Executive Interview: Emerging Trends and Effective Strategies from GCISO Dan Maslin

In our ongoing series of CISO interviews, we are excited to share insights from Dan Maslin, the Group Chief Information Security Officer (GCISO) at Monash University. In a recent conversation with SOCRadar’s Advisory CISO Ensar Seker and Sales & Channel Director APAC Rajeev Mathur, Dan shared his perspectives on the evolving cybersecurity landscape, emerging threats, and effective mitigation strategies. His insights are precious for cybersecurity professionals looking to stay ahead of the curve.

Emerging Trends and Technologies in Cybersecurity

Dan Maslin highlighted three significant trends significantly impacting the cybersecurity landscape. The first trend is misconfiguration, where attack surfaces are inadvertently exposed due to accidental misconfigurations or unrecognized vulnerabilities. Dan Maslin emphasized the importance of understanding and managing the attack surface, including unknown exposures such as APIs and software vulnerabilities.

The second trend involves increasingly using stolen credentials and tokens to compromise organizations. Dan Maslin noted the need for quick identification and response to such compromises, often facilitated by dark web monitoring and timely rotation of credentials.

The third trend focuses on third-party suppliers and service providers, who threat actors increasingly target. Ensuring robust third-party monitoring and integrating these entities into the organization’s security strategy is crucial for mitigating this risk.

Strategies for Ransomware Mitigation

The Role of AI and Machine Learning in Cybersecurity

Artificial intelligence (AI) and machine learning (ML) are transforming cybersecurity. Dan Maslin pointed out that AI helps both attackers and defenders move more quickly. For instance, AI can rapidly analyze breached passwords and dark web material for attackers, while for defenders, it can assist in identifying malicious emails and analyzing data trends.

AI and ML are gradually integrated into cybersecurity products, providing practical applications beyond the initial hype. Dan Maslin emphasized the need for adaptable cybersecurity strategies incorporating new technologies like AI to enhance security efforts.

Integrating AI and Cyber Threat Intelligence

Dan Maslin noted that integrating AI and cyber threat intelligence has shifted the approach from reactive to proactive and now predictive. Understanding attackers’ tactics and knowing the attack surface, including third-party risks, are critical use cases for cyber threat intelligence. Swiftly mitigating risks associated with stolen credentials and tokens is another critical area where cyber threat intelligence proves beneficial.

Ensuring Third-Party Compliance with Security Standards

Ensuring that suppliers and vendors adhere to security standards is challenging. Maslin recommended setting expectations upfront through contractual clauses, retaining the right to audit third parties, and using cyber threat intelligence to monitor third parties externally. These measures help ensure compliance and enhance overall security posture.

Balancing Known and Emerging Threats

Prioritizing vulnerabilities amidst a vast array of threats is a significant challenge. Maslin advocates for a defense-in-depth approach, assuming multiple layers of control will fail and having redundant defenses to detect and contain threats. This strategy ensures a robust defense even if one control fails.

Effective Communication with Non-Technical Stakeholders

Effective communication with executive boards and non-technical stakeholders is crucial for addressing cybersecurity challenges. Maslin highlighted the importance of adopting a common framework, such as the NIST Cybersecurity Framework, which provides a clear understanding for technical staff and board members. This common language facilitates better decision-making and enhances the organization’s security posture.

Essential Skills for Cybersecurity Professionals

To excel in cybersecurity, Dan Maslin emphasized the importance of problem-solving, critical thinking, task prioritization, and strong communication skills. The ability to convey complex information clearly to different audiences and manage workloads effectively is essential for success in this dynamic field.

Advice for Fellow CISOs

In closing, Dan Maslin advised fellow CISOs to take time to recharge, both mentally and physically. The cybersecurity field can be overwhelming, and setting boundaries and ensuring downtime is crucial for maintaining focus and effectiveness at work.

We thank Dan Maslin for sharing his valuable insights and experiences. His perspectives provide useful guidance for cybersecurity professionals striving to enhance their security strategies and stay ahead of emerging threats.