Accelerate your SASE deployment with the SASE Week Backstage Series. Explore sessions

close
close
  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,400 customers worldwide including more than 30 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

A Leader in SSE.
Now a Leader in Single-Vendor SASE.

Learn why Netskope debuted as a leader in the 2024 Gartner® Magic Quadrant™️ for Single-Vendor Secure Access Service Edge

Get the report
Customer Visionary Spotlights

Read how innovative customers are successfully navigating today’s changing networking & security landscape through the Netskope One platform.

Get the eBook
Customer Visionary Spotlights
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Learn about Netskope One
Abstract with blue lighting
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
NewEdge
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Aerial view of a city
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through secure access service edge (SASE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

The Future of Security: Quantum, AI, and Macro-political Change
Emily Wearmouth and Max Havey speak with Netskope CEO Sanjay Beri and CTO Krishna Narayanaswamy about the future of security.

Play the podcast Browse all podcasts
The Future of Security: Quantum, AI, and Macro-political Change
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through secure access service edge (SASE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2024 On-Demand

Learn how to navigate the latest advancements in SASE and zero trust and explore how these frameworks are adapting to address cybersecurity and infrastructure challenges

Explore sessions
SASE Week 2024
What is SASE?

Learn about the future convergence of networking and security tools in today’s cloud dominant business model.

Learn about SASE
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Careers chevron

    Join Netskope's 3,000+ amazing team members building the industry’s leading cloud-native security platform.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Accreditations chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Help shape the future of cloud security

At Netskope, founders and leaders work shoulder-to-shoulder with their colleagues, even the most renowned experts check their egos at the door, and the best ideas win.

Join the team
Careers at Netskope
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working
Post Thumbnail

On the latest episode of the Security Visionaries Podcast, host Max Havey sits down with Rich Davis, Director of Product Solutions Marketing at Netskope for a deep dive into the crucial topic of cyber hygiene. Specifically, they get into assessing the impact of cyber awareness days and revealing the challenges businesses face in instilling year-round cyber hygiene habits. Discover how multi-factor authentication and zero trust principles can elevate your cyber hygiene. From making cybersecurity personal to converting it into a business initiative, this episode is packed with useful tips for improving cybersecurity in your organization and personal life.

Ultimately it comes down to that user. We’ve got to make things easy for the users. We’ve got to explain to people why this is so important, and we’ve got to put tools in place that really help them make that good decision and not fall back to those bad practices.

—Rich Davis, Director of Product Solutions Marketing
Rich Davis

 

Timestamps

*00:01 - Introduction*09:50 - Multi-factor authentication and zero trust principles
*00:21 - Assessing the contribution of cyber awareness days*10:12 - Minimize attack surfaces and prevent data loss via adaptive trust
*01:05 - The struggles of implementing cyber hygiene throughout the year*12:55 - Addressing data exposure risk and reinforcing user education
*02:16 - The lifespan of security training and endorsing continuous education*13:45 - Misconfigurations and the associated risk of data exposure
*03:12 - Misunderstandings and challenges in maintaining cyber hygiene*15:59 - Making cyber hygiene a business initiative
*04:30 - Strategies to encourage healthier cyber hygiene practices within companies*18:24 - Conclusions
*07:00 - Practical examples of relating cyber hygiene to personal situations

 

Other ways to listen:

green plus

On this episode

Rich Davis
Director of Product Solutions Marketing at Netskope

chevron

Rich Davi

Richard Davis is Director, Solution Strategy at Netskope. He provides insights and expertise, country by country, on cyber resilience and defences such as cloud security, Security Services Edge and risk management while also overseeing product and solution strategy for the EMEA region.

Davis is a seasoned cybersecurity professional with over 20 years’ experience and is passionate about helping organisations protect their people and data. Prior to Netskope Davis held the roles of Principal Solutions Architect, Head of Product and Solutions, EMEA and then Cybersecurity Strategist at Proofpoint.

LinkedIn logo

Max Havey
Senior Content Specialist at Netskope

chevron

Max Havey

Max Havey is a Senior Content Specialist for Netskope’s corporate communications team. He is a graduate from the University of Missouri’s School of Journalism with both Bachelor’s and Master’s in Magazine Journalism. Max has worked as a content writer for startups in the software and life insurance industries, as well as edited ghostwriting from across multiple industries.

LinkedIn logo

Rich Davi

Richard Davis is Director, Solution Strategy at Netskope. He provides insights and expertise, country by country, on cyber resilience and defences such as cloud security, Security Services Edge and risk management while also overseeing product and solution strategy for the EMEA region.

Davis is a seasoned cybersecurity professional with over 20 years’ experience and is passionate about helping organisations protect their people and data. Prior to Netskope Davis held the roles of Principal Solutions Architect, Head of Product and Solutions, EMEA and then Cybersecurity Strategist at Proofpoint.

LinkedIn logo

Max Havey

Max Havey is a Senior Content Specialist for Netskope’s corporate communications team. He is a graduate from the University of Missouri’s School of Journalism with both Bachelor’s and Master’s in Magazine Journalism. Max has worked as a content writer for startups in the software and life insurance industries, as well as edited ghostwriting from across multiple industries.

LinkedIn logo

Episode transcript

Open for transcript

Max Havey [00:00:02] Hello and welcome to another edition of the Security Visionaries Podcast, a podcast all about the world of cyber data and tech infrastructure, bringing together experts from around the world across domains. I'm your host today, Max Havey, and today we're talking cyber hygiene with our guest, Rich Davis, director of Product solutions marketing here at Netskope. How's it going today, Rich?

Rich Davis [00:00:21] Yeah. Hey, Max. Great to be here. Looking forward to today's conversation. Certainly one that's dear to my heart, having previously, in, in great detail, around the human factor and and how humans can affect things. And certainly the today's topic very much aligns with that.

Max Havey [00:00:36] No doubt. So yeah, let's jump in here. So as the year starts off, we tend to see a lot of cyber related awareness days. Things like National Change Your Password Day, which is on February 1st or today when it's coming out is Safer internet day. But in your experience, have you found that these sorts of awareness days are really that effective? Like, what do you see them sort of driving the change that security professionals are really looking for when it comes to dealing with that human element?

Rich Davis [00:01:05] Yeah, I mean, these are of course a bit of a double edged sword. Firstly, we can't fault any publicity. Any publicity in any awareness is great. I think the problem is that, as with all of these sort of things, it can become a bit of a, "okay, I'll do it today and I'll forget it another day." And of course, this needs to be a year round effort, certainly when it comes to our, our users and that people, they're the first line of defense. And therefore they need to be thinking about this and they need to thinking about security and what they're doing day in, day out. So again, great that we focus on it on a particular day. Not so good that, it may then lead to them forgetting about it another times. And this is often seen in data as well. Just if you look at some of the, the historic data around user behavior, you actually see that, if, you know, a week or two after, security awareness training happens, you get a better result, you get lower click rates through, content. There were more likely to do those things. They remember things like DLP alerts drop as well, but then it tails off. And yeah, that's why these sort of things to be pretty effective. Yeah. Organizations really need to be thinking about this is a constant evolution. Day on day, week on week.

Max Havey [00:02:16] Definitely. The half life of security training is pretty low based on everything I've ever heard from our various members of the CSO team here. So finding ways to keep it going in the consciousness throughout the year is very good. But just single day it seems to be kind of ineffective overall.

Rich Davis [00:02:32] Yeah, yeah, most definitely. And I think, I think these, these safer internet days and change your password days really should be in a way resigned to that bin of yesteryear. And really, we should be thinking about this, you know, far more holistically.

Max Havey [00:02:47] Definitely more of a year round cyber hygiene conversation as opposed to, you know, just just single days where they're well intentioned. But the results aren't always exactly what we want.

Rich Davis [00:02:56] We should be calling it safer internet life. Really?

Max Havey [00:02:59] Most definitely. And I guess that brings us to our first real big question here is thinking about cyber hygiene. Why do you find that cyber hygiene can be a difficult, sometimes tedious task for organizations to really take on and make kind of a year round objective?

Rich Davis [00:03:12] Yeah, I think part of it is there a historic aspect. So I we've all been there, we've all had that email through that we dread, and it's that yearly time to go until your training and you think, oh, this is eight hours, I haven't got time for this. And we've automatically got this negative opinion. And I think as individuals, I think we also have this inbuilt sense that we don't need to do this, that yeah, we have common sense, we know what we're doing. So I think those do definitely play a part. And I think that's part of the problem. I also think that all too often it's driven around the benefits to the organization and not the benefits to the individual. And I think there's a lot and we've seen this really be successful is when it's focused around the individual in their families. If you can extend it to, you know, how to keep you and your family safe. Then organizations, I think, have more impact because you make it relevant to that individual.

Max Havey [00:04:01] Definitely appealing to the personal side of the user kind of feels like the way to make it real to them. And it's not just, you know, speaking about broad, abstract, sensitive data. It's your Social Security number. It's making sure that your passwords are safe and your banking information is safe, like it is personal, identifiable information for a reason. In that same vein, here in your roles, how have you found ways to promote better cyber hygiene practices within your organization? Maybe better emphasizing that sort of personal element that is a part of all of this?

Rich Davis [00:04:30] Yeah. And I think it really comes down to a couple of things. Firstly, kind of how you're designing that training. And yes, we're focused, you know, specifically on identity and passwords to an extent, but of course much broader than that. I think it's about that, as you say, making it personal. And that means giving real life examples that may happen to you both in a business sense, but then releasing it to something that they can understand, maybe in, in a personal sense. So relating that stealing of your own personal credit cards to stealing of company PIA or, intellectual property. And the effect that can have. Because again, you make it personal, you make it real, and you make it kind of linkable to what they think about day in, day out and what what they might personally, care about. I think if we think about it in terms of, the other side, which is the time. And when we do this, I think this is really about just drip feeding it through the year. I think organizations only have a certain amount of time that they can spend training their users in a year, and too many organizations will go "Okay. Right. Eight hours. We're going to do or once you on this date." And actually a far more effective way is to break that up. Yes, you might have, for compliance reasons, the need to take certain training on a yearly basis because you have to meet those requirements, but outside that far better use of time. It is to drip feed it and have that just in time training, but also make it relevant to situations that the company is facing. If you can actually, inform the, the, the user, your people as to the types of threats that are relevant to your organization rather than making it too generic. Then again, it gives you that link to the organization. They can understand why they're being asked to take certain training. And therefore you're going to get an overall better response to that training. And I've seen this, you know, firsthand in my past life working with organizations and trying to track the changes in the behavior, moving from this kind of once a year to, a much more targeted training program that rolls over the period of the year where you drip feed content, you just be training, and you make it much, much broader than just that, e-learning that occurs, once a year on that portal.

Max Havey [00:06:44] Definitely. And just to dig in a little bit more, as you sort of talked about, you know, finding ways to make these sorts of trainings relevant to the specific user in their family, in their daily life. Well, can you give us some sort of examples of what that sort of looks like and how that sort of how that sort of plays out?

Rich Davis [00:07:00] Yeah. Let me give you a relevant example to myself. I've got, children that have just turned to become teenagers for the first time they've started to have control of their own bank accounts. We've gone from looking after them oueselves to giving them access to having apps on their phones and, be able to use Apple Pay. So this is personal to me directly, but this then focuses around, well, how do you protect that? You don't want your hard earned money that may have been earned through chores in the house disappearing overnight because you've been careless with your information. And therefore, you know, at a young age, we started to talk to them about staying safe. They both got password managers that they can store their their key credentials in. I've talked through why this is needed and, and tried to make it relevant to that situation they're in. So I think it's just, you know, one great example of where you can try to, to make that relevant. So they're now using password managers day in, day out. It means that they've only got that one credential that they need to remember. It can be complex because there's only that one thing to to remember. And this is a 13 and a 15 year old. So if they can do it then, you know, there's no reason why every person from a business perspective can't do the same thing. My daughter now forwards me, smish through and she's like, oh, dad, look how obvious this one is. And, you know, it's just a great example of where we can actually see, you know, the benefit of what we're doing. I think another great example is making it relevant to what people understand day to day. So, if you look at YouTube, there's been a huge series of hacks on really very well known YouTube channels, including some of the biggest tech and security channels out there. Linus Tech tTips. One of the biggest kind of tips that a lot of people watch in this area. They they had their YouTube account compromised, and they're very much somebody that has the best security practices that uses password managers, uses 2FA, yet there's still a way around it. And this is where that human element, again, has to come in, is that this isn't just about protecting and stopping people gaining access, but it's about spotting and informing that organization very quickly. And in that particular case, somebody spotted some unusual behavior. And instead of trying to covering up and thinking they've done something wrong, they contacted somebody within the organization straightaway and they were able to deal with it much, much more quickly. And again, that then gets into the realms of, well, what is your exposure? Even if somebody has managed to breach an organization, what other tools have you got in place? Because this isn't just about authentication alone. And certainly when we're talking to users, this isn't just about identity aspect. It's other things that they can do to make sure that they're safeguarding information.

Max Havey [00:09:50] Definitely. And to to double click on what you just brought up there. How do multi-factor authent