CTRLPhreaks Clarissa Lucas & Bill Bensing

SummarySounil Yu, author of Cyber Defense Matrix, discusses the importance of terminology in cybersecurity and the distinction between safety and security. He explains how the Cyber Defense Matrix helps organize and identify gaps in security capabilities. He also introduces the concept of the D.I.E. Triad (distributed, immutable, ephemeral) and how it can reduce the impact of liabilities in cybersecurity. The conversation highlights the need to redefine the economic equation of cybersecurity from a cost to an investment. The talk explores the concepts of cyber safety and cybersecurity and how they relate to risk management and defense strategies. The guests discuss the importance of having necessary defenses in place, even for smaller businesses that may not be direct targets. They also delve into the three-line model and how it aligns with the cyber defense matrix. The matrix is a valuable tool for understanding the full scope of cybersecurity and making risk-based decisions. The conversation emphasizes the need for a common language and understanding between tech and audit professionals.
TakeawaysTerminology is crucial in cybersecurity to ensure clear communication and understanding.The Cyber Defense Matrix helps organize and identify gaps in security capabilities.The D.I.E. triad (distributed, immutable, ephemeral) can reduce the impact of liabilities in cybersecurity.Redefining the economic equation of cybersecurity from a cost to an investment is essential. Having necessary defenses in place is vital for all organizations, regardless of their size or direct targeting.The cyber defense matrix is a helpful tool for understanding the full scope of cybersecurity and making risk-based decisions.Common language and understanding between tech and audit professionals are crucial for effective communication and collaboration.Risk tolerance and appetite should clearly articulate and align with the organization's goals and resources.The cyber defense matrix can be used as an assurance map to identify controls and risk coverage gaps.
Chapters
00:00 Introduction and Background
06:18 The D.I.E. Triad
14:13 The Importance of Terminology
26:40 Risk Tolerance and Risk Appetite
35:07 The Role of Language and Common Understanding

SummaryIn this episode, Mike Leuzinger and Andy Kolenko discuss policy as code from a technology and audit perspective. Policy as code extends infrastructure as code, allowing organizations to automate and manage policies across multiple technology stacks. It can enable continuous compliance, self-service for auditors, and more robust controls through automation. However, challenges include dealing with heterogeneity and the complexity of new technologies. Bridging the gap between technologists and auditors is crucial for successful implementation. The conversation explores the challenges and benefits of implementing policy as code in an organization. Mike, Andy, Clariss, and Bill discuss the complexity of keeping up with proprietary schemas and controls and the importance of relying on vendors and industry standards. They also touch on the responsibility of setting and managing Policy as Code, highlighting the industry's lack of established processes and ownership. The conversation emphasizes the need for collaboration between auditors and technology partners and the importance of staying updated on compliance guidance and leveraging tools like Open Policy Agent and the AWS Well-Architected Framework.
Takeaways
Policy as code extends infrastructure as code, enabling organizations to automate and manage policies across multiple technology stacks.Policy as code enables continuous auditing and monitoring, providing more continuous assurance to stakeholders.Self-service for auditors reduces miscommunication and allows them to obtain the necessary evidence without relying on clients.Policy as code strengthens controls through automation, preventing security vulnerabilities from going into production.Challenges of policy as code include dealing with heterogeneity and the complexity of new technologies.Bridging the gap between technologists and auditors is crucial for successfully implementing policy as code. Keeping up with proprietary schemas and controls remains challenging, and organizations should rely on vendors and industry standards to stay ahead.The responsibility for setting and managing Policy as Code is still unclear, and there is a need for more established processes and ownership.Collaboration between auditors and technology partners is crucial for the successful implementation of Policy as Code.

In this episode, Lynn, Roberto, & Matt from John Deere discuss their digital transformation journey and its impact on IT and Internal Audit. They highlight the importance of agility in internal audit and how it helped prioritize work and enhance relationships with stakeholders. The team also shares the challenges they faced during the transformation and the strategies they used to overcome them. Additionally, they discuss the concept of defining deployable and its role in bridging the gap between technology and audit. The conversation explores the partnership between audit and other departments, the importance of metrics and measuring outcomes, applying software engineering principles to audit, and advice for implementing Agile in audit.
TakeawaysDigital transformation requires agility in internal audit to prioritize work and enhance stakeholder relationships.Challenges during the transformation can be overcome through continuous improvement and a focus on cultural change.Defining deployable is crucial in bridging the gap between technology and audit.Psychological safety and modeling behaviors are vital to creating a culture of trust and innovation. Partnerships between audit and other departments are crucial for automation and improving audit processes.Metrics should focus on measuring outcomes rather than just activities.Applying software engineering principles to audits can improve efficiency and effectiveness.When implementing Agile in audit, start small, adapt, build relationships, and disrupt with precision.

In this episode, Clarissa & Bill promise to open up new avenues of thought! Agile, Lean, and DevOps – you've probably heard these terms thrown around in software development circles. But what if we told you these methodologies are not confined to the digital realm? Join us as we shatter this age-old myth with our guests, Robin Yeman and Suzette Johnson.
Our daring duo takes us on a rollercoaster ride of their experiences, applying Agile, Lean, and DevOps in areas you'd least expect. They're not just sharing theories; they're bringing you real-life stories of implementing these dynamic practices in places ranging from auditing to operations. This episode is a treasure trove of tales and tips, perfect for anyone skeptical about mentioning 'Agile' outside the IT department.
In this insightful conversation, Robin and Suzette delve into the application of engineering principles to cyber-physical systems and stress the importance of considering constraints in the design process. They talk about the need for multiple planning horizons – a strategy that ensures predictable delivery while allowing the flexibility to adjust scope and resources based on empirical data.

Our guests share their journey in overcoming challenges and achieving success with new working methods. They highlight the importance of aligning on a common language and building internal support, which is essential to any transformation. Plus, they explore the concept of 'crossing the chasm', underscoring the necessity for continuous improvement in an ever-evolving digital landscape.

This episode is not just about changing how you work; it's about a paradigm shift in approaching technology governance and innovation. Let's dive in!

Read the book "Industrial DevOps" - https://itrevolution.com/product/industrial-devops-book/ Follow Robin Yeman on Linkedin - https://www.linkedin.com/in/robinyeman/ Follow Dr. Suzette Johnson on LinkedIn - https://www.linkedin.com/in/dr-suzette-johnson-984bb14/

Takeaways
Applying engineering principles to cyber-physical systems involves considering constraints and designing with the end in mind.Multiple horizons of planning are essential for predictable delivery and the ability to adjust scope and resources based on empirical data.Agile, lean, and DevOps principles can be effectively applied beyond software development, including in areas like hardware and manufacturing.Security and auditing need to be integrated early in the agile development process.Overcoming challenges and finding success with new ways of working requires aligning on a common language and building internal support.Crossing the chasm involves building a full product offering and providing evidence of success to gain wider adoption.Continuous improvement and a growth mindset are crucial in an ever-evolving digital landscape.Understanding and integrating constraints from the beginning is crucial for successful system development.Bridging the gap between software and hardware is essential in cyber-physical systems.Continuous improvement and innovation are necessary to keep pace with evolving industry trends.

Chapters
00:01:06 - Episode Introduction00:02:44 - Robin & Suzette Introductions00:04:38 - Discussion on Systems Engineering and Agile Approaches00:07:19 - Industrial DevOps and Cyber-Physical Systems00:11:49 - The Role of...

In this conversation, Bill and Clarissa discuss the importance of effective conversations with “Agile Conversations” co-author Jeffrey Frederick. Overall, the episode emphasizes the power of conversations in reducing unnecessary pain and improving collaboration in various domains. They explore the concept of Taylorism and its impact on management philosophies, highlighting the need for a more human-centered approach. The conversation also touches on the biases present in traditional auditing processes and the importance of recognizing and overcoming them. In this episode, Jeffrey Fredrick discusses the importance of effective conversations in auditing and other professional contexts. He emphasizes the need for alignment and shared understanding in conversations, especially when auditors and clients have different perspectives. Jeffrey introduces the concept of the Four Rs (Record, Reflect, Revise, Role Play) as a tool for improving conversational skills. He explains each step of the Four Rs and highlights the importance of genuine curiosity and transparency in conversations. Jeffrey also discusses the ladder of inference and how it can help auditors and clients overcome challenges related to understanding each other's businesses. He concludes by emphasizing the need for practice and continuous improvement in conversational skills.
Read the book “Agile Conversations” at https://itrevolution.com/product/agile-conversations/Learn more about Agile Conversations at https://www.agileconversations.com Check out Jeffrey’s Podcast “Troubleshooting Agile” at  https://agileconversations.com/troubleshooting-agile-podcast/Explore CITCON (Continuous Integration Conference) at https://citconf.com Follow Jeffrey on LinkedIn at https://www.linkedin.com/in/jfredrick Follow Jeffrey on X (Twitter) at https://twitter.com/jtf
TakeawaysEffective conversations are essential in Agile and DevOps practices.Recognizing and overcoming biases is crucial in auditing and other domains.Conversations can help reduce unnecessary pain and improve collaboration. Effective conversations require alignment and shared understanding.The Four Rs (Record, Reflect, Revise, Role Play) can improve conversational skills.Genuine curiosity and transparency are essential in conversations.The ladder of inference can help auditors and clients understand each other's businesses.

Chapters
00:00 Introductions07:36 Taylorism and Modern Management12:41 Reducing Suffering and Unnecessary Pain16:13 The Negative and Positive Aspects of Taylorism21:26 Spotting Taylorism and the Need for Change24:47 Conversations as a Tool to Overcome Biases27:18 Misalignment in Auditing25:36 The Four Rs29:20 Using the Four Rs in Conversations31:46 The Record Step33:14 The Reflect Step25:07 The Revise Step36:02 The Role Play Step39:28 Leveraging Conversational Concepts in Auditing44:24 Practice and Skills Gap

Clarrissa, Bill, and Robert Kelly discuss implementing automated governance systems in highly regulated organizations in this conversation. They explore the challenges of working with internal auditors and the importance of bringing auditors to the table early in the process. They emphasize the need for a culture shift and a change in mindset to ensure that automated governance solutions are integrated with internal audit processes. The conversation highlights the value of auditors in reducing risk and accelerating software delivery. Overall, the discussion provides insights into the implementation and benefits of automated governance systems. The conversation explores the integration of technologists and internal audits through automated governance. It discusses the challenges faced in bridging the gap between these two teams and the benefits of early collaboration. The concept of continuous compliance is examined, focusing on shifting towards real-time assurance. The conversation concludes with three key takeaways: the success of automated governance in various industries, the importance of bringing auditors in early, and the need to view compliance as an assurance process.
TakeawaysImplementing automated governance systems in highly regulated organizations requires a culture shift and a change in mindset.Bringing auditors to the table early in the process is crucial for ensuring the success and integration of automated governance solutions.Automated governance solutions should focus on reducing risk and accelerating software delivery.Building trust and collaboration between IT teams and auditors is essential for effective automated governance.
Chapters
00:00 - Introduction and Background04:25 - Building the Automated Governance System06:39 - The Problem Automated Governance Solves09:40 - Challenges in Implementing Automated Governance11:11 - Working with Internal Auditing14:41 - Bringing Auditors to the Table19:48 - Selling and Marketing the Automated Governance Solution22:36 - The Value of Auditors in the Process26:26 - Changing the Conversation with Auditors27:29 - Bringing Technologists and Internal Audit Together33:56 - Solving Audit Problems with Automated Governance38:30 - The Ideal Audit Experience with Automated Governance40:23 - Continuous Compliance vs. Real-Time Assurance44:53 - Lessons Learned and Takeaways