Start / Defense in Depth / Trusting security vendor claims

Trusting Security Vendor Claims

28 min • 13 augusti 2020

All links and images for this episode can be found on CISO Series (https://cisoseries.com/defense-in-depth-trusting-security-vendor-claims/)

Do security vendors deliver on their claims and heck, are they even explaining what they do clearly so CISOs actually know what they're buying?

Check out this post and the Valimail survey for the basis of our conversation on this week’s episode which features me, David Spark (@dspark), producer of CISO Series, co-host Allan Alford (@allanalfordintx), and guest Lee Parrish (@LeeParrish), CISO, Hertz.

Thanks to this week's podcast sponsor, AttackIQ.

AttackIQ, the leading independent vendor of breach and attack simulation solutions, built the industry’s first Security Optimization Platform for continuous security control validation and improving security program effectiveness and efficiency. AttackIQ is trusted by leading organizations worldwide to plan security improvements and verify that cyberdefenses work as expected, aligned with the MITRE ATT&CK framework.

On this episode of Defense in Depth, you’ll learn:

From those surveyed by Valimail survey, a third to a half didn't believe that vendors did a good job explaining what their product does, or that the product actually performed, or there was any way to actually measure that performance.
Many questioned those numbers because they feel many security buyers still fall for security vendors' boastful claims. Both can actually be true.
Stunned behavior at a trade show is not the indicator of knowledge and susceptibility to vendor pitches.
When you're under the gun as a security professional to produce results you often become victim to security vendor claims because you want to deliver on demands from the business.
By nature, CISOs should be skeptical about vendor claims and information within their own environment.
There's a battle between those vendors truly trying to deliver value and those who are using their marketing savvy to sway industry thinking.
Don't place all the blame on the vendors. CISOs still have trouble understanding their requirements, risk, and priorities. Many are guilty of engaging in "random acts of security".
Claims can often be more trustworthy if the vendor is willing to explain what they can't do.

Senaste avsnitt

Trusting Security Vendor Claims

Senaste avsnitt

How Can AI Provide Useful Guidance from Fragmented Security Data?

Why Salespeople's Knowledge of Cybersecurity Is Critical for the Ecosystem

What Are the Cybersecurity Trends We Need To Follow?

Is It Even Possible to Fast-Track Your Way Into Cybersecurity?

What's the Most Efficient Way to Rate Third Party Vendors?

Don't Ask "Can" We Secure It, But "How" Can We Secure It

Has the Shared Security Model for SaaS Shifted?

Improving the Efficiency of Your Threat Intelligence

Why Cybersecurity Professionals Lie on Their Resumes

What Should Be in a CISO Job Description?

The CISO's Job Is Impossible

Can You Have a Secure Software Environment Without Traditional Vulnerability Management?

How Much Should Salespeople Know About Their Product?

Why Are We Still Struggling to Fix Application Security?

What Can Someone with No Experience Do in Cybersecurity?

Are New Gartner-Created Categories/Acronyms Helping or Hurting the Cybersecurity Industry?

Can AI improve Third-Party Risk Management (TPRM)

Cybersecurity Is NOT an Entry-Level Position

Hey Vendors, What Problem Is Your Product Solving?

We've Been Fooled. There Is No Talent Shortage.

Is There an Increasing Consolidation of Vendors in the SOC?

Are CISOs Struggling to Get Respect?

Is Platformization Vs Best-of-Breed a False Dichotomy?

Protecting Your Backups from Ransomware

Can a Security Program Ever Reach Maintenance Mode?

The Hardest Problems in Security Aren't "Security Problems"

If and When Should a CISO Have a Long Term Security Plan?

Do We Want CISOs Dictating How Salespeople Should Engage?

Is AI Benefiting Attackers or Defenders?

CISOs DO Own the Risk

How Can We Fix Alert Fatigue?

Vulnerability Management ≠ Vulnerability Discovery

Are Security Awareness Training Platforms Effective?

The Argument For More Cybersecurity Startups

How Are New SEC Rules Impacting CISOs?

Managing the Risk of GenAI Tools

Defending Against What Criminals Know About You

Will We Ever Go Back From Work From Home?

The Lurking Dangers of Neglected Security Tools

When You Just Can't Take It Anymore in Cyber

Is It Possible to Inject Integrity Into AI?

Are Phishing Tests Helping or Hurting Our Security Program?

​​Who Is Responsible for Securing SaaS Tools?

Hiring Cyber Teenagers with Criminal Records

What's Working With Third-Party Risk Management?

What Triggers a CISO?

Information Security vs. Cybersecurity

Should Deny By Default Be the Cornerstone of Zero Trust?

What Is a Field CISO?

Cybersecurity Is a Communications Problem

Do Companies Undergoing a Merger or Acquisition Get Targeted for Attacks?

Telling Stories with Security Metrics

Securing Identities in the Cloud

How AI Is Making Data Security Possible

What Makes a Successful CISO?

We Want a Solution to Remediate, Not Just Detect Problems

Recruiting from the Help Desk

How Do We Build a Security Program to Thwart Deepfakes?

Where Are Secure Web Gateways Falling Short?

Understanding the Zero-Trust Landscape

Scaling Least Privilege for the Cloud

Should CISOs Be More Empathetic Towards Salespeople?

Managing Data Leaks Outside Your Perimeter

What Are the Risks of Being a CISO?

Onboarding Security Professionals

How to Improve Your Relationship With Your Boss

Improving the Responsiveness of Your SOC

The Demand for Affordable Blue Team Training

Why are CISOs Excluded from Executive Leadership?

What Is Your SOC's Single Search of Truth?

When Is Data an Asset and When Is It a Liability?

Tracking Anomalous Behaviors of Legitimate Identities

Why Do Cybersecurity Startups Fail?

Is "Compliance Doesn't Equal Security" a Pointless Argument?

CISOs Responsibilities Before and After an M&A

Use Red Teaming To Build, Not Validate, Your Security Program

The Do's and Don'ts of Approaching CISOs

Doing Third Party Risk Management Right

Who Is Responsible for Securing SaaS Tools?