Quarterly Market Review with a VC: Strategic Cyber Ventures – Hank Thomas – ESW #338
In this segment, we discuss the current state of the market recovery with Hank Thomas, founder of Strategic Cyber Ventures.
We've got market questions, like:
- What has changed in the last year?
- Are IPOs coming back any time soon?
- How large is the cybersecurity death pool?
- What do early and mid-sized startups need to do to survive in the current market?
Hank Thomas is a Washington D.C. based Venture Capital Investor, Founder, and CEO of Strategic Cyber Ventures (SCV). SCV invests in rapidly growing cybersecurity and privacy focused technology companies. The SCV team brings an expert, more modern venture capital experience to startup founders and the broader investment ecosystem, working every day to bridge the gap between emerging commercial technology and corporate and national security challenges. Hank is a former U.S. Army Military Intelligence Officer, and Booz Allen Hamilton security consultant and executive. He leverages 25 years of experience to identify, invest in, and help mature differentiated technology companies. Hank serves as a member of the board of directors for cybersecurity technology companies Cloudburst, Polarity, ID DataWeb, SnapAttack, and HackNotice. Hank also serves on Consumer Electronics Show (CES) advisory board.
Join us for one of our Identiverse Regional Events, coming up on December 1st in New York City and December 5th in Chicago! Participate alongside local experts and regional peers in information-rich sessions on the latest technologies, best practices, and industry trends.
Secure your complimentary registration at securityweekly.com/idvregionalevents2023
Data Chaos MUST be Curbed, but how? – Jackie McGuire – ESW #338
There is little to no organization of data within companies in 2023. We're all guilty of this at some level. The download folders and desktops on our personal machines are a mess. File servers, and cloud storage services are a mess. In Microsoft's recent data leak, AI researchers even had PC backups stored along side machine learning models for whatever reason.
Data is hard to classify, organize, and monitor. By designing for convenience, we've created convenience debt that now has to be paid down. In this segment we talk to Jackie McGuire about what needs to happen to accomplish this, at the enterprise level, and at scale.
Even if we can one day address the challenge of tracking and labeling data, we'll still have the challenge of addressing data integrity and resilience, which we'll also discuss if we have time!
Segment Resources: https://www.darkreading.com/risk/it-s-time-to-assess-the-potential-dangers-of-an-increasingly-connected-world-
While some people need to be thrown into the deep end, Jackie thrives there.
People love working with Jackie because she has a wealth of multi-disciplinary knowledge and cares deeply about delivering measurable results for the people and companies she works with. Her background spans security, data science, AI, AR/VR, and finance. A unique combination of highly analytical and highly empathetic, Jackie connects the dots between people, policy, and practicality.
Jackie’s ability to articulate the complexity of the security market has made her a sought-after writer, speaker, and media expert. She currently hosts her own new podcast, Woman-in-the-Middle, and co-hosts Enterprise Security Weekly, as well as speaking at many of the world’s largest security conferences, including RSA, Black Hat, and DEFCON.
Security Weekly Listeners: We are celebrating the milestone of reaching over 1,000 members of our CISO community. The Cybersecurity Collaboration Forum is a one-stop shop for executive collaboration comprised of CISOs across various industries. If you want to be part of this growing community of CISOs, join us as a member or technology partner. To learn more, visit: securityweekly.com/cybersecuritycollaboration
HAR files, Okta breach, EO on AI, Ransomware, Solarwinds CISO charged, and Bagels! – ESW #338
Oh, the HARror! Sanitizing HAR files is not as easy as some might lead you to believe. CISA funds Cyber.org for K-12 cyber education and ORNL creates a Center for AI Security Research (CAISER). Cloudflare creates a tool out of spite, and CISA creates a tool you shouldn't use in production? Biden's EO on "Safe, Secure, and Trustworthy AI" and the Top Five Things you need to know about how GenAI is used in Security Tools.
Five lessons learned form Okta's latest breach, should ransom payments be illegal, and why ransomware victims can't stop paying ransoms. We discuss the impact of the charges made against Solarwinds and its CISO by the SEC, the 2023 ISC2 Cybersecurity Workforce Survey, and Microsoft's latest open letter on security.
Finally we wrap up discussing a delicious $8M Series A for better bagels!
Join our cybersecurity community on Discord! Connect directly with our expert hosts, join discussions with fellow audience members, and customize your notifications to receive alerts every time an episode of your favorite show publishes. Get your invite at securityweekly.com/discord!
Adrian Sanabria
- FUNDING: Cranium Announces $25 Million in Series A Funding to Secure AI
- FUNDING: CISA Awards CYBER.ORG $6.8M in Funding for K-12 Cyber Education
- ACQUISITIONS: Palo Alto Networks buys Dig Security, sources say for $400M
- ACQUISITIONS: Proofpoint Signs Definitive Agreement to Acquire Tessian
- NEW ORGANIZATIONS: Center for Artificial Intelligence Security Research (CAISER)
- NEW TOOLS: HAR Sanitizer tool by Cloudflare
I recorded a simple HAR file of me logging into a VERY simple website that I regularly use. Maybe I need to do additional testing, but it was not possible for me to figure out which cookies or other elements to sanitize from the HAR file. The variable/cookie names looked randomly generated - there was nothing labeled "password", "secrets", or "OAuth key". Browsing the HAR file manually was also difficult, and I failed to locate the OAuth key that way as well.
In summary, I don't think the average employee would be successful in sanitizing HAR files, and I don't see a straightforward way to automate this process.
However, the attackers seem to have found a process to take advantage of them, however! They don't have to understand the HAR file or perform surgery on it, they can just use it as is to have a logged-in session.
- NEW TOOLS: Logging Made Easy
Initially created by NCSC and now maintained by CISA, Logging Made Easy is a self-install tutorial for small organizations to gain a basic level of centralized security logging for Windows clients and provide functionality to detect attacks. It's the coming together of multiple free and open software platforms, where LME helps the reader integrate them together to produce an end-to-end logging capability. We also provide some pre-made configuration files and scripts, although there is the option to do it on your own.
Logging Made Easy can:
- Show where administrative commands are being run on enrolled devices
- See who is using which machine
- In conjunction with threat reports, it is possible to query for the presence of an attacker in the form of Tactics, Techniques and Procedures (TTPs)
- LEGISLATION: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence
I'm sad we overlooked the opportunity to call this the "Skynet Prevention Act"
- AI ESSAYS: The Top Five Things You Need To Know About How Generative AI Is Used In Security Tools
- AI ESSAYS: AI Security Has Serious Terminology Issues
- REPORTS: Offensive Security Vision Report 2023
Penetration tests have always had gaps. It's unavoidable - you just can't do everything the bad guys can do, like installing malware with a worm component in production environments. But it strikes me that, with the popularity of SaaS these days, pentests might be missing entire environments. The term SaaS, environments like Salesforce, M365, Google Workspace, Okta never come up in this NetSPI report.
Working in product marketing for a SaaS security vendor, one of my challenges has been figuring out why SaaS security isn't higher on folks' priority lists, and I suspect this might be part of the reason why. I mean, I get it - folks still have NT4, Server 2003 on their networks (hell, they still have "networks"), and that's scary as hell. But an Okta/M365 admin takeover is pretty scary as well, no?
Is SaaS in scope for modern pen tests? Is it even on pen testers' radars?
- AI INTERVIEWS: Trustworthy AI for National Security – Kathleen Fisher – PSW #805
- BREACHES: Five Lessons Learned From Okta’s Support Site Breach
- TRENDS: Why ransomware victims can’t stop paying off hackers
- PODCASTS: Should Ransom Payments Be Made Illegal?
On its face, refusing to pay ransoms sounds like a great idea. However, 'winning' against cybercrime always comes with a cost. Here's my logic:
- We convince everyone to stop paying ransoms and we win! Cybercriminals stop using ransomware and extortion as a means of making money.
- The cybercriminals didn't go away, so they're going to use their sizable numbers, R&D budget, time, and skills to come up with a new way of making money.
- They'll either shift to something else that's currently working (e.g. BEC, which is already several times more profitable than ransomware), or come up with something new.
- Are we prepared for the new? Do we follow the trend and shift focus away from ransomware prevention to the new thing?
- Most companies don't have fundamentals down, so this plays out badly for us. Again.
Could we even consider stopping ransomware a success, or a reasonable goal, given that most orgs won't be prepared for what comes next?
- ESSAYS: How to Banish Heroes from Your SOC?
- INTERVIEWS: SC Media Talks Cybersecurity and Process Mining
- HOWTOS: How Leading Companies Use Trust Center Updates — Best Practices and Examples – SafeBase Blog
- LEGAL: SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures
- LEGAL: Cybersecurity Leaders Spooked by SEC Lawsuit Against SolarWinds CISO
Maybe there's an upside here though? Now CISOs can push back on pressure to bend the truth or lie, pointing to cases like these?
- LEGAL: Here’s what that Capital One court decision means for corporate cybersecurity
- REPORTS: 2023 ISC2 Cybersecurity Workforce Survey
- OPEN LETTERS: Announcing Microsoft Secure Future Initiative to advance security engineering
Lastly, we are continuing to push the envelope in vulnerability response and security updates for our cloud platforms.
- SQUIRREL FUNDING: Deal Dive: Bagels with a schmear of venture capital
