Undated
Mark Alvarado is the chief information security officer (CISO) of Academy Sports + Outdoors.
“Today's guest is Mark Alvarado, CISO at Academy Sports and Outdoors.”
Topic
Mark Alvarado
18 facts from 1 episode, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
Undated
Mark Alvarado says he has worked in IT for about 22 to 23 years and began his career as a business analyst rather than in cybersecurity.
“I've been in IT for twenty two years and twenty three now, going on twenty three. And I actually started off as a business analyst, not in cybersecurity”
Undated
Mark Alvarado says he worked in high-speed manufacturing for eleven years, was laid off, and was then hired as a business analyst by his brother-in-law's IT consulting company.
“I was in high speed manufacturing for eleven years, got laid off, had a brother in law who had a IT consulting company, brought me in on as a business analyst”
Undated
Mark Alvarado says he writes a problem-statement document that feeds into a project charter before seeking money for a new security tool.
“I have a a document that I turn that's going into a project charter.”
Undated
Mark Alvarado says a security purchase that fails to solve its problem wastes shareholder money at a publicly traded company.
“And if you're war working for a publicly traded company, you've wasted shareholder dollar, right?”
Undated
Mark Alvarado says AI tools typically use a specific identity to communicate with other systems, which is why identity and privileged access management matter before deploying AI.
“lots of times AI is going to use a specific identity to be able to talk back and forth to the systems.”
Undated
Mark Alvarado says data classification matters because some data is critical and could bring regulatory trouble if compromised, while other data is low-risk.
“not all data is equally weighted, right? Some data is critical data and then get you in trouble with regulators, and some is not.”
Undated
Mark Alvarado says perimeter and network security should let a company inspect data in transit, detect a malicious payload and cut the network connection.
“You're gonna want to be able to see if it turns out that it has a malicious uh payload in it that you can kill the network connection”
Undated
Mark Alvarado says a CISO's job is to keep security events from becoming material, meaning costly to the company, rather than to stop every incident.
“Your job is to keep the event from being material, right? And so material meaning where it's gonna cost a company.”
Undated
Mark Alvarado says the threshold at which a security event counts as material differs between companies and each company should set its own.
“the material threshold is different for every company, and each company should determine what that material threshold is”
Undated
Mark Alvarado uses an analogy in which the network is the road, the device is the car, the user ID is the driver and the password is the keys.
“The road is the network, the car is your device, whether it's your mobile device or your laptop. The user ID is you who drives it, and the keys is your password.”
Undated
Mark Alvarado says that computers must still communicate across networks and that networking has not changed much since its invention.
“You have to talk via the network, and that network hasn't changed that much.”
Undated
Mark Alvarado notes that passwords are still generally required, though passwordless approaches are being discussed.
“And you still require passwords, although there's now things talking about about passwordless and various other things”
Undated
Mark Alvarado describes using AI to benchmark a person's normal daily behavior so that impersonation or rogue activity stands out.
“You start benchmarking with AI and says, here is the way Yolandi goes about her day.”
Undated
Mark Alvarado says security teams can take an automated action first, such as disabling access, investigate afterwards, and restore access if it was a false positive.
“you do an action first, investigate, turns out that, oh, you know, it was a false positive. Cool, get the car back on the road.”
Undated
Mark Alvarado says AI-based security tools cost somewhat more but that he considers the cost justified.
“It's a little bit more expensive, but I think the cost is justified.”
Undated
Mark Alvarado says cybercriminals mostly rely on old, familiar tricks because people keep falling for them.
“It's the old tried and true things, right? Because humans, we fall for these things.”
Undated
Mark Alvarado argues that social media users voluntarily share personal details such as meals, workouts and vacations, and so bear responsibility for their data.
“did anyone from any of those social media outlets ask you for your information? Did anyone force you to put your food on there, your workout schedule, your vacation trips”
Episodes