In a study we never actually conducted, our fellow security leaders said unequivocally that there never has been a time they welcome a phone call from someone they don’t know trying to book a demo to see a product they have no interest in.
This episode is hosted by me, David Spark (@dspark), producer of CISO Series and guest co-host Andy Steingruebl (@asteingruebl), CISO, Pinterest. Our guest this week is Andy Purdy (@andy_purdy), CSO, Huawei
Got feedback? Join the conversation on LinkedIn.
Thanks to this week’s podcast sponsor, Living Security
On this week’s episode
Here’s some surprising research
As compared to small and medium companies, big enterprises don’t appear to trust the big telcos to execute their 5G strategy. This according to new research from Omdia as reported by Iain Morris of Light Reading. When asked, “do you trust a communications service provider, AKA big telco, to execute your security strategy,” SMEs overwhelmingly supported the telcos over all other options, and big enterprises didn’t. They trusted their own expertise or wanted to lean on a cloud service provider like Amazon or Google. Let’s investigate this discrepancy.
If you’re not paranoid yet here’s your chance
As if you didn’t know it already, get ready for some sobering news about third-party risk: According to a survey by BlueVoyant, as reported by SC Magazine, 80 percent of those surveyed had at least one breach caused by a third party vendor within the past year. Most of those surveyed didn’t monitor third-party suppliers for cyber risk. But, even if they wanted to, it’s often a point in time measurement, sometimes only yearly, and organizations have an average of 1409 vendors. UK’s National Cyber Security Center puts the focus of securing against third party risk squarely on the development of the software supply chain, and the need for isolation and proven security checks throughout the development process. That may be good advice, but it still seems so overwhelming given the volume and how much you can’t control.
A vulnerability response and incident detection conundrum from Jonathan Waldrop, Insight Global
What’s the best way to handle this
Lessons learned from a big security incident and how these will be applied to the next big security incident.
What do you think of this vendor marketing tactic
Very few, if any, security leaders like cold calls. Yet, even with all the expressed distaste of them, they still exist, and that’s probably because they still work, and still deliver significant ROI. But when these companies calculating that ROI, are they calculating all the people they’ve annoyed? One vendor sales rep who said after searching their CRM for “Do Not Call” there was a slew of vitriol from CISOs screaming to never contact them again. And as we all know, CISOs talk to other CISOs. So if you’ve angered one CISO sufficiently to never consider you, they’ve probably told a few friends as well. Let’s discuss getting pushed over the edge by a vendor’s aggressive sales tactics and what was done to essentially shut them off, including telling others about their actions.