Cyber Brisket

Chris Engler and Gary Elmer explore the legal and financial challenges businesses face after a cyber attack, stressing the importance of cybersecurity insurance and timely notifications. They discuss client notifications, forensic investigations, key contract clauses, and the legal risks of AI adoption. The episode warns about employees ignoring AI policies and the dangers of using AI for contract reviews and legal advice. It offers foundational legal guidance for growing businesses and examines significant changes in business law, especially AI's impact on business and legal landscapes, concluding with essential advice for business protection.

(0:00) Introduction and overview with guest Gary Elmer

(1:07) Biggest legal and financial mistakes after a cyber attack

(3:22) Cybersecurity insurance and importance of timely notification

(5:50) Notifying clients and forensics challenges post-breach

(11:09) Key contract clauses, especially limitation of liability

(15:16) Legal risks and policies for AI adoption

(18:34) Consequences of employees disregarding AI policies

(21:17) Risks of using AI for contract reviews and legal advice

(23:59) Legal foundations for growing businesses

(28:58) Legal foundations for growing businesses (continued)

(31:18) Key legal advice for SMB owners

(35:30) Significant changes and future trends in business law

(37:19) Impact of AI on business and legal landscapes

(38:39) Final thoughts and advice on business protection

Chris Engler and Justin Rimeuth from TechRug discuss the evolving risks faced by MSPs, particularly in the context of AI and software development. They explore shifts in the threat landscape, emphasizing the need for transparency, proper insurance, and robust incident response plans. Subrogation, dual authorization, and misconceptions about cyber liability are examined, along with the impact of cyber incidents on mental health. The episode highlights the importance of selecting the right MSP, emerging risks, and the cyclical nature of IT centralization. Offline password management with Reczone and the pros and cons of legacy systems versus modern cloud solutions are also discussed.

(0:00) Introduction and guest introduction: Justin Rimeuth from TechRug

(1:52) Biggest risk gaps in MSPs due to AI and software development

(5:41) Shifts in the threat landscape and MSP liability

(9:43) Importance of transparency and proper insurance

(14:24) Incident response plans and their importance

(18:48) Explanation of subrogation and its impact on MSPs

(20:26) Necessity of testing incident response plans regularly

(22:30) Challenges in selling and implementing incident response plan testing

(26:16) Cyber incidents and their impact on mental health

(30:06) Importance of dual authorization in preventing cyber fraud

(34:36) Common misconceptions about cyber liability and E&O coverage

(41:18) Specialized knowledge in IT and insurance

(44:33) Insurance carriers offering security services

(47:08) The importance of selecting the right MSP

(47:33) Emerging risks and trends for MSPs

(49:51) Cyclical nature of IT centralization and decentralization

(50:35) Offline password manager: Reczone

(51:39) Benefits of offline password management

(52:14) Preference for localized servers

(52:34) Legacy systems vs modern cloud solutions

(53:02) Reversing cloud migrations

(53:26) Guest appreciation and closing remarks

Chris Engler and Rob Allen delve into the evolving world of ransomware, focusing on double extortion tactics and the need for proactive measures. They discuss the limitations of traditional security, emphasizing layered defense and zero trust. The episode covers early detection, attack vectors, and balancing detection with control. They offer strategies for small businesses to boost cyber resilience, such as reducing attack surfaces and implementing least privilege. The conversation touches on living off the land attacks, AI in cybersecurity, and mitigating risks. They highlight unknown software, overlooked vulnerabilities, VPN risks, and securing cloud resources through Zero Trust Cloud Access.

(0:00) Introduction and guest Rob Allen

(1:17) Ransomware response experiences

(3:20) Evolution of ransomware and double extortion

(6:36) Proactive measures vs reactive backups

(9:41) Limitations of traditional security layers

(10:32) Layered defense and zero trust concepts

(13:51) IP scanners, early detection, and attack vectors

(15:34) Detection vs control in cybersecurity

(18:20) Cyber resilience strategies for small businesses

(21:25) Reducing attack surfaces and maintenance time

(23:03) Application control and least privilege

(24:21) Living off the land attacks and AI in cybersecurity

(26:06) Initial steps to reduce business cybersecurity risks

(27:04) Discovering unknown software in your environment

(29:26) Overlooked vulnerabilities and real attack examples

(31:14) Establishing a security baseline

(32:15) Sponsor: ThreatLocker support and response

(35:26) Upcoming products and features from ThreatLocker

(36:37) VPN risks and alternative solutions

(40:07) Zero Trust Cloud Access and securing cloud resources

Chris Engler and Bob Abrams explore the expanding influence of AI in IT peer groups, pinpointing where AI pilots often falter due to misconceptions and the lack of clear ownership. They discuss evaluating AI vendors through a cybersecurity lens and warn against the risks of free AI models. Aligning business and technical expectations is highlighted, alongside measuring AI's operational impact and emerging risks in core workflows. Best practices for AI deployment, compliance, and data retention are examined, leading to an introduction of the Hats platform. The episode concludes with strategies for addressing ShadowAI and ensuring security, compliance, and empowerment with Hats.

(0:00) Introduction and guest Bob Abrams

(1:07) The rise of AI in IT peer groups

(1:48) Where AI pilots break down and common misconceptions

(5:17) The importance of clear ownership in AI initiatives

(7:05) Evaluating AI vendors with a cybersecurity perspective

(10:54) Risks of using free AI models in business

(13:32) Aligning business and technical expectations for AI

(17:00) Measuring operational impact of AI experiments

(24:08) New risks from AI in core business workflows

(28:00) Best practices for AI application deployment

(28:52) Compliance and regulatory considerations for AI

(30:23) Data retention and logging for AI compliance

(31:20) Introduction to the Hats platform

(31:44) Addressing ShadowAI and unsecured AI tools

(32:20) Benefits and integration of the Hats platform

(33:57) Ensuring security, compliance, and user empowerment with Hats

Chris Engler and Reginald Andre explore ARC Solvers' journey, covering business growth, challenges, and cybersecurity misconceptions. They emphasize responsible AI adoption, governance, and business continuity planning. The episode distinguishes vendors from partners in cybersecurity and highlights future blind spots. IoT risks and smart home appliances are examined, alongside the evolution of managed service providers. Chris introduces Dr. Emily Parker to discuss 2023's emerging cybersecurity threats and provides tips for small businesses. The episode concludes with insights on the importance of employee cybersecurity training.

(0:00) Introduction and guest Reginald Andre’s background

(3:31) Growth, early success, and business challenges

(7:52) Founding and success of ARC Solvers

(9:17) Misconceptions about cybersecurity risk

(14:05) Cyber risks as companies scale

(17:30) Responsible AI adoption and governance

(24:09) AI adoption failures and the need for clear strategy

(26:58) Misconceptions about cybersecurity tools

(30:09) Business continuity planning and disaster recovery

(32:12) Vendors vs. partners in cybersecurity

(37:33) Future blind spots in cybersecurity

(39:02) Risks with IoT devices and smart home appliances

(42:22) Evolution of managed service providers

(45:04) The cost of IT downtime and AI’s future role

(48:18) Closing thoughts from Reginald Andre

(48:31) Chris Engler’s farewell and segment transition

(49:00) Introduction and background of Dr. Emily Parker

(51:15) Emerging cybersecurity threats in 2023

(53:10) Tips for small businesses to enhance cybersecurity

(55:05) Sponsor: SecureTech Solutions

(55:45) Importance of employee training in cybersecurity

Join Chris Engler and John Gibson from Just Right IT as they delve into John's journey from the Navy to the IT world, navigating early tech challenges like Windows '95. They discuss applying military principles to cybersecurity and business, emphasizing a cybersecurity-first approach for small businesses. Discover insights on AI's role in cyberattacks, building a robust cybersecurity stack, and the critical importance of password managers. High-profile breaches, compliance, roles-based access control, and the evolving cyber insurance industry are also explored, highlighting the need for layered security strategies.

(0:00) Introduction and guest: John Gibson of Just Right IT

(0:49) John's Navy background and early IT career

(2:33) Early IT challenges: Windows '95 and hardware issues

(4:53) Applying military principles to cybersecurity and business

(6:54) Float training group and parallels to cybersecurity

(10:13) Cybersecurity-first approach for small businesses

(14:17) Protection, detection, and response in security

(19:18) AI's impact on cyberattacks

(23:06) Building a cybersecurity stack

(24:31) The necessity and value of password managers

(25:29) Enigma, codebreaking, and password vulnerabilities

(27:40) Cybersecurity and physical security analogies

(29:26) High-profile breaches: Jeff Bezos example

(31:19) Importance of layered cybersecurity

(32:14) FTC safeguards rule and compliance

(35:11) Compliance requirements and qualified individuals

(41:09) AI in email and compliance concerns

(47:03) Roles-based access control and risk management

(48:22) Cyber insurance and industry evolution

Chris Engler delves into IT modernization with David Swenson, focusing on device management via Intune and Microsoft 365 Lighthouse. They explore feedback mechanisms, generative AI in business, and modern workplace strategies. As CIO at NetLogic, Swenson shares insights on IT operational overhead, best practices, and global strategy consensus. The episode highlights the evolution of the My 365 program, MSP partner support, AI's role in IT, and lessons from lean manufacturing. It concludes with the benefits of standardization in IT support and a preview of upcoming events.

(0:00) Modernization in IT and Introduction by Chris Engler

(1:21) David Swenson's role and insights on device management with Intune

(3:13) Microsoft 365 Lighthouse and feedback mechanisms

(5:06) Adapting to generative AI in business practices

(5:44) David Swenson, CIO at NetLogic, on modern workplace strategy

(10:56) Operational overhead challenges in IT modernization

(15:03) Best practices and global consensus in IT strategies

(18:48) Evolution of the My 365 program

(22:43) Ensuring availability and support for MSP partners

(25:06) AI's role in evolving IT operations

(27:34) The power of simplification in IT strategy

(30:12) Lessons from lean manufacturing for IT management

(31:56) The advantages of standardization in IT support

(34:23) Closing remarks and upcoming events

Chris Engler and Chris Traxler explore the dynamics of partnerships and common founder mistakes in sales process engineering. They discuss post-acquisition growth, culture evolution, and traits of successful sales leadership. The conversation shifts to building and scaling effective sales teams, highlighting Engler IT's relationship with the 20 MSP and the benefits of community and scalability. The episode introduces ID 2020 and user identity verification, addressing social engineering and information risks. Operational maturity in authorization and the evolution of the support desk are examined, along with accountability and performance metrics. The episode concludes with appreciation for partnerships and closing remarks.

(0:00) Introduction to guest and partnership dynamics

(2:08) Common founder mistakes and sales process engineering

(8:53) Post-acquisition growth and culture evolution

(12:02) Traits of successful sales leadership

(14:00) Building and scaling effective sales teams

(19:02) Engler IT's special relationship with the 20 MSP

(21:16) Benefits of community and scalability with the 20 MSP

(26:52) ID 2020 introduction and user identity verification

(30:48) Tackling social engineering and information risks

(33:18) Enhancing operational maturity in authorization

(36:27) Evolution of the support desk

(38:48) Accountability and support desk performance metrics

(41:54) Closing appreciation and partnership highlights

(42:16) Outro and podcast branding

Chris Engler and Kevin Ishizu dive into the current landscape of cyber insurance, starting with recent statistics on cyber claims. They discuss the evolution and challenges in the cyber insurance industry, highlighting the gap between cybersecurity posture and insurance requirements. Misconceptions about cyber risk and the scrutiny in insurance applications are addressed. Key factors in cyber risk assessment are examined, with a focus on AI's role. The episode introduces zero trust architecture and offers top actions for small businesses to enhance cyber insurability. Practical tips for cyber insurance underwriting wrap up the discussion.

(0:00) Introduction and cyber claims statistics

(2:01) Evolution of cyber insurance and challenges

(3:43) Cybersecurity posture vs. insurance requirements

(7:05) Misconceptions about cyber risk and insurance

(18:32) Scrutiny in cyber insurance applications

(21:34) Key factors in cyber risk assessment

(24:57) AI's impact on risk assessments and the importance of conducting them

(30:25) Introduction to zero trust architecture

(31:38) Guest: Telivy

(34:34) Top actions for small businesses to improve cyber insurability

(36:59) Tips for cyber insurance underwriting

(40:40) Conclusion and closing remarks

Chris Engler and Chris Gross delve into the risks associated with free AI tools and the balance between AI hype and its practical value. They discuss the importance of employee education and how AI can empower teams, introducing the ARIA assessment. Partner feedback and insights from the assessment are shared, highlighting AI's role in enhancing cybersecurity awareness. The episode wraps up with a clarification on the risks of free AI tools and final advice for small to medium-sized businesses.

(0:00) Introduction and Risks of using free AI tools

(0:47) Guest introduction: Chris Gross from Breach Secure Now

(1:44) AI hype vs. practical value and employee education

(4:13) Empowering employees with AI and ARIA assessment overview

(10:33) Partner feedback and insights from ARIA assessment responses

(18:02) The role of AI in cybersecurity awareness

(21:18) Clarifying the risks of free AI tools and final advice for SMBs

(23:45) Closing remarks