Episode 10:22 Ping And Identity Access Management In The AI Age Crucial Tech podcast

29:13

Today ends the 10th season of Crucial Tech, 250+ episodes over six years and not a single repeat subject. Today we look at an aspect of cyber insurance not yet discussed as far as we can find: Why do so few cybersecurity companies carry cyber insurance? We bring in our friend and benefactor, Spencer Timmel from Safety National Insurance , to get that answer. We are taking a few weeks off before launching into season 11. Send any ideas for new episodes to Cyber Protection Magazine.…

Crucial Tech

1
Episode 10.26 - The rise of NHI and the impact of Predatory Sparrow 22:44

15 days ago22:44

22:44

If you are one of the smart people who have a subscription to Cyber Protection Magazine you will soon receive our next special issue focused on the rise of non-human identities (NHI) and their impact on society. If not, you get just this podcast with a hint of what is in the issue. We talk with Mike Towers, Chief Security & Trust Officer at Veza , about the meteoric increase of NHI. As a bonus, we also look into the theft of $90 million in cryptocurrency by the Israeli hacktivist group Predatory Sparrow . This represents a new area of asymmetric warfare.…

Crucial Tech

1
Episode 10.25 - The degradation of tech PR 39:17

21 days ago39:17

39:17

This episode of Crucial Tech iis a bit different. It’s about technology public relations, rather than specifically about a product or service. Tech PR has a problem. Search Engine Optimization (SEO) already damaged the ability of practitioners to connect with members of the press and large language models (LLM) are destroying their ability to tell a compelling story to the press and customers. We sat down with one of the last great practitioners of tech PR, Beth Trier , to talk about how she is dealing with the degradation of the industry. Our 30-minute discussion was illuminating. She agreed that SEO and LLM have had significant impacts on the declline and how she and her team are making every effort to maintain professional and effective practices. She also points out that the fragmentation of the press adds significant complexity to their work. We also discuss the nature of “earned media” and how few people really understand what that means. We wrap up with ways press and public relations can work better together to do the crucial job of providing ethical and independent coverage of what is happening in the industries they support. Make sure you tak the poll on Spotify.…

Crucial Tech

1
Episode 10.24 - Q-Day? Meh. And a view on how M&A affects security 34:33

26 days ago34:33

34:33

I haven't been shy about rejecting the hype behind the coming of Q-day -- the day that a quantum computer exists that can break modern encryption. But I've always felt that the most powerful encryption available could somehow be bypassed. Talking with Crick Waters, CEO of Patero , my fears have been realized. And yet I am encourages. And we talk again with Spencer Timmel, head of cyber security insurance company Safety National , on the affect of mergers and acquisitions on security…

Crucial Tech

1
Episode 10.23 - When reporters get fired... and hope from the insurance industry 11:04

6 weeks ago11:04

11:04

This week is a short one and a two-fer. ABC fired a long-time reporter for expressing an opinion on social media. One might be tempted to call it censorship and bowing to our weak and failing leader. But I understand the reason and took some time to explain it. But on a more positive note, I talked with Spencer Timmel of Safety National Insurance about the current retreat of the US government from securing the internet. He provides a refreshing idea that it might not be so bad.…

Crucial Tech

1
Episode 10:22 Ping and Identity Access Management in the AI age 30:13

7 weeks ago30:13

30:13

Yes, AI is a problem in the hands of bad actors, especially when they use bots to automate brute force attacks on identity. There are also a ton of companies dedicated to protecting your identity to keep the bad guys from impersonating you and those you care about. One of those companies is Ping (no, not the guys that make the golf clubs). In a continuation of our series on bots, we talk with Peter Barker, chief product officer for Ping and what they are doing about AI-based attacks.…

Crucial Tech

1
Episode 10:20b - Dale Hoak on understanding Zero Trust, redux 23:15

7 weeks ago23:15

23:15

A few weeks ago I posted what was supposed to be an interview with Dale Hoak, CISO for RegScale, on understanding Zero Trust. Unfortunately, the audio was of yet another interview that I have to repost on a different subject. That's what comes from having to wrangle 50 hours of fecordings from the RSAC Conference along with follow ups/. So, I promise, this is the right one.…

Crucial Tech

1
Episode 10.21 - Netacea and stopping malicious bots 22:15

8 weeks ago22:15

22:15

During @RSAC Conference in April I met with Matthew Gracey-McMinn, VP of Threat Services for Netacea and we talked about the damage malicious bots can do. His company is one of a handful of companies dedicated to protecting users against that threat, in particular media companies. It was a short conversation and I decided it was worth going into a bit more depth.…

Crucial Tech

1
Episode 10.19 - The "key" to security could be in your hands 21:19

10 weeks ago21:19

21:19

Physical authentication keys are a common trope in movies, TV and spy thrillers and they have been around for almost 20 years. But they are still hard to find in real life. We talked with Alex Summerer, head of authentication for Swissbit, which is a relatively new player in the field, headquartered in ...of course, Switzerland. Frankly, after talking with him I'm wondering why I haven't bought one of these things.…

Crucial Tech

1
Episode 10.18 - Battle of the bots: stealing student aid 14:04

11 weeks ago14:04

14:04

Still digging through dozens of hours of recordings and pages of notes from #RSAC_Conference last week. But while looking into the issue of bots, both good and bad, discovered a fairly recent story about how scammers use bots to steal financial ait. And as I always say, if I don't know about something, I know someone who does. So I called up an old friend, Craig Mosher, who teaches history and political science about what he has experienced with fake students and how to deal with them.…

Crucial Tech

1
Episode 10.17 - Bruce Schneier gives a stunning prediction on AI at RSAC Conference, and how deep risk goes 24:26

12 weeks ago24:26

24:26

This was another exhausting #RSAC in San Francisco but I think I'm finally getting a handle on it. There will be more to come, but Bruce Schneier gave a keynote on Tuesday that I think bodes well for journalism. And we had a visit with our friend at Safety National Insurance, Spencer Timmel, about just how far insurance can cover cybersecurity wweaknesses.…

Crucial Tech

1
Episode 10.16 - RSAC preview, Government doing good and bad PR 11:53

13 weeks ago11:53

11:53

This is a short episode previewing what I'll be doing at RSAC 2025 next week, kudos to the California Franchise Tax Board, and a how-to on working with the press.

Crucial Tech

1
Episode 10.15 - Divorce the orange git! 18:56

14 weeks ago18:56

18:56

There comes a moment in many abusive relationships, when observant friends encourage the abused party to leave the abuser. I consider myself a friend of the cybersecurity industry, aside from its bad marketing practices, I see it as important to the well-being of society worldwide. And that’s why I say now, it’s time to leave the federal government, at least for the next two years. The actions persecuting Chris Krebs and SentinelOne for merely for doing their jobs without political bias, demonstrate that no amount of money is worth working with the Trump administration. I spend much of the past week unsuccessfully trying to get members of the US cyber industry to comment publicly on this issue. I was able to get public comment from a few outside the country. Some of that can be found in my piece this week on Cyber Protection Magazine. This podcast is with one of the commenters, James Bore, a British cybersecurity consultant and speaker. He says what everyone is thinking. It’s time to divorce the orange git.…

Crucial Tech

1
Episode 10.14 - Encryption, Insurance and why you should care 28:26

15 weeks ago28:26

28:26

When it comes to polite discussion, there are two things you should never discuss: Politics and Religion. At the same time, most people would also rather not talk about insurance or data encryption. Well, I can’t say I’m all that polite, because that is exactly what this episode is about. The need for encryption on or data has never been more important, but msot of us don’t know what is or isn’t encrypted and that knowledge has a direct bearing on how much cybersecurity insurance might cost. So we sat down with Spencer Timmel, head of cybersecurity and technology insurance for Safety National , the primary sponsor for this podcast, and we discussed the unmentionable topics.…

Crucial Tech

1
Episode 10.13 - The AI bubble and how it affects cybersecurity 26:42

16 weeks ago26:42

26:42

Microsoft haw cancelled plans for a massive build out of AI data centers and China is shutting down gigawatts or AI processing due to lack of demand. It seems the AI boom is on the verge of busting as big as the Dotcom collapse. And since cybersecurity companies seem dependent on the AI buzzwords to sell their services, that is going to mean change for the industry. We chatted with ThreatLocker CEO Danny Jenkins and Reality Defender CEO Ben Colman about what is and isn't real regarding the concepts of AI threats.…

Crucial Tech

1
Episode 10.12 - Encryption is all around us, until it isn't 18:25

17 weeks ago18:25

18:25

The "Signalgate" scandal has raised the issue of encryption to a broader audience in the past week. On the plus side, many sources say that 95% of digital traffic is encrypted now, compared to 43% in 2014, but most people have no idea that their personal data is being encrypted. It’s one of those invisible technologies that touch many people. But there is a basic fact, that a lot of stuff that should be secured, isn’t because users don’t know they have to turn it on For example, WhatsApp, the messenger platform from Meta, advertises that they have end to end encryption, but they don’t tell you that you have to turn it on to get that benefit. So that brings us to today. What is encryption? Why do we need it and where does it come into play. We talk with Luigi Caramico, CTO and founder of DataKrypto, a company dedicated to encryption. And not just encryption but fully homomorphic encryption, an important step forward in protecting our data…

Crucial Tech

1
Episode 10.11 - The problem with surveys 28:54

17 weeks ago28:54

28:54

As I've said before, I get a lot of "studies" and "surveys" from cybersecurity firms with breathless and urgent warnings about a coming cyber-pocalypse of one sort or another. Funny thing, it's always about something that they supposedly defend against. As I started writing this note, I got another one. I did one podcast about a survey from Huntress about phishing in February, which was actually pretty good. Then I did one a couple of weeks ago about a less-than-good survey from iProov . Well, my partner in Germany, Patrick Boch, wanted to get into the fun and we decided to talk about two more of these that were also less-than-good from HiddenLayer and Ontinue . No, we didn't interview representatives from either company on this one. We were just having some fun at, unfortunately, their expense. Here are some of the highlights of our discussion. Many cybersecurity surveys lack scientific rigor, often using small, potentially biased samples (e.g., 250 IT decision-makers) Reports frequently make vague assumptions or present data in ways that may exaggerate threats or market demand Deep fake attacks, while concerning, are currently not as prevalent or successful in cybercrime as often portrayed The Verizon Data Breach Investigation Report (DBIR) is considered a gold standard for its concrete terms and unbiased approach…

Crucial Tech

1
Episode 10.10 - The X DDoS attack was avoidable, and it's not over 22:27

19 weeks ago22:27

22:27

The DDoS attack on X.com this week provided a certain amount of schadenfreude for people less than enamored by Elon Musk. It also rang alarm bells in the cybersecurity community as that style of attack seems to be making a comeback, and not for financial gain. All indications are corporations, and, in particular, government institutions are not ready to repel attacks motivated by political revenge. We talked with Inversion6 CISO Ian Thornton-Trump about how the attack was allowed to happen and what it may mean for the very near future.…

Crucial Tech

1
Episode 10.9 - How bad marketing obscures the problems of deepfakes and identity theft 23:30

20 weeks ago23:30

23:30

I get a lot of "studies" about the state of cybersecurity and most of them are poorly done. In Episode 10.8 I talked about one I like, from Huntress and the week it came out I got pitched another report from iProov that was, well, less than well done. And as much as I tried to help them focus on reality, the more they pushed back. Again, this is not a knock on what the company does, which is to ensure the veracity of biometric identity, but it is a good example of how cybersecurity companies spend too little and on the wrong efforts to get their story out.…

Crucial Tech

1
Episode 10.7 - Bob Ackerman, Generative AI, and Universal Basic Income 27:50

22 weeks ago27:50

27:50

Artificial Intelligence is all the rage right now with broad claims about how it is going to change the world as we know it. I have my doubts about the hype and so does Bob Ackerman, the granddaddy of cybersecurity venture capital, founder and managing director of AllegisCyber Capital (for the past 29 years) and cofounder of the cyber incubator, DataTribe in Maryland. I always enjoy chatting with Bob because he sees the nuts and bolts of tech advancements and isn’t the kind of investor to get swayed by the glitz of questionable marketing. In this session, we discussed how AI is starting to displace high-paying jobs like computer coding and legal work, raising concerns about who will be left to buy the AI subscriptions and services. While there will be short-term disruption, he thinks AI will ultimately enable new industries and use cases that create new jobs and economic opportunities. Surprisingly enough, he believes the transition may require policies like universal basic income to support displaced workers. We also discussed the demographic challenges facing countries like the US and Europe, with aging populations and declining birth rates straining social welfare systems. dAI and automation may help address labor shortages, but also raise questions about how to fund programs like Social Security and Medicare long-term. More importantly, Bob thinks that the people who invested in AI early will to lose their shirts. Check it out.…

Crucial Tech

1
Episode 10.6 - DORA, Insurance and the state of international regulations 23:28

23 weeks ago23:28

23:28

Today we are talking about insurance and government regulation... No! Wait! It's good stuff so bear with us. As the US administration seems intent on dismantling government protections in cybersecutiy, we will all rely heavily on foreign governments and private industries, like insurance, to keep us safe from cybercrime. The Digital Operations Resilience Act, that the EU put into force in January, is a good example of the former, and the insurance industry is a good example of the latter. We talk to Spencer Timmel, head of cybersecurity and technology for Safety National Insurance (our sponsor) and Arnaud Treps from Odaseva about how insurance and cybersecurity tech companies are working hand-in-glove to fill in the gaps being left by the Musk/Trump administration.…

Crucial Tech

1
Episode 10.8 - Phishing on the rise, but there is hope 21:00

24 weeks ago21:00

21:00

Phishing attacks are on the rise again with the help of sophisticated generative-AI tools. But new defenses and increased wariness among potential victims are blunting the potential for widespread harm. We talked with Greg Linares, Principle Threat Intelligence Analyst for Huntress regarding their annual Threat Intelligence report. It sounds grim, but in a new article on Cyber Protection Magazine, we also report on how defensive technology from companies like DeepTempo and personal awareness can blunt the attacks.…

Crucial Tech

1
A reminder of where we come from 18:30

24 weeks ago18:30

18:30

I am very far behind in writing stories and making podcasts. The events since January 20 have made it difficult to keep up. But today, while walking downtown I came across a brand-new independent book store That had a copy of a book dedicated to Martin Luther King Jr.'s "Dream" speech. I attended that event, with my mother, when I was 11. It was a foundational moment for me. It is when I became "woke." When I saw that book, I knew I had to buy it for my grandchildren, because being two generations separated from that moment is too far. I needed to bring it forward for them, so I bought the book for them and intend to read it to them and help them understand how important the dream is for them as well, especially today. This isn't a political issue for me. It is how I want to model my life. It does afect my politics, but it also affects my view of family, friends, neighbors, theology, and the world. If you choose to listen to me read this speech, I thank you for taking the time. My thanks extends even to those who are offended by it, as long as they listen to it. It is important to hear, even 60+ years after the fact. Only by repeating it can we learn from it.…

Crucial Tech

1
Episode 10.5 - Lawyers and insurance companies stand firm on security 27:45

25 weeks ago27:45

27:45

This week, we are talking to a lawyer. Maryam Meseha is a founding partner of Pierson Ferdinand LLC, a relatively new and large firm dedicated to digital security. In the first few weeks of the year, the new US administration has castrated the governmental infrastructure to make sure corporation keep customer data safe, especially in the area of retail fraud. It’s law firms, like Pierson Ferdinand and insurance companies, like our sponsor Safety National that are stepping up to remind companies that maintaining g a strong security posture is a good idea. We appreciate that sentiment. Hope it works.…

Crucial Tech

1
Episode 10.4 - How moderation works (It ain't what you think) 11:35

26 weeks ago11:35

11:35

I've had several discussions about the nature of censorship, the freedom of speech and moderation and I came to the realization that most people have no idea what sociial media moderation is. So I did a bit of a rant. We also are bringing back the top threat reports from Fletch for a bit of lightheartedness before the rant.…

Crucial Tech

1
Episode 10.3 - James Bore on our fascination with shiny objects 27:17

27 weeks ago27:17

27:17

James Bore is a cybersecurity consultant, speaker and publisher based in the UK. He has a refined sense of cynicism that clicks with my own, so we've been chatting back and forth for several months on various subjects and decided it's probably time to record some of our interaction. Today, we are looking at the preferred marketing practice (shiny objects) of sewing fear, uncertainty and doubt to get people to buy their products. It drives us both nuts. The issue is not limited to cybersecurity, but it is prevalent in the industry. I'm guessing this conversation will resonate with many of you. Our hope is that our marketing listeners will rethink some strategies,…

Crucial Tech

1
Episode 10.2 - Bye bye, Zuck 25:12

28 weeks ago25:12

25:12

For about two years, the team at Cyber Protection Magazine has debated whether Meta platforms (Facebook, Instagram and * shudder * WhatsApp) were valuable or even necessary for the reach of our magazine. For two years, I've been outvoted every time. Instead, I unilaterally decided to divorce from the platforms. Providentially, Mark Zuckerberg made two announcements in as many weeks that made the decision unanimous. We are leaving Meta behind for good. Instead, we will remain on Linkedin and join Mastodon and Bluesky this year. This podcast is the recording of the conversation my co-founder, Patrick Boch, and I had on the "momentous" decision, which also drifted into the issue of what constituted valid information. Check it out.…

Crucial Tech

1
Episode 10.1 - China, oligarchs and tradewars with Lou and Ian 35:32

29 weeks ago35:32

35:32

We open a new year and a new season with our friend, Ian Thornton-Trump, chief information security officer at the MSSP Inversion6 and in 30 minutes we take on some pretty meaty subjects. First we discuss how China strategically infiltrated technology systems in the US and other countries as a geopolitical message rather than attacks. He discusses the challenges of securing complex, interconnected systems and the need for proactive defense. Next we review the rise of corporate power and influence and how the increasing wealth and influence of individuals like Elon Musk is disrupting the traditional balance of power in democracies. The ethical concerns around wealthy individuals wielding disproportionate political influence could result in something the oligarchs are not expecting. Finally, we review potential trade wars and the possibility of Canada and Mexico joining the BRICS alliance. 2025 is going to be bumpy but very interesting.…

Crucial Tech

1
Episode 9.11 - Who do you Trust? 15:43

33 weeks ago15:43

15:43

The available guests for this last podcast of the year dried up pretty quickly so I thought I would give some closing thoughts on a big issue facing the world: Trust and the lack of it. Also, our last threat reports courtesy of Fletch.ai

Crucial Tech

1
Threat report for Thanksgiving week 5:10

34 weeks ago5:10