Kitecast
Tim Freestone and Patrick Spencer
All episodes
Best episodes
Seasons
Top 10 Kitecast Episodes
Goodpods has curated a list of the 10 best Kitecast episodes, ranked by the number of listens and likes each episode have garnered from our listeners. If you are listening to Kitecast for the first time, there's no better place to start than with one of these standout episodes. If you are a fan of the show, vote for your favorite Kitecast episode by adding your comments to the episode page.
06/27/24 • 47 min
The Kiteworks Sensitive Content Communications Privacy and Compliance Report is an annual survey designed to delve into the pressing issues of data privacy, compliance, and cybersecurity. This comprehensive report gathers insights from IT, cybersecurity, risk, and compliance leaders around the globe, with the latest survey capturing responses from 572 leaders across 10 different countries. The report is meticulously divided into five sections: cyberattacks and data breaches, data types and classification, compliance and risk, cybersecurity and risk management, and operational procedures. These insights provide organizations with actionable intelligence to navigate the complex landscape of data security and compliance.
This Kitecast episode features a panel discussion, with Kitecast Co-host Patrick Spencer addressing key findings in the report and soliciting feedback from Co-host Tim Freestone and two guest panelists, Alexandre Blanc and Ranbir Bhutani. Alexandre pointed out that while the frequency of cyber incidents has decreased, the scale of each incident has grown significantly. Threat actors have become more organized, targeting larger organizations with higher impact, particularly in specific verticals like healthcare and finance. This shift is likely influenced by geopolitical tensions, using cyberattacks to disrupt trust in systems and organizations. Ranbir echoed these observations, adding that the sophistication of phishing attacks has increased, often leveraging unethical AI to create highly convincing fraudulent communications.
The conversation also explored the persistent challenge of human error in cybersecurity. Despite numerous training initiatives and advanced technologies, the human element remains a significant vulnerability. Tim, Alexandre, and Ranbir emphasized that until organizations can effectively abstract human errors from business processes, this will continue to be a weak link. Ranbir shared an anecdote about a near-miss phishing attempt, underscoring the difficulty even seasoned professionals face in recognizing sophisticated attacks.
Another critical insight from the discussion involved the disparity in cybersecurity maturity across industries. The podcast revealed that higher education and state government sectors are particularly vulnerable, with a high number of reported breaches. This is attributed to underfunding and a lack of stringent cybersecurity measures. In contrast, the federal government has shown better compliance due to regulatory pressures like CMMC 2.0. The panelists agreed that while regulations are a step in the right direction, the enforcement and practical implementation of these regulations remain a challenge, particularly for smaller organizations.
Finally, the podcast touched on the issue of litigation costs associated with data breaches. The long-term financial impact of breaches extends beyond immediate operational disruptions and ransom payments. Ongoing litigation can drain resources and affect an organization’s reputation and client trust.
Kiteworks 2024 Sensitive Content Communications Privacy and Compliance Report: https://www.kiteworks.com/sensitive-content-communications-report/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
10/09/23 • 50 min
This Kitecast episode features Jason Rebholz who has an extensive background in cybersecurity. He is currently the CISO at Corvus Insurance, which he joined in 2021. He also serves as an advisor for NetDiligence and MOXFIVE. Previously, Jason served as the VP of Strategic Partnerships for ICEBRG, which was acquired by Gigamon, VP of Professional Services for The Crypsis Group, and Manager at Mandiant.
Jason founded the educational initiative, “Teach Me Cyber,” that is available on YouTube and LinkedIn with the objective of making cybersecurity topics more accessible to general audiences. This was motivated by often seeing technical news coverage using jargon and screenshots that average readers would struggle to comprehend. Through short daily lessons on platforms LinkedIn and YouTube, Jason breaks down cybersecurity topics in simple terms anyone can understand. His goal is to help even one more person gain practical knowledge to improve their organization’s security.
In the podcast interview, Jason discussed a recent high-profile ransomware attack and provided insight into the challenges of containing and remediating active attacks, noting that it is very difficult to fully kick attackers out of an environment within a short time frame. Jason emphasized the importance of having strong monitoring and rapid response capabilities in place.
Multi-factor authentication (MFA) was another topic Jason covered. He highlighted that while MFA is crucial, organizations must be thoughtful about which types they enable, as weaker forms can still be bypassed. He advocated for the adoption of the most secure MFA options available to get the full risk reduction benefit using zero-trust principles.
Managing third-party cyber risk was also discussed. Jason argued that current third-party assessments often provide a false sense of security. He recommended assuming vendors have poor security and mitigating the impact via actions like limiting data sharing, controlling where sensitive data goes, and ensuring you can revoke access.
LinkedIn: www.linkedin.com/in/jrebholz
YouTube: www.youtube.com/@teachmecyber
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
09/22/23 • 40 min
This Kitecast episode features an interview with Chris Rose, a Partner at Ariento, a leading cybersecurity, IT, and compliance service provider. He has extensive experience in cybersecurity, having previously served as an instructor at UCLA where he taught cybersecurity and privacy courses. Chris holds an MBA and a master’s in computer science from UCLA, as well as a bachelor’s degree from Cal Poly.
During the podcast interview, Chris provides an overview of the Cybersecurity Maturity Model Certification (CMMC) framework and its origins within the defense industry. He explains that CMMC builds upon existing NIST 800-171 requirements for protecting controlled unclassified information that contractors already must comply with. However, CMMC adds a critical component—independent third-party assessments done by C3PAOs (Certified Third-party Assessment Organizations).
Chris believes CMMC will likely gain final approval in early 2024 based on the rulemaking process. He notes that reciprocity with frameworks like FedRAMP could help ease the compliance burden for contractors. For companies using cloud services, Chris strongly advises leveraging solutions that have achieved FedRAMP Moderate Authorization or above.
When asked about readiness across the Defense Industrial Base (DIB), Chris indicates that primes are pushing their subcontractors to get prepared. However, smaller companies are still in a wait-and-see mode in some cases, trying to weigh the costs versus risks. He emphasizes that companies should focus first on proper scoping of assets and information that will be in scope for CMMC assessments.
Chris also provides tips for selecting a C3PAO, noting that risk mitigation and technical competence are top evaluation criteria for most mid-market and enterprise clients. He also discusses Ariento’s experience with adjacent standards like FedRAMP, ISO, and ITAR that provide relevant expertise for CMMC advisory services.
LinkedIn: www.linkedin.com/in/cmmc
Ariento: www.ariento.com
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
07/17/23 • 44 min
Dr. Rebecca Wynn is the Global Chief Security Strategist and CISO at Click Solutions Group and Podcast Host for Soulful CXO and Threat Watch. In this Kitecast episode, Dr. Wynn discusses professional motivation, the importance of mentorship, and her unique approach to cybersecurity based on her diverse experience, including time in the U.S. military.
Dr. Wynn underscores the crucial role of mentors in professional development. She emphasizes that finding the right mentor depends on individual needs and suggests having multiple mentors for different aspects of one’s career. She differentiates mentors from sponsors within an organization where one works. A sponsor actively opens new opportunities for you and typically initially starts as a mentor. A sponsor is someone within your organization, whereas a mentor may or may not be a member of your same organization. When it comes to selecting mentors, Dr. Wynn states they should be individuals whose values resonate with those of the mentees.
For women in the cybersecurity field, Dr. Wynn encourages them to apply for positions, even if they have doubts about meeting all qualifications. She emphasizes that she personally ensures that all female applicants are reviewed, despite what HR algorithms might suggest. Dr. Wynn believes in conducting one-on-one discussions to identify the best position for the applicant, highlighting a recent success story where she helped an underselling candidate secure a managerial role in GRC (governance, risk, and compliance).
Throughout the podcast, Dr. Wynn shares her personal experiences, including her time caring for her elderly parents, which made her reflect on her core values and approach to work. She stresses the importance of maintaining authenticity and staying true to oneself. She also speaks about how her military background influenced her approach to cybersecurity, particularly her emphasis on GRC frameworks. According to Dr. Wynn, these frameworks allow for the fast mitigation, detection, and resolution of attacks.
When it comes to data privacy, Dr. Wynn champions the concept of Privacy by Design, which advocates for privacy measures to be built into products and systems from their inception, rather than added on afterwards. She emphasizes the idea of data having an expiration date, arguing that companies should not be allowed to keep personal data indefinitely without explicit consent. She suggests that tagging data upon creation with an expiration date could serve as a practical solution. This aligns closely with Kiteworks’ approach using digital rights management in concert with advanced security and compliance.
LinkedIn Profile: https://www.linkedin.com/in/rebeccawynncissp/
The Soulful CXO Podcast: https://soulfulcxo.com/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
04/15/25 • 51 min
In this insightful episode, cybersecurity experts Mike Crandall and Arun DeSouza join host Patrick Spencer to analyze Kiteworks' Top 11 Data Breaches in 2024 Report. Rather than just focusing on the number of records breached, the report introduces a sophisticated algorithm with seven key factors to score breaches on a scale of 1-10. This method provides a more comprehensive understanding of breach severity by evaluating financial impact, data sensitivity, regulatory compliance implications, ransomware involvement, supply chain impact, and attack vector sophistication. National Public Data topped the list with a score of 8.93, followed by Change Healthcare and Ticketmaster, both scoring 8.7.
A significant finding discussed by the experts is the shift in industry targeting patterns, with financial services overtaking healthcare as the most breached sector. The conversation emphasizes how credential theft continues to plague organizations despite sophisticated controls. Five of the top 11 breaches resulted from credential compromises, including attacks that bypassed multifactor authentication. Arun highlights that despite years of security awareness training, approximately 25% of incidents remain attributable to human error. He warns of the growing sophistication of social engineering with AI-generated phishing that will soon include voice modulation and deepfakes, making attacks increasingly difficult to detect. Mike recommends leveraging AI defensively to detect anomalous behaviors that humans might miss.
Both experts stress the critical importance of data protection and classification. Arun advocates for AI-powered data characterization and governance platforms that can proactively identify sensitive information requiring protection. Mike emphasizes the need for proper data classification, noting that organizations often struggle to differentiate between critical and non-critical data. He recommends data minimization strategies including cold storage for inactive data to reduce the potential attack surface. The experts agree that building enterprise-wide risk awareness requires collaboration across departments rather than treating security as an isolated IT function.
The panel concludes that organizations must prioritize zero-trust architecture implementation, adopt data minimization strategies, and enhance incident response capabilities. Arun frames this as a comprehensive coalition of "people, process, and technology safeguards all working together." Mike adds a sobering perspective for businesses that might not see themselves as targets: "These weren't the 11 hacks of 2024. These were the top hacks... there are literally hundreds of thousands, if not millions more. And that's you."
Top 11 Data Breaches in 2024 Report: https://www.kiteworks.com/top-data-breaches-report
Arun DeSouza LinkedIn: https://www.linkedin.com/in/arundesouza/
Mike Crandall LinkedIn: https://www.linkedin.com/in/crandallmike/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
02/21/25 • 37 min
With over two decades of experience in the cybersecurity domain, Chad Lorenc stands as a prominent voice in cloud security and enterprise security strategy. Currently serving as a security leader at Amazon Web Services (AWS), Chad has contributed significantly to advancing cloud architecture best practices and building robust security frameworks for some of the world’s most dynamic organizations. In this insightful Kitecast episode, Chad shares his expertise on cloud security, the evolving role of CISOs, and the integration of artificial intelligence (AI) into enterprise security strategies.
Evolution of Cloud Security: From Apprehension to Opportunity
In the early days of cloud adoption, organizations often hesitated to migrate their operations due to concerns over security and control. Chad reflects on this initial apprehension and explains how the cloud security paradigm has matured over the years. Many companies attempted to replicate on-premises security models in the cloud, often facing challenges with patching, incident management, and compliance. Cloud environments require unique security approaches, with a focus on building specific controls and aligning them with broader security operations and compliance requirements.
CISOs: Leading the Charge in Cloud and AI Adoption
A recurring theme in the podcast is the critical role of CISOs in driving cloud and AI strategies. Chad offers valuable advice to CISOs, encouraging them to lead cloud adoption initiatives rather than being pulled into projects at the last minute. He highlights the tangible security benefits of cloud environments, such as the ease of implementing encryption and other advanced security controls. By taking a proactive approach, CISOs can not only enhance security but also achieve cost savings and operational efficiencies.
Embracing AI and Navigating Regulatory Challenges
As organizations increasingly integrate AI into their operations, compliance and security become critical considerations. Chad discusses how the shift to data lakes and the acceleration of AI adoption have transformed cloud security conversations from traditional security measures to compliance and audit readiness. The conversation also touches on the complexities of shadow AI—where unsanctioned AI tools are used within companies—and how security leaders can address these challenges by aligning internal strategies with business demands. In addition, Chad sheds light on the regulatory landscape, including the growing importance of FedRAMP compliance for federal clients and the balance between rapid cloud innovation and regulatory adherence.
Charting the Future of Cloud Security with Chad Lorenc
The podcast concludes with Chad’s forward-looking perspective on the evolving cybersecurity landscape. He believes that while AI remains a dominant topic, true innovation lies in optimizing security operations and embracing technologies that drive business outcomes. Chad sees an emerging trend where CISOs are not only security experts but also strategic business leaders who contribute to overall organizational success. His parting advice to security professionals is clear: embrace new technologies like AI and cloud solutions with a strategic mindset to remain relevant and impactful.
LinkedIn: https://www.linkedin.com/in/chadlorenc/
Amazon Web Services: https://www.linkedin.com/company/amazon-web-services/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
07/10/24 • 51 min
Jacqui Kernot, the Security Director at Accenture for Australia and New Zealand, boasts over two decades of extensive experience in cybersecurity, spanning multiple industries. Recognized for her authoritative voice on diversity and inclusion alongside cybersecurity risk management, Jacqui is a well-regarded speaker who frequently addresses these pressing issues. She is committed to pushing the boundaries of cybersecurity and focused on integrating cutting-edge AI and technological advancements into the security domain.
In her recent appearance on the Kitecast episode, Jacqui illuminated the transformative impact of AI on cybersecurity. She pointed out that although AI technology is still emerging, the foundational steps taken today by organizations to build robust infrastructures will be pivotal. Jacqui stressed that companies poised to anticipate future technological needs and begin laying the groundwork for AI integration will likely lead the industry. This strategic foresight is crucial for fully realizing AI’s potential and maintaining a competitive edge in cybersecurity.
A significant portion of Jacqui's discussion centered on the imperative of data sovereignty and stringent management practices. In an era increasingly dominated by large language models and cloud-based technologies, securing and responsibly managing data is paramount. Jacqui advocated for strict data governance frameworks that ensure data is accessible only by authorized personnel, emphasizing that responsible AI deployment is fundamental to future security architectures.
Jacqui also delved deeply into the role of Zero Trust architecture in today’s cybersecurity landscape. She explained that as organizations increasingly migrate to cloud services and face more complex cyber threats, adopting a Zero Trust approach is crucial. This methodology is not only essential for blocking unauthorized access but also vital for building resilient security protocols that can robustly counteract potential breaches.
Looking forward, Jacqui shared insights on the evolving challenges and opportunities within cybersecurity. She highlighted the necessity for security strategies to remain adaptive and vigilant against new threats while also leveraging emerging technologies. The discussion touched on the need for more sophisticated security measures that can effectively safeguard against the evolving landscape of cyber threats, ensuring that organizations can protect their critical assets in an increasingly digital world.
LinkedIn Profile
www.linkedin.com/in/jkernot/
Accenture
www.accenture.com/us-en
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
08/28/23 • 52 min
Katie Arrington, former Chief Information Security Officer (CISO) for the U.S. Department of Defense and member of the US House of Representatives, discusses her experience as CISO, noting that the position was newly created in 2019 to address urgent cybersecurity threats. In the role, she aimed to establish consistent standards for cybersecurity across the Department of Defense, including weapons systems, critical infrastructure, and the defense industrial base. A key challenge was overcoming the different cybersecurity approaches between military branches and establishing a unified culture.
Regarding the Cybersecurity Maturity Model Certification (CMMC), Arrington explains it was initially conceived as a unified standard for defense contractors to demonstrate implementation of NIST 800-171 security controls. Hundreds of industry representatives helped develop CMMC 1.0. Arrington expresses that she regrets not fully eliminating the use of Controlled Unclassified Information (CUI) as an indicator of whether contractors needed certification, believing all defense contractors should adhere to CMMC standards given growing threats.
Arrington highlights the massive cyber threats posed by nation-states like China, Russia, Iran, and North Korea, which she says are targeting U.S. defense contractors to steal key technologies and intellectual property. She points out that China has a dedicated cyber army aimed at making China the world’s economic superpower. Russia has shown its cyber capabilities already in interfering with elections. These adversaries are relentless in exploiting vulnerabilities across the entire supply chain.
For defense contractors bidding on DoD projects, Arrington authored a white paper that estimates per-employee costs for cybersecurity based on company size. She believes contractors should build these costs into project bidding. Arrington argues CMMC is now just about verifying NIST 800-171 compliance, not evaluating maturity, so she anticipates the name changing in the future. In preparation for CMMC 2.0 Level 2 compliance audits, she recommends that contractors proactively get audits now rather than waiting until CMMC becomes a DIB mandate to address urgent threats.
Regarding supply chain risks, Arrington indicates primes cannot fully see risks beyond tier-one suppliers. She urges primes to contractually require CMMC certification from all subcontractors to improve security against threats that can enter anywhere in the supply chain.
Arrington stresses that cyberattacks are constant and rapidly evolving. No organization can be 100% secure. However, by implementing standards like NIST 800-171, organizations can mitigate these risks. Adherence to cybersecurity frameworks is critical today, an important focus for national security as cyber threats continue escalating.
LinkedIn Profile: https://www.linkedin.com/in/katie-arrington-a6949425/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
07/20/23 • 40 min
Billy Spears, Teradata’s CISO since 2021, stresses reciprocal learning and community in cybersecurity in a Kitecast episode. He believes each interaction offers learning potential and guides his volunteering decisions based on potential mutual benefits.
Spears discusses the evolution of cybersecurity standards since his time at the Department of Homeland Security. Initial efforts focused on creating policies and frameworks, while today's challenge is managing an overabundance of inconsistent frameworks. Companies need to navigate from the least to most restrictive frameworks, factoring in their needs, risk tolerance, global economic influences, regional regulations, and data handling practices. Spears highlights that compliance, while important, is not the sole determinant of strong security.
Spears emphasizes resource and cost management in implementing new cybersecurity technologies. As a CISO, he believes in cross-functional thinking across IT systems, including product, engineering, and marketing. The impact of technology solutions on business decisions must be considered holistically, assessing financial aspects with procurement teams for a comprehensive impact evaluation.
The cybersecurity skills shortage continues, and Spears suggests three mitigation strategies. First, avoid bias in recruitment towards candidates who reflect hiring managers. Second, dispel the misconception that cybersecurity is solely technical and hire non-technical roles like auditors, project managers, and governance professionals. Finally, combat the retirement of senior leaders by thinking creatively in recruitment, promoting cross-training, community engagement, university partnerships, and succession planning.
Spears emphasizes understanding the variety in AI. It’s not a single product but an array of algorithms and models used for different outcomes. Awareness of these differences is critical in cybersecurity to discern the benefits and risks of each AI model, like understanding blockchain. He advocates for education as key to navigating AI’s advantages and potential hazards.
LinkedIn: www.linkedin.com/in/billyjspears/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
01/10/25 • 42 min
Unveiling AI, Data Security, and Innovation
Howard Holton, the Chief Technology Officer of GigaOm, explores some of the most pressing topics in technology today. With over two decades of experience spanning roles as CTO, CISO, CIO, and consultant, Howard brings a wealth of knowledge to the conversation. His background includes leadership positions at Rheem Manufacturing, Hitachi Vantara, and Precision Discovery, where he honed his expertise in digital transformation, data science, and operational strategy. At GigaOm, Howard combines his technical acumen with a passion for helping organizations navigate the complexities of modern technology landscapes.
Generative AI: Hype vs. Reality
The conversation delves into the rapid rise of generative AI (GenAI) and the realities beyond the hype. Howard explains how businesses are grappling with this transformative technology, which, while promising, is rife with complexities. Many organizations rushed into adopting AI without fully understanding its implications, leading to inefficiencies and unexpected risks. He points out that generative AI is a powerful tool but cautions against treating it as a catch-all solution. The conversation highlights how improper use can lead to issues like misinformation, inaccurate outputs, and even legal challenges, underscoring the need for deliberate strategy in deploying AI tools.
Tackling AI Governance and Risks
Howard also provides an unvarnished look at AI governance and its associated risks. With generative AI being a relatively young technology, governance frameworks are still in their infancy. Organizations often lack cohesive tools to manage the risks associated with AI deployments. This leads to challenges in ensuring compliance with data privacy regulations and safeguarding sensitive information.
Shadow AI: The Hidden Risk
Shadow AI emerged as another critical topic in the discussion. Howard describes Shadow AI as the unauthorized use of AI tools by employees, often without the knowledge or approval of management. While employees leverage these tools to improve productivity or efficiency, this practice introduces significant risks to data security and compliance. Sensitive company data may unknowingly be exposed to public large language models (LLMs), creating vulnerabilities and potential regulatory breaches.
Advice for the Tech Community
Closing the episode, Howard offers invaluable advice for professionals navigating the ever-changing tech landscape. He underscores the importance of mentorship, curiosity, and collaboration in driving innovation. “It’s our job to help people,” he says, emphasizing the need for tech leaders to share their knowledge and foster growth within their communities. Howard also encourages organizations to adopt a mindset of continuous learning, particularly as emerging technologies like AI continue to evolve.
LinkedIn: https://www.linkedin.com/in/howardholton/
GigaOm: https://gigaom.com/
Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.
Show more best episodes
Show more best episodes
FAQ
How many episodes does Kitecast have?
Kitecast currently has 43 episodes available.
What topics does Kitecast cover?
The podcast is about Compliance, Podcasts, Technology, Data Privacy and Cybersecurity.
What is the most popular episode on Kitecast?
The episode title 'Luigi Lenguito: Getting Proactive About Your Cybersecurity' is the most popular.
What is the average episode length on Kitecast?
The average episode length on Kitecast is 45 minutes.
How often are episodes of Kitecast released?
Episodes of Kitecast are typically released every 20 days, 7 hours.
When was the first episode of Kitecast?
The first episode of Kitecast was released on Oct 7, 2022.
Show more FAQ
Show more FAQ