Why More Tech Won’t Prevent Cyberattacks | Network Visibility

by | Nov 25, 2020 | CISO, Cybersecurity, Podcast - Life of a CISO | 0 comments

Why More Tech Won’t Prevent
Cyberattacks | Network Visibility

This episode of Life of a CISO is an exercise that you can do to measure how effective you are at being a CISO.

Dr. Eric Cole explains what to do, and why each step is important, and includes examples of good and bad CISOs either using or not using these steps, respectively.

When you do this exercise, you will have a better understanding of why many CISOs still have it backwards.

All you need for this exercise is a blank page and some colored pencils.

Listen to this episode to get started with the exercise.

In this episode:

  • 0:04 Intro
  • 0:48 A key role of a CISO is understanding what you have in an organization
  • 1:28 What’s the difference between a technology, a product, and a solution?
  • 2:04 Companies get broken into because the tech generates more alerts than the staff can handle
  • 3:04 False positives lead to more break-ins
  • 5:27 A small percentage of unethical vendors ruin the reputation of the other 90+ %
  • 6:55 A CISO exercise that you need to do
  • 8:58 The exercise, continued
  • 10:06 How do you know if your technology is working if you don’t measure it effectively?
  • 11:21 Prevention is ideal, detection is a must
  • 12:41 What is a false negative?
  • 13:27 If you put all your effort into prevention, it guarantees that you will be compromised and not know it
  • 13:53 The exercise, continued
  • 15:05 A good CISO knows no news is bad news
  • 16:14 The big challenge remains that thinking about security is still backwards
  • 16:50 A story from a security business conference I recently went to
  • 19:15 Breaches are part of doing business. A CISO has to detect and fix them
  • 19:46 “97% of what I do is prevention” — Said a crazy person
  • 21:02 The real secret sauce
  • 22:10 The exercise, continued
  • 23:00 What we want is equally spreading security between inbound and outbound
  • 23:45 Comparing it to money
  • 24:20 Defense in depth is spreading the risk
  • 26:04 What is your level of confidence that you could find a breach?
  • 27:04 A problem today
  • 28:48 What good CISOs do
  • 30:16 Wrap up