Robert Wood

Sidekick Security

Founder and CEO

Soft Side of Cyber

Co-Founder and Content Creator

ICIT (Institute for Critical Infrastructure Technology)

Fellow

Centers for Medicare & Medicaid Services

Chief Information Security Officer

Project N95

Security

Simon Data

Chief Security Officer

SourceClear - now a part of Veracode

Nuna Inc.

Director, Trust and Security

Cigital, Inc

Principal Consultant and Director of Red Team Assessments

Senior Security Consultant

Security Consultant

Associate Security Consultant

Secure Network Technologies, Inc.

Information Security Engineer

CISO | Servant Leader | Advisor | Lifelong Student (posts here are my own opinions and musings)

I have built, scaled, and run security programs as a CISO at 4 different organizations ranging from small tech startups to trillion dollar government organizations. The early part of my career was spent working in application security and red teaming. Cybersecurity is a passion of mine; using it to do amazing things is something that gets me fired up.

That’s why I founded Sidekick Security. To help organizations achieve security-led growth and digital transformations. In an age of trust as currency in so many industries, I believe this is the time when security truly can be an enabler. 

Beyond that, I am a lifelong learner. I love studying outside of my field and finding ways to expand the mental models I have to solve problems differently, more effectively, or to think about them in altogether new and fresh ways. 

Helping to connect SMBs and startups with exceptional security talent. A fresh, blue ocean strategy on the cyber security services market for organizations that really need it. 

Being a former Federal CISO a lot of the meetings I've joined as of late have had small talk pointing to the shutdown and it's impact on cyber. 

Having gone through one of the longer shutdowns myself being one of the only essential staff in cyber, the impact is real...but it's not as cliche as I think some of the LinkedIn fodder would suggest.

To me, a big part of it is organizational and technical debt accumulation. Something the government already struggles to pay down.

I'm going to stick this full rant up on youtube.

#cybersecurity #govit #shutdown

Helping CISOs and CIOs navigate their own cybersecurity transformations | Former Federal CISO

Lots of CISO's strive to have dashboards that are looking good for their executive peers and the board. Why would AI risk be any different? 

Guardrails: 100%
Policy compliance: complete
Vendor reviews for AI risk: 100%
ISO 42001 certification: achieved
Training: 95%

Everything’s green. Everything’s fine. We are on track and looking great! 

Our industry has unfortunately gone through so many rounds of compliant companies getting hit with a major breach. Dependencies in the supply chain getting disrupted and causing problems. I'm going to avoid calling out specific companies because that's just shitty and unhelpful.

The point is, that your dashboards show what’s above the surface. What matters lives below it, which are metrics that might be a little more ugly as we collectively figure this stuff out.

Here's a few metrics that might make sense to adopt in your organization.

Time to Detect
- How fast can you identify abnormal model behavior?
- How fast can you identify new AI tools in use throughout your organization (native or cloud-based)?
- Baseline “normal,” track mean time to detect (MTTD), and reduce it monthly.

Time to Contain
- Once you detect an issue, how long until it’s isolated, rolled back, contained, or fixed?
- Measure mean time to contain (MTTC) and mean time to restore (MTTR).

Red Team Success Rate
- Run real AI attack simulations. This could be testing against AI features/products or testing against a corporate environment where AI tools are in use (and in scope).
- Track how often your red team succeeds, and make sure that trend declines over time.

Shadow AI Coverage
- Compare approved vs. actual tools in use (native tools, cloud/SaaS tools, browser extensions, etc.)
- Then measure the velocity of introduction to determine how fast new unapproved tools appear across your org.

Dashboards reassure and can be very helpful. Building real capability though protects. To do that demands a hard look in the mirror sometimes.

If you’re briefing your board next quarter, my recommendation is to ditch the “all green” slide when it comes to AI risk. Show how fast you can detect, contain, and recover when your AI systems fail in the real world.

 #AISecurity #RiskManagement #CyberSecurity #AICompliance #BoardReporting #SupplyChainRisk

No alternative text description for this image

This might be an unpopular take given the AI and tech craze. There’s a lot of reasons that a team might run a penetration test.

- They need to satisfy some compliance requirement.

- They want to find exploitable issues instead of garbage tool output.

- They want to assess the way that there. Blue teams respond.

- they want to get a security check before something goes live.

Regardless of the reason, one of the things that has always bothered me about the practice of penetration testing… really, with all those things happening on a daily basis in cyber, is that it sits in a neat little silo.

I didn’t really get this until I ran a few security programs, but  There is so much opportunity to connect the dots and create 2+2=7 outcomes. 

I see a lot of opportunity to do just that in the field of offensive security. I just don’t see the AI optimized tests, dashboards for everything, and “as a service” models addressing this gap. I see all that optimization actually making the problem worse.

#cybersecurity #ciso #offensivesecurity #pentesting

Why is purple teaming a standalone and specialized practice? 

I fully stand by and believe in purple teaming as an approach to blending offensive security and blue teaming. 

However, why this sort of collaboration is not a default practice for anyone doing pentesting is something I simply don’t understand.

Why do we force CISO’s to pay extra for such a practice? 

This to me is low hanging fruit. 

#pentesting #cybersecurity #purpleteaming #redteam

OpenAI’s new “ChatGPT-powered” browser just dropped and the big promise is not just a UI change but the browser as AI. 

There's a non-trivial attack surface attached to browsers, especially in corporate settings. Hence the rise of enterprise hardened browsers like Island.

So with such a big move, cybersecurity leaders should be asking themselves and their teams some of the key questions below. If you don't, I assume it'll be asked of you by someone outside of your team soon enough.

- Can I detect this in my environment and on my devices? 

- How does this tie back corporate accounts we might have with OpenAI? 

- Is there any way to manage configuration or controls on the browser here when everything about the user behavior is effectively now a part of this generative model? 

- How do we audit a browser that learns from every click, summarizes private content, and auto-executes tasks on our behalf? What's the privacy regulation impacts on that for us? 

- The line between “user action” and “AI action” is blurring, so how does that impact our policies around identity, acceptable use, and incident response?

- What does this do to our trust boundaries and compliance requirements?

For the CISO's out there, this might seem like another bit of gimmicky AI news but I could definitely see this introducing some _major_ challenges if Atlas picks up steam. If the explosion of ChatGPT in general has been any indicator, it certainly has potential to.

#CyberSecurity #AI #RiskManagement #CISO #BrowserSecurity #OpenAI

Shutdowns suck. For people and for cyber writ large. 

Here is the full video covering my take as a former Federal CISO on the cybersecurity impacts of the government shutdown.

There's a lot of caricatures out there. There's also a lot of armchair quarterbacks who haven't gone through it. The impact is real, but it may not be hitting the things you think.

Full video here: https://lnkd.in/ePnW_xZk

#govit #shutdown #cybersecurity

Taplio

Robert Wood's Linkedin Analytics

Robert Wood

Performance ScoreRobert Wood's LinkedIn Performance

Who is engaging with Robert

Robert Wood's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Robert Wood's Linkedin Analytics

Robert Wood

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Robert Wood's LinkedIn Performance

Who is engaging with Robert

Robert Wood's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Robert Wood's Linkedin Analytics

Performance ScoreRobert Wood's LinkedIn Performance

Robert Wood's Best Posts (last 30 days)