We’re thinking it just might be possible to wish our security problems away.
This episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson. Our sponsored guest this week is Steve Giguere, (@_SteveGiguere_) director of solution architecture and community, StackRox.
Check out Steve’s podcast, The Continuous Security Podcast.
StackRox resources mentioned on the show are here.
And this is StackRox’s recent open source security project Kube-linter.
Thanks to this week’s podcast sponsor, StackRox
Got feedback? Join the conversation on LinkedIn.
On this week’s episode
That’s something I would like to avoid
Security theater is a security placebo. We’re being told that it’s effective, and we may fool ourselves into believing it is, but the reality is there’s no real security medicine there. Over on Infosecurity Magazine, Danny Bradbury has identified a few key ones I want to call out. In particular, technology buzzwords – like getting a solution with AI, data collection – more data, more insights, right?, and endless security alerts – for practitioners and end users. All of these seem to be in regular practice today. Does calling out security theater result in pushback? And if so, how do you handle calling it out and how would you shift each of these security placebos into a more medicated version?
There’s got to be a better way to handle this
On reddit, kautica0 asks, “If a company becomes aware of a 0-day vulnerability and it impacts their production web application serving customers, what actions should be taken? Should it even be considered an incident?”
Just because it’s a 0-day vulnerability does that make it more threatening than any of the known vulnerabilities? There was a lot of logical advice that was akin to how we would handle any vulnerability, but the 0-day nature had the looming feeling of this could be an incident very quickly and would require an incident response plan.
“What’s Worse?!”
A “What’s Worse?!” entry from our youngest listener.
Please, enough. No, more.
The topic is Kubernetes Security. We discuss what we have heard enough about when it comes to Kubernetes security and what we would like to hear more.
Where does a CISO begin
Is being cloud first a security strategy? Over on the UK’s National Cyber Security Centre, an article argues that we should not ask if the cloud is secure, but whether it is being used securely. What does that mean? And is there an argument for and against cloud first being a valid security strategy?