Minimum Viable Security w/ Chris Roberts & Cecil Pineda: EXPLICIT CONTENT

Allan hosts a live podcast at the August, 2021 CISO XC event in the Dallas-Forth Worth area. He is joined by Chris Roberts, chief geek at Hillbilly Hit Squad, and Cecil Pineda, then head of the vICSO and GRC programs at Critical Start. The topic is Minimum Viable security, tactical frameworks, the challenges with large frameworks, and the challenges of competing frameworks. This show was recorded after happy hour and the audience and participants both imbibed.  It's a rowdy show and features some explicit content.   Key Takeaways: 0:00 Allan’s holiday greeting 0:39 Allan introduces the live show, guests and issues a disclaimer about naughty language 2:02 Chris Roberts on Minimum Viable Security 2:42 Cecil on his love/hate relationship with compliance and the need for weighting controls 4:25 Allan proposes “tactical frameworks” 5:38 Chris challenges the crowd on their asset management successes 7:43 Allan introduces “See it, manage it, secure it.” (Which he flagrantly stole from Steve Williams @ NTT DATA Services) 8:53 Cecil says: data discovery comes before DLP 10:17 Chris challenges Allan’s idea that MFA should “just happen” in order to capture at least 90% of ransomware threats 12:07 Cecil proposes a compromise – 30% of controls meet a higher CMMI requirement than the 70% 13:48 Chris says even the 30% are not even being met in most environments 14:56 Allan’s full proposal on a tactical framework (that includes Chris’ emphasis on asset management) 16:07 Chris states that we have to agree on the subset frameworks in order to achieve success.  Diverse frameworks actually harm the industry. 17:56 Chris challenges the crowd to hire interns and those new to the industry 20:02 Allan misattributes the total control count in NIST CSF.  We mentioned whiskey, right? 21:35 Barring regulated environments, Allan doubles down on his tactical framework idea 22:13 Chris says we must challenge the authors of all these frameworks 22:50 Allan points out that frameworks are implicitly behind the fast pace of the industry after going through committee 23:53 Chris criticizes the notion that compliance = security 24:57 Insurance carriers insist now upon framework compliance and are getting smarter 26:53 Chris says full compliance with a framework even still is useful only as a point in time exercise 28:22 We have to simplify compliance 28:59 Allan proposes SBOM, CMMC-like maturity awareness, and the shared responsibility model as the solution to the compliance problem 30:57 Chris says that will take ten years to sort out 31:49 Chris says “take the money out of compliance” 35:37 Cecil talks about self-attestation and standards that are needed on auditing processes  36:41 Allan says frameworks exist in the first place with the goal of getting secure 37:14 Chris disagrees and states (using naughty metaphors) that frameworks compete out of hubris 38:26 An audience member suggests “trust but verify” as the reason frameworks exist in the first place 41:24 Cecil deconstructs the practicality of shared responsibility, extending it into the business 43:28 Chris proposes working with insurance companies to create a consolidated or tactical framework   Links: Chris Roberts - LinkedIn Cecil Pineda - LinkedIn Follow Allan Alford on LinkedIn and Twitter Purchase a Cyber Ranch Podcast T-Shirt at the Hacker Valley Store Learn more about Hacker Valley Studio and The Cyber Ranch Podcast   Sponsored by our good friends at AttackIQ