DiscoverSecurity Stories
Security Stories
Claim Ownership

Security Stories

Author: Cisco Secure

Subscribed: 33Played: 484


Discover the unique, inspiring, and often amusing stories behind what it takes to lead cybersecurity efforts in an organization. The Security Stories podcast features interviews with a diverse range of guests, each sharing their leadership experiences for the benefit of others in the cybersecurity industry. Discover more at
33 Episodes
Our guest today is Stuart Peck,  director of cybersecurity strategy for Zero Day Lab. Stuart talks to Hazel about his various career roles within threat intelligence, social engineering and incident response.  We also talk about how he went from a non technical background to a technical one, and overcoming imposter syndrome in the process.  Stuart then talks about how preparing your mentality for a data breach is an incredibly important part of your plan, and how you can do that. We also talk about the Many Hats Club community that Stuart set up, providing a network for infosec professionals as well as raising incredible funds for vulnerable children's charities. You can see more details about this at https://themanyhats.clubPlus, there’s some great advice in this interview for anyone who might be on the verge of burnout, or needs any tips on how to manage stress, as Stuart talks about his experience in these areas.In the studio, we have a new cohost joining the ranks for a few epsiodes - Geraldo De La Cruz who is interning with us this summer and has his own podcast. We get to know him a little.Plus, we tell the story of one of the most notorious data breaches of all time – the Enigma code.  It's striking how many of the tactics used still tie in to current thinking when it comes to protecting one’s data.Time stamps:0.00 Intro and getting to know Geraldo10:16 The story of breaking the Enigma code24:19: Stuart Peck interview72:40: Closing thoughts and outro 
The past week has been a lot for people in the security industry. Last Friday in the US, people were just about to clock off for what would hopefully be a relaxing Fourth of July long weekend. Only for cybercriminals to have other plans.This episode contains the audio from a recent live stream, where Hazel sat down with Cisco Talos’ US Outreach Team lead Nick Biasini. We talked about the unfolding events surrounding the REvil ransomware campaign and Kaseya VSA supply chain attack. Nick broke down the complicated scenario, and talked about how the two attacks worked together. We also spoke about the impact for organizations around the world, as well as what we’re seeing with ransomware on a general level at the moment.  The audio includes questions that we received during the live stream from our audience, and Nick's answers.To stay up to date on this attack, please take a look at the Talos response post which is being continually updated.
Joining today's episode are not one, but two distinguished guests. First of all, we have Dug Song, Cisco's Chief Security Strategy Officer. Dug is the founder of Duo Security which was acquired by Cisco in 2018, and he is one of the industry’s most passionate and outspoken voices about building inclusive cultures.  We're also joined by Gene Hall, Vice President of Security Marketing at Cisco. Gene is a veteran of Cisco for over 20 years and is someone who is a great advocate for nurturing the next generation, and driving down barriers across the security industry. Both Gene and Dug meet up with Hazel to discuss how they both got into the security industry and what issues they're passionate about. We also chat about how Duo was born, and the values that Dug led with which have stood the test of time.We discuss the greatest security challenges that our customers are going through and how Cisco Secure is helping them through those. We also talk about what we can all do as a collective industry to build more inclusive cultures, and address the security skills shortage. Plus, we learn how Dug got his motto of ‘Dig and be Dug in return’.To learn more about Cisco's recruitment drive and to check out current openings, head to 
Today's guest is Tanya Janca (@shehackspurple), founder and CEO of We Hack Purple, an online learning academy, community and weekly podcast that revolves around teaching everyone to create secure software. She’s also the best selling author of 'Alice and Bob Learn Application Security'.We chat about Tanya's career journey and the various hats she's collected  (there are many!) - as well as being a founder and CEO, she’s been a pentester, a CISO, an AppSec Engineer, and software developer. She’s worked in startups to public service, including being the CISO for the Canadian elections when Justin Trudeau was elected, to working in tech giants.Tanya has a really interesting perspective on many issues in cybersecurity, as you'll see in this chat. From why application security needs to be given more of a spotlight, to the issue of representation, working closely with devs, and seeking a fundamental change in the way we educate people in the industry.Before that, Ben leads our intro topic. He discusses the influence his father had on him and his security career, which prompts Hazel and Sana to look back at their own lives and talk about their greatest influencers.Plus, we discuss the new proposal from Talos and the Cyber Threat Alliance to truly tackle the global ransomware threat. If you can, please take a few minutes to read Neil Jenkins and Matt Olney's op ed piece on this, which is available on the Talos blog.Time stamps:01:46 - 15:33 Intro topic - Influencing figures, led by Ben15:34 - 32:51 Tanya Janca interview, part 132:52 - 38:49 Ransomware recommendations discussion38:50 - 60:00 Tanya Janca interview, part 260:01 - 66:56 Closing thoughts and outro
Our guest today is Al Huger,  Vice President of Cisco’s security platform and response. Al is a well known figure in the vulnerability space, and has developed several patents for cloud managed threat products which hunt down malware. He is also a three time veteran of building security companies, and successfully selling them to large organizations, including Cisco. In this interview there is a huge amount of useful advice for anyone who is thinking of selling a company, or perhaps building your own security company is an ambition of yours.  We also explore the hottest security trends, taking a particular look at the future of end user security and SASE. And we lift the lid on Al’s creative process, as he talks about how he comes up with new ideas. We also talk about culture, the power of his team, and Al’s advice for security leaders heading into the next 6 months. In the studio, Sana leads our intro topic by recapping the best of RSAC 2021. And in Threat Corner, Ben and Hazel have a discussion on a new threat actor category posed by Talos: the privateers, whereby Hazel finally learns the difference between privateers and pirates.Resources mentioned in the episode:Cisco Secure Insights Summit with Al Huger: blog post on the proposal for a new category of threat actor: stamps:02:10: Intro topic by Sana - RSAC 2021 highlights11:06: Interview with Al Huger, part 123:27: Threat corner: The new potential threat actor category - the privateers 28:39: Interview with Al Huger, part 248:49: Final thoughts and outro
On today’s show our guest is Helen Patton, CISO Advisor for Cisco Duo. Previously, Helen was an Executive Director at JP Morgan Chase, and CISO for Ohio State University.Helen talks candidly about these two wildly different experiences—as well as how to know when it's time to leave a company, resilience in the age of Covid and killer hornets, and how the CISO role is likely to develop over the next three years.In the virtual studio, we chat about the new executive order signed by President Biden aimed at improving the United States’ cybersecurity, and Ben runs down his latest threat research on supply chain attacks. More resources:Helen's RSA talk:'s blog response to the new Executive Order on cybersecurity issued by President Biden:'s supply chain attacks  blog: Time stamps:0.00 - 14.54 Intro and recapping President Biden's executive order on improving the nation's cybersecurity14.55 Interview with Helen Patton part 135.49 Supply chain attacks46.02 Interview with Helen Patton part 201.01 Closing thoughts and outro
Today's episode is a little different from our usual format. In conjunction with Mental Health Awareness month, we welcome three leaders from Cisco Talos to join Hazel, Ben and Sana for a discussion on mental health, stress and burnout - specifically in the security and threat intelligence industry, although there are things that we discuss that could be relevant beyond that. Joining us are Matt Watchinski, Vice President of Talos who has been a guest before when we talked about the power of diverse teams. We also have Matt Olney, Talos’ Head of Threat Intelligence and Interdiction who our listeners will know from our episodes on election security. And we have Mitch Neff, who leads Talos' communication strategy and hosts the  Beers with Talos podcast.Together, we share our own experiences about dealing with stress and burnout, both during the pandemic and beyond. We share these experiences from an individual level, and also our experience managing people within teams, and also helping managers who are managers too.  Of course, there are many areas within mental health and people's experiences in threat hunting that we don't cover, so please don't consider this a full resource on the topic.We hope that by sharing our experiences, we’re helping to destablise any stigmas that are out there when it comes to talking about these topics, and if you or anyone close to you is struggling at the moment, we hope this inspires you to talk to someone.Some further resources: Adjusting to extraordinary times ebook Creating safe spaces, with Chloe Messdaghi
We welcome back Talos guests Nick Biasini and Edmund Brumaghin discuss their latest research on the rising cases of collaboration app abuse, and how cyber criminals have come up with new ways of using them as an entry point into organizations. They also share lots of advice on how people can protect themselves from this increasing trend. You can read more about their research on the Talos blog.In the studio, Ben shares the origin stories behind some cyber threats—and how they got  their unusual names. For more on this, check out Ben's twitter thread.You can also check out more information about the Ryuk ransomware in this run down by Talos Plus, Sana chats about the evolution of threats over the past year, how people can protect their home environments, and how the industry is fighting back.Episode time stamps:02:14 - The origin stories of prominent malware14:23 - Interview with Nick and Edmund on collaboration app abuse33:33 - Threats in the home environment, and how the industry is fighting back43:58 - Closing thoughts
We're delighted to have Tazin Khan as our guest this week. Tazin is a data privacy advocate and founder of the Cyber Collective, a community-centered organization that seeks to help people understand the ways data and privacy impact them, and empower them to learn more about their data privacy rights. Cyber Collective is the first and only women of color-owned data ethics, privacy, and cybersecurity research organization. In what Hazel describes as one of the most moving interviews she's ever conducted, Tazin isn’t afraid to tap into the power of her vulnerability, and talk about incidents that greatly affected her and shaped who she is today. From growing up as a Bengali immigrant, making a life for herself and her family in New York, finding her cybersecurity "sweet spot" and taking a stance on key issues, it's a fascinating story.In the studio, Sana leads our intro topic. She takes us through a journey of discovery with some 2021 security trends, as decided by over 1650 security experts. This includes how companies are working on their rapid response capabilities, and what are the top causes of burnout. Access the full data here finally Ben brings you the latest threat intelligence research, with some fascinating insights into the top threat categories certain industries face, and the threats that they’re more likely to encounter. Read the full blog at time stamps:01:35: Sana discusses 2021 security trends11:30: Interview with Tazin Khan part 138:07: Industry specific threat trends with Ben45:21:  Interview with Tazin Khan part 264:08: Closing thoughts
After a bit of a break, Security Stories is back! And we're back with a brand new lineup. Joining Hazel and Ben in the virtual pod booth is Sana Yousuf, a Cisco security marketing leader and storyteller, responsible for a diverse set of threat-focused products and solutions that bring our security platform to life. She is a diversity and inclusion evangelist and author of research reports. In this episode, we'll get to know Sana, as well as kick off a brand new opening feature. For each episode we’re going choose a topic that’s on our mind, and lead a discussion on it. There are no rules! This week it's Hazel's turn, and she leads a discussion on influential women in cybersecurity history, whose work may have gone under the radar. For more on this topic, check out this Time Magazine article: check out our brand new ebook, "Lifting each other up: A celebration of women in cybersecurity and their advocates" Our guest this week is Dr Christine Izuakor (@Stineology). Christine is the founder of Cyber Pop up which helps small businesses with their cybersecurity needs and strategies. She’s had a really varied career, going from the corporate world to start up land, becoming an author, CEO and hacker along the way, and she is someone very motivated by injustice.  In this interview we hear about her life, why some people told her not to pursue a career in cybersecurity, and we chat about the opportunity divide and how we can make the field more accessible to more people.Plus, we reveal the latest threat trends in DNS Security to help inform you on where to dedicate resources or training. For more of those great looking charts Ben talks about, head to time stamps:02:40 Getting to know Sana07:50 Influential women in cybersecurity history19:12 Interview with Dr Christine Izuakor part 146:05 Threat trends: What DNS Security told us about the past year59:38 Interview with Dr Christine Izuakor part 276:18 Outro
We're joined today by Wade Baker, co-founder of Cyentia Institute (@wadebaker) and Wolfgang Goerlich (@jwgoerlich), Advisory CISO at Cisco, for a fun discussion on security outcomes.Wade and Wolf dissect the results from Cisco's 2021 Security Outcomes Study, which seeks to answer the ultimate question, "What actually works in cybersecurity?" using random sampling and statistical analysis.  Together, we discuss how can we efficiently and effectively manage our cybersecurity risk, how is it that even the largest companies with the biggest security budgets still struggle to achieve certain outcomes, and with all the various options out there for achieving a successful cybersecurity program, which ones should practitioners focus on? New technology? More training? Better incident response procedures? Listen to find out!The full report can be downloaded for free from 
On today's show we welcome two guests onto the pod. First up is Esmond Kane, CISO of Steward Health care. Esmond spoke to Hazel and told her what it was like (and still is like) to be on the front lines of the pandemic, and how security is playing a part in helping the fight back against COVID-19.  Esmond also gets pretty deep in describing what the role of a security leader is today, and we also learn how Sherlock Holmes and Dr Watson help him to find the best talent.Our second guest is Edmund Brumaghin, threat researcher for Cisco Talos.  He joins Hazel and Ben live to discuss his research into Big Game Hunting (the security kind) and the evolution of ransomware over the past 12 months. Plus, Ben and Hazel take a quick dive into the main topics from our latest threat report, out today. For the full picture, download the magazine "Defending against critical threats: A 12 month roundup"  
For our final episode of 2020, we're joined by two very special guests. First up is Fareedah Shaheed, CEO and founder of security consulting company Sekuva. As a serial entrepreneur, Fareedah has just embarked on a brand new path, which she reveals during our chat. Fareedah has also just been named on Forbes’ 30 under 30 list, which identifies those who are  making waves in technology. She has such a fascinating story, from growing up in Saudi Arabia to building her own businesses, to her explorations in how the human mind works, and developing her own identity. Secondly, Ben and Hazel are joined by Ben Munroe, Senior Director for Security Product Marketing at Cisco, for our Review of the Year. The three of us each count down our top 3 security moments, and reveal why we chose them.In an incredibly testing year, we've found some moments to celebrate, some moments to be proud of, some moments to reflect on, and some moments we originally overlooked.  Thank you so much for listening to Security Stories this year. We'll be back in January with more amazing guests, more stories, and some exciting new plans. We wish all our listeners a great festive season, and look forward to connecting with you again in 2021.Episode time stamps:0:00 Intro07:48: Interview with Fareedah Shaheed47:22: Review of the Year with Ben Munroe01:39:12: Outro
In today's episode we're delighted to welcome Chloé Messdaghi, an infosec advocate and activist who is working to create a safe space for underrepresented groups within the industry.Chloé is the CEO and founder of We are Hackerz, as well as the cofounder of Hacking is not a crime, Women of Security and The Hacker Book Club, and she is also VP of Strategy at Point3 Security.We chat about the growing issue of burnout and how people can spot the signs within themselves and others.  Chloé also reveals how she comes up with her ideas, and how she is seeking to address certain issues in the cybersecurity industry such as women and underrepresented groups being trolled online. Plus, we discuss the fight for the truth in a growing age of misinformation.Our second guest is Warren Mercer, a threat researcher from Cisco Talos who helped to discover the Olympic Destroyer attack in 2018.  Warren is in the studio with Ben and Hazel to discuss the research he’s being doing on the evolution of Remote Access Trojans, and one of the newest players, Poetrat.  We also discuss his starring role in the new multi part documentary by Tomorrow Unlocked, called 'Who hacked the 2018 Winter games’. That then brings us onto the topic of why  attribution is so difficult in the threat landscape, and what some of the consequences are of misattribution.
Our guest today is one of the security industry's most prolific video bloggers, Javvad Malik. Javvad has a signature fresh and light hearted take on security, and during this interview he talks about how he found his own voice. He also has plenty of advice for our audience on how to put a great presentation together to keep your audience engaged.In addition, Javvad's story on how he got into the security industry, and the people who helped him along the way, is well worth a listen to. Plus, we discuss the "Zombieland" rules for Security, and find out what kind of movie Javvad would make if he was put in charge of such a thing.Also in this episode, we bid a fond farewell to Noureen who is moving on to an incredibly exciting new adventure. Before she goes however, she has some wonderful words of inspiration and wisdom for our listeners.And finally Ben has some brand new threat research for us. He's here to tell us all about Remote Desktop Protocols. We examine the ways in which RDP has been a target of bad actors over the years, covering unauthorized logins, man-in-the-middle attacks, and vulnerabilities, including the ‘wormable’ BlueKeep exploit. You can learn more about this research at Episode time stamps:0.00 - 14.16: Intro and saying goodbye to Noureen14.17 - 54.50: Interview with Javvad Malik54.51 - 67.54: Threat of the month (RDP attacks) with Ben67.55 - 69.09: Closing words
"Computers make excellent and efficient servants, but I have no wish to serve under them." That Star Trek Spock quote is relevant in more ways than one today, because in this episode we meet Gabriel Gumbs, Chief Innovation Officer at Spirion, a company which specialises in data and security privacy.  Gabe's role is to lead the charge on where data security is going next, which includes the evolution of what Gabe lovingly refers to as the 'SPOC' (aka the security and privacy operations centre).We also chat about Gabe's career trajectory, from when he was hacking portable devices at school. We also touch on how he’s been able to overcome personal fears of speaking in public.After that, we welcome Nigel Houghton from Talos and Wolf Goerlich, one of our advisory CISOs for Duo Security at Cisco, to talk about the impact COVID-19 has had and potentially will have on security operations. We also learn how Talos was able to transform itself into a entirely remote workforce, and the technical and non technical challenges that arose from that.  And Wolf talks about how organizations can modernise their security defences and take the path to passwordless.  To learn more about this, do have a read of Wolf's paper 'Passwordless: The Future of Authenthication'You can also check out Gabe's other podcast, 'Privacy Please'
On today's episode we’re heading into the murky waters of online manipulation campaigns, and particularly how they’re used to try and influence political elections.  To do that, we welcome back Theresa Payton, the first female CIO of the White House and author of 'Manipulated: Inside the Cyberwar to Hijack Elections and Distort the Truth'. We also welcome for the first time, Nick Biasini. Nick is a threat researcher within Cisco Talos and recently published a paper called ‘The Building Blocks of political disinformation campaigns’, which is part of Talos’ hands on research into election security.    We chat about some of the things that shocked Theresa when she was doing her research into manipulation tactics, as well as the amplification methods that are being used to spread certain lies online. Plus, we talk about what can be done to curb these campaigns with only a few weeks to go until the United States general election. This is a really fascinating discussion, and whilst it highlighted the huge challenges that we’re facing at the moment, Nick and Theresa shared a lot of great information on how we can overcome them.Also in this episode, Ben Nahorney shares his latest research on current threat trends. This time we rank the Indicators of Compromise that organizations have encountered grouped by particular topics, including ransomware, credential stealing, and looking at the top operating system IoCs.Link to Manipulated: Inside the Cyberwar to Hijack Elections and Distort the Truth' Link to ‘The Building Blocks of political disinformation campaigns’
On today's episode, Hazel and Noureen are joined by Leticia Gammill, Cisco’s Channel leader for Canada and Latin America, and Matt Watchinski, Vice President of Cisco Talos.  Together, we share our first hand experiences and stories on the impact of diversity in cybersecurity.  There are some brilliant insights here about where companies can find diverse talent, beyond the usual recruitment channels. We also discuss how organizations can build a culture of mentoring and support, so that members of diverse teams can feel appropriately valued, and retainment levels are strong. Also in this episode, Hazel chats to Cisco’s new CISO, Mike Hanley. Mike became our CISO in June, after 5 years in Duo where he was part of Duo Labs and then became Vice President of Security, and built and nurtured the team around him. From the importance of hiring a multitalented diverse team, to building a culture of appreciation, openness and fun, Mike’s interview is a fascinating listen for anyone leading a team today. We hope you enjoy this episode, and are inspired by both of these discussions as much as we were when we recorded them.Episode timestamps:0.00 Intro02:27 Discussion on diversity in cybersecurity46:49 Mike Hanley interview1h 26: Closing remarksFor more on this subject, do check out our new eBook, "Diversity in cybersecurity: A mosaic of career possibilities".  It contains over 20 interviews with cybersecurity professionals from around the world. We asked them how they all got their starts in the industry, and what they would tell their younger selves if given the chance.  You can read that ebook by visiting
In the first of four special episodes being released during the month of October, today's episode is all about cybersecurity careers.Hazel, Ben and Noureen are joined by guests Mitch Neff and Corien Vermaak, for a discussion on how we all got our starts in the cybersecurity industry. As it turns out, none of us took a conventional path! We also talk about the people and the mentors that helped us along the way, including some practical advice for anyone who wants to be a mentor, or gain a mentor. We passionately tackle the topic of job descriptions and why they might be contributing to the so called "cybersecurity skills gap". We also talk about what hiring managers can do to make sure they're not putting the right people off with their words.Before that, Hazel meets Curtis Simpson, Chief Information Security Officer at Armis to discover his story. A self taught cybersecurity geek, Curtis spent 20 years at Sysco, building a decentralized network. He talks about how he turned around perceptions on cybersecurity being a cost centre, and focussed on how cybersecurity could contribute to business outcomes. He also touches on just how difficult a decision it was to leave after 20 years, but how he knew it was the right thing.We also talk about his organisation's reaction to COVID-19, and Curtis' take on the current threat landscape, particularly around securing IoT devices.We hope this episode proves that that there is no singular footpath into cybersecurity.  And that’s no bad thing. Time stamps:0.00 Intro3.46 Interview with Curtis Simpson47.26 Discussion on careers in cybersecurity1.42.00 CloseHere are some more resources as mentioned in our careers discussion:Noureen's cybersecurity mentoring hub: https://cybersecmentorship.orgNoureen's mentor and mentee group on LinkedIn: NetAcademy courses: Team Village Discord of which Talos are a sponsor: check out our just published eBook: Diversity in Cybersecurity: A Mosaic of Career Possibilities
Today we chat to Chris Leach, senior CISO Advisor at Cisco. From his background as an accountant (which he hated!) to venturing into cybersecurity ("I had to learn to speak in bits and bytes, after only speaking in 1s and 0s"), he has a fascinating story to share.  Chris also has some brilliant insights into how to be a great leader and role model for your team, and he has some really poignant thoughts on resiliency, bouncing back, and dealing with the fear of failure.Also in today's episode, Ben shares the highlights of his just-published research on threat landscape trends. The idea behind this work is to shed light on areas where you can quickly have an impact defending your assets, especially if you're dealing with limited security resources. You can read more about this in Ben's blog post.And finally our 'On this Day' feature takes us back to the movies! In honor of the 25th anniversary of the film Hackers, the team sits down to talk about what that movie got right, and perhaps, not so right, with some surprising reveals.  We also discuss what our own movies on cybersecurity would look like, if we were each in charge of screenwriting. Personally, we hope Noureen's idea does genuinely get greenlit!In October, we're doubling our production schedule to release episodes on topics that mean a lot to us, including careers and diversity in cybersecurity, and how to protect your loved ones from disinformation campaigns (or "fake news) online. It would be brilliant if you could subscribe to your podcast feed of choice so that you don't miss any of these exciting episodes.
Download from Google Play
Download from App Store