BSW #276 – Karl Triebes
Full Audio
View Show IndexSegments
1. Unintended Consequences: Evolution of Applications, APIs, and Where They Run – Karl Triebes – BSW #276
While applications and APIs are developed with cloud in mind, many organizations must rely on a hybrid architecture and edge computing to deliver their services given the high cost of cloud services. However, many organizations lack the right security stack to protect data and applications in these unique environments, or from threats added through reliance on open source code. With today’s attacks coming from automated threats, organizations need to implement tools to mitigate risks that impact the bottom line, brand reputation, and customer experience without slowing development lifecycles. This segment is sponsored by Imperva. Visit https://securityweekly.com/imperva to learn more about them!
Announcements
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Security Weekly listeners save 20% on InfoSec World 2022 passes! InfoSec World will be held September 27th through the 29th at Disney's Coronado Springs Resort in Lake Buena Vista, Florida. Visit securityweekly.com/isw and use the code ISW22-SECWEEK20 to secure your spot now!
Guest
![](https://image-optimizer.cyberriskalliance.com/unsafe/1920x0/https://files.scmagazine.com/wp-content/uploads/2023/08/Karl_Triebes-1.jpg)
For over three decades, Karl Triebes has helped conceive and build products, services, and businesses for networking, application software, storage, and cloud. At Imperva, he leads product management for the Application Security business unit, driving product innovation for customers. Prior, he was Executive Vice President of Product Development and CTO at F5. Triebes has also held senior leadership positions with Amazon Web Services, Foundry Networks, and Alcatel.
Hosts
2. Coaching, What CEOs Expect, How NOT to Fire Your Security Team – BSW #276
In the leadership and communications section, The Coach in the Operating Room, What Today's CEOs expect from a CISO, Patreon security team layoffs cause backlash in creator community, and more!
Announcements
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Hosts
- 1. The Coach in the Operating RoomTL;DR - folks at the top of their game in all field need coaches. Why not yours? Much thanks to Ryan Naraine for bringing this one to my attention. One of the most profound pieces of wisdom I've learned in my years in security is that, though everything we deal with _seems_ unique and new, most of our problems are old ones. I think we're often guilty of thinking our work problems and personal problems all need new solutions. With all the money, marketing, and ink spent on new research and technologies, it's easy to see how we can fall into this trap. For example, this article was published in 2011. If I send this article to 100 people, I wouldn't be surprised if a third refused to read it because it's over a decade old. In fact, one of my favorite pieces I've ever written, an op-ed for Vice Motherboard, is now adorned with a large "THIS ARTICLE IS OVER FIVE YEARS OLD" warning, though nothing in it was time sensitive at all. In fact, in that article, I point to 20+ year old learnings from the quality assurance world. The moment we stop looking for new things to learn, I believe our skills and our value to those around us, begins to erode. A personal or executive coach doesn't need to know the first thing about security to be able to help you solve most of your problems. Some of my biggest epiphanies occur when I'm exercising with my personal trainer, bouncing thoughts and ideas off them.
- 2. What todays CEOs Expect from CISO – Elevate SecurityThis might be a polarizing one, but here's the synopsis of the article. Interviewing for CISO gigs, the author kept hearing the same answer: "I want my next CISO to be more like a General Manager" 1. Need the CISO to align with our mission, culture, and values, not try to change them 2. Need a CISO that understands how they can contribute 3. Need a CISO that's a good communicator - communicate with leadership in business terms The author's recommendations: We all need to take a step back and actively seek feedback on: - Are we fitting into the company’s culture and vision that was established before we got there? - How are we perceived as supporting the business? - How are we perceived as adding friction to it? Are we the Office of “No”, or the Office of “Yes, but…”? - Is the friction we may be adding rooted in data and risk, or is it just a HiPPO’s opinion? - What is it that our audiences need to hear about our security program? - How do we convey that in a way that isn’t security-speak? Each level of the organization requires a different level of communication. We need to adjust this for them, not the other way around. - How can we convey where our program is at today and where we’re taking it in the future? - How can we convey a level of conviction and high integrity commitments? - How can we seek to gain efficiencies in operations and budget?
- 3. Patreon security team layoffs cause backlash in creator communityEvergreen advice for handling breaches and security incidents: 1. control the narrative 2. update often, even if there's nothing new 3. be transparent It's good general business advice when it comes to public relations, not really something specific to security-related crisis communications. Not only did Patreon lose the narrative from the start... https://www.linkedin.com/feed/update/urn:li:activity:6973709234702032896/ ...their response was insufficient and felt false: "Patreon said that the layoffs will have no impact on its security program" My immediate response is "bullshit - there's no way you can dump your entire security team and claim no impact." Even if true, you need to _convince_ your customers of that - they're not just going to take your word for it. This statement effectively had the same impact as the classic "We care about your security and the privacy of your data" page on every Fortune 500 website. The backlash was deep and immediate. Just google "Patreon Security Team" and you'll see how comprehensively negative the reception of this news was. Every outlet covered it. It blew up on Reddit and Twitter. Experts were in agreement, saying, "I wouldn't trust my data with Patreon." What was Patreon thinking? How should they have handled this? Can they recover? What are they potentially replacing their team with? A crappy MSSP and some annual pen tests?
- 4. Kim Kardashian’s Next Role? Co-founding a New Private Equity Firm, SKKY PartnersThe investors on the latest All In podcast were talking about how traditional brands could be going away, replaced by personal brands. Talking about how influencers are quickly building the strongest and most valuable brands today. Kim Kardashian is a prominent example, but the discussion is more about the trend - how does security change when a multi-billion dollar brand is attached to a single individual executive? Some folks are still dismissive, but this is already happening - folks like Mr. Beast, Rihanna, and KimK, who were once merely 'influencers', are all already running $1B+ corporate empires.
- 5. The Reporting Line of Security Teams / CISOs – Updated