Why Silence After a Breach Helps the Hackers with Scott Dickinson

Descripción

Guest Introduction: Scott Dickinson is the first-ever CISO at AnMed Health, a not-for-profit hospital system in Anderson, SC with three main hospitals and a growing network of emergency care facilities. He brings a career spanning military intelligence, the FBI, the Department of Commerce, the Department of Defense, and multiple state agencies to one of the most high-stakes environments in cybersecurity. His background in intelligence gives him a rare and direct line into how adversaries think, and he applies that perspective every day to the mission of protecting patients and the systems that keep them alive. Here's a Glimpse of What You'll Learn * What it means to be an organization's first-ever CISO and how Scott approached building a security program from the ground up at AnMed Health * Why Scott draws a direct line between his military intelligence background and how he approaches threat modeling in healthcare * Why machine learning is fundamentally different from bolting an LLM onto a legacy product and what that distinction means for how security tools should be evaluated * How the cybercrime economy has changed in six years and why rented ransomware has lowered the barrier to entry to nearly zero * Why Scott believes the security community needs to shift from disclosure of what happened to disclosure of how it happened and what others can do to prevent it * How Scott thinks about building personal resilience as a CISO and why being battle-tested is now seen as a qualification rather than a liability * Why AI-powered critical thinking atrophy is one of the most underappreciated risks of widespread AI adoption, and what leaders should be doing about it In This Episode Scott opens with something that does not come up often enough in these conversations: the emotional dimension of the work. He chose to come into healthcare specifically because he does not want attackers picking on sick people. The framing is simple and it is genuine. Hackers are bullies. Hospitals are targets. People have died because of cyberattacks on healthcare facilities, and he intends to be in the way. That motivation runs underneath everything else he says in this episode and gives his technical arguments a weight that purely strategic conversations rarely carry. He also brings something most CISOs cannot: a decade in military intelligence and direct experience working alongside the FBI, Department of Defense, and Department of Commerce. He does not just understand how defenders think. He understands how attackers think, which is a different skill entirely and one he applies every day at AnMed. The most practically useful section of this episode is Scott's argument about what the security community owes each other after a breach. He is direct: the stigma around disclosure is helping the attackers. When an organization gets hit and goes quiet to manage the reputational damage, it withholds exactly the information that could allow every other organization to close the same door before the attackers find it. Scott's position is not that organizations should be reckless with sensitive information. It is that the focus of disclosure has to shift from what was exposed to how it happened and what others should do right now to protect themselves. He makes a pointed analogy to community resilience more broadly, drawing on a personal story about a neighbor who pulled a truck off him without stopping to weigh the legal liability. That instinct to help rather than hesitate is what he wants to see from the security community. Scott closes with the AI argument that most vendors are not making loudly enough because it is uncomfortable for them: the danger is not just that AI can be weaponized by attackers, it is that over-reliance on AI erodes the critical thinking that defenders need most when things go wrong. He uses his own SOC as a concrete example. When he introduced an AI-powered email security product, he did not let it run silently. He showed his analysts exactly what the tool was flagging and why, teaching them to think the same way so that the tool was developing their judgment rather than replacing it. That is the model he argues the industry needs to internalize before AI becomes a liability masquerading as a defense.

The Economics of Cybercrime and the AI Strategy Behind Getty with Isaac Straley - Ep 224

Guest Introduction: Isaac Straley [https://www.linkedin.com/in/isaac-straley/] is the CISO of the J. Paul Getty Trust [https://www.getty.edu/], one of the world's most significant cultural institutions, encompassing two museums in Los Angeles, a deep academic research library and scholarship program, a scientific conservation laboratory, and a global philanthropic grant-making foundation. Two months into his fourth CISO role, Isaac brings a career spent almost entirely in public sector and nonprofit organizations, including three prior stints as CISO at public research universities, to an institution that is increasingly a target in a sector that has historically underinvested in cybersecurity. He also holds responsibility for Getty's enterprise-wide AI strategy, making him one of the few guests this podcast has featured who is simultaneously building the offensive and defensive AI posture for the same organization. Here's a Glimpse of What You'll Learn * Why museums, libraries, and cultural institutions are now active targets and how recent attacks on the Seattle Library, Toronto Library, and British Museum changed the conversation * Why Isaac frames cybersecurity almost exclusively through an economics and business lens and what that means for how he prioritizes risk at Getty * Why patch management is the encyclopedia of security strategy and what has to replace it in an era of machine-speed vulnerability discovery * Why the NIST CSF 2.0's three response-oriented functions are more important than its two prevention-oriented ones and why the field has been signaling this for years * How observability pipelines rather than prevention controls are the architecture that makes AI-age security actually work * Why Isaac advises every aspiring security professional to go learn something else first and why that advice is more relevant in the AI era than it has ever been * Why measuring a SOC analyst on how many threats they found is the wrong metric and what he is replacing it with In This Episode Isaac opens by making the case, with genuine conviction, that the J. Paul Getty Trust needs a CISO and not merely an IT security director. The argument is stronger than it initially sounds. Getty is not just a tourist destination hosting a million and a half visitors a year across two museums in Los Angeles. It runs a digital archive of another million and a half physical pieces being built into a publicly accessible, API-enabled collection. Its conservation institute does leading-edge materials science research on how to preserve degrading plastics, oils, and stone. Its foundation funds cultural heritage organizations globally and distributes open source software, including a heritage data management platform used for archaeological dig sites. And all of it sits in a sector that, as Isaac notes directly, has not had the investment and focus it needs, evidenced by recent ransomware attacks on the Seattle Public Library, the Toronto Public Library, and the British Museum. That context is what makes his framing of the threat so useful: he thinks about attacks almost exclusively from an economics standpoint. Attackers are running supply chains with HR departments. Their KPIs are not calibrated to spare hospitals or museums. The question is simply whether a vulnerability exists and whether it can be exploited, and the answer is almost always yes and yes. The security architecture argument Isaac makes in this episode is the one that most challenges how the field has historically measured itself. Prevention and protection matter, he acknowledges, and there is a legal and ethical obligation to maintain basic hygiene. But NIST CSF 2.0 already signals where the weight should be: three of its five core functions are on the response side, detect, respond, and recover. The discipline has been pointing at this for years. What is new is that the AI age makes it structurally unavoidable. Organizations are no longer building controlled infrastructure with thoughtful design and hardened controls baked in. They are building platforms for people to create things nobody anticipated, and those platforms cannot be protected through prevention alone. What they can be protected through is observability, building trace data pipelines that capture what is happening across every system in real time, feeding that data to machine learning that understands what normal looks like, and escalating anomalies to a human before the damage compounds. Isaac is specific that this is not just a security strategy. It is a virtuous loop, because the same observability infrastructure that makes security possible also gives builders better feedback on whether their systems are working. Security and functionality, aligned by design rather than in opposition. The talent and leadership section of this episode is where Isaac is most candid about what he has learned the hard way. His standard advice to students asking how to break into cybersecurity is to go learn something else first: a business process, a technology, where it breaks, what controls feel like from the inside. The cybersecurity skills can be taught. The business knowledge and architecture intuition cannot be shortcut. In the AI era, that advice becomes more urgent, not less, because the organizations that will use AI well are the ones whose people can ask good questions of it. The 85% of Microsoft employees who stopped using Copilot after 90 days went straight to demanding outputs without context. The 15% who became power users treated it the way you treat a new hire who needs to learn the job. Isaac extends that into a leadership obligation: if AI is going to do the routine rote work, then the measure of a SOC analyst's success should not be how many threats they found. It should be how much they improved the observability pipeline from what they learned. That shift in measurement is what allows organizations to ride the wave of AI capability rather than be made redundant by it. This episode is brought to you by Cyberlynx [https://cyberlynx.com/]

Ayer35 min

Why Silence After a Breach Helps the Hackers with Scott Dickinson - Ep 214

Descripción

Comentarios

Empieza 7 días de prueba

Todos los episodios