Compliance is the floor, and I keep getting asked to explain what goes on top of it. These are conversations where I try to make security accessible to the people who have to fund it, report on it and answer for it.
CISOnomics, Spotlight E27
Get Beyond the Checklist: Compliance Does Not Equal Security
Hosted by Jake Sparkes, Greenridge Search · In conversation with Chris Roberts
A car insurer used to ask whether the car had seatbelts. It never asked whether anyone wore them. Security audits have the same blind spot. In this conversation with Chris Roberts, I get into why a SOC 2 or ISO 27001 report is a point-in-time look backward, why your choice of auditor matters, and what a pragmatic alternative looks like: continuous, third-party-verifiable validation built for your own assurance first and the audit second. We also cover insurers that reward behavior, and why more tools (the CISO version of gear acquisition syndrome) won't fix a process and people problem.
Decoding Security Frameworks vs. Actual Security: Avishai Avivi’s Cybersecurity Playbook for Executives
Hosted by Neatsun Ziv, CEO of OX Security
Recorded while CISO at SafeBreach
Why do two people have to turn a key to launch a missile? Segregation of duties, minus the jargon. In this conversation I get into how to take a framework (NIST, ISO, SOC 2) and translate it into the language your CFO and board actually speak. We cover why you can't eliminate risk and shouldn't promise to, why a breach is often just the excuse and weak preparation the real problem, and why a program needs people, process and tools in balance. One practical tip: pick examples your board has already read about. If it made Forbes, they've probably seen it.
Cybercrime Magazine, The Modern Security Architecture (sponsored by SafeBreach)
A Data-Driven Approach
Recorded while CISO at SafeBreach
Gut feelings don't survive a budget request. This one covers the two board conversations I rely on: the gap-and-target-state business case, and the "here's what last quarter's investment delivered" report that asks for nothing. We also get into breach fatigue, and why "we're fine" is sometimes the right thing to tell a board.
Cybercrime Magazine, The Modern Security Architecture (sponsored by SafeBreach)
Protecting Cloud Assets
Recorded while CISO at SafeBreach
There's no such thing as a cloud. It's just someone else's computer. We cover the questions to ask a vendor before you hand over data, why you should test the controls your provider says exist, and why a cloud outage is your business continuity problem, not just theirs.