried the experts.
Today it is state sponsored actors.
As chief security scientist and advisory CISO at Thycotic, Carson has pitted himself against CNI’s defences, and found them wanting.
But can, and should, we do more to create practices and norms to protect these vital services?
Is cyber a new war zone? Nation states account for a growing percentage of cyber attacks. And some experts warn that state-sanctioned hacking could spill over into an all-out cyber conflict, or worse still, outright war.
But is that overstating the risk? Will state actors hold back from attacks on sectors such as energy, or healthcare? Will they stop short of causing civil unrest, or is that their goal?
Cyber is now firmly part of the "grey zone" between peace and war, where norms and behaviours are only now starting to emerge.
What steps should governments, international bodies, and the cybersecurity industry itself take to stop an accidental cyber attack becoming an international incident?
Security Insights' Stephen Pritchard discusses this, and more, with Nominet Cyber's MD, David Carroll.
It's no longer a question of if you will be hacked.
It's when.
This makes rigorous security testing all the more important. And Red Team exercises, testing defences against an adversary in real time, is one of the most effective methods.
But Red Teaming can be demanding. How should CISOs engage a red team, and what is the best way to make the exercise effective?
In this special report, we speak to Gemma Moore, of Cyberis and CREST, David Benson, of Pen Test People, and Richard Hughes of A&O IT Group.
Reporter: Stephen Pritchard
Priorities for information security professionals in 2021 include insider threats, privacy, the risks posed by state actors and, of course, the aftermath of the pandemic.
In this episode, we speak to Forrester analyst Enza Iannopollo about her firm's latest security predictions - and how CISOs should deal with them.
The information security industry faces an ongoing skills shortage: globally, over 3m jobs are unfilled.
How, then, can we close the skills gap? One answer could be encouraging more career changers to consider the profession.
In this episode, we catch up with two people who have done just that: ex British Army communications specialist, turned pentester, Holly Grace Williams, and former professional cricketer, now security engineer, Charlie Shreck.
At the start of the pandemic, businesses started out on a journey that would transform the world of work for millions.
We invited CMA founder and CEO Amar Singh to discuss the steps organisations should take, to make that transformation as secure as possible.
A year on, how have organisations fared? Which measures have worked well, and which less well?
And what steps should CISOs take now to ensure organisations stay secure as, hopefully, we start to exit lockdowns?
One year on, Security Insights invited Amar Singh back, to discuss the lessons learned -- and what to do next.
Could the internet be safer if we trust no-one?
Trust and identity are bedrocks of security. But the erosion of a clear perimeter threatens conventional ways to secure data, applications and devices.
Zero Trust looks to replace reliance on perimeter defences with a more flexible, less intrusive and more effective form of security.
But how does it work, and does it bring risks as well as benefits? We ask Elliot Rose, of PA Consulting, Ian Pratt, from HP Personal Systems, Iben Rodriguez of Gigaom and Nico Fischbach of Forcepoint for their views.
Security training and security awareness only goes so far. Instead of annual tick box exercises, organisations should aim for a permanent shift in attitudes to security, argues our guest for this episode. They need to create a security culture.
Kai Roer is an author and security expert, and founder of security culture advisory firm CLT.re, now part of KnowBe4. He talks to host Stephen Pritchard about how we can make that shift.
Just one per cent of security spending goes on training and human factors, says Melanie Oldham.
Oldham is the founder of Bob's Business. Her security training company is best known for the eponymous Bob, a put-upon business exec who battles to secure his operation.
But Bob is not alone. This industry, Oldham argues, needs to strip away the complexity that too often surrounds cyber security.
And we need to focus less on hardware and technology, and more on the people who handle data. Non-technical users often make the best security champions. That, she says, will only be more important, as remote working becomes the norm.
If security is about people, process and technology, people are often the weakest link.
In this first of three episodes looking at security training, awareness and culture, Security Insights meets Simeon Quarrie, founder of Vivida, a company that uses virtual reality and storytelling to make security training more engaing.
In Security Insights' End of Year Review, editor Stephen Pritchard discusses 2020's key trends in information security, and the outlook for 2021, with Amanda Finch, chief executive of the Chartered Institute of Information Security, CIISec.
Security is not always top of mind when it comes to cloud computing.
The problem has only worsened recently, as organisations of all sizes have scrambled to put business processes online.
The result is a growing “cloud security gap” — and this is the theme of the latest cloud threat report, compiled by Oracle and KPMG.
Security Insights invited Oracle’s senior director for cloud security, Greg Jensen, to discuss the report, and how to make the cloud more resilient.
Philippe Courtot is one of the longest-serving CEOs in the cyber security business, with close to two decades at the helm of cloud-based security vendor Qualys.
In this Insight Interview, editor Stephen Pritchard asks Courtot about the ever faster evolution of cyber threats, the need for industry collaboration and the role of governments and law enforcement in reducing cyber crime – as well as the role of the cloud.
The cybersecurity industry faces a growing skills gap, with as many as 3.5m unfilled positions. And the problem is set to grow.
Could recruiting neurodiverse staff be part of the solution? Neurodiverse people, often have skills – including pattern matching and attention to detail – that lend themselves to cybersecurity roles.
Security Insights spoke to Gemma Moore, co-founder of consultancy Cyberis, and board member at CREST, about how this can work.
For military strategists sub-threshold conflicts, hybrid warfare or the "grey zone" is where future battles might be fought, and won or lost.
Technology threats are right at the heart of the grey zone. Robotics, drones, disinformation and of course, cyber, are all part of a fluid landscape that is hard for armed forces, governments, and businesses to navigate.
Security and defence company QinetiQ recently published a paper, which breaks these threats. Security Insights invited CTO Mike Sewart to discuss the report's findings.
As business moves online, so does fraud. Online fraud is already a multi-billon dollar problem, and it shows little sign of easing off. RSA Security's Daniel Cohen explains why fraud should be on the CISO's agenda.
In this fourth, and final, part of our series on information security during the pandemic, we examine how the cybersecurity world might look, after Covid.
We ask Mark Ward, Senior Research Analyst at the Information Security Forum, for his view of where we are now, where cybersecurity might be heading, and choices that asks of CISOs.
In the third part of our series on information security during the pandemic, we look at how the changing threat landscape is not just a response to Covid.
Rather, it is being driven by the longer-term trends in how businesses use technology.
Our guest Paolo Passeri, cyber intelligence principal at Netskope, explains how cyber attacks on the workforce were on the rise even before the pandemic.
The global pandemic continues to disrupt business -- and to create security threats.
In the second of our series on the pandemic, we look at the research data, to see how bad actors are using Covid to their advantage, and ask what businesses can do to protect themselves and their data.
Our guest this episode is Phillip Larbey, managing principal for cyber intelligence and incident response at Verizon.
The last six months have brought unprecedented changes to the way we live, and work.
Rapid changes to the way we work means some security compromises were inevitable.
But is now the time for organisations to look at their technology, and security, and close down vulnerabilities? And are there lessons to be learned from lockdown?
In the first of four special episodes, editor Stephen Pritchard talks to security strategist and former government adviser, Morgan Wright.
Security breaches are now all but inevitable. Yet three out of four organisations fail to plan properly for a cyber attack, according to Ponemon and IBM.
The result is lost revenue, and lost confidence.
But good planning is one of the most effective ways to weather a cyber incident, and come out the other side. Security Insights discusses security response planning with IBM's Wendi Whitmore.
Burn out and stress are by no means unique to the cybersecurity industry. But the pressures on professionals are growing, according to the Chartered Institute of Information Security. Its CEO, Amanda Finch, discusses how security teams can tackle mental health worries.
Denial of Service – or DDoS – attacks are rising sharply.
According to Netscout, attacks are up 62 per cent compared to this time last year, in the UK alone.
Changes to the way we work are exposing more infrastructure to attack – and security teams should look again at their vulnerabilities.
Netscout’s CTO for security, Darren Anstee, joins Security Insights presenter Stephen Pritchard, to discuss the data.
Almost two thirds of cyber crime goes unreported by enterprises, according to ISACA, even when failing to report breaks the law, or breaches industry regulations. And the problem is on the increase.
What are the causes, and what does this mean for business? Security Insights speaks to Ed Moyle, lead author of ISACA's State of Cybersecurity Report, to find out more.
Image: by Gerd Altmann on Pixabay.
This year's Data Breach Investigations Report says that most cyber attacks are financially motivated. But the insider threat has not gone away, and the threat from ransomware is growing. Verizon Business' head of cybersecurity strategy, John Loveland, goes through the 2020 data with Security Insights' Stephen Pritchard.
Mobile devices are business tools of choice for more and more people, and not just knowledge workers.
And these tools have come to the fore during the pandemic crisis.
But how can they be secured, and does mobile working bring its own set of risks? Security Insights investigates.
With guests Bridget Kenyon, CISO of Thales' Digital and Identity Services Group, Mike Elliott, CEO of Over-C, Neil Thacker, CISO at Netskope. Presented by series editor Stephen Pritchard.
Responding to the global pandemic, the Cyber Management Alliance has produced a checklist setting out practical security measures for organisations to support working from home.
CMA founder and CEO Amar Singh tells Stephen Pritchard what security teams should be doing now — and what they also need to do to secure their data, when more normal times return.
Editor Stephen Pritchard introduces Security Insights, a podcast that takes an in-depth look at cyber security.
Our podcasts are independent, and our audience is anyone who is concerned about the strategic consequences of information security, whether they are in government, the private sector or academia.