Building security natively

05/21/22 • 46 min

Originally recorded in September of 2021...today’s guest is Justin Berman, the Vice President of Infrastructure and IT and the CISO at Thirty Madison. Thirty Madison is aiming to be a platform that everyone can use to deal with their chronic healthcare needs. Justin’s main focus is on building out the teams that enable scaling. With his development background, Justin has some unique ideas when it comes to cloud security, which makes for a fascinating interview. You’ll walk away from this episode with a new perspective on how to build security into products from the start and a better understanding of how to transition smoothly from on-prem to the cloud.
Tweetables
“I see security as an engineering problem. What I mean by that is not that there aren't things that you solve with process, or with policy, or training, but rather that in as many places as possible if you want to have a scaled effect within security, you need to write code to solve a problem.” — @justinmberman [0:06:03]
Justin Berman on LinkedIn

Phoenix Project

Simon Sinek

The future of cloud security.
Simplify cloud security with Prisma Cloud, the Code to Cloud platform powered by Precision AI.
Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Send us a text

Phoenix Project

Simon Sinek

Previous Episode

What Is Threat Intelligence?

Send us a text

In this episode (originally recorded in November of 2021) we speak with Palo Alto Networks, VP of Threat Intel, Ryan Olson. Ryan helps define what threat intelligence actually is and how to get started building a program. He aptly reminds us that producing threat intel for the sake of threat intel is a waste of time. More importantly you first have to ask yourself, “Who’s going to be using this information?”.

Tweetables

“Producing threat intel for the sake of threat intel is a waste of time. What you should be doing is thinking ‘Who’s going to take the information that I have produced and use that to make a better decision?’ Because that's the goal of threat intelligence, to help a system, or a person, or a team, or a company make better decisions that will help secure them better.” — Ryan Olson [0:04:24]

“If I could give people one recommendation, if you can get access to your SSL traffic so that you can decrypt it and you can inspect it, you will have a much better chance at detecting bad stuff in your network than you would without it.” — Ryan Olson [0:29:58]

Links Mentioned in Today’s Episode:

Ryan Olson on LinkedIn

Unit 42

Unit 42 on Twitter

Unit 42 Palo Alto Networks Careers

Next Episode

MITRE + Cloud

Send us a text

As the world of cloud security continues to progress at high speed, new challenges and threats arise and morph on a constant basis. The MITRE Corporation is a body tasked by the US government with solving some of the largest threats in cybersecurity and beyond, and we are very lucky to welcome Tracy Bannon to the podcast today, who is the Senior Principal and Software Architect & DevOps Advisor at MITRE. Tracy opens up about her career journey leading up to her current position, what drew her into the work at MITRE, and how the simplicity of the solutions-focused mission has embedded her loyalty and passion within the organization. The conversation also goes some way into exploring the potential and limitations of zero trust, and what it actually means to make progress towards safer environments. Along the way, our guest makes some interesting and quite unique arguments for why words matter, and why change is healthier through a philosophy centered on building. So to catch it all in this fascinating conversation, make sure to join us on Cloud Security Today!

Key Points From This Episode:

Tracy unpacks a brief history of FFRDCs and their role as objective technology advisors.
The two main areas of Tracy's work at MITRE; digital transformation of software factories, and data centricity in data environments.
Understanding MITRE's practical application and validation of the principles of zero trust theory.
Weighing the validity of the negative reputation that developers have when it comes to security.
Issues with the terms DevOps, DevSecOps, and SecDevOps, and the overloading and rushing that often happens on security teams.
Why Tracy prioritizes 'culture building' over 'culture change' when thinking about progress.
Leading teams, modeling behaviors, and realistic expectations for human error.
Tools and safety nets in the cloud-native approach; Tracy's perspective on how much value to assign to these.
Why the mission at MITRE initially piqued, and subsequently retained, Tracy's interest!

Tweetables:

“It’s not a recipe. It's not five things you have to do. It's understanding the principles and then applying them, being able to audit them, and validate consistently that they're happening. MITRE does both sides of that.” — @TracyBannon [0:07:44]

“Our job is not to land and expand. It’s impact. At all costs, it's to make impact. If it's one person, or a half of that person, it's really defined by the ability to keep the US safe.” — @TracyBannon [0:09:39]

Links Mentioned in Today’s Episode:

Tracy Bannon on LinkedIn

Tracy Bannon on Twitter

MITRE Corporation

Revelation

The Kill Chain

Zero Trust Security

The Software Architect Elevator

Cloud Security Today - Building security natively

Transcript

**NOTE: Generated via ML. Expect crazy stuff to be translated by an imperfect algorithm that may have never actually been said by the host or guest :-) ***
[00:00:25] MC: Amazingly, this is our 15th episode. When I started the podcast well over a year ago, I didn't know how long I would do this for. I can tell you that if you've ever thought about starting your own podcast, I would really encourage you to just do it. I knew nothing at all about podcasting. To be ho