Beyond Penetration Testing: Developing a Defensive Cyber-Workforce

on YouTube ↗28m

" summary

Argues that defensive capacity, not glamourous penetration testing alone, stops breaches: cites the SingHealth breach with 1.5 million records and 160,000 prescriptions exposed, board-level failures and demotions, and an ESG/ISSA 2017 finding that skills shortages drive breaches. Recommends concrete moves: adopt NIST SP 800-50 for education/training/awareness, build cyber ranges and role-based training, balance red/blue teams, invest in leadership certifications, and deploy EDR and automation to remove tedious work and speed incident response.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 0:27Beyond Penetration Testing: Developing a Defensive Cyber- Workforce
3. 1:25Tools and technology help companies act the cybersecurity objectives of confident integrity, and availability; however, you manage security without people.
4. 2:17Finding weaknesses in the environment i important, but there is too much emphas offensive red team activities and not eno consideration for the blue team.
5. 13:21Top factors contributing to incidents: 1. A lack of adequate training of nontechnical employees. 2. A lack of adequate cybersecurity staff.
6. 15:58NIST Special Publication 800-50 Building an Information Technology Security Awareness and Training Program
7. 22:16Building defensive capabilities requires the intentional development of a cybersecurity workforce. • All security people should understand TTPs used in an at but this knowledge applies differently for offensive and defensive roles. • Defenders need a more robust understanding of control and communications from the context and perspective business impact.

" related talks

• 27mThe Offensive Approach to CybersecurityTristan TARRIEUX, Noé Zenner · BSides Strasbourg 2024
• 19mPenetration TestingBrandy Griffin · DevOpsDays Atlanta 2022
• 28mBreaches Are Everywhere; What's a Good Security Leader to DoRichard Greenberg · OWASP Global AppSec Virtual 2020
• 52mContinuous SecurityLaura Bell · NDC Sydney 2017
• 50mA CISO's Best Friend: The PentesterSean Atkinson, Chris Elgee · RSA Conference 2023
• 33mLearning from Past Security Breaches: Strengthening AppSec Efforts and FocusJon McCoy · OWASP Global AppSec San Francisco 2024
• 49mHow to Create a Breach-Deterrent Culture of Cybersecurity, from Board DownMarcus Sachs, Dana Linnet, Andrzej Cetnarski · RSA Conference 2023
• 52mHow to prevent cyber-attack, & what to do when attacked?Jasmin Azemović · IT Security Virtual Conference 2021