Soft skills for engineers - Evgeniy Kharam, Paul Nguyen - ESW #401

When we use the phrase "talent gap" in cybersecurity, we're usually talking about adding headcount. For this interview, however, we're focusing on a gap that is evident within existing teams and practitioners - the often misunderstood soft skills gap.

Side note: I really hate the term "soft skills". How about we call them "fundamental business skills", or "invaluable career advancement skills"? Hmm, doesn't quite roll off the tongue the same.

Soft skills can impact everything, as they impose the limits of how we interact with our world. That goes for co-worker interactions, career advancements, and how we're perceived by our peers and community. It doesn't matter how brilliant you might be - without soft skills, your potential could be severely limited.

Did you know that soft skills issues contributed to the Equifax breach?

We'll also discuss how fear is related to some of the same limitations and challenges as soft skills.

Segment Resources:

• https://www.softskillstech.ca/
• Order the Book

You might know them from their excellent research work on groups like Scattered Spider, or their refreshing branding/marketing style, but Permiso is laying some impressive groundwork for understanding and defending against identity and cloud-based attacks. In this interview, we talk with co-founder and co-CEO Paul Nguyen about understanding the threats against some of cybercriminals' favorite attack surface, insider threats, and non-human identity compromise.

Segment Resources:

• This blog post from our threat research team on Scattered Spider shows how threat actors move laterally in an environment across identity providers, Iaas, PaaS and SaaS environments, and how this lateral movement ultimately creates blind spots for many security teams
• This great talk by Ian Ahl, from fwd:cloudsec 2024, touches on a lot of great TTPs used by attackers in IDPs and in the cloud
• Another blog, When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying
• and another, What Security Teams Can Learn From The Rippling/Deel Lawsuit: Intent Lies in Search Logs

This week, in the enterprise security news,

1. we check the vibes
2. we check the funding
3. we check runZero's latest release notes
4. tons of free tools!
5. the latest TTPs
6. supply chain threats
7. certs won't save you
8. GRC needs disruption
9. the latest Rippling/Deel drama

All that and more, on this episode of Enterprise Security Weekly.

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-401