Person
1 episodes · 17 quoted claims
Mark Alvarado says he has worked in IT for about 22 to 23 years and began his career as a business analyst rather than in cybersecurity.
“I've been in IT for twenty two years and twenty three now, going on twenty three. And I actually started off as a business analyst, not in cybersecurity”
Mark Alvarado says he worked in high-speed manufacturing for eleven years, was laid off, and was then hired as a business analyst by his brother-in-law's IT consulting company.
“I was in high speed manufacturing for eleven years, got laid off, had a brother in law who had a IT consulting company, brought me in on as a business analyst”
Mark Alvarado says he writes a problem-statement document that feeds into a project charter before seeking money for a new security tool.
“I have a a document that I turn that's going into a project charter.”
Mark Alvarado says a security purchase that fails to solve its problem wastes shareholder money at a publicly traded company.
“And if you're war working for a publicly traded company, you've wasted shareholder dollar, right?”
Mark Alvarado says AI tools typically use a specific identity to communicate with other systems, which is why identity and privileged access management matter before deploying AI.
“lots of times AI is going to use a specific identity to be able to talk back and forth to the systems.”
Mark Alvarado says data classification matters because some data is critical and could bring regulatory trouble if compromised, while other data is low-risk.
“not all data is equally weighted, right? Some data is critical data and then get you in trouble with regulators, and some is not.”
Mark Alvarado says perimeter and network security should let a company inspect data in transit, detect a malicious payload and cut the network connection.
“You're gonna want to be able to see if it turns out that it has a malicious uh payload in it that you can kill the network connection”
Mark Alvarado says a CISO's job is to keep security events from becoming material, meaning costly to the company, rather than to stop every incident.
“Your job is to keep the event from being material, right? And so material meaning where it's gonna cost a company.”
Mark Alvarado says the threshold at which a security event counts as material differs between companies and each company should set its own.
“the material threshold is different for every company, and each company should determine what that material threshold is”
Mark Alvarado uses an analogy in which the network is the road, the device is the car, the user ID is the driver and the password is the keys.
“The road is the network, the car is your device, whether it's your mobile device or your laptop. The user ID is you who drives it, and the keys is your password.”
Mark Alvarado says that computers must still communicate across networks and that networking has not changed much since its invention.
“You have to talk via the network, and that network hasn't changed that much.”
Mark Alvarado notes that passwords are still generally required, though passwordless approaches are being discussed.
“And you still require passwords, although there's now things talking about about passwordless and various other things”
Mark Alvarado describes using AI to benchmark a person's normal daily behavior so that impersonation or rogue activity stands out.
“You start benchmarking with AI and says, here is the way Yolandi goes about her day.”
Mark Alvarado says security teams can take an automated action first, such as disabling access, investigate afterwards, and restore access if it was a false positive.
“you do an action first, investigate, turns out that, oh, you know, it was a false positive. Cool, get the car back on the road.”
Mark Alvarado says AI-based security tools cost somewhat more but that he considers the cost justified.
“It's a little bit more expensive, but I think the cost is justified.”
Mark Alvarado says cybercriminals mostly rely on old, familiar tricks because people keep falling for them.
“It's the old tried and true things, right? Because humans, we fall for these things.”
Mark Alvarado argues that social media users voluntarily share personal details such as meals, workouts and vacations, and so bear responsibility for their data.
“did anyone from any of those social media outlets ask you for your information? Did anyone force you to put your food on there, your workout schedule, your vacation trips”