At a time of devolving politics, Madison Horn stands out as a breath of fresh air.

Related: The Biden-Harris National Cybsecurity Strategy

I had the chance to sit down with Horn at RSAC 2024 to learn all about her measured decision to put an ascendent cybersecurity career on hold to run for political office.

I came away very impressed by Horn’s determination to inject technical expertise and ethical reform into an arena starkly bereft of both: the U.S. Congress. For a full drill down, please give the accompanying podcast a listen.

Horn’s background is as compelling as it is unorthodox. A seventh generation Oklahoman and a proud member of the Cherokee Nation, she grew up in a rural community with few socio-economic advantages. Her professional career began by happenstance at a small cyber firm that specialized in assessing critical infrastructure vulnerabilities.

She quickly progressed to significant roles at Fusion X, Accenture, PricewaterhouseCoopers and Siemens Energy, where she spearheaded global cybersecurity initiatives. “My career gave me a unique perspective on the threats facing America,” she says, everything from mitigating AI-boosted cyberattacks to strategizing cyber warfare countermeasures.

Even as her career trajectory steepened, Horn found herself repeatedly drawn back to her home state and increasingly troubled by its maladies. It was a sense of duty to serve her community, she says, that compelled her to try her hand at politics.

“Every time I came back to Oklahoma, I saw the lack of progress and the lack of opportunities,” she explains. “I felt I owed it to my community to come home and do something about it.”

Her decision was further galvanized by the political tumult following Donald Trump’s election and by the January 6th Capitol riot. “Seeing our political system deteriorate because of ego and partisanship was a call to action for me,” she says.

Horn is running against Republican incumbent Stephanie Bice, who has focused on border security and protecting the oil and gas industry. Oklahoma’s 5th District is rated solidly Republican by various analysts, but current polling has Madison and her opponent tied 46/46, with 8% undecided according to change research,  representing a path for Horn.

However, she believes her unique background in cybersecurity  and commitment to ethical governance can resonate with voters across the spectrum. “We need leaders who understand technology and can protect our digital future,” she argues.

Horn’s campaign rebukes the current political system, which she sees as being hampered by money and party politics. “All the money in politics is holding back good people from getting elected,” she contends. Her previous run for the U.S. Senate, though unsuccessful, helped her better understand the process and prepare for her current bid, she says.

Her platform hasn’t changed one iota, she told me. She hopes to contribute to resolving critical issues such as supply chain resilience, rural healthcare and infrastructure development. Horn emphasizes the importance of direct community engagement, a lesson she learned from her Senate campaign. “People are looking for authenticity and a genuine connection with their representatives,” she notes.

If Horn has an ace in the hole, it might be her high-level grasp of cybersecurity exposures, which gives her a full appreciation of the complexities that must be overcome to make the Internet as private and safe as it needs to be. If she wins this November, Madison would be the most credentialed cyber lawmaker in U.S. history.

Could Madison Horn be in the vanguard of a youthful critical thinkers motivated to restore governance by and for the people? Let’s hope so. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


The post RSAC Fireside Chat: Madison Horn’s quest to add cyber expertise, restore ethics to Congress first appeared on The Last Watchdog.

Security teams rely on an ever-growing stack of cybersecurity tools to keep their organization safe.

Related: The worst year ever for breaches

Yet there remains a glaring disconnect between security systems and employees.

Now comes a start-up, Amplifier Security, with a bold new approach to orchestrate security actions.

Just after RSAC 2024, I spoke with Thomas Donnelly, Amplifier’s co-founder and CTO, about how that they’re utilizing large language models (LLMs) and to emphasize continual employee engagements. For a full drill down, on how Amplifier aims to help companies shape a security culture — without sacrificing productivity — please give the accompanying podcast a listen.

At the heart of Amplifier’s solution is Ampy, an AI security buddy. Ampy interacts directly with each employee to facilitate automated security fixes. Ultimately Ampy offloads a ton of manual work that security teams typically have to do by chasing employees themselves.

Donnelly explained how Amplifier leverages LLM to make Ampy friendly and increasingly knowledgeable. For instance, Ampy helped one early customer achieve a 70 percent improvement in security training compliance in just a couple of weeks and other customers report material improvement in the time and effort required to manage vulnerabilities.

By making security very engaging and directly involving employees in security processes, CISOs can foster cross-functional teamwork with other departments, Donnelly argues. The clincher is that this can help them get firmer footing to secure employees and their assets, using existing tools, and thereby nurture a security culture, he says.

Makes a lot of sense. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Amplifier Security taps LLMs to help organizations foster a security culture first appeared on The Last Watchdog.

Secure Access Service Edge (SASE) has come a long way since Gartner christened this cloud-centric cybersecurity framework in 2019.

Related: Can SASE stop tech sprawl?

SASE blends networking architecture, namely SD-WAN, with cloud-delivered security services such as security web gateways, Zero Trust network access and more.

Several distinct variants of SASE have come to be supplied by diverse sources. This includes new players, like Versa Networks and Cato Networks; security stalwarts, like Palo Alto Networks and Zscaler; and even tech giants, like Cisco and Akamai.

Just after RSAC 2024, I had the chance to visit with Ken Rutsky, CMO at Aryaka, which is supplying yet another flavor: Unified SASE as a Service.” For a full drill down, please give the accompanying podcast a listen

We discussed how the SASE market has shifted post Covid 19. Early SASE solutions often stitched together disparate networking and security products resulting in operational inefficiencies, Rutsky told me.

Aryaka unifies networking and security architectures at a foundational level. “In a lot of scenarios, organizations are forced into this untenable trade-off between performance and security, and we know who usually wins,” he says. “We think unified SASE is the way to break that trade-off between performance and security.”

Acknowledging that organizations must rationalize past security investments, even ones that no longer quite fit, Aryaka does not ask customers to rip and replace anything.  Instead, it meets them where they are, he says, then guides them through adoption in stages.

This is a prime example of the wider trend of cybersecurity solutions becoming more integrated to meet complex pressures. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC 2024: The many flavors of ‘SASE’ now includes Aryaka’s ‘Unified SASE as a Service.” first appeared on The Last Watchdog.

Secure Access Service Edge (SASE) has come a long way since Gartner christened this cloud-centric cybersecurity framework in 2019.

Related: Can SASE stop tech sprawl?

SASE blends networking architecture, namely SD-WAN, with cloud-delivered security services such as security web gateways, Zero Trust network access and more.

Several distinct variants of SASE have come to be supplied by diverse sources. This includes new players, like Versa Networks and Cato Networks; security stalwarts, like Palo Alto Networks and Zscaler; and even tech giants, like Cisco and Akamai.

Just after RSAC 2024, I had the chance to visit with Ken Rutsky, CMO at Aryaka, which is supplying yet another flavor: Unified SASE as a Service.” For a full drill down, please give the accompanying podcast a listen

We discussed how the SASE market has shifted post Covid 19. Early SASE solutions often stitched together disparate networking and security products resulting in operational inefficiencies, Rutsky told me.

Aryaka unifies networking and security architectures at a foundational level. “In a lot of scenarios, organizations are forced into this untenable trade-off between performance and security, and we know who usually wins,” he says. “We think unified SASE is the way to break that trade-off between performance and security.”

Acknowledging that organizations must rationalize past security investments, even ones that no longer quite fit, Aryaka does not ask customers to rip and replace anything.  Instead, it meets them where they are, he says, then guides them through adoption in stages.

This is a prime example of the wider trend of cybersecurity solutions becoming more integrated to meet complex pressures. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC 2024: The many flavors of ‘SASE’ now includes Aryaka’s ‘Unified SASE as a Service.” first appeared on The Last Watchdog.

CISOs have been on something of a wild roller coaster ride the past few years.

Related: Why breaches persist

When Covid 19 hit in early 2020, the need to secure company networks in a new way led to panic spending on cybersecurity tools. Given carte blanche, many CISOs purchased a hodge podge of unproven point solutions, adding to complexity.

By mid-2022, with interest rates climbing and the stock market cratering, CFOs began demanding proof of a reasonable return on investment. Today, with purse strings tightened – and cyber risks and compliance pressures mounting — CISOs must recalibrate.

I had a fascinating discussion about this with Ryan Benevides, a principal at WestCap, the growth equity firm founded by Laurence Tosi, former CFO of Blackstone and Airbnb. WestCap’s cybersecurity partnerships  includes HUMAN Security, Bishop Fox and Dragos.

Benevides shared his perspective of how the cybersecurity realm has become saturated with over 4,000 venture-backed vendors who are under tighter scrutiny as well. For a full drill down, please give the accompanying podcast a listen.

Despite this turbulence, WestCap views this reset as a positive development. Both CISOs looking for better tools — and the innovators supplying them — must now focus on filling gaps and meeting genuine market needs, Benevides observes. And this can be done by leveraging advanced technologies, namely automation and AI, he says.

He highlighted the need for tools that improve communication between CISOs and board members and noted that positioning cybersecurity as a business enabler will be a key to success.

Agreed. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

 

The post RSAC Fireside Chat: Tightened budgets impose discipline on CISOs, resets security investments first appeared on The Last Watchdog.

Confidence in the privacy and security of hyper-connected digital services is an obvious must have.

Related: NIST’s  quantum-resistant crypto

Yet, Digital Trust today is not anywhere near the level it needs to be. At RSAC 2024 I had a wide-ranging conversation with DigiCert CEO Amit Sinha all about why Digital Trust has proven to be so elusive. For a full drill down, please give the accompanying podcast a listen.

We spoke about how the Public Key Infrastructure (PKI) has come under pressure. PKI and digital certificates provide the essential framework for authenticating identities, encrypting communications and ensuring data integrity.

However, with the shift to remote work and the proliferation of Internet of Things systems, the complexity of maintaining a fundamental level of trust in digital services has risen exponentially.

And that curve will only steepen as GenAI/LLM services ramp up and quantum computers get mainstreamed, Sinha observed.

Sinha highlighted the importance of automation and comprehensive control in managing digital certificate sprawl. With respect to AI innovation, Sinha noted a couple of near -term concerns: distinguishing real from fake content and ensuring the integrity of the software supply chain. With so many more connections being made, extending and scaling the PKI framework to help mitigate these new exposures makes sense and can be done, he argues.

At same time, companies need to stay in step with efforts National Institute of Standards and Technology (NIST) to implement quantum-resistant algorithms. DigiCert supports this push and is hosting the first World Quantum Readiness Day on September 26.

Digital Trust absolutely needs to be on the front burner. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Here’s what it will take to achieve Digital Trust in our hyper-connected future first appeared on The Last Watchdog.

Taking stock of exposures arising from the data-handling practices of third-party suppliers was never simple.

Related: Europe requires corporate sustainability

In a hyper-connected, widely-distributed operating environment the challenge has become daunting.

At RSAC 2024, I visited with Paul Valente, co-founder and CEO of VISO TRUST. We had a wide-ranging discussion about the limitations of traditional third-party risk management (TPRM), which uses extensive questionnaires—and the honor system – to judge the security posture of third-party suppliers. For a full drill down, please give the accompanying podcast a listen.

VISO TRUST launched in 2020 to introduce a patented approach, called Artifact Intelligence, to automate the assessment of third-party risks. This method employs natural language processing (NLP) and various machine learning models, including large language model (LLM) to automate the assessment of third-party risks, Valente told me.

The benefits of advanced TPRM technologies extend beyond implementing these audits much more efficiently and effectively at scale. Valente cited how a customer, Illumio, is  leveraging Artifact Intelligence to conduct vendor assessments very early in the procurement process, significantly enhancing decision-making and avoiding high-risk relationships.

The evolving regulatory landscape is a significant driver for the adoption of advanced TPRM solutions. From the stringent interagency guidelines and state laws in New York to healthcare regulations and European legal frameworks, companies face mounting pressures to enhance their third-party cyber risk management practices, Valente noted.

With “companies approaching 100 percent third-party integration,” CISOs are making TPRM a top priority, he says. “It’s just an enormous challenge. And to solve it from a CISO standpoint means solving the scalability issue and solving the data quality issue.”

The shoring up of supply chain security continues. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: VISO TRUST replaces questionaires with AI analysis to advance ‘TPRM’ first appeared on The Last Watchdog.

Companies that need to protect assets spread across hybrid cloud infrastructure face a huge challenge trying to mix and match disparate security tools.

Related: Cyber help for hire

Why not seek help from a specialist? At RSAC 2024, I visited with Geoff Haydon, CEO, and Alex Berger, Head of Product Marketing, at Ontinue, a new player in the nascent Managed Extended Detection and Response (MXDR) space.

MXDR extends from the long-established Managed Security Service Providers (MSSP) space. MSSPs came along 20 years ago to assist with on-premises tools like firewalls, intrusion detection and antivirus tools.

Managed Detection and Response (MDR) arose to focus on advanced threat detection and remediation. And next came MXDR solutions, which offer wider, more integrated coverage while emphasizing automation and collaboration.

Haydon and Berger, for instance, explained how Ontinue leverages machine learning to automate detection and low-level incident management. For a full drill down please give the accompanying podcast a listen.

Berger told me how Ontinue has begun leveraging Large Language Model (LLM) tool to automate incident summarization. LLM is perfectly suited to this task. Human analysts no longer must carve out time to write coherent summaries – and no longer even need to be fluent in English.

Ontinue has also tightly integrated their services with Microsoft Teams – to promote close collaboration with clients. “Security is a team sport,” Haydon says. “This allows us to become an integral part of our customers’ IT and security teams.”

How far will MXDR take organizations as they navigate unprecedented risks? I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Ontinue ups the ‘MXDR’ ante — by emphasizing wider automation, collaboration first appeared on The Last Watchdog.

Could we be on the verge of Privacy Destruction 2.0, thanks to GenAI?

Related: Next-level browser security

That’s a question that spilled out of a thought-provoking conversation I had with Pedro Fortuna, co-founder and CTO of Jscrambler, at RSAC 2024.

Jscrambler provides granular visibility and monitoring of JavaScript coding thus enabling companies to set and enforce security rules and privacy policies. For instance, it helps online tax services prevent leakage of taxpayers’ personal information via pixels, those imperceptible JavaScripts embedded in a web page to collect information about the user’s interactions.

It turns out, Fortuna observed, that GenAI/LLM is perfectly suited to the deeper mining of personal data collected by pixels as well as other JavaScript mechanisms currently in wide use.

This brought to mind 2010, the year I wrote news stories for USA TODAY about Mark Zuckerberg declaring privacy was “no longer a social norm” and Google CEO Eric Schmidt admitting that Google’s privacy policy was to “get right up to the creepy line and not cross it.”

Today, the temptation for companies to leverage GenAI/LLM just to get ahead of the competition is intense; and the stage is set for them to trample what remains of privacy protection in the post Zuckerberg/Schmidt era.

Jscrambler can at least provide technology to monitor and control how third-party JavaScript components handle private data. But at the end of the day, company leaders must be compelled to avail themselves of such tools and make privacy protection a priority.

For his part, Fortuna told me he is concerned that his two young children might become accustomed to relinquishing their privacy to unscrupulous data collectors; but he’s also optimistic that guardrails will emerge. For a full drill down, please give the  a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Jscrambler levels-up JavaScript security, slows GenAI-fueled privacy loss first appeared on The Last Watchdog.

Digital rights management (DRM) has come a long way since Hollywood first recognized in the 1990s that it needed to rigorously protect digital music and movies.

By the mid-2000s a branch called enterprise digital rights management (EDRM) cropped up to similarly protect sensitive business information. Today, businesses amass vast  amounts of business-critical data – at a pace that’s quickening as GenAI takes hold.

At RSAC 2024 I sat down with Isaac Roybal, chief marketing officer at Seclore, to discuss how the challenge of securing business data has moved beyond even where the EDRM space has been evolving. For a drill down, please give the accompanying podcast a listen.

Seclore takes a data-centric approach to securing data by aligning granular controls with the sensitive data itself. This allows for security teams to dynamically manage permissions, rescind access, alter editing capabilities,  and even perform real-time compliance checks, he noted.

“We can ensure that only authorized users have access and can perform specific actions such as reading, editing, or printing,” he says.

Seclore facilitates data protection in a global productivity ecosystem that’s constantly shifting between on-premises, hybrid and cloud architectures. Its ability to integrate seamlessly with existing security tools and policies is a key differentiator, Roybal says.

By partnering with DLP, CASB, and classification vendors, Seclore ensures that organizations can leverage their current investments while enhancing their overall security posture.

“We’re not asking organizations to start from scratch,” he emphasized. “Our solutions integrate with the tools [users] already use, allowing for a more cohesive and effective security framework.”

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.


(LW provides consulting services to the vendors we cover.)

The post RSAC Fireside Chat: Seclore advances ‘EDRM’ by aligning granular controls onto sensitive data first appeared on The Last Watchdog.