Careers Information Security Podcast

Want to know if a prospective loan customer is lying? Watch their eyes. And their breathing. And especially whether they move their lower lip.

These are the tips from Robert Nolan, a former mortgage banker, and Genie Laborde, an author and speaker, who have teamed up to offer training for banking institutions looking to reduce first party fraud.

In an exclusive interview, Laborde and Nolan discuss:

Laborde is the author of several books, Influencing with Integrity: Management Skills for Communication and Negotiation(170,000 sold); the follow-up book, Fine Tune Your Brain: When Everything's Going Right and What To Do When It Isn't, and the workbook 90 Days to Communication Excellence. Influencing with Integrity has been translated into French, Spanish, German, and Polish. Her latest is Influencing with Integrity on the Internet, which is an eBook and a book on paper.

She has produced the video training films and courses, "Influencing Skills," "TeleSkills," "Managing Meetings with PEGASUS," and "Paradigm Changes in Business" (co-produced with Florida Power and Light). The videos and trainings have been purchased by Fortune 500 Companies and educational institutions including Hewlett-Packard, Chase Manhattan Bank, IBM, Rochester Institute of Technology, Continental Airlines, and Eastman Kodak. Her videos, books and course materials are also available in Spanish.

Nolan founded IvyStone Consulting Group in 2007 to help Mortgage Loan Officers as well as others in professional sales to build better relationships with Real Estate Agents and clients. He has developed a course for Mortgage Fraud detection, which introduces new training techniques for detection during the mortgage loan application process.

Prior to ICG, he worked for Phoenix Consulting Group, helping companies in the pharmaceutical, medical device manufacturing and consumer goods industry train salesman and researchers how to detect competitors interested in obtaining intellectual property rights at trade shows.

He was in the Mortgage Industry for 12 years and held positions such as loan officer and manager for builder partnerships with national mortgage companies.

Organizations have made strides in business continuity/disaster recovery (BC/DR) planning. But BC/DR professionals need to sharpen their business skills to truly protect their organizations.

This is the stance taken by Roberta Witty, research VP at Gartner. In an exclusive interview, Witty offers candid insight on:

Witty is part of the Compliance, Risk and Leadership group within Gartner. Her primary area of focus is business continuity management and disaster recovery. She is the role specialty lead for the Gartner for IT Leaders (GITL) business continuity manager role. She is also a GITL Premier coach for Security and Risk.

Prior to joining Gartner, Witty managed the global technology risk management function for the corporate trust business of The Chase Manhattan Bank. In this role, she was responsible for awareness, advisory and compliance services regarding the business implementation of IT control policies, including information security, business continuity and Y2K business resumption planning. Before joining Chase, she was the information security officer for ING/New York, where her responsibilities included information security program development and implementation, security administration, and business continuity planning.

Everyone is talking about cloud computing these days - but are they having the right conversations?

H. Peet Rapp is an information security auditor who sits on ISACA's Cloud Computing Work Group, and he's co-author of the white paper Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives.

In an exclusive interview, Rapp discusses:

Rapp entered the IT audit/compliance profession in 2003, after publishing the widely read paper "An IT Executive's Overview of the Sarbanes-Oxley Act of 2002." With his firm, Rapp Consulting, he has audited, provided risk assessments and developed IT control frameworks for more than 70 organizations and developed a reduced IT control set for non-accelerated filers.

Over the past year or so, since the Heartland Payment Systems breach, we've heard a lot about the Payment Card Industry Data Security Standard (PCI DSS). What does 'PCI compliant' mean? Can a PCI compliant organization be breached? What's the role of the Qualified Security Assessor (QSA)?

Peter Spier, Senior Risk Management Consultant with Fortrex Technologies, has written a recent guest blog on PCI compliance, and in an exclusive interview offers insight on:

Spier is President of the ISACA Western New York Chapter and a Senior Risk Management Consultant at Fortrex Technologies based in Frederick, Maryland. Peter attained his graduate degree from Syracuse University's School of Information Studies and over the course of 12 years of experience, has earned Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), Project Management Professional (PMP), Qualified Security Assessor (QSA), Information Technology Infrastructure Library (ITIL) Foundation version 3, and HITRUST CSF Assessor certifications; among other credentials.

Insider crimes are among the biggest threats to public and private sector organizations. And yet too many groups continue to struggle to prevent or even detect these crimes.

In an exclusive interview, Dawn Cappelli of Carnegie Mellon University's Software Engineering Institute, discusses:

Cappelli is Technical Manager for the Threat and Incident Management Team of the CERT Technical Staff at Carnegie Mellon University's Software Engineering Institute (SEI). She has over 25 years experience in software engineering, including programming, technical project management, information security, and research. She is technical lead of CERT's insider threat research, a CyLab-funded project including the Insider Threat Study conducted jointly by the U.S. Secret Service and CERT. Before joining CERT in 2001, Cappelli was the Director of Engineering for the Information Technology Development Center of the Carnegie Mellon Research Institute (CMRI). Cappelli has a BS in Mathematics and Computer Science from the University of Pittsburgh.

Axelrod is currently executive advisor for the Financial Services Technology Consortium. Previously, he was a director of Pershing LLC, a BNY Securities Group Co., where he was responsible for global information security. He has been a senior information technology manager on Wall Street for more than 25 years, has contributed to numerous conferences and seminars, and has published extensively. He holds a Ph.D. in managerial economics from Cornell University, and a B.Sc. in electrical engineering and an M.A. in economics and statistics from Glasgow University. He is certified as a CISSP and CISM.

What's new in information security certifications? In an exclusive interview at RSA Conference 2010, W. Hord Tipton, Executive Director of (ISC)², discusses:

Tipton is the executive director for (ISC)², the global leader in educating and certifying information security professionals throughout their careers. Tipton previously served as president and chief executive officer of Ironman Technologies, where his clients included IBM, Perot Systems, EDS, Booz Allen Hamilton, ESRI, and Symantec. Before founding his own business, he served for five years as Chief Information Officer for the U.S. Department of the Interior.

How will the Payment Card Industry Data Security Standard (PCI DSS) be amended, and when?

These are the key questions in payments security, and Bob Russo, GM of the PCI Security Standards Council, is prepared to start answering them. In an exclusive interview conducted at RSA Conference 2010, Russo discusses:

Russo brings more than 25 years of high-tech business management, operations and security experience to his role as the general manager of the PCI Security Standards Council. Russo guides the organization through its crucial charter, which is focused on improving data security standards for merchants, banks and other key stakeholders involved in the global payment card transaction process. To fulfill this role, Russo works with representatives from American Express, Discover Financial, JCB, MasterCard Worldwide and Visa International to drive awareness and adoption of the PCI Data Security Standard.

In an exclusive interview, Chambers discusses:

Chambers began his career in 1976 with the U.S. General Accounting Office, where he first became an internal auditor. He firmly established himself in government internal auditing and was named Worldwide Director of Internal Review for the United States Army in 1993. He later served as Deputy Inspector General for the United States Postal Service and Inspector General for The Tennessee Valley Authority. In 2001, Chambers joined The IIA staff as vice president, Learning Center. After a brief tenure as "acting president," he left The IIA in 2004 to join PricewaterhouseCoopers, where he most recently served as national practice leader, Internal Audit Advisory Services.

Throughout his career, Chambers has served on numerous boards and panels, including the U.S. President's Council on Integrity and Efficiency, the City of Orlando Florida Audit Board, and The IIA's Internal Audit Standards Board. He has served in various leadership roles at The IIA since 1994.

In an exclusive interview, Bernik discusses:

Bernik is a risk professional with 15 years of experience in information security. He has developed risk management practices, procedures and standards for several Fortune 100 companies including several global banking organizations. He was formerly Director of Operational Risk at the Royal Bank of Scotland and CISO of ABN AMRO and its subsidiary, LaSalle Bank. He has a bachelor's degree from the University of Mary Washington and completed graduate work at the City University of New York.