You have been temporarily restricted. Please be more thoughtful when adding content for your portfolio. Your portfolio and digital media kit and should be reflective of the professional image you wish to convey. Accounts may be temporarily restricted if we receive reports of spamming or if the system detects excessive entries.
Membership
Publish your original ideas on the Thinkers360 platform!
This feature is available for Pro and Pro-Plus Members Only.
Speaker Bureau functionality whereby individuals can be featured speakers within our Speaker Bureau service and enterprises can find and work with speakers.
This feature is available for Pro, Pro-Plus, Premium and Enterprise Members Only.
Highlight your featured products and services within our company directory for enhanced visibility to active B2B buyers worldwide. This feature is available for Pro, Pro Plus, Premium and Enterprise Members Only.
Contribute to the Thinkers360 Member Blog and have your thought leadership featured on our web site, newsletter and social channels. Reach our opt-in B2B thought leader community and influencer marketplace with over 100M followers on social media combined!
You’ve reached your daily limit for entering quotes. Please only add personally-authored content which is reflective of your digital media kit and thought leadership portfolio.
Thinkers360 Content Library
For full access to the Thinkers360 content library, please join ourContent Planor become a contributor by posting your own personally-authored content into the system viaAdd PublicationorImport Publication.
Dashboard
Unlock your personalized dashboard including metrics for your member blogs and press releases as well as all the features and benefits of our member plans!
Interested in getting your own thought leader profile? Get Started Today.
Kayne McGladrey
Field CISO at Hyperproof
Bellingham, United States
The modern company has an implicit social contract to protect the data entrusted to it. As a cybersecurity professional, my role is to advise companies on how to uphold that social contract by managing risks and deterring and denying threat actors. My consultative approach is the result of decades of experience working with Fortune 500 and Global 1000 companies.
The ability to fluently speak the languages of both business and technology and effectively communicate complex concepts to non-technical audiences has not only facilitated conversation with company leadership in developing and implementing effective policies to reduce cyber threat, it has made me the go-to person for multiple media outlets and a spokesperson for IEEE’s Public Visibility Initiative.
One of my career priorities is to inspire under-represented communities to pursue careers in cybersecurity. Talent is not limited by geography or background. Because I look beyond the usual circles for talent, trust their abilities, and have an eagerness to help people succeed, I have been able to build effective teams despite the continued challenges of low unemployment in cybersecurity careers.
Available For: Influencing, Speaking Travels From: Bellingham, WA Speaking Topics: Cybersecurity, Compliance, Risk
· Working to increase the diversity of perspectives on enterprise cyber security challenges and opportunities.
· Dynamically responding to and anticipating the needs of the cyber security marketplace through unique and timely content.
· Serving as an “early explainer” to articulate “why” the subject matter is important to current practitioners and the next generation of cyber professionals.
Hyperproof's 5th Annual IT Risk and Compliance Benchmark Report Reveals a Pressing Need for Unified GRC Solutions
Hyperproof
February 22, 2024
"Each year, our benchmark report provides invaluable insights into the evolving priorities and challenges facing IT and GRC professionals," said Kayne McGladrey, Field CISO at Hyperproof. "This year's findings underscore the growing need for organizations to streamline their GRC processes and adopt integrated solutions to effectively navigate the complex risk and compliance landscape."
Survey Findings Show Link Between Data Silos and Security Vulnerabilities
Dark Reading
April 13, 2023
A recent survey showed a surprising correlation between those who operate their businesses with risk and compliance data in silos and those who experienced data breaches in the last 24 months.
Setting The Four Cornerstones Of Cloud Security: Accountability, Strategy, Visibility & Enablement
CSHub
March 29, 2021
Read this report on:
- Identifying accountability for cloud security across the enterprise
- Conceiving of a cloud security strategy to ensure that the business consults and informs the cyber security operation
- Gaining true visibility of the entire organization from on-prem to the cloud
- Adopting common language along with a newly assumed forward posture to find the edge of business innovation and enable it
Boards need to brush up on cybersecurity governance, survey finds
Cybersecurity Dive
March 29, 2024
CISOs now face substantial personal risks, as seen in cases like Uber and SolarWinds where the SEC has taken legal action against the security chiefs. The primary risk is both personal and professional liability for the CISO, according to Kayne McGladrey, field CISO at Hyperproof. The problem, however, is that boards unaware of the business risks from poor cybersecurity are unlikely to include the CISO in the Directors & Officers insurance policy. “This exposes CISOs to substantial risk,” McGladrey told Cybersecurity Dive.
Cybersecurity in Financial Disclosures: 11 Topics Your Section 1C of 10-K Filings Should Address
Hyperproof
March 25, 2024
Despite this guidance mandating only four disclosures (identifying and managing risks, disclosing material breaches, board oversight, and management’s role), over 40% of the 2,100+ 10-K filings I’ve reviewed between January 1 and March 11, 2024 disclosed eleven distinct topics.
Companies are disclosing more information than required in their 10-K filings for various reasons. One is that they lack a broad consensus how much detail to disclose in Section 1C. The recent civil litigation of SEC vs. Tim Brown and SolarWinds (case 1:23-cv-09518 in the Southern District of New York) significantly influences the disclosure requirements.
What are the pros and cons of shadow IT?
TechTarget
March 06, 2024
As workers develop and deploy technology without any reviews or security assessments, they often increase the organization's exposure to various risks, said Kayne McGladrey, a senior member of the IEEE and field CISO at Hyperproof, a compliance management software company, based in Seattle.
Employees should be aware that the IT department conducts thorough research to ensure the organization's technology is safe and compliant with company policies.
The technology itself could be vulnerable to cyberattacks, as unauthorized tech rarely goes through the same level of scrutiny that technology selected and onboarded by IT does, he said.
The practice of shadow IT could open the organization to critical weaknesses.
Hackers are known to look for such vulnerabilities, further upping the cybersecurity risk, McGladrey said.
IT teams might face challenges in managing unfamiliar technologies not approved by the organization.
As the unauthorized technology falls outside of IT's knowledge and control, the IT team might have less visibility into and a diminished ability to monitor its use, he said. That means IT might not quickly detect nefarious activity.
Such practices could lead to potential long-term delays in addressing cybersecurity issues.
"Shadow IT might make it harder for the company to even know it has been breached," McGladrey said.
Businesses need to provide better cybersecurity training – here's how
Raconteur
January 03, 2024
Training should be tailored to specific cyber risks in each learner’s role, monitored and regularly updated, according to McGladrey, whose company provides a platform offering risk, security and compliance assurance.
For instance, “while all employees should be made aware of phishing techniques, specialised training in, say, incident-handling procedures should be delivered to the incident-response team only”, he explains. “Similarly, organisations should provide training only if it’s intended to reduce a specific risk, as it’s unreasonable to expect employees to become knowledgeable about every possible topic in this field.”
McGladrey adds that employers “should provide annual training at the very minimum, supplemented by micro-training modules after policy violations or incidents”.
While a firm’s CISO and their team will typically lead the training, there are other options. These include engaging external expertise such as dedicated cybersecurity consultancies or a virtual CISO to develop a tailored programme.
Designing and delivering well-targeted courses is only half the battle for firms seeking to improve employee awareness. It’s vital to assess the effectiveness of these interventions to ensure that they’re having the desired effect.
Is Basic Cyber Hygiene Enough in the Age of AI?
CXOToday
January 02, 2024
“These threats are not merely theoretical, although, at the moment, they are still relatively limited in their application,” McGladrey said. “It is reasonable to expect that threat actors will continue to find innovative new uses of generative AI, extending beyond business email compromise, deepfakes, and the generation of attack code.”
Why enterprises need cyber insurance — how and what to buy
SDXCentral
December 20, 2023
“It should be a strategic choice for a company to transfer certain business risks associated with cybersecurity threats, which exceed an acceptable level of risk, to an insurer,” says Kayne McGladrey, a senior member of the IEEE. “The expectation is that the insurer will help lessen the financial impact of significant cyber incidents or data breaches.”
However, this approach assumes companies maintain risk registers with clear definitions and measurement criteria for various risk categories, he notes. “It also presumes they use compliance operations to continuously assess the effectiveness of their current controls in reducing or mitigating these risks.”
3 ways to fix old, unsafe code that lingers from open-source and legacy programs
CSO Online
November 29, 2023
The biggest issue with prioritizing software fixes is that there’s often a disconnect between security controls and business risk outcomes, according to Kayne McGladrey, IEEE senior member and field CISO at Hyperproof, a security and risk company. That makes it harder to get executive support, he says. Code maintenance and dependency management aren’t sexy topics. Instead, executive interest tends to focus “on the financial or reputational repercussions of downtime,” McGladrey tells CSO.
“To address this problem, organizations should document and agree upon the business risks associated with both first-party and third-party code. Then they need to determine how much risk they’re willing to accept in areas like reputational damage, financial damage, or legal scrutiny. After there’s executive-level consensus, business owners of critical systems should work to identify and implement controls to reduce those risks,” McGladrey says.
The FTC updated the Safeguards Rule. Here’s how to avoid notification events.
Hyperproof
November 17, 2023
The primary emphasis of the new revision is that a ‘notification event’ now triggers the reporting process, described as any unauthorized acquisition of unencrypted customer information. This is a change from the earlier draft of the Rule, which used the term ‘security event’ to describe unauthorized system access or information misuse. This change may result in some confusion, unfortunately, described below.
FedRAMP Rev. 5: How Cloud Service Providers Can Prepare
Dark Reading
October 23, 2023
This article covers high-level information that cloud service providers (CSPs) need to know to prepare for their transition to FedRAMP Rev. 5, as documented in the "FedRAMP Baselines Rev. 5 Transition Guide."
37 Cybersecurity Awareness Month Quotes from Industry Experts in 2023
Solutions Review
October 11, 2023
When CISOs work with go-to-market teams, cybersecurity transforms from a mere cost center into a valuable business function. This change is crucial in B2B interactions where robust cybersecurity controls offer a competitive advantage. A centralized inventory of cybersecurity controls, grounded in current and past contracts, helps businesses gauge the financial impact of these partnerships. This inventory also identifies unnecessary or redundant controls, offering an opportunity for cost reduction and operational streamlining. By updating this centralized list after the termination of contracts, the business can further optimize both its security posture and operational costs. This integrated strategy empowers the business to make well-informed, data-driven decisions that enhance profitability while maintaining robust security controls.
Tasks that bog down security teams (and what to do about them)
CSO Online
August 23, 2023
With security now a board-level concern and the focus of a growing number of regulations, today's CISOs and their team members are spending a lot more time responding to questions about their security programs. Providing answers -- whether to internal compliance teams who need the information to fulfil legal obligations or external business partners who want assurances -- is now an expected part of the modern security department's responsibilities. Yet it's not the most effective use of worker time. "It's not only frustrating, but it also sucks up a lot of time," says Kayne McGladrey, a senior member of the Institute of Electrical and Electronics Engineers (IEEE), a nonprofit professional association, and field CISO at Hyperproof. There are strategies for meeting security's obligations to provide information without tying up CISOs and their teams too much, he and others say. McGladrey says automation is one such strategy, saying that "evidence of control operations should be automated, and evidence of effectiveness can also be automated."
The SEC approved new disclosure requirements. Here’s what you need to know.
Security Boulevard
August 01, 2023
Public companies will have to change a lot of their processes to adhere to these new rules. They’ll need to carefully evaluate the information they disclose about cybersecurity incidents, and those that don’t comply will potentially face investor lawsuits, SEC enforcement actions, and potential damage to their reputations. Board members will have to get up-to-speed quickly on their understanding of cybersecurity risk. CISOs will likely lean on platforms like Hyperproof to help educate their boards about their risk postures and how risk is mitigated at their companies. They can also use Hyperproof to inventory their controls when describing how they’re managing threats and risks to better answer questions from the board.
Managing Risk and Compliance Through a Recession
Solutions Review
March 24, 2023
As security professionals, managing risk and compliance efficiently during a recession is essential for our organizations. Here's a structured approach to evaluate control effectiveness and identify potential budgetary efficiencies:
• Gap Analysis: Map existing controls to documented risks, ensuring a consolidated inventory.
• Automate Evidence Collection: Simplify the process of gathering control operation and effectiveness evidence, fostering collaboration.
• Automate Control Testing: Implement automated testing to quickly identify and resolve issues, increasing overall effectiveness.
• Estimate Control Effectiveness: Assess control health to make data-driven decisions for risk reduction strategies.
• Evaluate Outlier Controls: Examine controls for potential budgetary efficiencies, optimizing resource allocation.
• Annual Control Assessment: Revisit the process annually to identify control gaps, inform budget planning, and drive cost savings.
• Leverage for Cyber Insurance: Use control assessments in conversations with insurers, potentially reducing premiums.
Adopting this end-to-end process can lead to a more secure organization, even in a challenging economic climate.
Hack Me If You Can
American Banker
February 21, 2023
A hacker can say that an institution has 90 days to fix a vulnerability before publicly divulging the secret, and for the vulnerable bank or credit union, that might come off as extortion or a threat. However, it is well within the boundaries of normal security research to do that, according to Kayne McGladrey, Field CISO for the security and compliance company Hyperproof.
The Ultimate Guide to Enterprise Risk Management
Hyperproof
December 13, 2022
Enterprise risk management is a nebulous, hard-to-define topic area. It encompasses a large variety of risks and procedures for the enterprise and it differs greatly from traditional risk management. So, what exactly is enterprise risk management? In this article, we’ll establish what it is, present common strategies for enterprise risk management, and emphasize the value of having enterprise-ready software to help simplify the process.
Three Key Predictions for 2023: The Year of Risk
ISACA
December 09, 2022
As we approach 2023, it’s natural to look back on the biggest security events that took place this year and anticipate their effect next year. The previous two years have shown that our world is full of complexity and uncertainty, despite all the advances in data collection, compliance operations automation, and SaaS technology. Risk modelers and analytics experts know we can’t predict or control the world with any degree of certainty, but it’s important to brace ourselves for the upcoming threats and new opportunities the coming year will present. Here are three key risk management predictions we have for 2023 that will shape the risk management industry.
How to Upgrade Your Security Program from ISO 27001:2013 to ISO 27001:2022
Hyperproof
December 08, 2022
Since the initial release of ISO 27001, the threat actor economy has diversified substantially, with both criminal groups and nation states developing and selling offensive cyber products and cyber surveillance solutions. In response, cybersecurity experts have documented and developed best practices and actionable guidance for organizations to effectively manage their cybersecurity risks. ISO 27001:2022 provides a risk-based reference set of information security, cybersecurity, and privacy controls that have been adopted by modern organizations as part of deploying cloud technologies and addressing data protection requirements driven by GDPR.
It's Time to Regard Cybersecurity as Human Safety
Industry Week
November 17, 2022
Cultural change takes time and is a journey, not a destination. Senior leaders, managers, and individual contributors all have a role and responsibility in ensuring that manufacturing companies stay safe from cybersecurity risks. Elevating cyber risks to the same level as safety risks will help companies to comprehensively understand and manage their risks now and in the coming years.
Best practices for cryptocurrency firms and digital currency firms managing money
Security Magazine
October 26, 2022
A Consent Order issued in August 2022 by the New York State Department of Financial Services (“NYDFS”) for a $30 million fine on Robinhood Crypto, LLC (“RHC”) shows that cryptocurrency firms are not immune from regulatory and legal obligations. The Consent Order can be read as a partial roadmap for similar firms in establishing best practices for ongoing successful compliance operations, which help firms to remain compliant and secure concurrently.
Based on the Consent Order, firms in this space should be prepared to demonstrate to NYDFS how their compliance programs meet the standards outlined in DFS regulations, particularly the Virtual Currency Regulation, the Money Transmitter Regulation, the Cybersecurity Regulation, and the Transactions Monitoring Regulation. Firms should also ensure that they have documented policies and procedures required by the Cybersecurity Regulation.
4 Stakeholders Critical to Addressing the Cybersecurity Workforce Gap
Dark Reading
October 17, 2022
ic and International Studies (CSIS) published the report "A Human Capital Crisis in Cybersecurity," which noted "there are about 1,000 security people in the US who have the specialized security skills to operate effectively in cyberspace. We need 10,000 to 30,000." Twelve years later, the Cyberspace Solarium Commission 2.0 Workforce Development Agenda for the National Cyber Director observed that "in the United States, there are almost 600,000 open cybersecurity jobs across the private sector and federal, state, and local governments — a remarkable gap considering that the field currently employs just over a million professionals." This is not an encouraging trend.
What Thoma Bravo’s latest acquisition reveals about identity management
Venture Beat
October 14, 2022
Identity management of users and devices is key for CISOs to manage the risks associated with unauthorized access to sensitive data and systems, according to Kayne McGladrey, Field CISO at Hyperproof and Senior IEEE Member. “From a control operations standpoint, the two most important capabilities are the ability to validate a user’s behavior when it deviates from the norm, and the ability to quickly de-provision access when it is no longer needed,’’ McGladrey told VentureBeat.
For example, if a user regularly logs in from Washington State using their Windows-powered computer to access a single program, there’s little reason to prompt them for a second authentication factor, he said. “But when the device changes, perhaps a new Mac computer that’s not configured correctly, or their location suddenly changes to Australia, they should be prompted for multifactor authentication as part of identity validation before being allowed to access those data,” McGladrey said. When a user leaves an organization, their identity access should be rapidly revoked across all platforms and devices. Otherwise, organizations run the risk of a threat actor using the older access and credentials, McGladrey added.
Banks can leverage automation, regulation for cyberattack prevention
Bank Automation News
October 13, 2022
Financial institutions can avoid becoming the next victim of a costly cyberattack by leveraging automation and existing legislation. Automation can help to mitigate risk when handling personal client information by storing records efficiently and securely, Kayne McGladrey, field chief information security officer at Hyperproof, told Bank Automation News. “If you don’t automate, that has a cost, because now people are spending their time doing control testing,” he said. “The organizations that recognize that are going to probably spend a lot less time on compliance and have a happier team, because they’re not doing routine stuff that they should have automated.”
GRC Platforms: 5 Features You Need
Hyperproof
September 29, 2022
"Choosing the right GRC platform is hard, but knowing what’s most important for you and your organization is key to choosing the right one. Ultimately, what matters most is that you find a platform with all the features listed above that will enable your team to maintain compliance without the headache of manual processes or inflexible legacy solutions."
Exploring the Advantages of Deploying DPUs in the Data Center
CIO Magazine
June 24, 2022
“Moving network and security functions to a DPU allows server CPUs to be more efficient at running core applications and operating systems without sacrificing security controls,” said Kayne McGladrey (@kaynemcgladrey), Security Architect at Ascent Solutions LLC. “DPUs should also expedite the application of Zero Trust principles by allowing finer-grained micro-segmentation of applications and networks so that there is limited or no unearned trust.”
Secure Collaboration: Adopt an approach that balances people and technology
CIO
March 21, 2022
“Make the security guardrails as invisible as possible to your end users and ensure that organizational change management is part of your planning for rollout,” says Kayne McGladrey, security architect, strategy and GRC practice lead at Ascent Solutions LLC. “This increases adoption of new collaboration technologies by ensuring that users are aware that the solution exists and understand that it’s easy to use. End users won’t use a solution specifically because it’s secure; rather, they’ll adopt it if it meets their needs easily and quickly.”
What’s new in cybersecurity for physical security systems?
Source Security
June 01, 2023
The article explores the growing cyber resilience in the physical security industry, highlighting increased customer demands for compliance testing, the burgeoning use of cyber-safe cloud services, and the global adoption of the zero trust framework. It underscores the role of robust cybersecurity controls and the impact of IoT technologies in transforming physical security systems' connectivity and security posture.
Expert Panel Roundtable: What's new in cybersecurity for physical security systems?
Security Informed
June 01, 2023
Discover how manufacturers in the physical security industry are embracing enhanced cybersecurity measures and implementing them at scale. From streamlining maintenance and updates to integrating cloud solutions, these efforts aim to protect against evolving threats and human error. The article highlights the importance of compliance, secure communication, and training employees on best practices. Explore insights on zero trust principles, secure APIs, and evolving certifications, all contributing to the continuous improvement of cybersecurity in physical security systems.
Cyber Threat Prevention for PSOs: Credential Stuffing (Part 1 of 8)
PSVillage
May 17, 2017
Credential Stuffing, unfortunately, is not a new attack rather an existing attack that the bad guys have found a way to operate at economies of scale. Credential stuffing is a type of automated...
Cyber Threat Prevention for PSOs: Provisioning and De-provisioning (Part 2 of 8)
PSVillage
May 17, 2017
In this second episode of our 8 part series, Kayne McGladrey will be discussing Provisioning and De-Provisioning. In general, provisioning means "providing" or making a resource available. De-...
Cyber Threat Prevention for PSOs: Identity and Access Management (Part 3 of 8)
PSVillage
May 17, 2017
In this third episode of our 8 part series, Kayne McGladrey will walk you through three primary Identity and Access Management (IAM) systems available for your end users to have access to your...
Cyber Threat Prevention for PSOs: Privileged Access Management (Part 4 of 8)
PSVillage
May 17, 2017
In this fourth episode of our 8 part series, Kayne McGladrey will cover Identity Access Management system and a specific resource when it comes to where your client files are stored, or your...
Cyber Threat Prevention for PSOs: User and Entity Behavior Analysis (Part 5 of 8)
PSVillage
May 17, 2017
When a hacker has intercepted your credentials and login information and attempts to use that information, an effective User and Entity Behavior Analysis (UEBA) solution can be what saves you from...
Cyber Threat Prevention for PSOs: Multi-Factor Authentication (Part 6 of 8)
PSVillage
May 17, 2017
In this sixth episode of our 8 part series, Kayne McGladrey reviews Multi-Factor Authentication (MFA). MFA can be used in many instances to ensure the identity of a person trying to access or...
Cyber Threat Prevention for PSOs: Attestation Reporting (Part 7 of 8)
PSVillage
May 17, 2017
Kayne McGladrey discusses Attestation Reporting in the seventh video in this series. The goal of Attestation Reporting is to ensure that a user should have the access that has been requested and...
Cyber Threat Prevention for PSOs: Certification Campaigns (Part 8 of 8)
PSVillage
May 17, 2017
In this last video in the series of 8, We will see how the process of certification in consulting works. IGA, a governance administration tool, will produce certification reports and should work...
The proverbial endpoint is everywhere. Consumers have more IoT and mobile devices than ever before. Industrial IoT is becoming ubiquitous and IoT malware is as common as cell phones. While conveniences are making their way into every facet of life, so are malicious software, social engineering attack and all manner of bad actors.
Include Cybersecurity
Include Cybersecurity
January 05, 2018
Include Cybersecurity is a non-profit organization dedicated to changing the face of cybersecurity professionals. As a co-founder alongside Carmen Marsh, I am responsible for helping to find volunteers and speakers, moderating panel discussions, social media outreach, fundraising, and establishing connections with the many underrepresented communities in cybersecurity.
Senior member is the highest grade for which IEEE members can apply. IEEE members can self-nominate, or be nominated, for Senior Member grade.
To be eligible for application or nomination, candidates must:
* Be engineers, scientists, educators, technical executives, or originators in IEEE-designated fields
* Have experience reflecting professional maturity
* Have been in professional practice for at least ten years (with some credit for certain degrees)
* Show significant performance over a period of at least five of their years in professional practice
Top 50 IoT Influencers to follow in 2023
Engatica
November 08, 2022
Can IoT reach a level where businesses can build scalable solutions for the future? Will it help us have a better 2030? Well, the experts should know. And they should have a better idea of it.
Cloud Thought Leader of the Day ️
WhizLabs
July 09, 2021
Having 28+ years of experience in the field, Kayne McGladrey's role is to advise companies on how to uphold that social contract by managing risks and deterring and denying threat actors.
His consultative approach is the result of decades of experience working with Fortune 500 and Global 1000 companies. One of his career priorities is to inspire underrepresented communities to pursue careers in cybersecurity.
His simplification of complex concepts to non-tech audiences has given him more reach on his social platforms. His blogs are a must-read for both tech and non-tech people who are interested in cybersecurity.
Check out his blogs here: https://lnkd.in/efHU2Mp
Currently, he is working as Security Architect / Strategy and GRC Practice Lead at Ascent Solutions LLC, a premier productivity, security, and innovation consulting firm.
We thank Kayne for his exceptional contribution to the cloud discipline.
150+ Top Global Cloud Thought Leaders and Next Generation Leaders of 2021
WhizLabs
April 19, 2021
Having 28+ years of experience in the field, Kayne’s expert approach on how to uphold that social contract by managing risks and deterring and denying threat actors is appreciated by many companies. One of his priorities is to inspire under-represented communities to pursue careers in cybersecurity. His simplification of complex concepts to non-tech audiences has given him more reach on his social platform. His blogs are must read for both technical and non-technical people who are interested in cybersecurity.
Top Cyber Pro Awards for 2020
Top Cyber Pro
December 01, 2020
Kayne McGladrey is a senior member of the IEEE and the cybersecurity strategist for Ascent Solutions. He has over two decades of experience in cybersecurity and has served as a CISO and advisory board member, and focuses on the policy, social, and economic effects of cybersecurity lapses to individuals, communities, and the nation.
Getting AI Right: 3 Challenges for the Future
IEEE Transmitter
October 25, 2023
AI systems need to be trained using data. But data sets are frequently made by people who can be biased or inaccurate. As a result, AI systems can perpetuate biases. This is especially true in hiring practices and in criminal justice, and managing those biases can be difficult.
“We can audit software code, manually or automatically, for privacy defects,” said IEEE Senior Member Kayne McGladrey. “Similarly, we can audit software code for security defects. We cannot currently audit software code for ethical defects or bias, and much of the coming regulation is going to screen the outcomes of AI models for discriminatory outcomes.”
Cybersecurity Concerns Continue
IEEE Transmitter
October 25, 2023
Realistically, the use of AI in cybersecurity will help to reduce the punishing cognitive load on tier 1 security operation center (SOC) analysts and incident responders. Rather than having to comb through a needlestack looking for a needle, AI promises to automate much of the correlation across vast amounts of data that humans struggle with.
What is End-To-End Encryption? 7 Questions Answered
IEEE Transmitter
August 17, 2023
“End-to-end encryption is generally agreed upon as being a useful technology for protecting the data of businesses and consumers,” said IEEE Senior Member Kayne McGladrey. “Online shopping, for example, would not be as popular or feasible if a consumer’s payment information could easily be intercepted. Similarly, private video calls over the internet by senior executives or government officials would be far too risky if anyone could watch.”
Telehealth is Booming: Here’s What You Need to Know
IEEE Transmitter
October 26, 2020
Telehealth, often referred to as virtual doctor appointments, has been utilized in remote regions that do not have local medical resources for several decades. But when COVID-19 began impacting many countries across the globe, telehealth became the go-to method for checking in with your doctor about possible COVID-19 symptoms or other healthcare check-ups.
How to Keep Your Video Conferences Secure From Intruders
IEEE Transmitter
April 16, 2020
As the world adjusts to a “new normal” of remote education and work, video conferencing services have surged in demand as people take to these platforms to connect digitally. Yet, these platforms are susceptible to a variety of intrusions that could lead to the theft of private and company data or inappropriately distracting calls and meetings that leave participants feeling they have no control.
To protect your students, employees, families and yourself from these types of cyber disruptions, we asked IEEE Member Kayne McGladrey for cybersecurity tips for safe video conferencing.
Decreasing Risk Through Enterprise Compliance
CSHub
March 02, 2020
Compliance is often viewed as a reaction for organizations. The auditing of compliance becomes the event that is anticipated with resources and preparation aligned to culminate in the audit itself. A famous approach used in product development is that launch is a process, not an event. The spirit of that message is important for security leaders to consider in building a sustainable business case for compliance. Compliance should be viewed as a continuous, organizational process.
Should You Be Worried About Airport Cybersecurity Threats?
IEEE Transmitter
February 13, 2020
Navigating and traveling through an airport can be stressful. Trying to get through security while searching for a boarding pass and assessing whether there’s enough time to jump on that long line for a desperately needed cup of coffee is a universal experience.
With all of that juggling going on, the last thing on your mind are the cybersecurity threats that you might encounter at the airport along the way. Luckily, cybersecurity experts have already put into place a variety of technologies to protect us and keep our cyber lives safe while we travel. So take a deep breath and focus on getting to your seat in a timely manner instead.
Passwords, Multi-Factor Authentication and Cybersecurity
IEEE Transmitter
April 16, 2018
Device location and user behavior can shed a lot more light on a login attempt, yet not all MFA solutions currently incorporate them, says McGladrey. If organizations switched to better access management systems, the cost to successfully infiltrate accounts would rise exponentially, barring “all but the best-funded nation-state actors and APTs.”
Why AI Could be Cybersecurity’s Next Big Thing
IEEE Transmitter
February 16, 2018
For many organizations, analysts in security operations centers spend their days sifting through hoards of log files for suspicious activity. The repetitive nature of this work makes AI an ideal replacement, says Kayne McGladrey, IEEE Member, Director of Information Security Services at Integral Partners (US): “Artificial intelligence has been shown to be good at pattern recognition and correlation over a vast number of data points, and can make connections faster than human analysts would.”
Smart Office Controls
IEEE Transmitter
April 20, 2017
Forget light switches and thermostat buttons in the office. IoT sensors can control when lights go on and off, as well as heating and cooling in the office. Lights can go on and off based on your location.
IOT and Big Data: A Day in a Connected Life
IEEE Transmitter
April 05, 2017
How could your data be used?
“Office workers often find that all the meeting rooms are booked, which can mean consulting teams that arrive to meet with a client must search for an unoccupied meeting room in which to squat. Regardless of reservation status, IoT sensors can impassively detect if meeting rooms are unoccupied and offer them on a first-come, first-served basis.”
What are the security and privacy concerns with this device?
“Insecure IoT heating, ventilation and air conditioning systems are a threat to buildings and cities. For example, in the summer, a hard-coded administrative password in an IoT thermostat deployed in smart buildings in New York City could be compromised by an adversary who forces the thermostats to continuously run cooling systems. The spike in electrical usage could cause a very costly, life-threatening blackout.”
Understanding Cybersecurity Breaches at Consulting Firms
IEEE Transmitter
March 30, 2017
Cybersecurity threats are affecting consulting and professional service firms causing substantial losses. Kayne McGladrey (@kaynemcgladrey), an IEEE Member and professional services director, weighed in on how consulting firms can mitigate threats, keep client data safe and learn from current breaches.
Bridging the Gap: Communicating Cyber Risks as Business Imperatives
ISC2
October 25, 2023
As CISOs make plans to secure operating budgets for the new financial year, they face the age-old challenge of convincing stakeholders, who often see cybersecurity and privacy as a cost center, to invest in this area. It's time to change the narrative. Discover how to drive more productive conversations about cybersecurity as a strategic growth enabler. Take home actionable ideas for proactively managing controls and risks, increasing efficiency and reducing costs.
2023 IT Compliance and Risk Benchmark Report Findings: The Top 5 Game-Changers
Hyperproof
February 23, 2023
Hyperproof conducts an annual survey to uncover the top challenges IT compliance professionals face and what hot topics they’re focused on in the coming year. We’ve asked over 1,000 survey respondents about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to provide an in-depth view of the market’s current state and what to prepare for this year.
We’ll cover:
The top five findings from the survey
How your peers are planning to handle compliance, audit management, and risk management in the midst of a volatile economy
What companies are doing differently in response to recent and highly publicized security breaches to avoid security lapses and compliance violations
Leading practices for ensuring security, compliance, and risk management today
Closing Keynote - The Most Common Visibility and Compliance Lapses in Your Cloud Vendors’ Environments.
SC Magazine
May 17, 2022
Whenever a key business function is hosted by a cloud-based vendor, your organization cedes a certain amount of control to the service provider. And that sometimes means that your security team lacks visibility into how this third party handles sensitive data and to what degree it successfully meets regulatory compliance standards around privacy and data security. This session will identify some of the most common gaps in visibility and compliance to develop between companies and their SaaS, PaaS and IaaS providers, and explain the root causes behind these lapses so that your own company hopefully can avoid some of these pitfalls.
Opening keynote speech at the Seattle Electrical Conference
Seattle Electrical Conference
December 22, 2020
Our key note speaker Kayne McGladrey today will discuss Cybersecurity. Keeping our websites and our networks secure is one of our biggest challenges in our digital age.
Keynote speech at CIA Conference 2020
CIA Conference
October 26, 2020
Prepare and adapt yourself to evolving threat landscape by listening to our next keynote speaker Mr. Kayne McGladrey, will speak on "Deter, Deny and Defend Against Cyber Attacks."
24th Annual Colloquium for Information Systems Security Education - November 4th, 2020
Colloquium for Information Systems Security Education
September 28, 2020
On November 4th at 8:15 AM Pacific, Kayne McGladrey, CISSP, will give the keynote speech at the Colloquium for Information Systems Security Education and discuss the social and economic impacts of cyber security during a pandemic. Registration is free.
Tags: COVID19, Cybersecurity, Diversity and Inclusion
TAG Cybersecurity - February 2020 Meeting
TAG NW
February 03, 2020
Featured Presentation:
"Best practices for cyber security training programs" by Kayne McGladrey, CISSP
Employees dread the meeting invitation that reads 'Annual mandatory cyber security training in the break room at 1 PM Wednesday'. In this presentation, we'll discuss best practices for creating a reality-based training program that encourages employee participation and builds organizational muscle memory for responding to active threats.
Deter, Deny, and Defend Against the Three Most Common Cyber Attacks
TagNW
November 08, 2019
Cyber attacks are bad and getting worse, and you’d like to turn things around before it’s too late. In this session, you’ll learn how the three most common attacks target people, how to deter and deny threat actors attacking your applications, and how to defend yourself and your community.
Cybersecurity Career Accelerator EXPO
Include Cybersecurity
December 01, 2018
The Cybersecurity Career Accelerator Expo 2018 program is an opportunity for anyone interested in cybersecurity to come receive – and share – useful and relevant information critical to launching – or advancing – a career in cybersecurity. This day-long symposium will be divided into two tracks with sessions designed to benefit novice, entry-level and advanced cybersecurity professionals. The content will be presented in a combination of lectures, workshops and expert panel formats.
Cybersecurity Career Accelerator Expo 2018 is part of the “Include Cybersecurity” initiative focusing on cybersecurity workforce development in the Sacramento Valley. Our mission is to spark interest within traditionally underrepresented groups in exploring an exciting and rewarding career in cybersecurity.
Include Cybersecurity Event 2018
Include Cybersecurity
September 06, 2018
Our panel discussion on September 6th, 2018 presents an opportunity for anyone interested in cybersecurity to learn firsthand from the experts what it takes to succeed. A significant portion of this event will be questions from the audience.
The panelists and speakers are passionate cybersecurity defenders. They are experts in the field and bring first-hand knowledge of what it’s like working as part of a cybersecurity team and how to take the first steps to join this growing community.
Include Cybersecurity 2018
Conferize
September 06, 2018
Every day your news feed has a story about cybersecurity. About a friend that has to replace their credit card due to a breach. A couple that’s trying to repair their credit report due to identity theft. A business laying off staff because of losses from a phishing email.
You are not powerless. All communities are affected by cybercrime, but not all groups of people are working together to fight back against cybercriminals. Our goal is to educate and empower job seekers of all stripes to take the plunge into the cybersecurity world. We want to dispel common myths about what it takes to succeed in a cybersecurity job so that the cybersecurity industry represents the diversity of our nation.
Cybersecurity for Outside Counsel
Clear Law Institute
October 05, 2017
A 2016 American Bar Association survey showed that more than 25% of law firms had at least one data security breach in that year. In the spring of 2017, the Association of Corporate Counsel (“ACC”) released their Model Information Protection and Security Controls for Outside Counsel Possessing Company Confidential Information (“Model ”). The Model provides best practices for data security that outside counsel should use to safeguard their company’s confidential information.
This webinar will show how outside counsel can best implement the ACC’s recommendations to avoid a potentially catastrophic data security breach. Instead of focusing on the easy and self-evident solutions to sections 3, 4, 7, and 8 of the Model, this presentation will focus on the areas where external counsel is most likely to encounter difficulties.
CYBER SECURITY FOR SMALL BUSINESSES AND CONSULTANTS
IEEE
August 08, 2017
Do you feel like you are overwhelmed trying to run your business while defending against the latest cyber threats? Join Kayne McGladrey, speaker, author and Director of Information Security Services for Integral Partners (http://www.ipllc.co) for our upcoming presentation on taking a proactive, risk-oriented approach to cyber security for individual consultants and small businesses.
Kayne will discuss:
- Why you should manage risks based on user identity instead of chasing the latest threats
- How individual consultants can protect themselves
- A vendor-neutral reference architecture for cyber security at small businesses
We will have time for Q&A at the end of the presentation.
Cybersecurity for consultants and small businesses
IEEE-USA
March 30, 2017
Do you feel like you are overwhelmed trying to run your business while defending against the latest cyber threats? Join Kayne McGladrey , speaker, author, and IEEE Member for our upcoming presentation on taking a proactive, risk-oriented approach to cyber security for individual consultants and small businesses. Kayne will discuss:
- Why you should manage risks based on user identity instead of chasing the latest threats
- How individual consultants can protect themselves
- A vendor-neutral reference architecture for cyber security at small businesses
We will have time for Q&A at the end of the presentation.
The Jobs of Tomorrow: Insights on AI and the Future of Work
CXOToday
April 23, 2024
Kayne McGladrey, IEEE Senior Member, noted that the use of generative AI models in business hinges on their ability to provide accurate information. He cited as examples studies of AI models’ abilities to extract information from documents used for financial sector regulation that are frequently relied on to make investment decisions. “Right now, the best AI models get 80 percent of the questions right,” McGladrey said. “They hallucinate the other 20 percent of the time. That’s not a good sign if you think you are making investment decisions based on artificial intelligence telling you this is a great strategy four out of five times.”
The Evolution of the CISO Role in Modern Cybersecurity
Ask a CISSP
April 18, 2024
Welcome back to this week's "Ask A CISSP," where we dive deep into the evolving world of cybersecurity with key industry leaders. In a recent enlightening episode, we were joined by Kayne McGladrey, Field CISO at Hyperproof, to discuss the pressing challenges and transformations within the role of Chief Information Security Officers (CISOs).
For a larger overview of our conversation please check out, "Navigating the Future of Cybersecurity with Kayne McGladrey"
What are the biggest ethical considerations of security technology?
Source Security
April 04, 2024
Algorithmic bias is one of the primary risks associated with emerging physical surveillance technologies. While the risks of facial recognition software are well known and documented, efforts are being taken to adapt computer vision to new and novel use cases. For example, one of the more deeply flawed failures was an attempt to detect aggressive behaviour or body language, which was unfeasible as there was not enough training data available. Other physical security systems will face a similar challenge of not discriminating against individuals based on protected factors due to a lack of training data, or more likely, a lack of gender or racially unbiased training data. Companies considering purchasing advanced or emerging physical security systems should enquire about the training data used in the development of those systems to not be subject to civil penalties resulting from discrimination caused by using said systems.
The Evolving Landscape of Cybersecurity for Medium-Sized Businesses
Cyberfame
February 16, 2024
In recent years, we've seen a significant shift in the threats targeting businesses. "Everybody focused on the human harms, people couldn't check into their hotel rooms; people couldn't use an ATM... the nature of the technical exploits is not what we focus on in terms of harm... that's not what we focus on in terms of harm," states Kayne McGladrey, a field CISO at Hyperproof and senior IEEE member. This reiterates the transition from mere inconvenience to significant operational disruptions and economic consequences that cyber threats now pose.
Kayne McGladrey: The CISO’s Role Is To Advise on Business Risk
The PrOTect OT Cybersecurity Podcast
November 09, 2023
In this episode of The PrOTect OT Cybersecurity Podcast, Aaron and Kayne McGladrey discuss:
Strategic alignment of cybersecurity with business risk
Navigating the changing landscape of cybersecurity
Empowering CISOs in the evolving landscape of cybersecurity
The challenges and opportunities of generative AI
Key Takeaways:
The key to a successful cybersecurity strategy lies in reframing it as a business imperative, focusing on aligning security efforts with business risks, engaging with cross-functional teams, proactively obtaining certifications, and leveraging control design expertise, ensuring a competitive advantage and effective risk management beyond mere compliance and technology concerns.In today's dynamic cybersecurity landscape, CISOs must continually reassess their controls and their alignment with business risks, while also considering the personal liability they bear, making succession planning and strategic adaptability vital for maintaining effective security programs.The role of a CISO is crucial, yet often misunderstood; empowering and respecting CISOs' authority is essential to effectively manage cyber risks and avoid potential disasters, as generic approaches and AI-driven risk registers fall short of addressing the unique challenges faced by businesses.In a world where cybersecurity threats are inevitable, the key lies in fostering resiliency rather than aiming for an unattainable zero-risk goal; while a lot are excited about the potential of education and automation, the lack of regulatory control over generative AI poses a daunting challenge, risking societal upheaval and economic unrest.
"If we don't decide to manage the economic impacts of artificial intelligence, potentially a lot of industries could be at least partially automated. And that has the potential for a lot of social arm where people just don't have jobs. And when you get people who are automated out of a job, what are they going to go do? They're going to do something that everybody can do fine, but it doesn't pay well. Like you end up going and driving for a living or doing deliveries for a living. And you end up with a highly educated workforce that is unhappy. That's like a recipe right there for civil unrest." — Kayne McGladrey
Next-Generation Cybersecurity Defenses Coalesce for Space Systems
Via Satellite
October 23, 2023
“There's the cybersecurity threat and then there's the real threat,” explains Kayne McGladrey, field chief information security officer (CISO) of compliance company Hyperproof, and senior member of the Institute of Electrical and Electronics Engineers (IEEE). “A cybersecurity threat is disruption, like when we saw the Russians invade Ukraine as part of their illegal war, they took down Viasat and not by attacking the satellites themselves, instead, they attacked the firmware of satellite modems on the ground."
PCI Compliance & the Importance of Penetration Testing
StateTech Magazine
October 23, 2023
By asking the right questions and implementing appropriate controls according to a defined standard, state and local agencies can go a long way toward improving security. “If you're compliant with PCI, it really does reduce the likelihood of data breaches and the reputational damage associated with that,” says Kayne McGladrey, IEEE Senior Member and field CISO at compliance management platform Hyperproof.
Why a return to the office brings identity and mental health challenges
SDX Central
October 10, 2023
Another newer issue is that “the transition from a fully remote to a partially on-site work environment creates substantive cybersecurity concerns based on the ongoing mental health crisis,’’ said IEEE senior member Kayne McGladrey. As some businesses attempt to mandate a return to the office, they should be aware of the mental health challenges employees are facing, he said. “Research shows a significant decline in workers’ mental well-being, resulting in stress and anxiety. These mental states can negatively affect decision-making and lead to cybersecurity lapses.”
The Job Of Security Director Is Expanding: How Does It Impact Technology?
Security Informed
October 10, 2023
The enduring trend of allowing employees to work either partially or entirely from home has significantly impacted the role of the security director. No longer limited to overseeing an organization's physical office or campus, security director must look outside of their four walls to understand the full spectrum of modern risks. This expanded view necessitates close partnerships with cybersecurity experts to implement effective controls. For instance, while certain systems like operational technology systems (OT) remain bound to specific locations, many essential business tools, like laptops, often function remotely. The theft of an unencrypted laptop is often the cause of a security breach. In contrast, addressing the theft of an encrypted laptop simply involves filing a police report and replacing the affected device for the user. Additionally, security directors now find themselves working hand in hand with HR departments to enforce compliance measures, such as the heightened background checks and employee risk assessments mandated by FedRAMP and various financial regulations.
Is basic cyber hygiene enough in the age of AI?
APN News
September 27, 2023
IEEE Senior Member Kayne McGladrey said that “These threats are not merely theoretical, although at the moment, they are still relatively limited in their application. It is reasonable to expect that threat actors will continue to find innovative new uses of generative AI, extending beyond business email compromise, deepfakes and the generation of attack code.”
Emerging cyber threats in 2023 from AI to quantum to data poisoning
CSO Online
September 08, 2023
Kayne McGladrey, field CISO at Hyperproof, has seen the evidence. He worked with one organization whose executives received a contract for review and signature. "Nearly everything looked right," McGladrey says. The only noticeable mistake was a minor error in the company's name, which the chief counsel caught. But Gen AI isn't just boosting the hackers' speed and sophistication, it's also expanding their reach, McGladrey says. Hackers can now use gen AI to create phishing campaigns with believable text in nearly any language, including those that have seen fewer attack attempts to date because the language is hard to learn or rarely spoken by non-native speakers.
Universities Tap Student Talent to Support Security Operations
EdTech Magazine
August 25, 2023
“Not all high schools are promoting cybersecurity as a career option, and working in the SOC can have the knock-on effect of bringing people in who were unaware of the field before,” says Kayne McGladrey, a senior member at IEEE. Even if they don’t go on to take cyber jobs, “working in the SOC gives them exposure to some of the language and risks common in cybersecurity,” he says. “Then, if they’re working as developers, it’ll influence the direction by which they create things. They’ll at least have security in mind.”
Expert: Generative AI won’t harm cybersecurity workforce
SC Media
August 23, 2023
TechRepublic reports that generative artificial intelligence has been touted by Hyperproof Field Chief Information Security Officer Kayne McGladrey to not hamper employment opportunities in cybersecurity.
Continuous cyberattack innovation and supply chain diversity among threat actors would ensure that humans will not be displaced by generative AI, said McGladrey in an interview at the Black Hat security conference.
"We're going to need to continuously adapt the tools that we have with the people we have in order to face the threats and risks that businesses and society continue to face," said McGladrey.
The Cyber Ranch Podcast
The Cyber Ranch Podcast
August 16, 2023
Did you miss Black Hat this year? Well you won't miss the great conversations that were had, as Allan captured so many good ones for this special Black Hat retrospective episode.
Criminals Are Flocking to a Malicious Generative AI Tool
GovInfoSecurity
July 27, 2023
Kayne McGladrey, field CISO at Hyperproof, told ISMG that while there are jailbreaks to work around limitations in commercially available AI systems, they're inconvenient for threat actors to run at scale. "Jailbreaks introduce friction into software developer workflows, forcing users to periodically adapt their prompts based on changes introduced by the AI toolmaker. One of the potential benefits of using an AI intentionally developed for malicious activities is that jailbreaks are not necessary," McGladrey said.
How Will the New National Cybersecurity Strategy Be Implemented?
Information Week
July 21, 2023
Kayne McGladrey, field CISO at Hyperproof, hopes that a future version of the plan will get more granular. “Industry-specific guidance is missing, as hospitals, banks, and SaaS startups all have different cybersecurity needs and available resources,” he says.
How the Social Media Platform Discord is Helping Parents Keep Kids Safe
Parents Magazine
July 19, 2023
"Discord initially was used as a way for gamers to hold real-time voice and text chats in games that either didn't support real-time communications or where the in-game system wasn't robust," says Kayne McGladrey, a senior member of IEEE, a professional organization for technology and engineering. But the platform gained popularity, particularly during the COVID-19 shutdown. "During the pandemic, Discord emerged as a free alternative to Zoom for gamers, friends, cryptocurrency enthusiasts, and other communities to host remote events," McGladrey says.
There’s a handy new label to tell you if your gadget is easy to hack or not
Vox
July 19, 2023
On Tuesday, the White House announced that we’ll soon get those IoT labels: The US Cyber Trust Mark, which looks like a shield with a microchip on it, will be on products that have cybersecurity protections. Kayne McGladrey, field CISO for Hyperproof, expressed reservations about the mark. His concern is that Cyber Trust Marked devices could be sold at a premium to account for the increased cost of cybersecurity measures, which could lead to most consumers simply choosing whatever’s cheaper, rendering the program ineffective. He also noted that it won’t address all the devices that pre-date the Cyber Trust Mark and are already in people’s homes. “For example, LED light bulbs have lifespans of tens of thousands of hours, which means that insecure light bulbs will be a feature of the IoT landscape for the coming decade or longer,” McGladrey said in an email.
Why and how CISOs should work with lawyers to address regulatory burdens
CSO Online
July 19, 2023
As the regulatory burden increases, organizations and CISOs are having to take ownership of cyber risk, but it needs to be seen through the lens of business risk, according to Kayne McGladrey, field CISO with Hyperproof. Cyber risk is no longer simply a technology risk. "The problem is, organizationally, companies have separated those two and have their business risk register and their cyber risk register, but that’s not the way the world works anymore," says McGladrey.
He believes the Securities and Exchange Commission (SEC), the Federal Trade Commission, FTC and other regulators in the US are trying to promote collaboration among business leaders because cyber risks are functionally business risks. McGladrey thinks most CISOs understand this, but that doesn't necessarily extend to the other leaders in the business. "Can we just please have one risk conversation with people and plan that out appropriately," he says.
How Discord's Parental Controls Can Keep Kids Safe
Lifewire
July 18, 2023
Discord relies heavily on server moderators to enforce community rules, IEEE Senior Member Kayne McGladrey said via email. This moderation is done on a server-by-server basis.
“In practice, this enables smaller private servers to feature far more informal conversations and rules than a public community server – it's possible that kids can see hateful content, such as racism or cyber-bullying, happen on these types of servers where the moderators are less engaged,” McGladrey added.
Data de-identification: Best practices in the new age of regulation
VentureBeat
June 15, 2023
Confidential computing also is an emerging technology meant to protect data in use, said McGladrey of the IEEE.
“Confidential computing can allow the processing of data from multiple parties without sharing the input data with those other parties,” he said. “For example, if an organization wants to perform processing on a large set of healthcare data collected from multiple third-party organizations, properly configured confidential computing potentially permits those third parties to provide their data for processing in aggregate. In this scenario, not even the cloud provider can see the cleartext data provided by the third parties, or the results.”
The risks of 5G security
TechRepublic
January 25, 2023
Kayne McGladrey, field CISO at HyperProof.io, explained the dangers of such an approach. “Low-cost, high-speed and generally unmonitored networking devices provide threat actors a reliable and robust infrastructure for launching attacks or running command and control infrastructure that will take longer to detect and evict,” he said. McGladrey also pointed out that as organizations deploy 5G as a replacement for Wi-Fi, they may not correctly configure or manage the optional but recommended security controls. “While telecommunications providers will have adequate budget and staffing to ensure the security of their networks, private 5G networks may not and thus become an ideal target for a threat actor,” he said.
Three Keys to Protecting the Corporate Network in the Era of Hybrid Work
CIO
January 19, 2023
“Organizations should invest in a combination of asset management, endpoint detection, data loss prevention, cloud-based managed detection and response, and patch or vulnerability management,” says Kayne McGladrey (@kaynemcgladrey), Field CISO at Hyperproof and Senior IEEE Member. “Of those, asset management is the starting point, as an organization should have visibility into the devices accessing corporate data and be able to select and apply appropriate controls to those devices. Those controls then may include endpoint protection or data loss protection, for example, if exfiltration of sensitive corporate data may result in compliance violations.”
Expert Predictions for 2024
GPSec
November 27, 2023
An illuminating panel discussion, ‘Expert Predictions for 2024’, where seasoned experts delve into the future of cybersecurity. This dynamic discussion explores controversial key areas shaping the landscape in the coming year.
Cyber Budgets Taking a Step Back
Maturity in Vulnerability Management
AI Effects on Cybersecurity Job Market
Experts provide valuable predictions and actionable insights to help you navigate the complex cybersecurity terrain of 2024.
Don’t miss the opportunity to stay ahead of the curve in a rapidly evolving digital world.
Keynote Panelists
Michael Fulton, Vernovis, Chief Information Officer
Warner Moore, Gamma Force, Founder & vCISO
Joe Otten, Fifth Third Bank, Sr. Director, Information Security
KEYNOTE PRESENTATION: Expert Predictions for 2024 at GPSEC Columbus Tech Summit 2023
Whova
November 14, 2023
Join us for an illuminating panel discussion, ‘Expert Predictions for 2024’, where seasoned experts delve into the future of cybersecurity. This dynamic discussion will explore controversial key areas shaping the landscape in the coming year.
- Microsoft Security Co-pilot Effects
- Cyber Budgets Taking a Step Back
- Impact of War Climate on Cybersecurity
- Maturity in Vulnerability Management
- AI Effects on Cybersecurity Job Market
Our panel of experts will provide valuable predictions and actionable insights to help you navigate the complex cybersecurity terrain of 2024. Don’t miss this opportunity to stay ahead of the curve in a rapidly evolving digital world.
A 2023 Regulatory Round-Up and How to Prepare for 2024
ISACA
October 30, 2023
This year has brought a number of regulatory changes and updates. From the SEC’s new guidance to updates to the industry go-to standards of NIST CSF, 2023 was yet another year of cyber security and compliance evolution. With every shift in regulatory guidance or requirement, should come a shift in the way organizations are thinking about the way they are protecting their data and the data of their customers. Join our panel of experts as they not only discuss what we’ve seen change in 2023, but also how they suggest security and risk professionals strategically prepare for the year ahead.
Cybersecurity Breaches Are in the News: How Internal Assessments Can Help You Avoid One
ISACA
March 22, 2023
Emerging from a global pandemic, businesses must re-evaluate their processes and procedures to adapt to the new normal. This includes the Risk Management processes. It is more than an ever for businesses to implement processes that will safeguard the company’s assets which includes information. An asset is something of value and in today’s society information is very valuable and must be protected. How does an organization ensure the confidentiality, integrity, and availability of its information assets and the systems that support them? The digital transformation continues, and new technologies continue to emerge. This virtual summit will cover topics that will cover tools and techniques necessary to identify, assess and respond to risk associated with emerging technology and the company’s assets.
Panel Discussion: Navigating the Maze of New Cyber & Privacy Regulations – Keys to Avoiding Regulatory Action
Compliance Week
February 15, 2023
* Deep dive look into interpreting the different emerging US data privacy state laws and the consequences of non-compliance
* Learn about the requirements of the SEC cybersecurity rules and the ramifications for public companies
* Discuss the security programs that need to be implemented to comply with local and international regulations and rules.
ISACA Virtual Summit 2022: Pursuing Digital Trust
ISACA
December 07, 2022
The digital space is the primary method of retaining data and transacting in today’s business landscape. But with the increase in cyberattacks, scams and security breaches, a secure digital world is more important than ever. Cybersecurity, risk, data privacy, governance and assurance are essential processes in the modern business landscape and are critical to helping enterprises become digitally trustworthy, enhance their reputations and increase their brand loyalty with consumers.
Streamlining GRC Controls to Optimize Cybersecurity
IT GRC Forum
November 17, 2022
On this webinar, we will discuss how to streamline GRC controls and optimize cybersecurity risk management processes, to enable leaders to determine what investments best reduce risk with the best return on investment (ROI). Attendees will learn how to:
* Simplify GRC and security operations by reducing the number of controls your organization has to deal with, therefore reducing its workload to test and audit the controls
* Develop a set of controls baselined to the internal and external requirements that your organization needs to meet
* Enable both security process automation and enterprise risk decision-making
* Shrink your organizations cybersecurity attack surface
Finding a long-term solution to curb Cybercrimes in the digital sphere: A Global Perspective
WebForum
November 08, 2022
This was the 7th series of WebForum which was in line with this year’s International CyberSecurity Awareness Month theme "See you in cyber - #becybersmart” held on 28th October 2022.
Curbing Cybercrimes in the digital sphere. #becybersmart - DCA Digital WebForum
DotConnectAfrica
October 25, 2022
The findings of the webforum will inform African countries, businesses, and the global community of the key issues that need to be addressed in order to curb cyber crimes from ethical hacking, implications of data sovereignty and cloud, implications of metaverse and Web 3.0, and data privacy in the cloud. It will also demonstrate the global community’s commitment to the shared objective of protecting citizens, businesses, and organizations in the digital era. This will be imperative to prevent more damaging cyber-attacks, which could have devastating impacts.
SECtember 2022: Transforming Security Along with the Business
SECtember
September 28, 2022
As we all know, decisions that get made to transform the business are not always the best decisions for security. Especially with the accelerated digital transformation of the last few years, now is the time to reassess whether security teams have been properly tracking and addressing all cloud and digital assets that their organizations have taken on. This panel of experts will discuss the challenges of tracking cloud assets, if their risk is being properly measured, and ultimately whether security teams are properly supporting business transformation decisions.
The Future of Health Tracking Apps
CIO Tech Talk
September 01, 2022
Join us live on Twitter Spaces as we discuss:
* how safe patient medical information is with tech firms?
* the challenges health tracking apps present for users?
* how can users protect their data while still using health tracking apps
* red flags users should look out for when choosing or using health tracking apps
* What can tech firms do with data from health tracking apps
Cloud Adoption Outpaces Security
Sub-Four Capital
May 24, 2022
Cloud adoption has been rapidly rising for years and exploded as a result of the COVID-19 pandemic. With a remote workforce, companies needed the accessibility, flexibility, and scalability offered by cloud-based solutions. However, while many companies are moving rapidly to the cloud, security is lagging behind. Cloud infrastructure is very different from an on-premise data center, and these differences introduce unique security challenges. Many companies are still working to understand these differences, leaving their cloud deployments at risk. For many companies, the security of their public cloud infrastructure is a significant concern.
Preparing and Issues to Consider in an Incident Response Plan (IRP)
Sub-Four Capital
May 24, 2022
When it comes to data breaches, they say not if but when. Preparing your business to quickly and competently respond to a data incident starts with the creation of an Incident Response Plan. Understanding the topics covered in an IRP and then making choices that are best for your business helps ensure that the IRP will work in your time of crisis response.
Cyber Threats, Cyber Vulnerabilities: Assessing Your Attack Surface
Dark Reading
November 17, 2021
Today’s cybersecurity environment features a wide range of available threat intelligence, ranging from simple vulnerability alerts to commercial services that monitor threat actor behavior. But how can you use that data to assess the security posture of your own organization? How can you harness threat intel to measure cyber risk? In this panel, threat intelligence experts offer advice and recommendations on how threat intelligence can be used as a means to measure your attack surface.
Returning to the Office: Security Threats and Proactive Solutions
Ascent Solutions
May 13, 2021
A year after the pandemic began, employers are now considering how to welcome their employees back to the office. Join Ascent cybersecurity leaders, Derek Swenningsen and Kayne McGladrey for a discussion on the challenges and threats that are emerging in the modern workplace.
While there are obvious threats, such as threat actors sending phishing lures with fake return to work information, there are less obvious threats, such as IT assets that have not connected to your corporate LAN in a year.
Our experts will take audience questions and discuss the proactive cybersecurity steps that businesses and organizations can take to prepare for employees returning to offices in a hybrid working environment.
How Hackers Used and Abused the Pandemic to Profit
Infosecurity Magazine
March 24, 2021
In this session, a panel of experts will reflect on the various ways in which hackers have targeted the pandemic over the past 12 months, lifting a lid on the methods employed and outlining how businesses and users can best protect themselves from ongoing COVID-related attacks, scams and fraudulent activity.
CISO Perspectives: Zero Trust-As-A-Service
CSHub
November 05, 2020
Join Pulse Secure’s Global Chief Security Architect and Ascent Solutions cybersecurity strategist Kayne McGladrey, CISSP in this webcast to learn about:
- The shift in security challenges, current security concerns, and potential challenges in the future
- Main components of Zero Trust-as-a-Service
- How Zero Trust-as-a-Service solves security challenges in a hybrid IT environment
- Zero Trust-as-a-Service implementation and deployment considerations
- How Zero Trust security practices can help you prepare and build a business continuity plan that withstands the unexpected and future security concerns
This webinar will take place on:
November 05, 2020
11:00 AM - 12:00 PM EST
#IDGTechtalk : A 2019 Recap and 2020 Predictions
IDG Communications, Inc.
December 19, 2019
We will be discussing 2019 trends and looking ahead to a new decade of amazing tech advancements at the final #IDGTechTalk of the year. Join us on Twitter by following #IDGTechTalk at 9 AM Pacific on December 19th, 2019.
Panel Discussion: Who is responsible for Cyber Security in the enterprise?
Cyber Security Hub
November 13, 2019
Cyber Security is still primarily seen as an ‘IT issue’ and this often means that security often gets “bolted on” rather than embedded in a company’s ecosystem. In this panel discussion, discover why everyone within the business is responsible for Cyber Security and how to educate the enterprise on safeguarding customer data.
Key takeaways
- Improve security by creating a culture of healthy suspicion
- Encourage the executive board to communicate policies
- Ensure best practice is maintained throughout your business
FedRAMP with Matthew Feldman | Drafting Compliance Ep. 31
Hyperproof
April 12, 2024
Special Guest Matthew Feldman joins Kayne and Tom to pull the curtain back on his FedRAMP experiences. Matthew has a wealth of experience and understands the nuances of FedRAMP. Mathew helps understand the importance of best practice when looking through the lens of compliance. Of course, as always, we have beer to review and Kayne has a reaction. Come see the fun!
Art of Cyber Defense: Insights from a Theatrical Minded CISO with Kayne McGladrey
Breaking Through in Cybersecurity Marketing
March 27, 2024
Prepare to laugh until your stomach hurts with our most hilarious episode yet, featuring the one and only theater kid turned cybersecurity guru, Kayne McGladrey, Field CISO at Hyperproof. Join us for a rollercoaster of emotions as we dive into the absurdity of security info in 10K filings, engage in heated debates over the polarizing cinnamon sticky bun ale, and champion the cause for more singing and dancing in cybersecurity. Think of it as the "Cybersecurity's Got Talent" episode you never knew you needed! Kayne's journey is packed with invaluable insights and captivating stories that are as unique as they are engaging.
Virtual CISO Happy Hour: The Scary Truth About Data Privacy
AccessPoint
November 07, 2023
In this live episode of the Virtual CISO Happy Hour, our cybersecurity experts discuss the critical steps companies must take to navigate the complex landscape of data privacy. They discuss the importance of establishing regular data inventories and minimization efforts to ensure that only business-critical information is retained, thereby reducing the attack surface for threat actors.
The conversation shifts to the pitfalls of treating privacy audits as one-off events rather than ongoing processes. Our experts argue for the automation of data control operations and the continuous evaluation of their effectiveness, which is crucial for maintaining compliance and achieving certifications like ISO or SOC 2.
The episode also tackles the misconception of 'cyber risk,' advocating for a broader understanding of business risk and its real-world consequences. The discussion highlights the importance of aligning cybersecurity strategies with business KPIs and KRIs to effectively communicate the value of security measures to executives and boards.
Furthermore, they explore the role of CISOs in control design and effectiveness, emphasizing collaboration with CFOs to leverage their experience with regulatory compliance for more nuanced and effective control strategies. They also touch upon the significant cost savings that can be realized by reevaluating and updating corporate risk registers in response to changes in data storage and access patterns.
This episode is a must-listen for any professional involved in data privacy and cybersecurity, offering practical insights into making informed decisions that align with both security and business objectives.
The Cyber Security Recruiter talks to Kayne McGladrey, field CISO at Hyperproof
The Cyber Security Recruiter
October 31, 2023
In the latest episode of The Cyber Security Recruiter podcast, I had an in-depth conversation with Thomas Richard about my 25-year journey in cybersecurity. From my unlikely beginnings in theater arts to my current role as the field CISO at Hyperproof, this conversation covers a wide array of subjects. We delve into the importance of implementing effective security controls and critique the industry's heavy reliance on certifications. Thomas and I agree that while certifications can serve as useful benchmarks, their increasing prominence risks creating an exclusionary environment that could perpetuate a perceived "skills gap." The episode covers not just technical matters but also broader philosophies and strategies that are essential for building a resilient cybersecurity posture.
Drafting Compliance Episode 19: Moving to FedRAMP Rev5
Hyperproof
October 11, 2023
Kayne and Tom talk about the FedRAMP Rev4 to Rev5 transition. Learn about key control changes, the shell game that is Rev5 and obviously, the unique flavor profile of a new beer.
Don't let the security questionnaire stall your deals with Kayne McGladrey, Field CISO at Hyperproof
The Cybersecurity Startup Revenue Podcast
October 09, 2023
Are you a founder, CEO, leader, or salesperson in the cybersecurity industry? Are you looking to grow your sales and revenue faster? In this episode of the Cybersecurity Startup Revenue Podcast, we dive into one way to avoid having your deals stalled out.
What risks can derail your software development and revenue growth?
How can you optimize the role of a field CISO in your organization?
Why is building trust and managing risk essential for successful sales cycles?
Our guest, Kayne McGladrey, a Field CISO at Hyperproof.io, brings his expertise and unique perspective as a CISO to discuss these critical topics and more. He shares his insights on the challenges faced by cybersecurity startups and how organizations can effectively communicate and address risk.
Don't miss out on this valuable conversation that can help you navigate the cybersecurity landscape and accelerate your company's growth. Tune in now to gain actionable strategies and hear from industry experts.
Episode 55 -- How Informed is the Board of Directors on Cybersecurity Risks?
The Cyber Readiness Podcast
October 04, 2023
With the global cost of cybercrime expected to reach $10.5 trillion by 2025, cybersecurity has become a board-level imperative. According to the Diligent Institute survey 'What Directors Think,' board members ranked cybersecurity as the most challenging issue to oversee. Even though boards say cybersecurity is a priority, they have a long way to go to help their organizations become resilient to cyberattacks. Kayne McGladrey, Field CISO at Hyperproof and a senior IEEE member sheds light on this important aspect of cybersecurity governance. The driving question being: How informed is the Board of Directors to provide effective oversight of cybersecurity governance?
Interview with Kayne McGladrey - The Other Side of the Firewall
Ask a CISSP
September 14, 2023
In this very entertaining episode of The Other Side of the Firewall podcast, we'll learn Kayne's amazing cybersecurity "origin story" and discuss the need for more diversity of culture and thought within cybersecurity. We'll also go into upcoming Federal and State policy and how he and his team have developed the tools necessary to keep up with the future of Governance, Risk, and Compliance. Don't miss out!
On The Hook Eps 9 w/ Kayne McGladrey - CISO Mansion of Madness
On The Hook
August 10, 2023
Ever wonder why hackers wear hoodies? Or why should you be concerned if your government job has a good view? Or what the most money-sucking board game is? ell this is the episode for you! We met Kayne’s cat, talked about old computers, ethics issues in AI, funny stories from Kanye's first job, comical failings of physical security from Kayne’s audit days, and of course board games again!
The Truth Behind Automating Compliance Controls
EM360
February 09, 2023
In this episode of the EM360 Podcast, Analyst Richard Stiennon speaks to Kayne McGladrey, Field CISO at Hyperproof to explore: Automating compliance controls vs SOAR automation, Helping CISOs, and if one master set of controls cover multiple frameworks
What Businesses other than Banks Need to Know about Gramm-Leach-Bliley [Podcast]
Compliance and Ethics
January 17, 2023
The Gramm-Leach-Bliley Act (GLBA) is typically referred to in the context of financial institutions. It requires offerers of consumer financial products to explain how they share information and protect sensitive data. It’s not, however, only banks that fall under GLBA’s umbrella. New rules will affect retailers offering credit terms to their customers, higher education institutions that administer federal student aid and others a well, explains Kayne McGladrey, Field CISO for Hyperproof.
Cyberattacks and How to Defend Against Them with Kayne McGladrey
The Cameron Journal Podcast
June 13, 2022
"In this episode, we're talking with Kayne McGladrey about cybersecurity, cyberterrorism and how to defend against these attacks at the personal, corporate, and national levels. I've been working on research for my next book and I knew that I had to talk to him to see what we could do to defend against this new and pernicious form of war. "
Telehealth: Emerging Security, Privacy Issues
Healthcare InfoSecurity
July 09, 2021
"While the use of telehealth has surged during the COVID-19 pandemic, the data security and privacy concerns for both patients and healthcare providers have also increased, says cybersecurity strategist Kayne McGladrey"
Episode 6: Securing the fast-moving digital world
CIO
March 03, 2021
You have a remarkable economic incentive for threat actors to do their job. Unlike a fire, threat actors innovate. There's not some new way we're going to have a fire. I guarantee you by the end of the week, we're going to have a dozen new ways for threat actors to do their jobs.
Making cybersecurity more effective in the age of cloud and COVID-19
Deloitte
December 10, 2020
Cybersecurity has always been a critical task that must be handled effectively. However, cloud—and more recently—COVID 19—have exacerbated cybersecurity issues and changed the security landscape. In this episode of the podcast, Mike Kavis and guest, Ascent Solutions’ Kayne McGladrey, discuss cybersecurity in the context of cloud, and vis-à-vis the changes wrought by the pandemic. Kayne’s take is that the transition to cloud and the pandemic have exposed and magnified issues that have always been a problem, and that companies should not skimp on cybersecurity, in favor of spending on other “more pressing” projects. The key to success is to focus on data, automation, and risk assessment.
Episode 179: CISO Eye on the Virus Guy – Assessing COVID’s Cyber Risks
The Security Ledger
March 26, 2020
To get a sober assessment, we invited Pensar CISO and IEEE member Kayne McGladrey, CISSP into the studio to talk about the variety of risks that remote working introduces. There are some new risks that companies need to account for: from remote access bottlenecks to prying eyes in insecure home offices to insecure home workstations.
Don't Forget the Cybersecurity!" on The Wave of Change with Tony Flath
The Wave of Change
January 10, 2020
Episode 005 - "Don't Forget the Cybersecurity!" A great chat with IEEE member, spokesperson and cybersecurity ninja, Kayne McGladrey @kaynemcgladrey all about the cybersecurity landscape and emerging technologies. He covers the ways cybersecurity is emerging too to address many cyber concerns providing better threat protection. We also discuss AI, Analytics, and Automation and the role they play in the cybersecurity landscape, and insights on the weird and wild world of Social Media and Cyber Awareness.
The Future is Now: Podcast
Aurora IT
February 27, 2018
The team at Aurora IT interviewed me for a feature-length podcast on cybersecurity. Listen to hear about third-party attacker tactics, managing cyber risk, multi-factor authentication, and why a lack of diversity is a threat to public safety.
Episode 20 - Interview with Kayne McGladrey on Multi-Factor Authentication
Insider Threat Podcast
October 02, 2017
We made it to 20 episodes! I know some people don't like it when you talk about milestones like this, but I'm doubly excited for this one because I finally get to publish my interview with Kayne McGladrey from Integral Partners. I know many of your have been scrambling to finish up the quarter or fiscal year, depending on your industry, so hopefully this will give you an opportunity to sit back, relax, and listen to the excellent information that Kayne provided.
Zero trust secures agile business transformation
CIO
October 30, 2023
CIOs should collaborate closely with CISOs to evaluate which zero trust controls will offer the most significant mitigation of agreed-upon business risks. Once specific controls are implemented, they can be centralized and reused across the various compliance standards like SOC 2 Type 2, ISO 27001, and PCI, delivering greater flexibility. “The key lies in the deliberate selection of zero trust controls aimed at reducing specific business risks while potentially streamlining existing compliance efforts,” explains Kayne McGladrey (@kaynemcgladrey), field CISO at Hyperproof and senior IEEE member.
The Jobs of Tomorrow: Insights on AI and the Future of Work
IEEE Transmitter
January 19, 2024
Kayne McGladrey, Field CISO at Hyperproof and IEEE Senior Member, noted that the use of generative AI models in business hinges on their ability to provide accurate information. He cited as examples studies of AI models’ abilities to extract information from documents used for financial sector regulation that are frequently relied on to make investment decisions.
“Right now, the best AI models get 80 percent of the questions right,” McGladrey said. “They hallucinate the other 20 percent of the time. That’s not a good sign if you think you are making investment decisions based on artificial intelligence telling you this is a great strategy four out of five times.”
What Will Be The Biggest Surprise For Security In 2024?
Security Informed
December 26, 2023
"In 2024, the most significant cybersecurity surprise will be the widespread recognition that Chief Information Security Officers (CISOs) are primarily risk advisors, not risk owners. This distinction contrasts with some companies' previous perceptions and the operational reality. With cybersecurity concerns such as data center vulnerability, cloud vulnerability, and ransomware attacks still being a top concern for business leaders in 2024, this distinction is important to keep in mind to ensure the success of corporate security. Business systems are managed by business owners, whose performance is measured based on the system's effectiveness. Historically, some companies have incorrectly assumed that the CISO is responsible for authorizing or mitigating some of the risks associated with these business systems. This is a misconception. The business owner, likely the individual who has approved the business continuity plan or is most affected by operational disruptions, also bears the responsibility of deciding how to address each risk. While CISOs can identify and propose mitigation strategies for business risks related to cybersecurity, they do not and should not accept or authorize the mitigation of risks for systems outside their ownership."
Article: Experts advise on how to build a successful hybrid work security strategy
CIO
December 15, 2023
Next, commit to solving the complexity issue. In practice, this involves consolidation and integration of tools while striking “a balance between robust protection and user convenience,” said Kayne McGladrey (@kaynemcgladrey), Field CISO at Hyperproof and Senior IEEE Member. For example, “automation and integration of security controls are crucial in achieving scalability and simplifying validation of efficient control operations.”
We’ve compiled the best VPNs for Netflix to show you those that have secure servers, optimum speed and allow you to stream Netflix on different devices.
How to develop an application modernization strategy that delivers tangible results
CIO
November 17, 2023
Kayne McGladrey, (@kaynemcgladrey), senior IEEE member and field CISO at Hyperproof, which provides SaaS-based compliance and security operations solutions, says: “Developing an application modernization strategy requires careful assessment, planning and execution. First, you must understand your business goals and objectives. Only then can you create an aligned business and application roadmap.”
Using AI Isn’t As Easy As It Seems
CXOToday
November 12, 2023
“Realistically, the use of AI in cybersecurity will help to reduce the punishing cognitive load on tier one analysts in the security operation center,” said IEEE Senior Member Kayne McGladrey. “Rather than having to comb through a needlestack looking for a needle, AI promises to automate much of the correlation across vast amounts of data that humans struggle with.”
Data loss prevention vendors tackle gen AI data risks
CSO
October 31, 2023
“Employees across industries are finding new and innovative ways to perform their tasks at work faster,” says Kayne McGladrey, IEEE senior member and field CISO at Hyperproof. “However, this can lead to the sharing of confidential or regulated information unintentionally. For instance, if a physician sends personal health information to an AI tool to assist in drafting an insurance letter, they may be in violation of HIPAA regulations.” The problem is that many public AI platforms are continually trained based on their interactions with users. This means that if a user uploads company secrets to the AI, the AI will then know those secrets — and will spill them to the next person who asks about them. It's not just public AIs that have this problem. An internal large language model that ingested sensitive company data might then provide that data to employees who shouldn’t be allowed to see it.
Zero trust from edge to cloud: not one-and-done
CIO Magazine
August 30, 2023
“The only meaningful consideration of zero trust adoption is when the board and CEO are willing to trust and partner with the CISO to effectively mitigate business risks. A recent Gartner study found that a CISO who can effectively tie business outcomes to a material reduction in business risk through practical implementation of zero trust controls will make security an asset for their organization that enables them to compete more effectively.” — Kayne McGladrey, field CISO, Hyperproof
Cloud, 5G to be Decisive Technology Trends in 2023: Study
Geospatial World
November 02, 2022
While homomorphic encryption can require lots of computing power, it has a few big upsides. For one thing, according to Kayne McGladrey, IEEE Senior Member, it allows companies in highly regulated industries, such as finance or healthcare, to store data on a public cloud. “As the data remains encrypted in all phases, even a data breach of a third party will not provide a threat actor with access to encrypted data,” McGladrey said.
Cybersecurity hiring remains red-hot—the industry to surpass $400 billion market size by 2027
Fortune
July 22, 2022
“As a result, those companies with solutions and products in the cybersecurity industry are heavily reinvesting their profits into research and development of artificial intelligence-based solutions intended to automatically detect and remediate actions from these increasingly well-funded adversaries,” McGladrey tells Fortune. “This cycle will continue so long as it remains profitable for cybercrime actors, barring remarkable changes in how companies prioritize and address their cyber risks.”
When More is Not Necessarily Better: The Impacts of Multiple Security Tools
CIO
November 04, 2021
“Organizational collaboration is difficult when different data protection tools perform similar functions, as it may be unclear how to allow a collaborator to access or modify data. Something as simple as data classification and labeling becomes overly complex and a nuisance to end users if they need to set a label in multiple locations, particularly when the labels are not consistent across tools.” — Kayne McGladrey (@kaynemcgladrey), Cybersecurity Strategist at Ascent Solutions
Sinclair TV Stations Targeted in Weekend Ransomware Attack
GovInfoSecurity
October 18, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW and cybersecurity strategist for the firm Ascent Solutions, says once the incident is resolved, Sinclair "should do an internal hot-wash" to identify lessons learned - allowing them to strengthen technical defenses and update/validate their incident response plan.
New Legislation Eyes Both Ransom, Incident Reporting
GovInfoSecurity
September 30, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW and cybersecurity strategist for the firm Ascent Solutions, tells ISMG, "These [various legislative efforts] all stem from the issue that there is no single source of truth on the volume or scope of cyberattacks, which has led to the perception that it is difficult to apply commensurate public and private policy responses."
Experts Weigh In on Data-First Modernization
CIO
September 30, 2021
“This will vary by industry and size of business,” notes Kayne McGladrey, cybersecurity strategist at Ascent Solutions. “A social media company losing control of their content for an hour has a very different risk profile than a manufacturing company being unable to manufacture products.”
Remote Work and Cybersecurity: 3 Experts Describe the Tech They Wish Everyone Could Use
IEEE Transmitter
September 27, 2021
“As part of the great resignation of 2021, we’ve seen an increasingly fragmented view of intellectual property on the part of departing employees. Businesses can reduce the substantial risk associated with data exfiltration of trade secrets, regulated data and other sensitive data by deploying and monitoring DLP across the enterprise, including remote endpoints.” — IEEE Senior Member Kayne McGladrey
FTC Warns: SMS Phishing Scam Impersonates State Agencies
Bank InfoSecurity
August 09, 2021
Kayne McGladrey, an advisory board member for the Technology Alliance Group NW, warns that these scams can be effective when highly targeted. He says the schemes work when supporting larger campaigns underway prior to any SMS outreach.
Is my medical device vulnerable to cyber threats?
IEEE Transmitter
August 06, 2021
It is a matter of whether the threat actor has sufficient resources (both staffing and financial resources) and the motivation. The real question is about the likelihood of a threat: an always-on internet-connected medical device will have a very different threat profile than a medical device that requires direct physical access.
Machine learning is demonstrating its mettle across industries
CIO
July 14, 2021
“The modern business has far more potential cybersecurity events to investigate than can be reasonably reviewed by people, and machine learning has the benefit of quickly focusing people’s attention on the signal, not the noise, so that organizations can rapidly respond to potential incidents before threat actors can establish persistence in an environment.” — Kayne McGladrey (@kaynemcgladrey), cybersecurity strategist at Ascent Solutions
The SMB Mission: Data Security Without Compromising User Productivity
CSO Online
June 29, 2021
“Tying data security to user identities is the easiest, lowest-effort way to modernize security for small to medium businesses,” says Kayne McGladrey (@kaynemcgladrey), cybersecurity strategist at Ascent Solutions (@meetascent). “Establishing data security based on user identity means that data remains secure regardless of storage location or medium.”
What is 5G and What Does it Mean for Cybersecurity?
APN News
March 10, 2021
“For older, cheap, IP-based security cameras and digital video recorders (DVRs), the easiest way to secure them is to recycle them responsibly as there often are no security updates available.”
The Resilience of Humanity
IEEE Transmitter
February 23, 2021
“Multi-factor authentication and passwordless technologies help to protect our digital identities and account credentials from theft or impersonation. This matters just as much to an individual using a hardware key to access their online bank as it does for a corporate employee using facial recognition to access a privileged administrative account.”
– Kayne McGladrey, IEEE Senior Member
Communicating Risk with Your Leadership Team
FutureCon
December 06, 2023
In response to the ever-changing risk environment, company leadership is asking more and more questions about how to best manage risk. But being able to answer those questions means having a system and process in place to accurately document, manage, mitigate, and report on those risks.
Luckily, some frameworks and processes already exist to help guide you through that process. Kayne McGladrey, Field CISO, will walk you through the current state of risk and how to effectively and accurately communicate risk to your leadership team.
In this presentation, you’ll learn:
● What the 2023 risk landscape looks like
● How risk managers are planning on updating their risk workflows to adapt
● How to communicate risk to leadership
December 6th at 10:45 AM at FutureCon in Atlanta, GA
How Instacart Created Strong Relationships with Engineering to Build a More Compliant Product
ISACA
August 21, 2023
In a world where compliance and engineering teams must work together to build compliant products, competing goals and philosophies can make collaboration frustrating for both sides. Join representatives from Instacart as they share their story on how they worked with engineering to build a compliant product, best practices for collaborating across teams to build scalable, compliant solutions and how to foster a culture of security and compliance across your organization.
After completing this session, participants will be able to:
• Build more credibility with engineering teams.
• Incorporate features that enable compliance into products.
• Work with your engineering team—not against them—to build high-quality, compliant products.
• Make long-term continuous compliance a reality with automation tools.
Cyber security for Bellingham families and neighborhoods
Eventbrite
October 13, 2019
Americans are buying and installing smart speakers, virtual assistants, smart electrical plugs, smart garage door openers, smart light bulbs and connected children's toys at an unprecedented rate. We know to lock the physical doors to our homes, but fewer people appreciate how smart devices can act like unlocked doors for cyber criminals into our homes, our social networks, and our bank accounts.
The lack of communications and understanding between professionals who work in cyber security and their neighbors who don't is one of the reasons cyber crime has grown for fifteen years. There are simple things we can each do to protect our families against the risks to our privacy and security.
In this session, you'll learn:
- how cyber criminals hack into smart devices, bank accounts, and cloud services
- two easy ways you can protect your family's accounts
This session includes a live hacking demo, so please bring your mobile phone (Android or Apple) if you’d like to participate. This is not a sponsored event and there is no cost. Any solutions recommended will be free, and there will be time for questions at the end of the presentation.
Top Cybersecurity News for April, 2024: Kayne's 5 Under 5
Hyperproof
April 05, 2024
Join Hyperproof's Field CISO, Kayne McGladrey, as he talks about the top five cybersecurity news stories to know for April, 2024 in under five minutes.
Infosec Pros: Dustin Lehr, Sr Dir Platform Security, Deputy CISO at Fivetran
Hyperproof
March 28, 2024
During this Hyperproof live stream series, leaders in information security shed light on crucial topics that shape the modern cybersecurity landscape. This month’s episode features Dustin Lehr, Sr Dir Platform Security, Deputy CISO at Fivetran, and our host, Kayne McGladrey, Field CISO at Hyperproof. Guided by Kayne and audience questions, Dustin will share insights into his current work and past experiences in the field. Register now for your chance to learn from one of today’s top InfoSec pros.
Tom provides an update on the status of the Hyperproof FedRAMP project. Along the way, Kayne uncovers some of the challenges associated with the project and suggests solutions for others going through the same process. And straight out of left field, Kayne actually likes a beer more than Tom. Come find out what caused this seismic disturbance in the force.
Top Cybersecurity News for March, 2024: Kayne's 5 Under 5
Hyperproof
March 07, 2024
Join Hyperproof's Field CISO, Kayne McGladrey, as he talks about the top five cybersecurity news stories to know for March, 2024 in under five minutes. This month we are talking specifically about Hyperproof's 5th annual 2024 IT Risk and Compliance Benchmark Report.
Ask A CISSP | Kayne McGladrey - Ask A CISSP Season 2 Episode 8
The Other Side of the Firewall
March 03, 2024
This week on Ask A CISSP, we have an interview with Kayne McGladrey, Field CISO at Hyperproof.
In this very entertaining episode, we'll learn Kayne's amazing cybersecurity "origin story" and discuss the need for more diversity of culture and thought within cybersecurity. We'll also go into upcoming Federal and State policy and how he and his team have developed the tools necessary to keep up with the future of Governance, Risk, and Compliance. Don't miss out!
Planning Domain Under FedRAMP | Drafting Compliance Ep. 29
Hyperproof
February 21, 2024
Tom and Kayne uncover the intricacies of the Planning family of requirements in FedRAMP Moderate. Learn about the SSP, Rules of Behavior and Architecture in the planning process. Also, of course, learn about Cigar City Brewing’s Jai Alai IPA, one of Tom’s favorites and Kayne’s… well Kayne is Kayne.
Audit and Accountability | Drafting Compliance Ep. 28
Hyperproof
February 15, 2024
Come and see how Boulevard Brewing rebounds after a poor showing and shines with its Tank 7 American Saison beer. Kayne and Tom talk about the Audit and Accountability family of controls in FedRAMP Moderate. Learn the challenges and technologies leveraged to cope with the many requirements. Maybe you will also learn a little about Saison beer!
Top Cybersecurity News for February, 2024: Kayne's 5 Under 5
Hyperproof
February 08, 2024
Join Hyperproof's Field CISO, Kayne McGladrey, as he talks about the top five cybersecurity news stories to know for February, 2024 in under five minutes.
System and Information Integrity | Drafting Compliance Ep. 25
Hyperproof
February 01, 2024
Kayne and Tom dive into the System and Information Integrity family of FedRAMP Moderate controls. Find out what challenges Hyperproof has faced with this family of controls and learn some tips to help you in your own FedRAMP journey. A clear outlier shows up in this show’s beer reviews, tune in and hear for yourself.
The Evolving Role of CISO, Amazing GRC Tools, & The Proper Use of AI In Compliance | Ask A CISSP
Ask a CISSP
April 18, 2024
In this conversation, Ryan Williams and Kayne McGladrey discuss the evolving role of the CISO, the importance of governance, risk, and compliance (GRC), and the impact of AI in cybersecurity. They highlight the need for CISOs to have the full backing of their boards and the challenges they face in managing civil liability for processes they don't control. They also emphasize the importance of democratizing GRC knowledge and providing companies with tools like Hyperproof to assess and improve their cybersecurity maturity. The conversation touches on the increasing regulatory requirements and the need for companies to demonstrate compliance and accountability. The conversation explores the use of artificial intelligence (AI) in the governance, risk, and compliance (GRC) field. The guest, Kayne McGladrey, discusses the dual nature of AI, where it can both save time and raise concerns. He shares examples of how AI can be used to summarize information, generate control suggestions, and analyze large-scale signal data. However, he also highlights the ethical and practical challenges of relying too heavily on AI, such as the need for human judgment and accountability. Kayne emphasizes the importance of using AI as a tool to enhance human intelligence and focus on more meaningful tasks.
Watch as #IEEE Senior Member Kayne McGladrey shares some of his highlights from the show floor, including new applications for #AI and a bright future for #EVs.
Infosec Pros: Ali Khan, Field CISO at ReversingLabs
Hyperproof
November 09, 2023
During this Hyperproof livestream series, leaders in information security shed light on crucial topics that shape the modern cybersecurity landscape. This month’s episode features Ali Khan, Field CISO at ReversingLabs, and our host, Kayne McGladrey, Field CISO at Hyperproof. Guided by Kayne and audience questions, Ali will share insights into his current work and past experiences in the field. Register now for your chance to learn from one of today’s top infosec pros.
Strategic Risk Management: A CISO's Approach to Business-Centric Security
AccessPoint
November 07, 2023
Learn how a CISO's strategic approach to risk management can lead to significant corporate savings and better board engagement. This clip discusses the importance of framing cybersecurity as a business risk to gain executive support and drive effective decision-making.
Moving Compliance From Paperwork To Automation
CISO Series
September 28, 2023
Understanding the risk to your business requires human intuition. But that doesn't mean there aren't a lot of things along the path to understanding risk that can't be improved with automation. At Black Hat, David Spark spoke to Kayne McGladrey, field CISO, Hyperproof, about how having a security-focused company culture can help CISOs link their known risks to their controls in order to put their budget where it will have the most impact. This can allow organizations to operate within the reality that business risk and cyber risk are not separate things. With changing state regulations and rapidly advancing technology, staying on top of your risk in a simple and understandable way is more imperative than ever.
What piece of advice would you give companies approaching an audit?
NextDLP
September 08, 2023
Video interview with Kayne McGladrey, field CISO of Hyperproof and Chris Denbigh-White, CSO of NextDLP, about the value of automating routine evidence collection and testing as part of ongoing compliance operations.
Drafting Compliance: FedRAMP Moderate Identification and Authentication
Hyperproof
July 13, 2023
Kayne and Tom talk about the domain under FedRAMP moderate, providing both an overview of the domain as well as specific examples of controls, and real-world scenarios for the use of those controls. They also come close to agreeing about “Color Cloud Pink”, a Berliner Weisse with “Pink Guava, Dragon Fruit, and Passion Fruit” by Equilibrium Brewery of Middletown, New York.
Has 2023 been the year of risk? Updates on our 8 predictions
Hyperproof
July 12, 2023
It’s been about six months since we released our top eight predictions for 2023, which covered everything from org chart changes and crypto regulation to the new FTC Safeguards Rule. Were our predictions accurate? Let’s find out.
How to do Contingency Planning for FedRAMP
Hyperproof
June 29, 2023
Kayne and Tom talk about the Contingency Planning domain under FedRAMP moderate, comparing it against the best practice of Business Continuity Planning, and providing specific guidance for key elements of a successful contingency plan. They also find what amounts to near common ground on this episodes beer tasting, Laughing Lab Scottish Ale.
What is the Maintenance Domain Under FedRAMP? | Drafting Compliance Ep. 11
Hyperproof
June 15, 2023
Kayne and Tom talk about the Maintenance domain under FedRAMP moderate, including how it is related to the Configuration Management domain. They also nearly agree on Rogue’s Hazelnut Brown Nectar, although Kayne still likens it to old hotel coffee while Tom will drink a free one.
How to do Configuration Management in FedRAMP | Drafting Compliance Ep. 8
Hyperproof
May 05, 2023
Kayne and Tom talk about the major pillars of Configuration Management under FedRAMP Moderate. While digging into inventory management, baseline configurations, configuration drift, and risk, they tackle Bell’s Two Hearted American IPA.
Top Cybersecurity News for May, 2023: Kayne's 5 Under 5
Hyperproof
May 04, 2023
Join Hyperproof's Field CISO, Kayne McGladrey, as he talks about the top five cybersecurity news stories to know for May, 2023 in under five minutes.
- ChatGPT/AI regulations
- Zero Trust Maturity Model 2.0
- New CMMC-like FAR rule
- Long-term costs for cybersecurity insurers
- Oldsmar city hack investigation
The FedRAMP Incident Response Control Family
Hyperproof
March 24, 2023
In this episode, Kayne and Tom talk about the nuances of the Incident Response family of FedRAMP controls, some of the required documentation, testing, and beer. This episode’s beer is Woods Boss Brewing Company’s Pulaski Pecan Brown Ale.
Cyber Privacy, Ethics, and Abuse CISS 417 at WWU
Western Washington University
February 17, 2021
On February 17th, 2021 Kayne McGladrey, CISSP will be leading a tabletop exercise for the students of CISS 471 at Western Washington University. The tabletop exercise explores the ethical decisions associated with a ransomware attack at a fictional international organization.
2024 IT Risk and Compliance Benchmark Report Findings: Turning Cybersecurity Challenges into Opportunity
Hyperproof
March 01, 2024
It’s that time again! Hyperproof’s fifth annual benchmark survey is here. Each year, we ask over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more to compare results from the previous year, provide an in-depth view of the market’s current state, and prepare for this year and into the future. What we found this year is highly interesting: there’s been a change in the overarching narrative of cybersecurity — long relegated to the role of a cost center — to make cybersecurity compliance a key competitive differentiator.
Join us for our webinar to learn:
* The top findings from the survey (hint: trust and transparency are top-of-mind in 2024)
* How unifying risk and compliance data affected survey respondents’ ability to mitigate risk, improve cybersecurity, and avoid breaches
* How highly publicized breaches in 2023 have made business operations more challenging for both B2B and B2C companies
* How the market has responded to AI risks in 2023 and how cybersecurity professionals plan on leveraging AI in 2024
* Why cybersecurity decision-making among organizations with an integrated view of risk and compliance data is becoming more collaborative
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
ISC(2)
April 09, 2024
Is your IT risk and compliance program ready for 2024 and beyond?
For the last five years, Hyperproof has asked over 1,000 GRC professionals about their pain points, IT risk and compliance budgets, staffing, risk management best practices, and much more. We then compare results from the previous year, and provide an in-depth view of the market’s current state in our annual benchmark report. The 2024’s IT Risk and Compliance Benchmark report highlights a fascinating change in the overarching narrative of cybersecurity: respondents and key stakeholders from other departments are thinking about cybersecurity compliance as a key competitive differentiator rather than just a cost center.
Join Hyperproof and ISC2 April 9, 2024 at 1:00 p.m. Eastern/10:00 a.m. Pacific to learn:
-How unifying risk and compliance data affected survey respondents’ ability to mitigate risk, improve cybersecurity, and avoid breaches
-Key trends for cybersecurity in 2024
-How the market has responded to AI risks in 2023 and how cybersecurity professionals plan on leveraging AI in 2024
-Why cybersecurity decision-making is becoming more collaborative with an integrated view of risk and compliance data.
From Cost Center to Competitive Edge: Operationalizing GRC
Hyperproof
April 02, 2024
Enterprise GRC professionals are often pressured to minimize spend on risk and compliance initiatives while still maximizing their efficiency and keeping their organizations secure and compliant. Fortunately, there's a growing realization that the right GRC solution, traditionally seen as a cost center, holds untapped potential for better decision-making, unlocking a significant competitive advantage. As a result, they need to break down the data silos between risk and compliance activities to get a transparent, holistic view of their compliance and risk postures, but they aren’t always sure where to start.
Join our experts Cheri Hotman, Partner, vCISO, Hotman Group and Kayne McGladrey, Field CISO from Hyperproof to learn more about:
- The drivers creating a growing need for transition from viewing GRC as a compliance obligation to operationalizing it as a strategic solution
- Practical strategies for transforming GRC operations, with a focus on breaking down silos
- Best practices for unifying risk and compliance data
- How to best prioritize GRC initiatives
Elevating Security: The Power of CIS Critical Security Controls
Hyperproof
December 05, 2023
Presented by
Kayne McGladrey, Field CISO - Hyperproof | Charity Otwell, Director, Critical Security Controls - CIS
Dec 05 2023, 11:00am PST
CIS Critical Security controls are a prescriptive, prioritized, and simplified set of best practices that can strengthen your cybersecurity posture. The CIS Controls include foundational security measures that you can use to achieve essential hygiene and protect yourself against a cyber attack. Are you curious whether CIS Critical Security Controls is the right choice for your organization? Or are you currently using CIS Critical Security Controls and wondering how to maximize your experience? Join Charity Otwell, Director at Critical Security Controls - CIS, and Kayne McGladrey, Field CISO at Hyperproof, to discuss areas of focus for CIS controls and how they can best apply to organizational security.
Participants will:
- Learn the basic foundation of CIS Controls
- Understand how to assess applicability for their organization
- Learn how to adopt best practices around CIS Controls
- Learn the upcoming changes that will be made to the CIS Controls
Working with ChatGPT: The Dos and Don’ts for Your Organization’s Security
BrightTalk
June 15, 2023
As generative AI tools like ChatGPT continue to evolve and impact various industries, compliance experts are left wondering about the potential security implications for their businesses. Join us for this enlightening webinar as we discuss the dos and don'ts of working with ChatGPT and similar technologies to equip compliance experts with the knowledge to navigate the security challenges presented by generative AI. We’ll also explore how you can ensure the safe and secure implementation of AI technologies within your organization and what security threats to anticipate.
Join speakers Kayne McGladrey, Field CISO at Hyperproof, and Dr. Rebecca Wynn, Global Chief Security Strategist & CISO at Click Solutions group, as they discuss:
- Valid use cases for using generative AI tools like ChatGPT in your business practices
- How to teach your organization to responsibly use AI tools how they can negatively impact enterprise risk and liability
- Security policy considerations that organizations should examine before incorporating ChatGPT or similar AI technologies
Insights into enterprise risk management frameworks that can help manage this new risk
Level Up Your Security: How to Build Compliance and Risk Mgmt Programs to Scale
ISC(2)
April 11, 2023
Maintaining cybersecurity compliance and building reliable risk management practices isn’t a simple to-do item you check off anymore. The livelihood (and ultimately the growth) of your business depends on resilient security and compliance programs. Add in changing regulatory requirements, and the challenge becomes exponentially more complex.
Join Hyperproof and (ISC)2 on April 11, 2023 at 1:00 p.m. Eastern/10:00 a.m. Pacific to hear more about:
• The value of connecting compliance and risk
• Optimizing stakeholder visibility and communication
• Using GRC tools to scale your business
• Long-term impacts of streamlining compliance, security, and risk management workflows
Communicating Risk With Your Leadership Team
FutureCon
March 22, 2023
In response to the ever-changing risk environment, company leadership is asking more and more questions about how to best manage risk. But being able to answer those questions means having a system and process in place to accurately document, manage, mitigate, and report on those risks.
Luckily, some frameworks and processes already exist to help guide you through that process. Kayne McGladrey, Field CISO, will walk you through the current state of risk and how to effectively and accurately communicate risk to your leadership team.
Scale Your Security Questionnaire Response and Audit Preparedness Processes
BrightTalk
October 26, 2022
What do answering security questionnaires and preparing for IT compliance assessments (i.e. SOC 2 Type 2 assessment) have in common?
It turns out, a whole lot. Responding to security questionnaires and Document Request Lists for audits are things you absolutely have to do to land customers. Both processes are data intensive, repetitive and require getting accurate answers from domain subject experts across your company. Further, both processes tend to grow in volume and become exponentially more painful to manage as your company expands its footprint.
What if you can respond to a question from a security questionnaire or a request from an auditor in minutes instead of hours or days? What if you didn’t have to bother domain subject matter experts or search through corporate file systems for answers anymore? What if you knew the status of each item at all times?
On this webinar, join Loopio and Hyperproof to see how you can scale the security questionnaire response process and your audit preparation process as your company grows – without having to hire more staff.
Kayne McGladrey, Field CISO - Hyperproof and John Forsyth, Director, Data & Infrastructure in Engineering - Loopio
Scale Your Security Questionnaire Response and Audit Preparedness Processes
Hyperproof
October 05, 2022
What do answering security questionnaires and preparing for IT compliance assessments (i.e. SOC 2 Type 2 assessment) have in common?
It turns out, a whole lot. Responding to security questionnaires and Document Request Lists for audits are things you absolutely have to do to land customers. Both processes are data intensive, repetitive and require getting accurate answers from domain subject experts across your company. Further, both processes tend to grow in volume and become exponentially more painful to manage as your company expands its footprint.
What if you can respond to a question from a security questionnaire or a request from an auditor in minutes instead of hours or days? What if you didn’t have to bother domain subject matter experts or search through corporate file systems for answers anymore? What if you knew the status of each item at all times?
On this webinar, join Loopio, Hyperproof, and our special guest to see how you can scale the security questionnaire response process and your audit preparation process as your company grows – without having to hire more staff.
The CISO Experience
The CISO Experience
July 26, 2022
Save the date for a very special “The CISO Experience” hosted by myself with our star guest Kayne McGladrey taking a Macro Economic view of the industry.
Very honoured to have Kayne as a speaker where we will be discussing a variety of topics including:
- Industry hiring practises
- Gatekeeping
- Burnout
Followed by a LIVE Q and A for the audience to participate
Tags: Cybersecurity, Diversity and Inclusion, Security
6 Steps to Prepare Your Company for CMMC 2.0
Ascent
June 22, 2022
Join us this Wednesday for an actionable six-step roadmap, prioritized under CMMC 2.0 and aligned to Zero Trust tenets, to improve your cyber program and reduce cyber risks to your business. #cybersecurity
Watch: Supply Chain Congestion: A Golden Opportunity for Hackers
Supply Chain Brain
November 19, 2021
Global supply chains have been under intense strain in recent months, a situation that has been made even worse by the growth of cyber attacks, especially in the form of ransomware. The transportation sector, which has been largely deregulated, needs to adopt recommendations by industry and government organizations for implementing measures that they might have overlooked in years. The price of failing to do so can be high, with ransomware attacks threatening to shut down critical logistics operations for days or even longer.
Webinar: Zero Trust-As-A-Service
CSHub
November 05, 2020
Gain perspective on: The shift in security challenges, current security concerns, and future challenges; Main components of Zero Trust-as-a-Service; Zero Trust-as-a-Service implementation and deployment best practice; How Zero Trust-as-a-Service solving security challenges in a hybrid IT environment.
This is a pre-recorded webinar.
CISO Perspectives: Zero Trust-As-A-Service
Cybersecurity Hub
October 26, 2020
The rapid shift to work-from-home has accelerated the adoption of Zero Trust frameworks. Zero Trust-as-a-Service will be a necessary component of security strategies for 2021 and beyond.
Join Pulse Secure's Global Chief Security Architect, Mike Riemer and industry veteran Kayne McGladrey in this webinar to learn about:
- The shift in security challenges, current security concerns, and potential challenges in the future
- Main components of Zero Trust-as-a-Service
- How Zero Trust-as-a-Service solves security challenges in a hybrid IT environment
- Zero Trust-as-a-Service implementation and deployment considerations
- How Zero Trust security practices can help you prepare and build a business continuity plan that withstands the unexpected and future security concerns
Futureproofing Now (Season #2, Ep. 11) - Cybersecurity & Cybertrust - Predictions & Implications
Futureproofing
July 14, 2020
“Bob Gourley emphasized that despite the dark topic of cyberthreats, we all leave with optimism. Carol Tang addressed the importance of continuous learning as part of a business leader’s proactive approach to mitigating risk and providing safety for customers. Kayne McGladrey emphasized the dual responsibility of today’s corporate decision makers with regard to cybersecurity: understand the complexity but act with transparency and specificity. It’s important to integrate cybersecurity awareness into the fabric of the organization, not sequester cybertrust solely within the domain of technology.”
Kayne's Top Five in Five for April 2023
Hyperproof
April 05, 2023
April has brought a range of important cybersecurity developments to my attention. Here are the key takeaways:
• ChatGPT Risk Solutions: Addressing confidentiality, intellectual property, and compliance risks with practical recommendations.
• CISO Preparedness: Discussing generative AI risks and governance with senior executives, while considering supply chain disclosures.
• National Cybersecurity Strategy: Exploring breach responsibility, potential market regulation, and guidance from the NIST Secure Software Development Framework.
• Board Expertise Trends: Analyzing cybersecurity representation on Fortune 500 boards and the impact of SEC proposed rule changes.
• Credit Rating Implications: Evaluating the effect of cyber risk on companies' and municipalities' credit ratings.
CISO Strategies & Tactics For Incident Repsonse
CSHub
August 31, 2020
“Your incident response plan will be examined during discovery, period, point blank. Keep that in mind. It’s your policy and your plan that are going to be examined by our discovery, and make sure that you can actually do what that policy says and make sure you can do what the procedures say.”
Kayne McGladrey, Cybersecurity Strategist at Ascent Solutions
Enterprise Cyber Security Trends and Predictions 2020
Cyber Security Hub
November 27, 2019
“Effective defense in depth is not just shiny overlapping technical controls,” said Director of IT and Security Kayne McGladrey. “Rather, it’s the combination of culture, documented and tested processes, policies, and technical controls. For example, an organization with a policy of least privilege, a process for approving account privileges, and a process for auditing and harvesting unused privileges does not need multiple technical controls to implement the desired outcome.” It’s best to start with policy and then enact that in culture, where feasible.
Market Report: Cutting-Edge Defense Tactics For Network Endpoints
Cyber Security Hub
September 23, 2019
Data has historically been contained to the computing devices that accessed it within the enterprise campus perimeter. The traditional network endpoint was isolated to desktop PCs, laptop computers and most server components that attached to the organization’s network. In recent years, a dramatic increase in mobile devices has broadened the endpoint definition. Mobile devices require access to a company’s data anytime and from anywhere. With the addition of always-connected, sensor-powered Internet of Things (IoT) devices, the range of endpoints can now include everything from IP cameras to smart vending machines to biomedical devices.
The original definition still holds true to this day; however, the presence of more sophisticated devices requesting an IP address from the network, and often without a user interface, also suggests that the approach to endpoint defense must change. Bi-directional communications means the endpoint can be an entry point into a network or application. What does the device need to communicate with? Does it require internet connectivity? Does a device with an embedded OS provide some form of protection?
The Phishing Phenomenon: How To Keep Your Head Above Water
CSHub
January 30, 2019
Phishing is the lowest cost way for a threat actor to gain access to an organization’s network and assets, according to Kayne McGladrey, an IEEE member and director of Security and IT at Pensar Development. “While it might be fashionable to worry about the latest zero-day, or shadowy nation-state threat actors developing crippling remote exploits, the fact is that it’s cheaper to ask users for their passwords.”
The fact that nearly a billion people had their personal information exposed in November 2018 “has further helped threat actors to develop more compelling and targeted phishing content,’’ McGladrey adds.
Charting a new course: AT&T Cybersecurity report volume 8
AT&T
October 31, 2018
“Organizations that don’t have cybersecurity as a core business differentiator, or as a core business function, are often struggling to adapt modern cybersecurity practices,” says Kayne McGladrey, Director of Security and IT at Pensar Development.
AT&T Cybersecurity Insights, Vol. 7
AT&T
April 16, 2018
Migration is a transformative process, which means it needs the full backing of the C-suite. Kayne McGladrey, Director of Information Security Services for Integral Partners, LLC, says it is vital to offer “an effective presentation to the board about the benefits and challenges associated with
the migration, and it has to have a narrative. You have to find stories of success and failure inside
of your industry in order to present the full picture to the board.”
“There are many lessons that the enterprise will learn through piloting—whether it’s identified
security risks, user communication risks, or education risks—all of which provide future guidance,” says Kayne McGladrey, Director of Information Security Services for Integral Partners LLC. “By the time you get to the harder transition elements, including full infrastructure rollout, you’ve already sorted through the main issues, thanks to your pilot-based learning journey.”
In response to increasing regulatory burdens and the risk of civil litigation, successful companies in 2024 will lean into enhancements in their compliance operations. They will actively collect and test evidence of security control effectiveness, linking these controls directly to their risks, across all critical assets or systems. This approach ensures companies are confident in accurately describing how well they manage their risk portfolio, including in SEC filings. The automation of compliance operations enables security and audit professionals to spend more time doing the parts of their jobs that they love. Furthermore, as supply chain risks intensify scrutiny of B2B transactions, companies will efficiently repurpose many of their controls and control evidence. This strategy not only allows companies to secure additional attestations or certifications such as ISO or SOC 2 without increasing their workforce, but it also provides a significant competitive business advantage.
A review of the events of 2022 shows that 2023 will not be the year of dire new cyber attacks waged by hoodie-wearing cyber criminals or office-bound nation state APTs. Instead, 2023 will be the year where multiple regulatory bodies express their mounting frustration with public and private companies' collective inability to reduce the volume and impact of prior cyber attacks. In short, 2023 will be the year of risk.
An unprecedented six regulatory entities all have announced separate plans to enact additional rules in 2023 to instruct companies on how to manage their risks. These are the Department of Defense (DOD), the Federal Reserve, the Federal Trade Commission (FTC), the New York Department of Financial Services (NYDFS), the Office of the Comptroller of the Currency (OCC, part of Treasury), and the Securities and Exchange Commission (SEC). These entities wouldn’t be telling companies how to manage their risks if they believed that there was adequate risk management being conducted today. Instead, the pending regulatory changes are intended to cover perceived systemic shortcomings associated with cyber risk management.
Ransomware threat actors will continue to find new and innovative ways of generating revenue for their criminal operations throughout 2022. If organizations deploy adequate governance and technical controls in 2022 alongside an effective multinational policy response, we can anticipate a gradual ransomware slowdown in the fourth quarter as those threat actors not in prison re-skill as part of a workforce transition to other profitable criminal enterprises. Those countries giving license to ransomware threat actors inside their borders have a unique opportunity to provide a path to legitimate careers for those criminals who choose to voluntarily leave the market, and while this should not necessarily relieve them of any legal actions pending, it may be a useful incentive when considering sentencing.
Venture capitalists will accelerate feature development via mergers and acquisitions. In recent years, VCs have funded point solution vendors for technologies like SOAR and UEBA. These are features, not stand-alone technologies, and it’s often cheaper for market leaders to buy rather than build new features. CISOs should be aware of this market reality, as buying early-stage cybersecurity from a startup carries the risk of unintentionally having a business relationship with a much larger vendor within two years, and consequently needing to either buy the larger technology solution or rip and replace after the acquisition closes.
Cloud computing will continue to grow despite the frequency of breaches due to a lack of administrative controls and unintentional configuration errors. When an administrator had access to an on-premises server, they could only administer that server; a “cloud administrator” can administer all the assets in a given cloud instance, including backing up and exfiltrating entire servers. This is like the unintentional configuration errors that have plagued so many Amazon S3 buckets in 2019, where organizations have stored PII in S3 in a default configuration, and then those data have been accessed by security researchers.
The Internet of Things is a dumpster fire and upcoming regulatory controls aren’t going to put it out. Putting a sticker on a box with a username and random password and providing an updated privacy policy that consumers ignore isn’t adequate, although it is compliant. Manufacturers need to invest in user behavior analysis, require multi factor authentication, and to force patching of IoT devices. Otherwise, threat actors will continue to violate the privacy of people’s homes and nation states will built botnets as part of battlespace preparations.
Media source for expertise on AI, Cybersecurity, IoT
Location: Virtual Date Available:
September 07th, 2019 Fees: 0
Submission Date:
September 07th, 2019 Service Type: Service Offered
As a CISSP I have an ethical responsibility to help educate the public about cybersecurity issues, and have been featured in Reader's Digest, USA Today, Fast Company, the Philadelphia Inquirer, Dark Reading, Cyber Security Hub, CIO.com, Robotics Business Review, The Institute, and more. Please contact me via email if you need a source for a story, an alternate perspective, or a longer-form piece. It'd be favorite if I had at least a day to reply.
Join Thinkers360 for free! Are you a Reader/Writer, Thought Leader/Influencer (looking to increase your earnings), or an Enterprise User (looking to work with experts)?
Cyber Security Hub Advisory Board
Hyperproof's 5th Annual IT Risk and Compliance Benchmark Report Reveals a Pressing Need for Unified GRC Solutions
Survey Findings Show Link Between Data Silos and Security Vulnerabilities
Setting The Four Cornerstones Of Cloud Security: Accountability, Strategy, Visibility & Enablement
Boards need to brush up on cybersecurity governance, survey finds
Cybersecurity in Financial Disclosures: 11 Topics Your Section 1C of 10-K Filings Should Address
What are the pros and cons of shadow IT?
Businesses need to provide better cybersecurity training – here's how
Is Basic Cyber Hygiene Enough in the Age of AI?
Why enterprises need cyber insurance — how and what to buy
3 ways to fix old, unsafe code that lingers from open-source and legacy programs
The FTC updated the Safeguards Rule. Here’s how to avoid notification events.
FedRAMP Rev. 5: How Cloud Service Providers Can Prepare
37 Cybersecurity Awareness Month Quotes from Industry Experts in 2023
Tasks that bog down security teams (and what to do about them)
The SEC approved new disclosure requirements. Here’s what you need to know.
Managing Risk and Compliance Through a Recession
Hack Me If You Can
The Ultimate Guide to Enterprise Risk Management
Three Key Predictions for 2023: The Year of Risk
How to Upgrade Your Security Program from ISO 27001:2013 to ISO 27001:2022
It's Time to Regard Cybersecurity as Human Safety
Best practices for cryptocurrency firms and digital currency firms managing money
4 Stakeholders Critical to Addressing the Cybersecurity Workforce Gap
What Thoma Bravo’s latest acquisition reveals about identity management
Banks can leverage automation, regulation for cyberattack prevention
GRC Platforms: 5 Features You Need
Exploring the Advantages of Deploying DPUs in the Data Center
Secure Collaboration: Adopt an approach that balances people and technology
What’s new in cybersecurity for physical security systems?
Expert Panel Roundtable: What's new in cybersecurity for physical security systems?
Educated Endpoints
Senior IEEE Member
Top 50 IoT Influencers to follow in 2023
Cloud Thought Leader of the Day ️
150+ Top Global Cloud Thought Leaders and Next Generation Leaders of 2021
Top Cyber Pro Awards for 2020
Top 50 Global Thought Leaders and Influencers on Internet of Things
100 B2B Thought Leaders and Influencers to Follow in 2020
ISSA Article of the Year 2017
Getting AI Right: 3 Challenges for the Future
Cybersecurity Concerns Continue
What is End-To-End Encryption? 7 Questions Answered
Telehealth is Booming: Here’s What You Need to Know
How to Keep Your Video Conferences Secure From Intruders
Decreasing Risk Through Enterprise Compliance
Should You Be Worried About Airport Cybersecurity Threats?
Bridging the Gap: Communicating Cyber Risks as Business Imperatives
2023 IT Compliance and Risk Benchmark Report Findings: The Top 5 Game-Changers
Closing Keynote - The Most Common Visibility and Compliance Lapses in Your Cloud Vendors’ Environments.
Opening keynote speech at the Seattle Electrical Conference
Keynote speech at CIA Conference 2020
24th Annual Colloquium for Information Systems Security Education - November 4th, 2020
TAG Cybersecurity - February 2020 Meeting
Deter, Deny, and Defend Against the Three Most Common Cyber Attacks
Cybersecurity Career Accelerator EXPO
Include Cybersecurity Event 2018
Cybersecurity workshop and job opportunities for veterans
The Jobs of Tomorrow: Insights on AI and the Future of Work
The Evolution of the CISO Role in Modern Cybersecurity
What are the biggest ethical considerations of security technology?
The Evolving Landscape of Cybersecurity for Medium-Sized Businesses
Kayne McGladrey: The CISO’s Role Is To Advise on Business Risk
Next-Generation Cybersecurity Defenses Coalesce for Space Systems
PCI Compliance & the Importance of Penetration Testing
Why a return to the office brings identity and mental health challenges
The Job Of Security Director Is Expanding: How Does It Impact Technology?
Is basic cyber hygiene enough in the age of AI?
What's a Red Flag When Applying for a Cybersecurity Job?
Emerging cyber threats in 2023 from AI to quantum to data poisoning
Universities Tap Student Talent to Support Security Operations
Generative AI: Cybersecurity Weapon, But Not Without Adaptable, Creative (Human) Thinkers
Expert: Generative AI won’t harm cybersecurity workforce
The Cyber Ranch Podcast
Criminals Are Flocking to a Malicious Generative AI Tool
How Will the New National Cybersecurity Strategy Be Implemented?
How the Social Media Platform Discord is Helping Parents Keep Kids Safe
There’s a handy new label to tell you if your gadget is easy to hack or not
Why and how CISOs should work with lawyers to address regulatory burdens
How Discord's Parental Controls Can Keep Kids Safe
Data de-identification: Best practices in the new age of regulation
The risks of 5G security
Three Keys to Protecting the Corporate Network in the Era of Hybrid Work
How Will AI Impact the Jobs of the Future?
KEYNOTE PRESENTATION: Expert Predictions for 2024 at GPSEC Columbus Tech Summit 2023
A 2023 Regulatory Round-Up and How to Prepare for 2024
Cybersecurity Breaches Are in the News: How Internal Assessments Can Help You Avoid One
Panel Discussion: Navigating the Maze of New Cyber & Privacy Regulations – Keys to Avoiding Regulatory Action
ISACA Virtual Summit 2022: Pursuing Digital Trust
Streamlining GRC Controls to Optimize Cybersecurity
Curbing Cybercrimes in the digital sphere. #becybersmart - DCA Digital WebForum
SECtember 2022: Transforming Security Along with the Business
The Future of Health Tracking Apps
Cloud Adoption Outpaces Security
Preparing and Issues to Consider in an Incident Response Plan (IRP)
Cyber Threats, Cyber Vulnerabilities: Assessing Your Attack Surface
Returning to the Office: Security Threats and Proactive Solutions
How Hackers Used and Abused the Pandemic to Profit
CISO Perspectives: Zero Trust-As-A-Service
#IDGTechtalk : A 2019 Recap and 2020 Predictions
Panel Discussion: Who is responsible for Cyber Security in the enterprise?
TagNW Closing Panel and Comments
Diversity of Mindset: Why It’s Not Just About Gender, Race, or Age
Future of the Security Operations Center
Art of Cyber Defense: Insights from a Theatrical Minded CISO with Kayne McGladrey
Virtual CISO Happy Hour: The Scary Truth About Data Privacy
Don't let the security questionnaire stall your deals with Kayne McGladrey, Field CISO at Hyperproof
2023: The Year of Risk
The Truth Behind Automating Compliance Controls
What Businesses other than Banks Need to Know about Gramm-Leach-Bliley [Podcast]
Cyberattacks and How to Defend Against Them with Kayne McGladrey
Telehealth: Emerging Security, Privacy Issues
Episode 85 - Kayne McGladrey, Cybersecurity Strategist - Ascent Solutions
Episode 6: Securing the fast-moving digital world
Making cybersecurity more effective in the age of cloud and COVID-19
Episode 179: CISO Eye on the Virus Guy – Assessing COVID’s Cyber Risks
Don't Forget the Cybersecurity!" on The Wave of Change with Tony Flath
Zero trust secures agile business transformation
The Jobs of Tomorrow: Insights on AI and the Future of Work
Article: Experts advise on how to build a successful hybrid work security strategy
How to develop an application modernization strategy that delivers tangible results
Integration of AI: A strategic imperative for organizations
Using AI Isn’t As Easy As It Seems
Data loss prevention vendors tackle gen AI data risks
Zero trust from edge to cloud: not one-and-done
Cloud, 5G to be Decisive Technology Trends in 2023: Study
Cybersecurity hiring remains red-hot—the industry to surpass $400 billion market size by 2027
When More is Not Necessarily Better: The Impacts of Multiple Security Tools
Sinclair TV Stations Targeted in Weekend Ransomware Attack
New Legislation Eyes Both Ransom, Incident Reporting
Experts Weigh In on Data-First Modernization
Remote Work and Cybersecurity: 3 Experts Describe the Tech They Wish Everyone Could Use
FTC Warns: SMS Phishing Scam Impersonates State Agencies
Is my medical device vulnerable to cyber threats?
Machine learning is demonstrating its mettle across industries
The SMB Mission: Data Security Without Compromising User Productivity
What is 5G and What Does it Mean for Cybersecurity?
The Resilience of Humanity
Communicating Risk with Your Leadership Team
How Instacart Created Strong Relationships with Engineering to Build a More Compliant Product
Cyber security for Bellingham families and neighborhoods
IoT & Ethical Obligations of Engineers
CES 2024 Recap
What piece of advice would you give companies approaching an audit?
Cyber Privacy, Ethics, and Abuse CISS 417 at WWU
2024 IT Risk and Compliance Benchmark Report Findings: Turning Cybersecurity Challenges into Opportunity
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
From Cost Center to Competitive Edge: Operationalizing GRC
Elevating Security: The Power of CIS Critical Security Controls
Working with ChatGPT: The Dos and Don’ts for Your Organization’s Security
Level Up Your Security: How to Build Compliance and Risk Mgmt Programs to Scale
Communicating Risk With Your Leadership Team
Scale Your Security Questionnaire Response and Audit Preparedness Processes
Scale Your Security Questionnaire Response and Audit Preparedness Processes
The CISO Experience
6 Steps to Prepare Your Company for CMMC 2.0
Watch: Supply Chain Congestion: A Golden Opportunity for Hackers
Webinar: Zero Trust-As-A-Service
CISO Perspectives: Zero Trust-As-A-Service
Kayne's Top Five in Five for April 2023
CISO Strategies & Tactics For Incident Repsonse
Enterprise Cyber Security Trends and Predictions 2020
Market Report: Cutting-Edge Defense Tactics For Network Endpoints
