Center for Internet Security

Welcome to Cybersecurity Where You Are, the Center for Internet Security's podcast.

Cybersecurity affects us all, so join us as we discuss trends and threats, explore security best practices, and interview experts in the industry.

Together, we'll clarify these issues, creating confidence in the connected world.

Hello, and welcome to the show, Cybersecurity Where You Are.

I'm Sean Atkinson, CISO here at the Center for Internet Security.

Going on a solo mission today, um, going down the path of game theory and security chaos engineering.

This is part of a presentation that I put together for the RSA Conference in 2025, and I thought I'd bring some points to the podcast and see, um, the types of relevance that we have today.

Welcome to Cybersecurity Where You Are, the Center for Internet Security's podcast.

Cybersecurity affects us all, so join us as we discuss trends and threats, explore security best practices, and interview experts in the industry.

Together, we'll clarify these issues, creating confidence in the connected world.

Hello, and welcome to the show, Cybersecurity Where You Are.

I'm Sean Atkinson, CISO here at the Center for Internet Security.

Wanna talk about a topic that, that's near and dear to my heart, one I've been, um, putting, uh, posts on LinkedIn.

This is secure harness engineering.

It, it's super critical that across the 16 critical infrastructure sectors that the FBI has identified, that we focus on these things.

So the Center for Internet Security is a organ- Think of it like a chamber of commerce for cybersecurity nerds like me.

At InTrust, we, we, we pay to belong to this thing to be able to use their resources commercially.

They have incredible resources.

The state of Ohio last year, and we talked about this, passed a law.

Again, kudos to Ohio for ti- tending to lead in this space.

Ohio Revised Code 9.64 that amongst other things requires any political subdivision, any, any taxing authority in Ohio to have a cybersecurity program, and they actually reference the Center for Internet Security Critical Controls, one of the things CIS provides, as a baseline, a framework for you to build your cybersecurity program around, and other states have done this as well.

So my point is, Center for Internet Security is a well-known, well-respected organization.

Welcome to Cybersecurity Where You Are, the Center for Internet Security's podcast.

Cybersecurity affects us all, so join us as we discuss trends and threats, explore security best practices, and interview experts in the industry.

Together, we'll clarify these issues, creating confidence in the connected world.

Hello, and welcome to the show, Cybersecurity Where You Are.

I'm Sean Atkinson, CISO here at the Center for Internet Security.

You know, doing a solo, uh, podcast today, and, and the reason why, I wanted to talk to you guys about, um, security and AI risk management.

One of the things we're starting to see is obviously the, the proliferation of AI through many tools, services that we're consuming, right? Bringing those into our environments.

So typically what we would recommend, right? So obviously you want to have your vendor management, right? But we recommend that every company do as an ongoing matter of business, some sort of maturity level assessment against one of these frameworks.

I mentioned NIST, the Center for Internet Security developed a framework of which you can assess NIST at a pretty granular level.

Our recommendation is that you would do that periodically.

Assess where you are, right? Because I can't get to where I need to be if I don't know where I am.

So do you have a SOC 2, right, is going to be the first question.

And then number two, do you internally, because a SOC 2 is a component of cybersecurity, it's not full end-to-end.

Are you, like I mentioned, do you subscribe and implement the Center for Internet Security? If so, which implementation group? Do we just focus on this CSF 2.0 and we take our own kind of approach to implement controls based on the framework? So I would say it's a standard matter of due diligence, right? Does the company...

Do they have a SOC 2? And then what else are they doing beyond that? If you're not confident that the SOC 2, because once again, just because they give you the report doesn't mean it meets all the requirements.