Cyber Smokehouse

TBDCyber

0.0 (0)
Business

This is Cyber Smokehouse. Join Ernie and Graeme as they grill the minds, dig into the experience, and serve up the stories of leaders in cybersecurity. Cyber Smokehouse is sponsored by TBDCyber, a cybersecurity strategy consulting firm.

6d ago

Getting Security Out of IT - Tim Callahan - Cyber Smokehouse - Episode #35

Take your security leadership, board reporting, and emerging technology governance to the next level with pragmatic wisdom from a veteran who spent 22 years in military Explosive Ordnance Disposal (EOD) before leading global technology and cyber resilience for Fortune 500 enterprises. It’s time to stop chasing every shiny headline and start building an adaptable operational foundation that absorbs modern technological disruption. Who better to guide you through this transition than former Aflac Global CISO & CIO, NTSC Co-Founder, and 2026 Technology Association of Georgia Board Chair, Tim Callahan? You will learn why standing up standalone AI committees creates unnecessary administrative sprawl, how to manage the friction between CIO and CISO priorities by separating budgets and reporting structures, and why mastering the fundamentals of access control protects you against AI threats just as it did with early PDAs and virtual servers. Get motivated to cut down board slide decks, invest in internal talent succession, and master the discipline of knowing where an "A+" is required and where "good enough" provides optimal business defense! Takeaways: The "Great at Being Good Enough" Philosophy: In an environment of finite budgets, security leaders must distinguish between operational controls that require an A+ (preventing and responding to attacks) versus areas where baseline compliance (a "C") is completely sufficient.Absorb Innovation Through Existing Governance: Rather than creating ad hoc committees for every new trend, Aflac scaled AI governance by expanding the mandate of its existing Data Protection and Privacy Subcommittee.Access Control as the Universal Anchor: Whether defending against Trojan horses, securing 2000s-era mobile devices, or permissioning autonomous AI agents, foundational access control ("deny all except as permitted") remains the primary security barrier.Separating Security from the IT Chain: True operational independence requires separating security budgets and reporting lines from IT operations - ideally routing CISO reporting to a General Counsel or Chief Risk Officer.Board Communication Through Conversation: Successful board briefings rely on executive brevity and high-level conversational engagement; bury dense regulatory checklists in the appendix and never get bogged down in technical metric weeds. Quote of the Show: "One thing that I've learned in life is you've got to be really great at being good enough... It's not a call to mediocracy. It's a call to know what you have to have an A+ in and where a C is just fine." - Tim Callahan Links: LinkedIn: https://www.linkedin.com/in/tim-callahan-4b39241/Website: http://www.ntsc.orgWays to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Oct 27

Vulnerability Velocity - Jim Covington - Cyber Smokehouse - Episode #34

Take your security program maturity, cyber risk quantification, and board reporting to the next level with practical insights on advancing beyond baseline frameworks, governing rapid AI adoption, and building continuous operational resilience. It’s time to move past chasing every "shiny new toy" and refocus your strategy on core hygiene, financial risk translation, and actionable metrics. Who better to guide you through this transition than Qualcomm Cybersecurity Program Strategy Lead, former digital health DPO, and Qualified Technology Executive (QTE), Jim Covington? You will learn why aiming for a level 5 maturity across every NIST CSF domain isn't always the right business move, how to translate technical security gaps into financial loss metrics that boards care about, and why continuous system rollover is replacing legacy 30-day patch cycles. Get motivated to cut through reporting noise, implement AI governance with real teeth, and build security programs designed for ultimate business resilience! Takeaways: Targeted NIST CSF Maturity: Organizations don't need a 5.0 maturity rating across every domain; target high maturity for critical functions like Incident Response and balance other domains around business risk appetite.Speaking the Board's Financial Language: Technical scores and 1-to-5 heatmaps no longer cut it; converting cyber risk into potential financial loss or gain is essential for securing executive buy-in.The Perils of Chasing "Shiny Toys": Leaders often chase cloud, machine learning, or generative AI while neglecting basic cyber hygiene; mastering 80% to 90% of the CIS Top 10 remains the most effective defense.Continuous Rollovers vs. Patch Tickets: With zero-day exploit velocity shrinking, traditional ticketing to IT teams is failing; continuous 24- to 48-hour automated system updates represent the future of vulnerability management.AI Governance Requires Real Teeth: While organizations rush to deploy AI agents and tools, steering committees often lack the purview and enforcement mechanisms needed to manage internal and external data risks. Quote of the Show: "The risk needs to be converted into financial loss or gain in order for the executives and boards to really take notice and understand, to be able to speak their language." - Jim Covington Links: LinkedIn: https://www.linkedin.com/in/covingtonsd/Website: https://www.qualcomm.com/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Oct 20

The Science of Security Leadership - Jim O’Connell - Cyber Smokehouse - Episode #33

Take your security leadership, IoT risk modeling, and board communication strategies to the next level with practical insights on protecting fleet computers, simplifying cyber risks for underserved markets, and preparing for quantum acceleration. It’s time to stop acting as the "land of no" and start grounding complex technical threats in clear, business-aligned risk terms. Who better to guide you through this transition than former Old Dominion Freight Line CISO, former Federal Reserve System Chief Architect, and 2025 Carolina CISO Orbie finalist, Jim O'Connell? You will learn why physical transport devices present "killware" risks beyond traditional financial ransomware, how low-tech vectors like ham radio frequencies can impact heavy fleet operations, and how to extend corporate security awareness to protect employees' families and small businesses. Get motivated to simplify your board reporting, prepare your infrastructure for quantum-ready encryption, and build adaptable security teams that enable business growth! Takeaways: Protecting Underserved Communities: Cyber awareness must extend beyond corporate walls to educate small business owners and individuals who lack access to dedicated security resources.Killware & Fleet IoT Vectors: In transportation and industrial IoT, the primary threat shifts from financial ransomware to "killware" - where low-tech vectors like radio frequencies can impact physical braking systems.Extending Family Cyber Wellness: Encouraging employees to share corporate security awareness training with their families creates a safer environment at home and reduces personal stressors brought into the workplace.Security Is Not the "Land of No": CISOs must avoid blocking business initiatives; instead, they should present alternative paths that balance risk with business enablement.Preparing for Quantum Acceleration: AI is accelerating quantum development timelines, requiring CISOs to inventory assets and prepare for rapid certificate and encryption refresh cycles today. Quote of the Show: "Security can't be the land of no. The second that you're the land of no, somebody's finding a way around you." - Jim O'Connell Links: LinkedIn: https://www.linkedin.com/in/jamesmichaeloconnell/Website: https://odfl.us/ShipWithUs_li Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Oct 13

Ditching Traffic-Light Risk Models - Jon Villanti - Cyber Smokehouse - Episode #32

Take your security program, board reporting, and risk management strategies to the next level with tactical insights on cyber risk quantification, agentic AI deployment, and enterprise governance. It’s time to stop relying on subjective traffic-light risk matrices and start speaking the language of financial impact that boardrooms understand. Who better to guide you through this transition than retired Air Force lieutenant colonel, F-16 fighter pilot, former SANS instructor, and 3-time bank CISO, Jon Vallanti? You will learn why the traditional COSO three lines of defense model fails in modern cybersecurity, how to leverage internally hosted open-weight AI models to protect sensitive financial data, and why OT&E (Organize, Train, Equip) is the ultimate blueprint for security leadership. Get motivated to eliminate guesswork, challenge legacy audit frameworks, and harness AI to scale your SOC and defend against next-generation cyber threats! Takeaways: Quantifying Risk in Dollars Over Traffic Lights: CISOs must move away from 1-to-5 scales or green/yellow/red heatmaps; board members understand financial ranges and dollar impact.The Flaw in COSO’s Three Lines of Defense: Separation of duties between IT and Information Security under traditional COSO frameworks often starves security of operational agility; flexibility in governance is essential.Self-Hosted Open-Weight AI Models: For regulated sectors like banking, internally hosted open-weight models solve data privacy and guardrail drift issues inherent in public LLM APIs.Deploying Internal Tripwires & Honeypots: As adversaries adopt AI-augmented tools, deploying internal decoys and tripwires is critical for early detection before lateral movement occurs.Leadership through OT&E (Organize, Train, Equip): Military-grade leadership centers on getting the right people on the bus, investing in high-end technical training, and equipping teams to win. Quote of the Show: "Cyber is risk, and everything we do is about uncertainty. We need to move away from low-medium-high scales and talk to the board in dollars - it’s a game of removing uncertainty, not chasing perfection." - Jon Vallanti Links: LinkedIn: https://www.linkedin.com/in/jonvillanti/Website: https://www.stellar.bank/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Oct 6

Resilience, AI Governance, and Practical Zero Trust - Elie Hachem - Cyber Smokehouse - Episode #31

Take your cybersecurity leadership and operational strategy to the next level with practical insights on AI-driven planning, risk-based zero trust, and framework execution. It’s time to stop chasing unachievable 100% security and start building resilient, business-aligned security programs that maximize risk tolerance and protect core operations. Who better to guide you through this transition than CISO and Director of Cybersecurity at Select Sires, Elie Hachem? You will learn how to leverage AI to accelerate security roadmaps, implement CIS Controls v8.1 for tangible gap analysis, apply sales psychology to navigate executive boardrooms, and scope zero trust practically around high-value assets rather than blanket mandates. Get motivated to engage business partners, build proactive incident containment, and align security investments directly with organizational ROI! Takeaways: Shifting from 100% Security to Resilience: Achieving total security is unrealistic; CISOs must focus on minimizing detection-to-response time and building proactive quarantine controls.Accelerating Security Roadmaps with AI: Read-only tenant integration allows security leaders to rapidly analyze internal processes, identify pain points, and condense traditional multi-year planning horizons.Practical Scoping for Zero Trust: Blanket zero trust across entire enterprises often fails due to executive friction and BYOD demands; focus zero trust controls tightly on privileged accounts and core infrastructure.Structuring Frameworks with CIS Controls: Utilizing structured frameworks like CIS Controls v8.1 gives security teams a measurable, tangible baseline to assess gaps and map directly to NIST standards.Applying Sales Psychology to Security Leadership: Leveraging transactional sales experience and human behavior analytics helps CISOs communicate risk effectively and secure executive buy-in. Quote of the Show: "Security is an enabler to the business, and it is impossible to be a hundred percent secure. What you can do is maximize your risk tolerance and build proactive resilience." - Elie Hachem Links: LinkedIn: https://www.linkedin.com/in/eliehachem/Website: https://www.selectsires.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Sep 29

The Shift to Cloud-Native Security - Chris Goosen - Cyber Smokehouse - Episode #30

Take your enterprise Microsoft architecture and AI strategy to the next level with practical insights on Copilot deployment, agentic governance, and modern cloud security. It’s time to slow down, eliminate data sprawl, and secure your foundational permission structures before turning loose generative AI across your organization. Who better to guide you through it than 13-time Microsoft MVP, Cloud Architects co-host, and principal technology consultant Chris Goosen? You will learn how to navigate the 70+ Copilot product variations, contain sensitive data leaks using isolated enterprise models, govern unmonitored agent sprawl, and transition away from legacy Active Directory infrastructure. Get motivated to evaluate your M365 licensing efficiency, adopt automated patch management, and implement a "best of platform" security approach that saves budget while maximizing protection! Takeaways: Cutting Through Copilot Branding: With dozens of distinct Copilot products across M365, GitHub, and Power Platform, organizations must distinguish between consumer chat tools and isolated enterprise models that prevent data leakage.Addressing AI-Exposed Data Sprawl: AI tools don't create new security holes; they expose legacy over-permissioned files and old SharePoint archives using natural language queries.The Rise of Agentic Governance: As organizations face "agent sprawl," tools like Agent 365 and conditional access policies are becoming essential to track, identity-tag, and govern autonomous AI agents.Transitioning Off Legacy Active Directory: On-premises Active Directory remains a primary target for attackers; migrating to cloud-native identity architectures eliminates decades of technical debt.Best of Platform vs. Best of Breed: Leveraging built-in M365 Business Premium or E5 security features prevents double-paying for third-party tools and unifies security telemetry in one place. Quote of the Show: "Copilot or any of the AI models aren't discovering stuff that was hidden before - they are just surfacing what was previously over-permissioned and making it easier to find." - Chris Goosen Links: Website: https://gooseco.auLinkedIn: https://www.linkedin.com/in/ctgoosen/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Sep 22

Who Audits the Auditors? - Bernie Wedge - Cyber Smokehouse - Episode #29

Take your technology risk and compliance strategies to the next level with powerful insights on independent control validation, third-party risk management, and the evolving audit ecosystem. It’s time to move past rubber-stamp compliance, navigate the alphabet soup of IT frameworks, and understand how AI is transforming sampling into full-population testing. Who better to guide you through it than retired EY partner, Americas Technology Risk practice leader, and senior cybersecurity advisor Bernie Wedge? You will learn how to evaluate auditor credibility through peer reviews, avoid the marketing trap of "instant" SOC 2 tools, and streamline multi-framework testing into a single efficient audit cycle. Get motivated to ask tougher questions of your third-party providers, align controls across the business, and build a trust center that provides real transparency! Takeaways: The Reality of SOC 2: While lower-cost auditors and automated GRC tools have created instances of "security theater," SOC 2 remains a robust, vital assurance mechanism when executed with proper governance and independent testing.Auditing the Auditors: Organizations must exercise due diligence by requesting peer review reports from their auditing firms to verify credentials and ensure proper quality control standards.Navigating Framework Proliferation: Rather than siloing SOC 2, ISO, HITRUST, and PCI efforts, leaders should adopt a "test once, use many" approach to audit overlapping foundational controls simultaneously.Asking the Right TPRM Questions: Vendor risk management requires reading the actual details of a SOC 2 report, challenging sample sizes, testing depth, and even interviewing the signing audit partner, rather than just filing the document away.AI's Impact on the Future of Auditing: Generative AI tools allow auditors to move away from small sample sets and analyze entire populations of system logs and access requests in real time. Quote of the Show: "SOC 2 is not a security theater for those who put time and effort into doing reports correctly, but it is sort of what the company puts into it." - Bernie Wedge Links: LinkedIn:https://www.linkedin.com/in/bernie-wedge-jr-59817583/Website: http://www.openhandatlanta.orgarc360.comhttps://s2guild.org/ Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550
Sep 15

Agentic Development and the Evolution of DevSecOps - Ken Toler - Cyber Smokehouse - Episode #28

Take your application security strategy to the next level with powerful insights on securing fast-paced agentic development, navigating abstracted SaaS platforms, and bridging the gap between engineers and security teams. It’s time to move past rigid no-saying, embrace "vibe coding" as a shared collaborative workspace, and build resilient security systems that stand the test of time. Who better to guide you through it than DevSecOps podcast host, blockchain application security expert, and Founder & Managing Principal Consultant at Asgard Security, Ken Toler? You will learn how AI-driven tools are accelerating threat modeling and supply chain management, why abstracted "squishy middle" infrastructure presents new attack vectors, and how to foster a curious, error-friendly engineering culture. Get motivated to enable your developers, simplify system abstractions, and build collaborative bridges across your entire organization! Takeaways: The Pace of Agentic Development: AI tools and agentic development aren't changing core security fundamentals; rather, they are accelerating execution and making practices like threat modeling and supply chain fixes faster to implement.Preserving Systems Thinking: While AI lowers barriers to coding, engineers and security teams must still maintain deep reading and architectural comprehension to diagnose complex system vulnerabilities.The Danger of the "Squishy Middle": Modern abstracted platforms (like Replit or Lovable) consolidate credentials and environment variables into shared SaaS infrastructure, creating lucrative targets for attackers.Embracing Citizen Developers & "Vibe Coding": When non-technical departments prototype apps using AI, security and engineering teams should engage collaboratively rather than dismissively to build organizational alignment.Enabling Over Blocking: Security leaders thrive by finding creative, positive ways to enable business goals securely instead of being the transactional "no guy". Quote of the Show: "I've gotten so much further figuring out how to enable people securely rather than trying to tell people why they are insecure. Nobody wants to talk to the angry security guy." - Ken Toler Links: X: RelotnekLinkedIn: https://www.linkedin.com/in/kentoler/Website: https://www.asgardsec.com Ways to Tune In: Spotify: https://open.spotify.com/show/5LuXXqbK9k9rrVRFsdGzl0 Apple Podcasts: https://podcasts.apple.com/podcast/cyber-smokehouse/id1872442297 Amazon Music: https://music.amazon.com/podcasts/40a6c0da-242f-404b-8bd3-9f4997f19c47 iHeart Radio: https://iheart.com/podcast/319629841/ Podchaser: https://www.podchaser.com/podcasts/cyber-smokehouse-6356550

Trailer

Cyber Smokehouse Trailer!

This is Cyber Smokehouse. Join Ernie and Graeme as they grill the minds, dig into the experience, and serve up the stories of leaders in cybersecurity. Cyber Smokehouse is sponsored by TBDCyber, a cybersecurity strategy consulting firm.

This is Cyber Smokehouse. Join Ernie and Graeme as they grill the minds, dig into the experience, and serve up the stories of leaders in cybersecurity. Cyber Smokehouse is sponsored by TBDCyber, a cybersecurity strategy consulting firm.

Creator

TBDCyber
Years Active

2026
Episodes

36
Rating

Clean
Copyright

© TBDCyber
Show Website

Cyber Smokehouse