Creating Connections: Exciting beginnings.

Was this shared with you? Subscribe here.

Welcome to our first issue of Creating Connections for 2024. This is the 5th calendar year that we are publishing this newsletter. We started the newsletter during the pandemic in 2020 when we were all in lockdown as a way to stay connected knowing many of us were feeling isolated. So much has happened since that first issue. We've returned to a level of "normalcy" - some returning to our offices, attending conferences in person, and even meeting colleagues for networking events face to face. The changes that occurred in the past five years allowed us new ways of connecting, and for that I find myself thankful. I'm taking that gratitude into 2024 where I feel like my remote working life (that I had before the pandemic) is normal, and thanks to the pandemic, I am able to connect on new levels virtually with colleagues, friends, and the world at large.

With the beginning of the year, we are welcoming a new podcast to our network. Just today, the Cybersecurity Marketing Society's weekly podcast, Breaking Through in Cybersecurity Marketing, is joining N2K's CyberWire network. The first episode is now available, with new episodes airing every Wednesday. Listen to the latest episode and subscribe wherever you find your favorite shows, or visit the show page for more information. Cheers and welcome to the women-hosted podcast team that runs the Cybermarketing Society including Gianna Whitver and Maria Velasquez! Here's to another exciting beginning!

We’d love to hear from you. Send us an email with your plans or ideas that you'd like to see in 2024.

N2K Partners with WiCyS for Cyber Talent Study.

By Emily Bradford, Marketing Director, N2K Networks 

This month N2K announced our partnership with WiCyS, a nonprofit organization committed to advancing women in cybersecurity, that will result in a Cyber Talent Study that aims to deepen our understanding of cybersecurity competencies across our industry.

Participants will gain personal insight into skills gaps and opportunities for professional development to close those gaps. By leveraging this data, the study will help identify commonalities in skills, highlight potential gaps in knowledge and abilities, and give us a better understanding of the alignment between member skill sets and the roles they actively occupy. This is an exciting step forward in deepening our understanding of the capabilities of the cybersecurity workforce. Read the full press release here.

AI ups the ante of scam sophistication.

By Maria Varmazis, Host of T-Minus Space Daily, N2K Networks 

It is beyond cliche at this point to declare AI either a technological miracle or menace. Most of us, even those who see its promises and downsides, are really still trying to catch our breath as we understand its true utility. And as much as those of who see it as a potential tool to cut down on drudgery and menial tasks -- I often refer to ChatGPT as my personal marketing intern -- there are of course plenty of people trying to use AI to get the upper hand in the never ending arms race that is cybersecurity.

For a moment there many of us thought we had AI-generated images pretty well figured out: Faces staring straight past you and maybe a few too many fingers. Similar idea for AI-generated videos: Something would seem a bit pasted-on about the face, something striking you as a bit of an uncanny valley in the back of your mind.

But many generative AI tools have quickly outpaced that now-outdated model, and protection measures many systems and organizations have had in place for some time to, for example, mitigate fraud are quickly being brought down. Just this month a Reddit user posted a how-to on using readily-available generative AI video software and plugins to create a convincing fake Know Your Customer (KYC) video. These videos are a verification tool that many corporate HR departments use to check the employment status of new hires to prevent employment fraud, and financial institutions have been using KYC for some years, especially when conducting major transactions or opening new accounts.

So what’s a company or a bank to do if they decide that AI has poisoned the well and they can’t trust most user verification methods anymore? One could imagine that institutions may find trying to keep up with AI-related fraud isn’t worth it and may just require people to show up in person. What’s old could be new again, until AI figures out a way to mess that up too, I suppose.

Note from author: I used zero AI to write this article. Powered by me + a Starbucks matcha latte only! 

We belong: Q&A with Jac Lai: Passionate, hopeful, and loyal.

By Chris Hare, Project Management Specialist, Content Developer, N2K Networks 

Each month, N2K shares our commitment to workplace diversity, equity, inclusion, and belonging by featuring a representative female voice to shine a light on the answers to the tough questions we all need to ask to make sure each and every one of us is seen, heard, and belongs. 

Chris Hare: Can you please introduce yourself, Jac? Tell us a bit about who you are and what your connection is to the topic of diversity, equity, inclusion, and belonging. 

Jac Lai: I am a 38 year-old AuDHDer (Autism + ADHD) woman, with a teaching background. I currently work at a small, not-for-profit in Brisbane, Australia, which focuses on working with and for autistic individuals to change societal outcomes. My connection to diversity and inclusion is to empower and hold space for other autistic individuals, so they may discover their unique strengths and be confident in building a life that enables them to thrive, achieving everything they wish to attain in life.

Chris Hare: What challenges have you faced as an individual with autism, let alone a woman with autism, in the workplace, and how did you overcome them?

Jac Lai: My current workplace is fantastic, and I have been able to thrive as a result of having a supportive employer, but also having the confidence and self-knowledge to know and voice what I need to be supported. Even though I have had supportive workplaces in the past, working as part of the education system presented lots of challenges, which included stricter processes, underfunding, and bullying to name a few.

Chris Hare: How do you handle bullying and exclusive behavior in the workplace? 

Jac Lai: I ignored it for many years, and it made me miserable and self-loathe, trying even harder to fit in and be part of the social norm, through masking. I think I should have followed formal processes and reported it to my Duty Principal. It wasn’t just me. I think there’s a difference between indirect bullying and bullying, so making sure to understand the difference and being cautious of it helps.

Read the rest of Chris and Jac’s discussion.  

CW Message. Example: Would you like to be featured in a future issue of the Creating Connections newsletter? We are currently accepting submissions for pieces written by women, about women, and information on women in cyber related events. Simply reply to this email to get started.

A book recommendation from the Quarterly Analyst Call.

Rick Howard, N2K's CISO, Chief Analyst and Senior Fellow, and his guests Merritt Baer, Field CISO at Lacework, and Caroline Wong, Chief Strategy Officer at Cobalt, held an insightful discussion about the events of the last 90 days of 2023 that materially impact your career, the organizations you’re responsible for, and the daily lives of people all over the world. Here is an excerpt from the meeting. You can find the full event recording here.

Rick Howard: Let's turn to Caroline's topic. She wants to talk about one of the best cybersecurity books of the year. Yeah, there it is. So, tell us about it, Caroline. Why did you like this book so much?

Caroline Wong: I love this book (holding up Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls that Derail Us). And the number one reason is because it's super funny. When was the last time you picked up a 400-page security textbook and, while reading it, you literally laughed out loud? This came out in January 2023 by Addison-Wesley. The other thing I like about it and the other reason it's so darn funny is because it's real talk, there's no BS in this book. This is all deep thinking in plain language. It's talking about very important concepts and there's no ego, there's no elitist "I'm more technical than you" vibe to it. This is really just an honest look at things. And I love that. So, the book is called "Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls that Derail Us." And there are dozens and dozens of myths and misconceptions in this book. I just want to share a handful of my favorites.

Rick Howard: Oh, yeah, let's do it.

Caroline Wong: Macs are safer than PCS. Linux is safer than Windows. Passwords should be changed often. Everything can be fixed with blockchain.

Rick Howard: Oh, yeah.

Caroline Wong: We can solve all of our problems with big data. And there is an entire chapter for cognitive biases, about two dozen of them, action bias, omission bias, survivorship bias. But one of the things that I love most about this book is the last section is all about finding hope.

Rick Howard: What does that mean finding hope? What -- I love the sentiment of it. Okay? What were the authors getting to when they said that?

Caroline Wong: Yeah. So, there are dozens and dozens of myths and misconceptions that are discussed in this book. And, at the end of the book, we've got some meta myths and some meta recommendations. One of those meta myths is that cybersecurity is doomed, because sometimes, working in this industry, this is how it feels. Sometimes it feels really hard and it just feels like we're failing and stuff is getting harder. However, the book makes an excellent point, which is that far too little attention is made to how much progress we've actually made in protecting people and devices. And, so, it talks about there's an opportunity. Instead of focusing on the negative and blaming users for our human faults, why not empower people and why not offer cybersecurity that's actually well suited for helping people? And, so, there is both kind of a sarcastic and a funny bent to this book. But there's also a tremendous amount of hope.

You can revisit our Q4 analyst call with Rick Howard, Merritt Baer and Caroline Wong here. Stay tuned for our next Quarterly Analyst Call on Thursday, March 28th!

CyberWire Daily

In this Threat Vector segment, David Moulton and Palo Alto Networks’ Madeline Sedgwick discuss the skills and methods necessary for understanding threat actor intent and behaviors.

Ann Johnson, host of Microsoft Security’s Afternoon Cyber Tea podcast, goes beyond basics with her guest Tanya Janca, founder of WeHackPurple. 

Rick Howard talks with Lauren Brennan of GuidePoint Security about evaluating and maturing your SOC.

In the Learning Layer segment, host Sam Meisenberg talks with Shelby Ludtke about passing the new ISC2 Certified in Cybersecurity (CC) exam. 

Rick Howard speaks with guests John Goodman & Amanda Satterwhite of Accenture Federal Services about the launch of a public sector Cybersecurity Center of Excellence. 

In our Solution Spotlight, Simone Petrella talks with ISC2 CEO Clar Rosso about putting a dent in the cybersecurity workforce gap. 

In our Solution Spotlight, N2K President Simone Petrella speaks with Michelle Amante of the Partnership for Public Service with an update on the Cybersecurity Talent Initiative. 

Ann Johnson, host of the Afternoon Cyber Tea podcast, speaks with Caitlin Sarian, known to many as Cybersecurity Girl. 

Guests N2K President Simone Petrella and WiCyS Executive Director Lynn Dohm talk about a new partnership for a comprehensive Cyber Talent Study.

Ann Johnson from Afternoon Cyber Tea talks with Deneen DeFiore, Vice President and Chief Information Security Officer at United Airlines, about cybersecurity at 35,000 feet. 

Afternoon Cyber Tea

Tanya Janca, head of Community and Education at Semgrep and the founder of WeHackPurple, joins Ann on this week's episode of Afternoon Cyber Tea. Tanya brings over two decades of coding and IT experience, navigating diverse landscapes from startups to tech giants like Microsoft, Adobe, and Nokia. Tanya is not just a seasoned professional; she's also the acclaimed author of 'Alice and Bob Learn Application Security,’ a groundbreaking book that goes beyond the fundamentals, delving into intricate subjects such as threat modeling and security testing. She is a dynamic force in the cybersecurity community, an award-winning public speaker, and an engaging streamer, sharing her expertise through hundreds of talks and training sessions spanning six continents. Ann and Tanya unravel the layers of Tanya's journey, shedding light on the ever-evolving landscape of application security and beyond.

Caitlin Sarian, known to many as Cybersecurity Girl, joins Ann on this week's episode of Afternoon Cyber Tea. Caitlin is a leading influencer with a cybersecurity-focused social presence, primarily on TikTok and Instagram, where she provides insights on data protection, privacy, and cybersecurity. Caitlin shares her journey into cybersecurity, starting from a background in aerospace mechanical engineering and transitioning to cybersecurity. She emphasizes breaking down complex cybersecurity concepts to make them accessible to a broader audience and the challenges of educating the public about the consequences of online activities. Caitlin offers practical tips for individuals starting their journey in cybersecurity awareness and advises people to take an inventory of their online accounts.

Deneen DeFiore, Vice President and Chief Information Security Officer at United Airlines, joins Ann on this week's episode of Afternoon Cyber Tea. Deneen shares insights into her Aviation Information Sharing and Analysis Center (A-ISAC) chairperson role, focusing on priorities such as building a trusted community, supply chain security, and global collaboration with government entities. Both Ann and Deneen express optimism about the future of cybersecurity, citing advancements in technology, responsible AI implementation, and the growing recognition of cyber risk management. They believe a collective defense and protection strategy and improved relationships between private companies and government sectors will contribute to a safer digital landscape.

Career Notes

Rashmi Bharathan, an Information Technology Internal Auditor from Wintrust Financial Corporation sits down to share her story as a woman with 10 years in the IT industry and how she got her start. From childhood Rashmi always wanted to be a good leader, helping those around her, now she shares how helping people is a passion of hers and spends a lot of her time volunteering to help those coming into this industry. She says "It's all about, you should know your connections. That is more important. So I would say that networking and volunteering is really going to help you to grow in your career," sharing that community is the key to her success and working hard to network has been a great help to her to get her where she is today. We thank Rashmi for sharing her story with us.

Control Loop

Dawn Cappelli, Head of Dragos' OT-Cyber Emergency Readiness Team shares details about the launch of Dragos’s free community initiative to protect small utilities that serve the majority of Americans.

CyberWire Live: Quarterly Analyst Call

Join Rick Howard, N2K's CISO, Chief Analyst and Senior Fellow, and his guests Merritt Baer, Field CISO at Lacework, and Caroline Wong, Chief Strategy Officer at Cobalt, for an insightful discussion about the events of the last 90 days that will materially impact your career, the organizations you’re responsible for, and the daily lives of people all over the world.

Hacking Humans

Alethe Denis from Bishop Fox talks with Dave and Joe with her take on the 23AndMe breach. 

The host of T-Minus, N2Ks very own Maria Varmazis brings her own story and discusses it with Dave and Joe. Maria shares Arctic Wolf Labs' story and how they have investigated several cases of Royal and Akira ransomware victims being targeted in follow-on extortion attacks dating back to October of 2023. 

RH-ISAC Podcast

Jackie Deloplaine, who oversees RH-ISAC’s working groups, discusses some of the hot topics in 2023 and what’s planned for 2024.

In this episode of the Retail & Hospitality ISAC podcast, we kick off the RH-ISAC’s 10th anniversary year with an interview series featuring RH-ISAC President Suzie Squier and the cybersecurity leaders who helped to found the organization in 2014. 

In this episode of the Retail & Hospitality ISAC podcast, we continue the RH-ISAC 10th anniversary interview series with RH-ISAC President Suzie Squier and Michael Daniel, who helped to found the organization back in 2014. 

Special Edition

In this special edition of Solution Spotlight, N2K President, Simone Petrella is talking with ISC2 CEO Clar Rosso about putting a dent in the cybersecurity workforce gap through empowerment, breaking down barriers and expanding DE&I initiatives.

SpyCast

Bonny Lin joins Andrew Hammond to discuss the current state of China and intelligence. Bonny is the Director of the ChinaPower Project at the Center for Strategic and International Studies.

The Microsoft Threat Intel Podcast

Sherrod DeGrippo is joined by Judy Ng, Mark Parsons, and Ned Moran. Together, they delve into the riveting world of Cyberwarcon, exploring the activities of threat actors such as Volt Typhoon from China and Iranian-based adversaries. Sherrod sheds light on Volt Typhoon's strategic targeting of critical infrastructure while the team elaborates on the Iranian actors' reactive and opportunistic approach to current cyber attacks. The episode unfolds with insightful discussions of sophisticated techniques like "living off the land" and the intricacies of information operations while providing a deep dive into the evolving landscape of cyber threats and intelligence.

Sherrod DeGrippo is joined by Jeremy Dallman, Kimberly Ortiz, and Steve Ginty. Sherrod emphasizes the importance of understanding vulnerabilities before they're exploited in the wild and discusses the process of responding to security vulnerabilities, including identifying threat actors and the urgency of patch deployment, especially for vulnerabilities targeted by ransomware groups. The conversation also focuses on Security Copilot, a tool built on Microsoft's extensive threat intelligence, designed to make SOC analysts' work more accessible by providing immediate, relevant information on threats. This episode offers an insider's view on how these professionals track internal incident responses, share crucial intelligence with customers, and continuously evolve their processes to ensure swift, accurate delivery of threat intelligence.

Threat Vector

In this episode of Threat Vector, David Mouton has an engaging conversation with Madeline Sedgwick about the skills and methods necessary for understanding threat actor intent and behaviors. Madeline, a senior cyber research engineer and threat analyst, shared insights into how analyzing adversary behavior helps in anticipating threats and avoiding guesswork. We discussed the value of understanding both system dynamics and human behavior in cybersecurity, emphasizing that cyber adversaries are limited by the same laws of internet physics. Stay tuned to gain valuable insights into the evolving threat hunting and deterrence landscape.

N2K Cyber & IT practice tests $39 deal ends 1/31.

Is a new certification on your list for 2024 goals? Start studying with confidence with N2K practice tests. Choose from our vast exam prep library that includes top vendors like AWS, CompTIA, Microsoft, and more. Hurry - this deal ends tonight, 1/31/2024 at 11:59 pm EST. Visit n2k.com/certify to find your cert.