Summary
In this episode of the CvcISO So Podcast, hosts Evan Francen, Dave, and Jordon explore the humorous side of cybersecurity by identifying various red flags in VC engagements. The conversation is filled with laughter as they share funny anecdotes and insights about what to look out for in cybersecurity practices, emphasizing the importance of awareness and vigilance in the field. The hosts also touch on legal and ethical concerns, making the discussion both entertaining and informative. In this engaging conversation, the speakers explore the intersection of humor and seriousness in cybersecurity, discussing various red flags that can indicate poor practices in both personal relationships and professional environments. They emphasize the importance of communication, planning, and integrity in navigating these challenges, while also sharing lighthearted anecdotes and insights into the cybersecurity landscape.

Takeaways
Red flags in cybersecurity can often be humorous yet insightful.
Understanding the implications of cybersecurity practices is crucial.
The importance of prioritizing cybersecurity in budget discussions.
Humor can be an effective tool in discussing serious topics.
Misconceptions about cybersecurity can lead to significant risks.
Legal and ethical considerations are vital in cybersecurity engagements.
Awareness of red flags can help prevent potential issues.
Engaging discussions can lead to better understanding of cybersecurity.
The role of humor in making cybersecurity relatable.
Cybersecurity practices should be taken seriously, even when discussed lightheartedly. If their love language is sending you a 47 page NIST compliant PDF.
You may be in the presence of a red flag if the security team has more turnover than the help desk.
If their idea of incident response is emailing the entire C-suite, whoops, we're hacked with the shrug emoji.
If their business continuity plan is to post, we're looking into it on Twitter, that might be a red flag.
If the last time your anti-virus was updated, Blockbuster was still open, that's a concern.
If their quarterly risk assessment is a whiteboard with hackers equals bad in red marker, that's a red flag.
If your sock gets alerts but calls them suggestions, that's a problem.
If your Amazon S3 bucket is more open than a 24 hour diner, that's a security issue.
If your CISO's penetration test is asking the intern to guess the CEO's password, that's a major red flag.
Apathy in leadership can lead to significant risks in cybersecurity.