On this episode of "Compliance Unfiltered," The CU Guys dive into the intricacies of compliance management programs. They explore various implementation approaches, from manual spreadsheets to sophisticated systems, and discuss the importance of organizations owning their data. Adam shares insights on the potential pitfalls of relying solely on assessor systems and emphasizes the efficiencies gained by leveraging internal systems. Check out this episode to discover how to streamline your compliance processes and make your organization's compliance journey more efficient and effective.

The CU Guys dive into the heightened risks hotels face during the holiday season. They discuss the importance of maintaining cybersecurity vigilance amidst increased traffic and seasonal hiring. The conversation covers best practices for background checks, training, and physical security, emphasizing the need for diligence to prevent data breaches. Tune in to learn how to protect your organization during the busiest time of the year.

Episode Transcript:

Now, you know, one thing I wanted to talk about is our listeners, and we'd love to hear from them. And what I mean by that is we'd love to know, if you're listening to this, we'd love to know your feedback and input on topics that you'd like to hear about or folks that you'd think we'd enjoy having on the show, and we'd love it if you would send those inquiries to complianceunfiltered@total compliancetracking.com.

Yeah, I mean, honestly, even if they've got, hey, I heard this like really, really, really funky story or whatever, you know, and anything, anything, anything that folks want to hear about, they'd be, it'd be great to kind of hear what their interests are and, and we'll be happy to, we'll be happy to oblige.

No doubt. Now, speaking of the holiday season, Adam, we're going to jump right in because the holiday season is putting hotels at risk.

Tell us more, Adam. Why does this time of year heighten the risk for hotels?

I mean, we're right in the, you know, in the thick of the holiday season, you know, between Thanksgiving and Christmas and New Year and all that fun stuff. So, you know, we've got, it's an interesting time when, you know, there's a lot of hotels that are, you know, that have a lot more traffic than they would normally. And, you know, staff are, you know, running all over the place trying to make sure they're taking care of guest needs, you know, etc.

But, you know, keep in mind that that means it's also peak season for, you know, cyber attackers and bad actors to be able to take advantage, you know, of it. I mean, they, you know, they know that now is the best time to, you know, gain access to the sensitive data because everybody's, you know, run around, distracted and all that fun stuff. So, you know, it's not if you're going to suffer an attack. It's really about more about when and how. So, you know, you don't want, as an operator of one of these types of establishments, you definitely don't want to fall victim to it and find out in the wrong way that you were subject to some type of an attack. So, it's better to be safe than sorry.

That's a good shout. Now, as you're dealing with kind of an influx of new folks in an organization, right? So like seasonal hiring, how does seasonal hiring impact background checks?

Well, I mean, the biggest thing is, is that, um, is for the organizations don't, don't cut corners, you know, if you've got to bring in some additional staff or, you know, for seasonal hiring, et cetera, that there's, there's certainly the possibility. Um, although I, um, you know, we'll call you, it'd be pretty ballsy to pretty ballsy to go give this one a whirl, but, you know, if you're not going to have any idea, if you don't run your background checks, so, um, could be bad actors come, you know, that are, that are coming through, uh, you know, with the seasonal hiring push, um, you know, it, uh, it may very well be, it's someone that just has a, uh, a pass that doesn't line up with the rules, regulation guidelines for your organization, but you're not going to have any idea if you're not running the, running the background checks.

Um, even though you have to fill up staffing needs quickly, you know, et cetera, you know, it's not, you don't want to do it at the cost of possibly running into an issue, you know, make sure that you're maintaining your due diligence, forming thorough background checks on everybody that, you know, is going to, uh, is going to run into the hiring line.

The CU Guys dive into the critical topic of central logging sanity checks. They explore the common pitfalls organizations face when they set up central logging systems and then leave them on autopilot. Adam emphasizes the importance of regular sanity checks to ensure that logging systems are functioning as expected and highlights the risks of assuming everything is working perfectly. The discussion also covers the need for compliance professionals to validate assumptions, spot-check logs, and ensure that alerts are being properly handled. Tune in to learn how to maintain a robust compliance program that truly supports organizational security.

Episode Transcript:

Today, we're going to talk about, you know, another central theme here, not just a central member to a band, but central logging, specifically central logging sanity checks. So a lot of companies that have mature compliance programs set up their central logging and then kind of put it on autopilot. What are the downsides there, Adam?

Well, I mean, I've been for a long time, a huge fan of trust, but verify. And, you know, when the, when the companies go in and, and kind of set up their, their central logging, you know, they, they really do just kind of, okay, we're done, you know, we're done, we've, we've established all the things, you know, we've done all the checks and we've set up the system and we have all the right processes and, you know, we, the, the reviews are happening and alerts are flying and, you know, so then they just, you know, move into this mode where they just literally let her roll and, you know, and then don't tend to go back to it, you know, for, you know, for a recheck or a sanity check or, or whatnot. They just go into the guiding assumption that everything's good because it's up and it's, nothing's gone boom and, you know, blah, blah, blah.

So, you know, the, the, the most important part for, for these organizations is that they, they go back in and, you know, double check, you know, is, is what I think happening, is it actually happening? You know, but, you know, they got, they got to go back in and, and just do a sanity check on, you know, on things. So, you know, that's kind of the, the, the driving force here with the, with this particular topic.

Sure. Now with that in mind, what are some of the concerns that compliance professionals should be focusing on?

Well, I mean, first and foremost, you know, is everything that I think is logging actually logging, you know, is it are things that I set up to, to, you know, to log, are they still logging? Did something go off the rails? Um, it's really, really easy, uh, depending on the system and the, and the structure that's set up, what checks and things that they put in place, it's really easy to, I don't know, I'm just gonna make a number up. So let's just pretend, you know, out of the gate, there were a hundred different things that were, you know, that were sending stuff to central logging. Well, you know, fast forward a couple of months or in a lot of cases, a couple of years, um, you know, the, uh, are the things that we, uh, are those hundred things still, still doing what they're doing?

I mean, you know, there's, there's all sorts of possibilities for something going wrong. You know, you've got, you know, updates or patches that, you know, may go ahead and interfere with the, with the capability for those devices to push their logs. I mean, it could be something as simple as, you know, somebody was messing with a firewall rule to try to do some troubleshooting and, you know, lock down some ports so they could get some things isolated, et cetera. And then forgot to put every, put Humpty Dumpty back together, you know, back together again and blah. And in the process, you know, block the, you know, the outbound logging, you know, capability from, you know, fill in the blank device, that type of thing.

In this heartfelt episode of "Compliance Unfiltered," as the TCT Guys reflect on their journey with TCT, sharing personal stories of growth, challenges, and gratitude. Adam and Todd delve into the evolution of TCT, the invaluable input from clients, and the strong relationships built over the years. Join them as they discuss the importance of client feedback in shaping the organization's offerings and celebrate the dedicated team that makes it all possible. Tune in for an inspiring conversation about making compliance management a little less daunting and a lot more rewarding.

In this episode of "Compliance Unfiltered," the CU Guys dive into the complexities of managing multiple compliance certifications and custom request lists. They explore the challenges faced by organizations of all sizes, from small businesses to international giants, in navigating the ever-evolving compliance landscape. With insights into the common pitfalls and practical advice on streamlining processes, this episode is a must-listen for anyone involved in compliance management. Tune in to discover how to make your compliance journey less painful and more efficient.

In this episode of Compliance Unfiltered, The CU Guys dive into the challenges and strategies for retailers as they gear up for the holiday season. With cyber threats on the rise, particularly AI-driven attacks, the duo discusses the importance of proactive measures, employee training, and maintaining PCI compliance. They also explore the impact of seasonal hiring and the need for vigilance in protecting sensitive data. Tune in to learn how retailers can navigate the bustling holiday period while safeguarding their operations.

On this week's  episode of Compliance Unfiltered, The CU guys get candid and take a dive into the world of vendor relationships and the challenges faced in the marketplace. Adam shares his personal journey from working with "boneheads" to founding his own company, emphasizing the importance of genuine customer service and the pitfalls of AI hype. With a mix of humor and insight, they explore the disconnect between vendors and clients, offering a refreshing perspective on how businesses can truly serve their customers. Tune in for an unfiltered discussion that promises to be both enlightening and entertaining!

On this Episode of Compliance Unfiltered, the CU Guys delve into the complexities of HIPAA compliance for hospital systems. Adam discusses the dual nature of hospital compliance, highlighting both the advantages of early adoption and the challenges posed by the complexity of hospital systems. The conversation covers the intricacies of managing multiple compliance standards, the inefficiencies and costs associated with manual compliance processes, and the importance of maintaining control over compliance data. Adam emphasizes the need for hospital systems to regularly update their compliance controls to align with current technologies and reduce risks. All this, and more, on this week's Compliance Unfiltered!

On this episode of Compliance Unfiltered, The CU Guys dive into their recent experiences at the PCI European Community Meeting in Amsterdam. From the city's impressive public transportation to the vibrant conference atmosphere, they share insights and anecdotes that highlight the unique charm of Amsterdam. Discover the excitement around TCT's latest technology, EasyCert, and how it resonated with attendees. Whether it's the eclectic mix of conversations or the delightful culinary adventures, this episode captures the essence of a memorable trip. Tune in for a blend of professional insights and personal stories that make for an engaging listen.

On this episode of Compliance Unfiltered, the CU Guys dive into the critical role of inventory management within large-scale engagements. They explore why inventory is central to security and compliance programs, share insights on integrating inventory into daily operations, and discuss common pitfalls organizations face. With Adam's practical tips and real-world examples, this episode is a must-listen for anyone looking to enhance their compliance strategies. Special thanks to listener Heidi for suggesting this topic! Tune in and discover how to make inventory a core element of your compliance DNA, on this week;'s Compliance Unfiltered!