Access Control
Teleport
All episodes
Best episodes
Top 10 Access Control Episodes
Goodpods has curated a list of the 10 best Access Control episodes, ranked by the number of listens and likes each episode have garnered from our listeners. If you are listening to Access Control for the first time, there's no better place to start than with one of these standout episodes. If you are a fan of the show, vote for your favorite Access Control episode by adding your comments to the episode page.
How a BISO can help accelerate Fintech innovation
Access Control
04/29/22 • 41 min
Overview of Podcast
For this 15th episode of Access Control Podcast, a podcast providing practical security advice for startups, Developer Relations Engineer at Teleport Ben Arent chats with Alyssa Miller. Alyssa is a seasoned hacker and highly experienced security executive. Alyssa began her career programming for a Wisconsin-based provider of financial software and services. Later moving into a leadership role within the ethical hacking team, conducting pen tests and app assessments. This was followed by working in consulting, which provided a unique perspective on the challenges of the security industry, and then working across multiple organizations and high-level executives to address security at a strategic level.
This brings us to today, where Alyssa directs security strategy for S&P Global Ratings as a Business Information Security Officer (BISO). S&P Global is a 162-year-old finance services company, with over 50k employees. Today we’ll dive into how Fintech companies can learn the best practices and navigate the regulatory landscape, and how to embed these security practices to truly shift left and empower developers.
Key topics on Access Control Podcast: Episode 15 - How a BISO Can Help Accelerate Fintech Innovation
- BISO is a fairly young role within cybersecurity that gets structured differently across organizations. A BISO's primary goal is to provide a bridge between the cybersecurity function of the organization and the individual business lines.
- S&P Global Ratings, part of S&P Global, is focused on credit ratings for organizations and sovereign nations.
- When looking to adopt new technologies, you have to consider what this means in terms of the regulatory environment.
- If you're starting up a fintech, you're going to be working with regulatory bodies. Regulators can help you understand what the right ways are to be compliant with specific regulations.
- The best thing you can do with a regulator is give them reason to trust you, by showing them that you're thinking about the things that you should be thinking about, and by doing the right things.
- Compliance can be broader than regulation. Regulators such as SEC, FCA and ESMA vary based on the environment that they're in. The key is to work with them proactively.
- Getting software to production involves what can be described as a three-headed monster of responsibility: software has to be delivered efficiently, has to be stable and has to be secure.
When should a startup hire a CSO?
Access Control
04/16/21 • 43 min
Key Topics on Access Control Podcast: Episode 1 – A Security Chat with Donnie Hasseltine
- Skilled cyber practitioners are in high demand, and transitioning to the cybersecurity industry is not a difficult transition for those already practicing cybersecurity in the military.
- Xenon is a tech private equity team that buys and operates B2B SaaS companies, with a focus on distressed assets.
- Acquired startups tend to have a general lack of knowledge of basic security hygiene and where the risks lie in the company.
- There is no such thing as a normal day for a CSO.
- Companies that can't yet afford a CSO should at least put one person in charge of security.
- TeamPassword is a password manager, and password management is a critical tool for not just business but also for individuals.
- It's important to consider what leads to hacks, such as the recent SolarWinds hack.
- Addressing computer security vulnerabilities requires addressing the human aspect of security since it may be the source of vulnerabilities.
This podcast is produced and sponsored by Teleport.
When should a startup call the FBI
Access Control
09/28/21 • 30 min
Key topics on Access Control Podcast: Episode 11 - When a Startup Should Call the FBI
- The FBI is the national law enforcement agency, and post-9/11, also the domestic security agency.
- National security cyber matters comprise matters related to foreign states, foreign terrorist organizations, as well as domestic terrorism.
- The COVID 19 pandemic has really accelerated cybercrime.
- With the growth of ransomware as a service and the money mule network, even low-skill actors today are getting into the ransomware game.
- You should have an incident response plan that you can put into action if you fall victim to a ransomware attack.
- Business Email Compromise (BEC) occurs when someone sends you an email or text eliciting you to take some action and asks you to wire money.
- With regard to intellectual property, you have to do your due diligence as an organization to protect your information.
- To report an issue, ic3.gov is cyber-focused while tips.fbi.gov is for all tips that the FBI get.
- As long as you're aware of what your exposure is, can weigh the risks, and have taken sufficient mitigation strategies for these risks, that's all you can do at the end of the day.
Multi-Layered Security
Access Control
03/23/23 • 32 min
Key topics on Access Control Podcast: Episode 18 - Multi-Layered Trust
- Sendbird provides APIs and services for chat and products to integrate into applications.
- As Sendbird is B2B, B2B2B, and B2B2C, its customers use Sendbird to build chat applications that their own customers use, resulting in a lot of data that enters Sendbird's system and that needs to be secured.
- Compliance and security go hand in hand. You determine how compliance requirements fit your business and use them as a baseline to improve your company's security posture.
- Two guidelines for access control are a multi-layered design (where more than one thing should go wrong for something bad to happen within the company) and keeping things as simple as possible.
- A sound access control philosophy ensures that people in the company have access to what they need to do their jobs.
- Security is always should be a balance between usability and providing security.
Access at Scale
Access Control
12/21/22 • 35 min
With Joseph Conti, Systems Engineer and Linux enthusiast with 15+ years of financial industry engineering experience, and Chris Spann from Jump Trading Group.
Watch a video version of this panel on Jan 26th https://goteleport.com/teleport-connect-virtual-2022/
Securing the Open-source Future
Access Control
01/12/24 • 58 min
Throughout this episode, Filippo offers a comprehensive view of his professional journey in the field, from his initial intrigue with cryptographic algorithms during his high school years to his pivotal role in the Go Team at Google. Key discussion points include:
- Key milestones in web cryptography include HTTPS, WebPKI, and the impact of messaging protocols like Signal and WhatsApp on end-to-end encryption.
- Looking to the future, Filippo discusses the importance of transparency mechanisms in cryptography and highlights the need for accountability.
- Filippo advises against rolling one's own crypto but encourages collaboration and learning with experienced individuals to build a feedback loop for secure implementations.
- Filippo shares his thoughts on the current state of Certificate Authorities (CAs).
- Filippo explains the accountability established by transparency in open source and compares it to closed-source software.
- Security patching is addressed, highlighting the need for a balance between stability and urgency when applying patches.
- Filippo explains the potential threats posed by quantum computers and the ongoing efforts to implement post-quantum key exchanges in protocols like SSH and TLS.
- Cryptographic concerns in cloud computing are discussed, focusing on the importance of trust in cloud platforms while acknowledging the shared responsibility model.
- In a practical piece of advice for improving security, Filippo recommends being deliberate in trimming dependency trees to reduce vulnerabilities.
SRE Powered Dev Productivity
Access Control
09/07/21 • 55 min
Key topics on Access Control Podcast: Episode 9 - SRE-Powered Dev Productivity
- The DevOps movement is about how we can all work together to build a better pipeline for building, running, and shipping software and give our customers a better experience.
- In the financial world, security is probably number one, followed by latency, and then resiliency/reliability.
- It's important to determine what aspects one gets by default from their cloud platform and what the blind spots are.
- Security in the context of Kubernetes has become an important issue.
- Teleport is a Certificate Authority and an Access Plane for your infrastructure.
- By working closely with developers, SRE teams can make sure that developers are getting what they expect.
- By giving service ownership, service empowerment, and confidence to developers, SRE teams can enable them to manage their own applications.
Hacker-Powered Security
Access Control
08/13/21 • 37 min
If anyone ever wants to ask Ben any questions about bug hunting, bug bounty programs, you're always welcome to reach out to be Ben at @NahamSec, https://nahamsec.com/ and on his Discord
Key topics on Access Control Podcast: Episode 7 - Hacker-Powered Security
- Bug bounty programs and vuln disclosure programs are similar, except the first pays and the second doesn't.
- The scope of bounty programs usually encompasses a company's main application where the production sites are happening. What is out of scope is mostly third parties.
- Rules of engagement depend on the bug bounty program and the company.
- Some programs pay for credential stuffing, but not for phishing since companies don't want you to phish their employees and customers.
- How much hackers are paid in a bug bounty program is entirely up to the company and depends on its budget.
- Determining the bug severity level depends on a combination of the vuln type and how critical it is and the asset itself.
- Hackers care more about how fast they get paid than about how quickly the company fixes the issue.
- A bug bounty program doesn't make you a bigger target.
- Building a public bug bounty program depends on the product and size of the company.
- Improve Input validation to reduce bugs created
Security as a Service
Access Control
05/13/24 • 41 min
Access Control Podcast: Episode 22 - Security as a Service Rob Picard, CEO of Observa
- Outsourcing security to a provider like Observa can be beneficial for early-stage companies that don't have the budget or need for a full-time in-house security team. It allows the company to focus on their core business while getting the security expertise they need.
- When starting an engagement, Observa focuses on three key things: addressing urgent goals (like getting SOC 2 certification), creating a plan for the longer-term security program maturity, and managing the ongoing operational work.
- Common security mistakes Observa sees include companies making decisions based on fear, uncertainty, and doubt rather than facts; agreeing to overly restrictive security requirements from customers; and having a cynical "everything is a dumpster fire" attitude rather than a pragmatic approach to security.
- SOC 2 is an important compliance framework, but its primary purpose is to provide a way for companies to make statements about their security practices and have them audited, not necessarily to improve security itself. However, going through the SOC 2 process can lead to security improvements.
- When educating auditors, it's important to help them understand how new technologies and architectures (like containerization, passwordless authentication, etc.) change the risk profile compared to traditional IT environments.
- The security team's role should be to enable the business to make informed risk decisions, not just to say "no" to everything. Security should be a partner, not a gatekeeper, and the team should avoid glorifying a "no" culture.
- Outsourcing certain security functions like pen testing, managed detection and response, and incident response can be beneficial for early-stage companies that don't need or can't afford a full in-house security team.
Show more best episodes
Show more best episodes
FAQ
How many episodes does Access Control have?
Access Control currently has 25 episodes available.
What topics does Access Control cover?
The podcast is about Infrastructure, Cloud, Security, Entrepreneurship, Devops, Podcasts, Technology and Business.
What is the most popular episode on Access Control?
The episode title 'Securing the Open-source Future' is the most popular.
What is the average episode length on Access Control?
The average episode length on Access Control is 42 minutes.
How often are episodes of Access Control released?
Episodes of Access Control are typically released every 31 days, 22 hours.
When was the first episode of Access Control?
The first episode of Access Control was released on Apr 16, 2021.
Show more FAQ
Show more FAQ