Travis McPeak is a security generalist with over a decade of experience working at several companies including Databricks, Netflix, IBM, HP, and Symantec. He’s the Co-Founder and CEO of Resourcely, whose goal is to create a paved road to secure, efficient, and easy to manage cloud infrastructure. In this conversation, Travis shares his biggest takeaway from working at Netflix, the problem with overusing JIRA, and the importance of making security a shared responsibility between developers and security ops.   The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.   0:00 Introduction 1:26 Travis’ background 2:10 View of industry 4:00 Netflix “paved road” 5:20 Lemur 8:00 Security at small orgs 11:36 Reactive security with JIRA 14:35 Measuring security 18:16 Inflection point 20:48 Demystifying the paved road 24:30 DevSecOps 30:40 Unifying the objective, shared responsibility 33:40 Resourcely— Cloud infrastructure 36:20 Get connected 37:00 Positive Message 38:27 Outro   Travis McPeak https://www.linkedin.com/in/travismcpeak/ https://www.resourcely.io/ https://www.resourcely.io/post/guardrails-and-paved-roads   Cyber Security and Cloud Podcast hosted by Francesco Cipollone Twitter @FrankSEC42 Linkedin: linkedin.com/in/fracipo  #CSCP #cybermentoringmonday cybercloudpodcast.com    Social Media Links  Follow us on social media to get the latest episodes: Website: http://www.cybercloudpodcast.com/ You can listen to this podcast on your favourite player: Itunes: https://podcasts.apple.com/gb/podcast/the-cyber-security-cloud-podcast-cscp/id1516316463  
Spotify: https://open.spotify.com/show/3fg8AqP4vEi5Im8YKxazUQ  Linkedin: https://www.linkedin.com/company/35703565/admin/  
 Twitter: https://twitter.com/podcast_cyber   
 Youtube https://www.youtube.com/channel/UCVgsq-vMzq4sxObVonDsIAg/   

  Nathan is the manager of the application security team at Intuit Mailchimp. He has over 7 years of experience in application security working at both startups and Fortune 500 companies. In that time, Nathan has been both an engineer and a leader. His primary focus has been on building out application security programs by implementing scalable processes and efficient methodologies. Nathan holds a Master’s in Digital Forensics and CyberSecurity from John Jay College of Criminal Justice and a Bachelor’s in Music Composition from University of the Arts.   In this show, Nathan and Francesco discuss the start in application security, how to mentor new interns and bridge the skillgap and how to measure application security progress when deploying shift left methodologies in devsecops    The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://www.phoenix.security for a free 14-day licence.     2:00 - Nathan's Intro 7:30 – from music to cybersecurity and new generation 11:00 – State of application security 14:00 – Vulnerability – What is a vulnerability in software 18:00 – How do you bring in the business in appsec – Product security 12:00 - Cybersecurity technicalities - Pen-tests  and regulation 16:00 - Cybersecurity and regulation in USA 19:00 - SBOM, Digital Software supply chain 20:00 – Risk for application security and business perspective 22:00 – Business categories of risk for application security 24:00 – Business criticality vs low criticality – how to talk about risk 26:00 – Prioritize work based on risk in application security    27:00 – Avoiding burnout and preventing risk – Mailchimp program of work – SPIDER 31:00 – Doing more with less in application security 33:00 – Measuring shift left effectiveness – Dentist story 37:00 – Positive message and conclusion   Nathan   Blog: https://nathancooke.com/  Linkedin: https://www.linkedin.com/in/nathancooke7/     Cyber Security and Cloud Podcast hosted by Francesco Cipollone Twitter @FrankSEC42 Linkedin: linkedin.com/in/fracipo  #CSCP #cybermentoringmonday cybercloudpodcast.com    Social Media Links  Follow us on social media to get the latest episodes: Website: http://www.cybercloudpodcast.com/ You can listen to this podcast on your favourite player: Itunes: https://podcasts.apple.com/gb/podcast/the-cyber-security-cloud-podcast-cscp/id1516316463  
Spotify: https://open.spotify.com/show/3fg8AqP4vEi5Im8YKxazUQ  Linkedin: https://www.linkedin.com/company/35703565/admin/  
 Twitter: https://twitter.com/podcast_cyber   
 Youtube https://www.youtube.com/channel/UCVgsq-vMzq4sxObVonDsIAg/   

   Kevin Davis, Global CTO of AWS at Atos. Kevin has extensive experience in cloud technology, security and solutions and has a proven track record in senior roles at Cloudreach and Atos.     In this show, Kevin and Francesco discuss the move to the cloud, challenges in the cloud security pivot and how to leverage the power of the cloud for security controls.   The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://www.phoenix.security for a free 14-day licence.   1.40 - Kevin Intro 3.00 - Baby Steps into the cloud 6.00 - Shared Responsibility Model 9.00 - Operational Security in the Cloud 11.00 - Traditional Security to Cloud Security 16.00 - Security Governance in Cloud  18.00 - Paradigm Shift - Segmenting units 20.00 - Cloud native Tooling and migrating from traditional to modern 23.00 - Changes in the cloud as software gotcha and pitfalls 26.00 - Consolidated technology stack & Clod environment guardrails 27.30 - Devops and job demands - what is devops in the cloud 28.00 - Security in Devops for cloud - Devsecops  29.00 - People and security - the impact of cloud transformation in cloud 33.00 - Biggest threat in the cloud, cloud security misconfiguration 35.00 - Cloud security observability, logs, AI and investigation 36.00 - Positive message 38:00 - Closing   Kevin https://www.linkedin.com/in/relevantsoft/      Cyber Security and Cloud Podcast hosted by Francesco Cipollone Twitter @FrankSEC42 Linkedin: linkedin.com/in/fracipo  #CSCP #cybermentoringmonday cybercloudpodcast.com    Social Media Links  Follow us on social media to get the latest episodes: Website: http://www.cybercloudpodcast.com/ You can listen to this podcast on your favourite player: Itunes: https://podcasts.apple.com/gb/podcast/the-cyber-security-cloud-podcast-cscp/id1516316463  
Spotify: https://open.spotify.com/show/3fg8AqP4vEi5Im8YKxazUQ  Linkedin: https://www.linkedin.com/company/35703565/admin/  
 Twitter: https://twitter.com/podcast_cyber   
 Youtube https://www.youtube.com/channel/UCVgsq-vMzq4sxObVonDsIAg/   

  Ollie Whitehouse is the founder BinaryFirefly a boutique British cyber advisory firm with a career spanning over 25 years in applied cyber attack and defence. Ollie's portfolio of advisory positions today includes science advisory positions for UK Government as a member of the Science Advisory Councils for the Home Office and Police, Industry 100 within the National Cyber Security Centre and various Non-Executive Directorships. His operational tenures include over ten and half years at NCC Group where he was Group CTO until the end of 2022, BlackBerry and Symantec. Ollie has given oral evidence to the UK Parliament Joint Committee on the National Security Strategy twice in 2017 and 2022 on matters related to cyber security.   The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the vulnerabilities that matter most and reduce your exposure to modern attacks. See it for yourself. Go to https://www.phoenix.security for a free 14-day licence.     2:00 - Career and dot com 3:00 - Pen-testing and philosophy  5:00 - Business and Cybersecurity and role of the cyber NED 9:00 - CISO 10:00 - Executive understanding  12:00 - Cybersecurity technicalities - Pen tests and regulation 16:00 - Cybersecurity and regulation in the USA 19:00 - SBOM, Digital Software supply chain 22:00 - Regulators, Board and how they think  26:00 - Assets, different opinions based on generation 30:00 - Non exec hands-on startups vs later stage  35:00 - policy and frameworks, and assessing, quantifying the net value of a control 40:00 - Software vs infrastructure breach why more on software  42:00 - scaling attacks with automation 46:00 - the business perspective  47:00 - Positive message   Ollie Whitehouse https://www.linkedin.com/in/olliewhitehouse/  https://twitter.com/ollieatnowhere  https://bluepurple.binaryfirefly.com/archive  https://bluepurple.binaryfirefly.com/      Cyber Security and Cloud Podcast hosted by Francesco Cipollone Twitter @FrankSEC42 Linkedin: linkedin.com/in/fracipo  #CSCP #cybermentoringmonday cybercloudpodcast.com    Social Media Links  Follow us on social media to get the latest episodes: Website: http://www.cybercloudpodcast.com/ You can listen to this podcast on your favourite player: Itunes: https://podcasts.apple.com/gb/podcast/the-cyber-security-cloud-podcast-cscp/id1516316463  
Spotify: https://open.spotify.com/show/3fg8AqP4vEi5Im8YKxazUQ  Linkedin: https://www.linkedin.com/company/35703565/admin/  
 Twitter: https://twitter.com/podcast_cyber   
 Youtube https://www.youtube.com/channel/UCVgsq-vMzq4sxObVonDsIAg/   

  Chris Hughes is a Proven Cloud/Cybersecurity leader with nearly 20 years of experience in the Federal and commercial industries. Chris is an active blogger, passionate about all things cyber and a published author of books like Software Transparency.    The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the vulnerabilities that matter most and reduce your exposure to modern attacks. See it for yourself. Go to https://www.phoenix.security for a free 14-day licence.   1:12 Introductions 4:45 regulation and federal space 6:40 Software supply chain attacks 8:40 SSDF and SBOM 11:06 Software is complex 15:00 Vulnerability to attacks, attacker mindset  17:00 Common supply chain attacks 20:00 Cloud critiques, is cloud secure? 23:00 Business Risk, Quantifications, How to measure everything,  24:00 FAIR and Quantification at scale 25:00 Method to evaluate vulnerability, CISA KEV, EPSS, How to triage 28:00 Why does the software supply chain get attention 30:00 Get connected   Chris Huges   https://www.linkedin.com/in/resilientcyber/  https://podcasts.apple.com/us/podcast/resilient-cyber/id1555928024  https://resilientcyber.substack.com/  FAIR: https://www.opengroup.org/certifications/openfair  Hot to measure anything in cyber risk: https://amzn.eu/d/hBWxJGO    Cyber Security and Cloud Podcast hosted by Francesco Cipollone Twitter @FrankSEC42 Linkedin: linkedin.com/in/fracipo  #CSCP #cybermentoringmonday cybercloudpodcast.com    Social Media Links  Follow us on social media to get the latest episodes: Website: http://www.cybercloudpodcast.com/ You can listen to this podcast on your favourite player: Itunes: https://podcasts.apple.com/gb/podcast/the-cyber-security-cloud-podcast-cscp/id1516316463  
Spotify: https://open.spotify.com/show/3fg8AqP4vEi5Im8YKxazUQ  Linkedin: https://www.linkedin.com/company/35703565/admin/  
 Twitter: https://twitter.com/podcast_cyber   
 Youtube https://www.youtube.com/channel/UCVgsq-vMzq4sxObVonDsIAg/    Summary Transcript (auto-generated might have some typos)  Hello everyone and welcome back to the cybersecurity and cloud podcast, this is your host Francesco and this is probably the last last episode that we do in 2022 is 29 of December 2022 we're almost on the end of the years but we managed to squeeze in a last episode with chris Hughes and it's an absolute pleasure because we chris we've been interacting a lot of linking teasing each other over a number of topics and we said you know it's the time to come on the show and do a proper episode. So chris, thank you very much for coming on the show. Chris is uh is a consultant to direct robot via and it's been in Air force previously, so it's very heavily involved with a lot of us regulation around storm and around cybersecurity and the U. S. Has faced a lot of change in late and today in the episode we're gonna dig in and explore this. But before digging into the exciting topic of storm and software supply chain chris tell us a little bit more about you, how did you start? How did you get us to the point where you are today? Yeah definitely. I'm happy to give you some background. I start off active duty Air Force you know prior to that I always had an interest in computers and technology but got joined the Air Force and got put in cybersecurity and at the time I didn't really realize the opportunity. You know you're just a young kid you know. Uh And and then like I started really taking an interest in it because it was a fascinating career field and like I've never stopped you know I did four years in the Air Force and then I've been a federal employee with the U. S. Government twice once with the Navy doing cloud and deficit cops. And you know cyber security for them. And then also with an organization known as G. S. A. The General Services Administration which probably isn't too familiar for many. But like if you've heard of Fed ramp, I was part of the Fed ramp team reviewing cloud services coming to the you know us federal market there as a security to me. Um, and as you mentioned, I think we're definitely seeing like an evolution of the regulation in this space, you know, in our, in our environment, in the public sector. You know, we've always had things like Nist and uh, you know, risk management framework, Nist 853 and and you know, think of Nist 871 for defense, industrial base and then see mm see that people are talking about a lot now, thinking about, you know, not just software supply chain but supply chain risk management in general, you're under your suppliers. That was a topic that's gotten a lot of attention as of late and then, you know, obviously software supply chain, you know, it's not necessarily a new topic. You know, you can date new google. Had a white paper recently, they started like an incident from 1980 you know, for something where the United States did something that Russia with software and it's like, wow, this issue has been around for a long time, but it's gotten more and more attention, I think is, you know, we've seen open source adoption kind of accelerate and go, you know, go crazy, everyone's using open source software. Most modern applications are made of open source software and I think people are realizing like, you know, I think prototype for example, had a study showing that in the last three years it's like a 742% increase in software supply chain attacks. So malicious actors are paying attention. And now I think that's making organizations regulators, you know, the industry pay attention and try to respond to this brilliant. And then of course he moved over to cisa and kind of has kept up that, you know, that momentum since then. So I think, you know, definitely solar winds was kind of the watershed moment, I think from an attention perspective and then the cyber street executive order and all the, all the activity has come after that. And as you mentioned, like, you know, I think regulation is going to has and will continue to play a big part in this. Like, you know, without regulation forcing the issue, suppliers are not necessarily incentivized to provide this information that transparency and many, you know, I've been really focused or interested in the economic factors of cyber. Many consider cyber to be a market failure. They said, you know, regulation is required for the, for things to change. Um, and I think it's, you know, it's hard to argue with that because if we just leave it up to the industry, they're not going to necessarily provide this information. Why why would they, you know, just put some additional risk or scrutiny? So, yeah, I think, I think we're definitely seeing a lot of changes And security resolve doesn't seem like a massive cost. So if there isn't a regulation behind it, there isn't a business justification to a ship with a bomb. I think the attack of one of the big topic in cyber that is asset management in general. That is a huge debated and often avoided topic in, cyber or in generally 90 is not even a cyber problem. And I think this one kind of industry has now brought to the topic a problem that is like, what do we do with, what do