Fix Security Problems with What You've Got

Defense in Depth

All links and images for this episode can be found on CISO Series (https://cisoseries.com/defense-in-depth-fix-security-problems-with-what-youve-got/)

Stop buying security products. You probably have enough. You're just not using them to their full potential. Dig into what you've got and build your security program.

Check out this post for the basis for our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Allan Alford (@allanalfordintx), and guest Brent Williams (@brentawilliams), CISO, SurveyMonkey.

Thanks to this week's podcast sponsor, Deep Instinct.

Deep Instinct is changing cybersecurity by harnessing the power of Deep Learning to prevent threats in zero time. Deep Instinct’s on-device, solution protects against zero-day, APT, ransomware attacks, and against both known and unknown malware with unmatched accuracy and speed. Find out more about the solution’s wide covering platform play.

On this episode of Defense in Depth, you’ll learn:

• It's very possible you're not using the tools you've purchased to their full potential. What would happen if you completely stopped buying security products and tried to fix your problems with the tools you've already purchased?
• The reason this is such a popular discussion is that as an industry we're still struggling with managing the fundamentals of security.
• Shelfware happens because we buy before we're ready. Purchase decisions should be made in conjunction with knowing if you have the staff and understand the integration points to implement the solution.
• Tooling for the few layers must be dealt with first. You don't need a solution selling a higher layer of security if you don't have the foundation built.
• Much of this argument is based on the messaging we hear from vendors. They're understandably in the business of selling product. Be cognizant of how you're absorbing information.
• We need to also focus on the people who unfortunately are fallible and can make non-malicious, but poor decisions.
• If there was going to be any additional spending, the argument was to invest in your people - from the entire staff to specific training for your security staff.