CvCISO Podcast

Summary
 
In this episode, the hosts discuss Mental Health Awareness Month, sharing personal stories and insights about mental health challenges. They emphasize the importance of being open about mental health, the stigma surrounding it, and the role of therapy. The conversation also touches on misconceptions about mental health, the impact of diet and exercise, and the effects of COVID-19 on mental well-being. The hosts encourage listeners to share their stories and seek help when needed, reinforcing that mental health is a crucial aspect of overall well-being. In this conversation, the speakers delve into the complexities of mental health, discussing the importance of confronting fears, the misconceptions surrounding mental health issues, and the journey of healing and personal growth. They emphasize the significance of authenticity, the struggles faced in life, and the motivations behind being allies in the mental health movement. The dialogue highlights the interconnectedness of individuals and the necessity of supporting one another in navigating emotional challenges.
 
Takeaways

• Mental health awareness is crucial for personal and societal well-being.
• Sharing personal stories can help others feel less alone.
• Stigma around mental health prevents open conversations.
• Therapy is a valuable resource for mental health support.
• Diet and exercise play a significant role in mental health.
• Guilt can be destructive, while conviction can lead to growth.
• Mental health issues are often invisible to others.
• Workplace culture can impact mental health discussions.
• COVID-19 has exacerbated mental health challenges for many.
• It's important to seek help and not suffer in silence. Most fears about sharing mental health issues are unfounded.
• Exploring one's true self is more important than societal expectations.
• Mental health issues vary in curability and require honesty to address.
• Healing from mental health issues is possible with deep work.
• The journey of mental health is often a marathon, not a sprint.
• Struggles and challenges are essential for personal growth.
• Authenticity is crucial in a world that pressures us to conform.
• Being an ally in mental health is motivated by love and support.
• Wisdom is gained through experiences of pain and struggle.
• Self-care and mental health awareness are vital for overall well-being.

Summary

In this episode of the CvCISO Podcast, the hosts engage in a light-hearted conversation that transitions into deeper discussions about the importance of relationships in business, essential questions to ask when engaging with clients, understanding business motivations, and the significance of trust and credibility in professional interactions. In this conversation, the speakers delve into the importance of building authentic relationships in business, particularly in the context of venture capital. They discuss how being transparent and genuine can foster better connections with clients. The dialogue emphasizes the significance of understanding the dynamics of a business, defining success in client engagements, and the necessity of knowing the 'why' behind business operations. The speakers also highlight the need for adaptability in response to changing business needs and the importance of clarity in communication. 

Takeaways

• Building relationships is crucial in business.
• Managing expectations can lead to better outcomes.
• Understanding a client's business is key to providing value.
• Trust and credibility are foundational in client relationships.
• Engagement should be genuine and focused on the client's needs.
• Asking the right questions can uncover important insights.
• Recognizing the motivations behind a business helps tailor solutions.
• Communication is essential for successful partnerships.
• A good relationship can lead to future opportunities.
• Understanding the client's mission can enhance collaboration. Be yourself and be transparent in relationships.
• People can sense when someone is being disingenuous.
• The best relationships require minimal effort to maintain.
• It's essential to care about the business and its mission.
• Understanding the 'why' behind a business is crucial for success.
• Clarity in communication helps avoid misunderstandings.
• Relationships in business should be more than just transactional.
• Adaptability is key in navigating client needs.
• Defining success at the outset of engagements is important.
• Regular check-ins can help maintain alignment with client goals.

Summary

In this episode, the hosts discuss the complexities surrounding the compensation and role of a Virtual Chief Information Security Officer (VCISO). They explore various factors influencing salary, the distinction between VCISO and CISO roles, and the importance of technical knowledge and mentorship in developing effective security leaders. The conversation also highlights the challenges faced in client engagements and the need for clear communication regarding roles and responsibilities. In this conversation, the participants delve into the complexities of client assessments, the importance of communication in building relationships, and the challenges faced in cybersecurity development. They discuss the significance of mentorship and experience in the field, the implementation of risk assessments for nonprofits, and the evolving landscape of pricing strategies for cybersecurity services. The dialogue emphasizes the need for transparency, understanding client perspectives, and the value of delivering quality service. 

Takeaways

• The proper compensation for a VCISO varies significantly based on location and experience.
• Understanding the cost of living is crucial when determining salary ranges.
• A true VCISO should have experience leading teams, not just performing assessments.
• Salary expectations for seasoned VCISOs are higher than entry-level positions.
• Mentorship is essential for developing new VCISOs into effective leaders.
• Technical knowledge is vital for a VCISO to understand the tools and processes involved in cybersecurity.
• Client engagement can be challenging, especially when clients resist recommendations.
• The role of a VCISO can differ greatly depending on the client's needs and expectations.
• Effective communication with clients is key to successful engagements.
• The importance of ongoing relationships with clients cannot be overstated. Navigating assessments can be challenging due to differing client perspectives.
• Communication is key in building trust with clients during assessments.
• Security measures can often be seen as obstacles by developers.
• Experience in cybersecurity is gained through active participation and mentorship.
• Complementary risk assessments can provide valuable learning opportunities for new professionals.
• Pricing strategies should reflect the value delivered to clients, not just hourly rates.
• Understanding the client's needs is crucial for effective assessments.
• The landscape of cybersecurity is constantly evolving, affecting pricing and service delivery.
• Mentorship programs can help bridge the gap between theory and practical experience.
• The perception of perfection in security can hinder progress and improvement.

Summary

In this special 50th episode of the CvCISO Podcast, the hosts celebrate their milestone while discussing the importance of continuing education for venture capitalists (VCs). They explore various strategies for staying educated, including maximizing conference experiences, understanding CPE requirements, and aligning learning with career goals. The conversation emphasizes the significance of being proactive in professional development and the various avenues available for earning CPEs, including independent learning and community involvement. In this conversation, the speakers discuss the importance of maximizing the value of Continuing Professional Education (CPE) credits, emphasizing the need for passion and engagement in learning. They explore different learning styles and effective training methods, as well as strategies for choosing the right conferences and getting the most out of them. Networking is highlighted as a crucial component of professional development, with practical tips provided for building connections at events. 

Takeaways

• This is a special episode celebrating 50 episodes of the podcast.
• Continuing education is crucial for VCs to stay relevant.
• Conferences can provide valuable CPE credits and networking opportunities.
• CPEs are available through various avenues, not just formal courses.
• Being strategic about CPEs can enhance professional growth.
• Understanding external factors is important for VCs.
• Independent learning can also count towards CPEs.
• Engaging with the community can provide additional learning opportunities.
• Documentation is key for proving CPE credits.
• The conversation around education is vital for helping others in the industry. Maximizing CPE value requires active engagement and passion.
• Learning is more effective when it is applied in real-world scenarios.
• Different individuals have unique learning styles that should be considered.
• Choosing the right conferences can significantly impact professional growth.
• Networking is essential for career advancement and knowledge sharing.
• Preparation before attending conferences enhances the learning experience.
• Finding 'golden nuggets' of information is key to effective learning.
• Building connections with speakers and attendees can lead to valuable opportunities.
• A strategic approach to conferences can yield better results.
• Continuous learning and networking are vital for success in the cybersecurity field.

Summary

In this episode, the hosts discuss the controversy surrounding Mark Lanterman, a forensic expert accused of embellishing his credentials. They explore the implications of credibility and integrity in the cybersecurity field, particularly for expert witnesses. The conversation delves into the ethical responsibilities of professionals and the potential legal ramifications of misrepresentation. The hosts reflect on the importance of validating claims and the consequences of failing to do so, both personally and professionally. In this conversation, the speakers delve into the implications of dishonesty, particularly in professional settings. They discuss the consequences of lies, the importance of maintaining integrity and reputation, and the value of truth in personal and professional growth. The dialogue emphasizes the need for self-awareness and the significance of competing with oneself rather than others. Ultimately, the speakers encourage listeners to embrace honesty and learn from their mistakes, highlighting that it's never too late to start anew.

Takeaways

• Mark Lanterman is accused of embellishing his credentials.
• Credibility is crucial in the cybersecurity profession.
• Embellishing credentials can lead to legal consequences.
• Expert witnesses must have validated backgrounds.
• The importance of integrity in professional settings cannot be overstated.
• Legal implications arise from misrepresentation in court.
• The hosts emphasize the need to call out dishonesty.
• There is a lack of accountability in verifying expert witnesses.
• The conversation highlights the ethical responsibilities of professionals.
• Consequences of lying can be more damaging than the truth. Shitty choices have consequences.
• Don't fall for the urge to claim more than you are.
• The truth always comes out, eventually.
• Reputation is everything; it can be destroyed easily.
• You can always start now to rebuild your integrity.
• Competing with yourself is the only true competition.
• Lies of commission and omission both destroy credibility.
• Don't take shortcuts; they will sting you in the end.
• Winners focus on winning; losers focus on others.
• You can turn negative experiences into positive lessons.

Summary

In this episode, Meg and Dave discuss the importance of viewing information security not just as an IT issue, but as an organizational and societal concern. They explore how different departments within an organization contribute to security and the need for a holistic approach. The conversation also delves into the societal dependency on technology and the implications of critical infrastructure failures. They emphasize the importance of collaboration between sectors to enhance security and resilience in communities. In this conversation, Dave and Meg explore the complexities of cybersecurity consulting, focusing on the importance of regulatory standards, risk management frameworks, and the need for awareness in the industry. They discuss the challenges posed by ignorance and apathy, the interconnectedness of security sectors, and the significance of translating technical risks into business context. The conversation emphasizes the broader impact of security on communities and the necessity for organizations to be aware of available resources. 

Takeaways

• Information security is fundamentally an organizational issue, not just an IT issue.
• Understanding the critical elements of each department is essential for effective risk assessment.
• Business impact analysis helps prioritize what is most critical for different departments.
• The societal perspective on security is crucial for understanding broader risks.
• Dependency on technology has increased, making security more complex.
• Critical infrastructure is vital for daily life and community resilience.
• Collaboration between sectors is necessary for effective security measures.
• InfraGard serves as a bridge between the FBI and critical infrastructure sectors.
• Awareness of security risks varies by industry and needs continuous improvement.
• The conversation highlights the importance of proactive measures in security planning. Awareness of cybersecurity resources is crucial for organizations.
• Ignorance and apathy are significant barriers in cybersecurity.
• Regulatory standards like NIST and ISO provide frameworks for risk management.
• Cybersecurity impacts not just organizations but entire communities.
• Translating technical risks into business context is essential for effective communication.
• The interconnectedness of security sectors highlights the importance of a holistic approach.
• Consultants must ensure clients are aware of available resources and standards.
• The CVCISO program uniquely prepares individuals to communicate risks effectively.
• Public information is often overlooked in cybersecurity discussions.
• Engaging with local cybersecurity resources can enhance organizational security.

Summary
In this episode, the hosts discuss the concept of failure, exploring its inevitability and the importance of embracing it as a part of growth. They share personal anecdotes and insights from a book titled 'Chasing Failure,' emphasizing that failure can lead to unexpected opportunities and learning experiences. The conversation also touches on the fear of failure, the need for a supportive culture that accepts failure, and the distinction between rational and irrational fears surrounding failure. In this conversation, the speakers delve into the complex nature of failure and success, exploring how failures can be reframed as learning opportunities. They discuss the importance of perspective in defining success, emphasizing that true success lies in finding one's 'sweet spot' where passion, skill, opportunity, and purpose intersect. The dialogue also touches on overcoming the fear of failure and the significance of calculated risks in personal and professional growth.
 
Takeaways

• Failure is a part of life and growth.
• Chasing failure can lead to unexpected opportunities.
• Creating a culture where failure is accepted is crucial.
• Learning from failure is more important than the failure itself.
• Fear of failure can be irrational and paralyzing.
• It's important to separate personal identity from failure.
• Failure can redirect you to your true path.
• Comfort can be a barrier to growth.
• Every failure provides a lesson if you choose to learn from it.
• Success is often a culmination of many failures. Failure exists on a spectrum, from minor setbacks to major catastrophes.
• Reframing failure as a learning opportunity can lead to personal growth.
• Success should be defined beyond material gains and societal expectations.
• Finding your 'sweet spot' involves aligning passion, skills, opportunities, and purpose.
• Fear of failure can be mitigated by gradually exposing oneself to challenges.
• Calculated risks are essential for growth and should not be avoided due to fear.
• Success is often about being present and content with where you are now.
• Failures can inspire others and contribute to their success.
• Regret from not trying can be a greater failure than the act of failing itself.
• Faith and purpose can provide strength in facing fears and failures.

Summary
 
In this episode of the CvCISO Podcast, host Evan Francen and co-hosts Jordan and Meg welcome Dave Tuckman, the new Executive Director at the Academy. They discuss Dave's background in IT and cybersecurity, his transition to FRSecure, and the importance of awareness training in the industry. The conversation also touches on work-life balance, the therapeutic role of music, and the vision for the Academy to uplift others through education and community building in cybersecurity. In this engaging conversation, the speakers delve into the importance of mentorship and building relationships for personal and professional success. They explore aspirations for future programs and the value of community support. The discussion takes a lighthearted turn as they share personal insights and humorous anecdotes, creating a dynamic and relatable atmosphere. In this episode, the conversation flows through various themes including online behavior, the nuances of incognito browsing, the importance of digital privacy, and personal anecdotes related to government processes and travel challenges. The group shares humorous exchanges while reflecting on their experiences with online security and the complexities of passport regulations. The episode concludes with lighthearted banter about future plans and collaborations, showcasing the camaraderie among the participants.
 
Takeaways

• Dave Tuckman is excited to join the CvCISO Podcast and share his journey.
• He has a rich background in IT and cybersecurity, having owned a company for 25 years.
• Awareness training is crucial in cybersecurity to prevent phishing and other attacks.
• Transitioning to FRSecure has allowed Dave to align his career with his values.
• Balancing work and personal life is important, and helping others recharges Dave.
• Music serves as a therapeutic outlet for stress relief and creativity.
• The CVCISO program provides practical knowledge that differs from traditional education.
• Building a community in cybersecurity education is essential for ongoing support.
• The Academy aims to uplift others through education and professional development.
• Dave envisions expanding the Academy's offerings to serve a broader audience.
• Finding ways to help others achieve their goals is crucial.
• Mentorship can be likened to having a sponsor in AA.
• Building relationship equity is essential for success.
• Being available for someone can be invaluable.
• The community can provide a wealth of knowledge and support.
• Aspirations for future programs include accreditation and continuing education credits.
• The importance of collaboration in professional development is emphasized.
• Lighthearted conversations can foster deeper connections.
• Personal insights can lead to humorous and relatable discussions.
• Uplifting others is a necessary counter to negativity in the world.
• Online behavior can be humorous yet judgmental.
• Incognito browsing raises questions about digital footprints.
• Website security is crucial in today's digital age.
• Personal experiences often highlight government inefficiencies.
• Passport regulations can complicate travel plans.
• Humor can ease discussions about serious topics.
• Collaboration is key to achieving shared goals.
• Traveling internationally requires careful planning.
• Understanding online security headers is essential.
• Lighthearted conversations foster strong relationships.

Summary
 
In this episode, the hosts discuss the importance of integrating security into business culture while maintaining a fun and engaging environment. They explore the concept of a 'security first' mentality, emphasizing that security should not overshadow business objectives but rather be a part of them. The conversation highlights the significance of situational awareness, employee empowerment, and the role of leadership in fostering a security-conscious culture. The hosts also challenge the notion that people are the weakest link in security, advocating for better system designs and training to enhance overall security awareness. In this conversation, the speakers delve into the complexities of establishing a robust security culture within organizations. They discuss the critical role of executive management in fostering this culture, the importance of effective communication about security risks, and the need for a clear definition of information security. The conversation also highlights the challenges faced by security professionals in navigating organizational dynamics and the necessity of incremental progress in security awareness. Ultimately, the speakers emphasize the importance of consulting and collaboration in making informed security risk decisions.

Takeaways 

• Have fun in security; it shouldn't be all serious.
• Security first is about integrating security into business.
• Situational awareness is a crucial life skill.
• Training is essential for building a security culture.
• Leadership must be involved in promoting security.
• Security should be part of everyday business operations.
• Recognize that people can be your strongest asset.
• Measure security training effectiveness in business terms.
• Celebrate security wins to encourage participation.
• Avoid labeling people as the weakest link in security. Security culture is essential for organizational safety.
• Executive management plays a crucial role in security culture.
• Effective communication is key to conveying security importance.
• Most leaders genuinely want to do the right thing regarding security.
• The definition of information security is often misunderstood.
• The CEO sets the tone for the organization's security culture.
• Communication breakdowns can lead to security vulnerabilities.
• Incremental progress in security culture is achievable.
• Understanding the psychology of security can improve awareness.
• Awareness of security threats is increasing in society.

Summary
In this episode, the hosts discuss essential tips for Virtual Chief Security Officers (VCSOs), emphasizing the importance of understanding the business context before addressing security concerns. They highlight the need for preparation, relationship building, and simplifying complex security concepts to effectively communicate with business leaders. The conversation also covers the significance of asset inventory, prioritizing impactful security initiatives, and using analogies to convey security risks in a relatable manner. In this conversation, Evan Francen discusses the importance of building impactful relationships within a business to achieve significant wins. He emphasizes leveraging credibility when making recommendations, the power of message delivery, and the necessity of simplifying security processes. The dialogue also covers quantifying the value of security to the business, embracing opportunities in executive dialogues, and understanding business objectives. Creative approaches to balancing security controls with business needs are explored, along with strategies for getting buy-in from leadership and developing a security roadmap with milestones.
 
Takeaways

• Understand the business first, security second.
• Preparation builds trust and credibility with clients.
• Simplifying complexity enhances communication effectiveness.
• Asset inventory is crucial for effective security management.
• Prioritize impactful security initiatives for better results.
• Communicate security risks in business terms.
• Use analogies to make complex security concepts relatable.
• Security is fundamentally about risk management.
• Avoid pushing security measures that hinder business objectives.
• Focus on helping the business make money through security strategies. Focus on impactful wins for the business.
• Leverage credibility when making recommendations.
• The deliverer of the message can change perceptions.
• Simplifying processes can lead to greater acceptance.
• Use facts to build trust and credibility.
• Security can drive both revenue and profit.
• Engage with executives to create opportunities.
• Understand business objectives to align security efforts.
• Creative solutions can enhance customer onboarding.
• Develop a roadmap with milestones for predictability.