In this exciting second episode of the new season, we’re offering up a buffet of delicious options to feast your incessant little cybersecurity appetites on!

BREACHES

We start by spending time on 5 of the top breaches that took place in 2022, but shift into some real world thoughts and ideas on what concepts could have helped in preventing those types of breaches.

FRAMEWORKS

Jason and Kevin dig deep into their CISSP bag of tricks to discuss cybersecurity frameworks and do a bit of a shallow dive into NIST, and then migrate into the CIS Top 18 cyber controls for effective cyber defense.

GAP ASSESSMENTS and MATURITY ASSESSMENTS

The guys hit on two very important aspects of how to leverage a framework for your business, for both analyzing your security overlap and your gaps. Then, they take a look at how you can use that same framework to monitor growth and maturity over time. They use hypothetical company ‘XYZ Company’ to show real-world examples of gap matrices and maturity matrices. These types of critical elements in your security program are items that should be assessed annually or even more frequently.

A LOOK AT KPIs

The guys move from leveraging the frameworks into looking at KPIs (Key Performance Indicators) and how you can pull KPIs from your controls to determine if you controls are actually working for you! What good is a robust framework if you can’t measure its success?

3RD PARTY RISK

Lastly, the guys take a look at the importance of 3rd-party risk and how your partners, customers, vendors, and joint ventures might play a part in your overall security posture. Not only how they play a part, but WHAT you can do to take actionable steps around 3rd party risk.

This one is VERY action packed and we cover a lot of ground. Jump on the rollercoaster as we hit ALL the rides in the cyber theme park on this one!

 

CITATIONS:

All about the NIST Cyber Framework https://www.nist.gov/cyberframework CIS Top 18 Cyber Controls https://www.cisecurity.org/controls/v8 Training for using the Frameworks offered by SANS https://www.sans.org/blog/cis-controls-v8/ YouTube Training Videos on each of the 18 Controls https://www.youtube.com/@TheCISecurity https://www.youtube.com/watch?v=pGZViAZlg1k&list=PLpNN1VAyNhovvTU6pye4cNYZksP5CLTyy

WE ARE BACK! Happy 2023 friends…

In this exciting episode of or BRAND NEW season 2, Kevin and Jason make good a promise from Season 1 where they go back and take a deep dive into the Dark Web. This time, we’re coming with a purpose! We go back to investigate and see what’s really out there and try to separate myth from reality.

Have you always wondered what really exists out on the Dark Web? Do you have a curious bone just itching to go check it all out for yourself? Well, you’re in luck! In this episode, you’ll learn all about how to properly prep to take this journey for yourself. Do we actually recommend it? Listen and find out!!

Find out more about the original Dark Web marketplace founded by Ross Ulbricht known as the Silk Road and other place you can still visit today. Learn how to browse the Dark Web, how it all started, and how many people actually surf the Dark Web today. Learn facts you probably didn’t know about this mysterious corner of cyberspace. Lastly, find out things you can ACTUALLY purchase on the Dark Web. You might just be surprised at some of these!!

It is important to mention that no humans were trafficked, and no organs were harvested in the making of this episode!

 

CITATIONS:

How to Safely Browse the Dark Web IDEALLY…Visit the Dark Web via an isolated OS ·         Here are some of the most popular options: o   Whonix - https://www.whonix.org/ o   Tails  - https://tails.boum.org (as mentioned on our episode) o   Qubes - https://www.qubes-os.org/ o   Kali Linux - https://www.kali.org/ (awesome hacking tools packaged with this OS) o   TrueOS - https://www.trueos.org/ Get the Tor Browser: https://www.torproject.org/download/ Use a good VPN – Here are some popular options (some offer free 30 day trials): ·         NordVPN - https://nordvpn.com/ ·         SurfShark - https://surfshark.com/ ·         TorGuard - https://torguard.net/ ·         Proton VPN - https://protonvpn.com/ ·         IP Vanish - https://www.ipvanish.com/ ·         Express VPN - https://www.expressvpn.com/ ·         RusVPN - https://rusvpn.com/en/       Learn about Surfing the Dark Web Online https://www.udemy.com/courses/search/?src=ukw&q=Dark+Web Dark Web Stats and Facts https://websitebuilder.org/blog/dark-web-statistics/ Dark Web Usage Stats

https://earthweb.com/how-many-people-use-the-dark-web/

There is a worldwide shortage of over 3 million in the ranks of cybersecurity professionals, with half a million of that shortage in North America alone. The problem is only expected to get worse as the demand for infosec talent is expected to grow dramatically in the coming months and years. One troubling fact about this shortage of talent is that the gap could be dramatically filled if only one segment of the population were proportionately represented in the cybersecurity industry – women! Join us as Kevin, Jason, and their very special guests, Kristen Twining (Senior VP of Sales) and Madison Beane (Commercial Account Executive) from Illusive Technology as we rip the Band-Aid off the issue and expose it for what it is, a societal travesty! Gender bias is certainly part of the issue, as evidence suggests that young females, often during high school or even before that point in life have already formed preconceptions about their place in the world. Let’s face it, the world of technology is intimidating enough without the additional issues of biases. The good news is that evidence suggests that things are turning around. We have a long, long way to go to eliminate gender biases, however, we are making progress! We must all do our part to encourage the female population to join the exciting field of cybersecurity. Help us fight the good fight. WE NEED YOU! In this exciting two-part episode, join us for some fun and we talk all about how tear down some of these walls and get more women interested in this fantastic field and career path. Join us this Cybersecurity Awareness month, as we hit on many important topics and focus on WOMEN in CYBERSECURITY! CITATIONS: ISC2 Women in Cybersecurity Report Download the report here: https://www.isc2.org/research/women-in-cybersecurity Frost & Sullivan (Agents of Change: Women in the Information Security Profession) https://1c7fab3im83f5gqiow2qqs2k-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/Women-in-the-Information-Security-Profession-GISWS-Subreport.pdf Cybercrime Magazine Women Know Cyber: The Documentary https://www.youtube.com/watch?v=Kpc31WJ6l2M York University School of Continuing Studies What Challenges do Women Face in Cybersecurity https://www.youtube.com/watch?v=0S7kGvug4m4 Other Great Resources: Women in Cybersecurity.org https://www.wicys.org/ Girls Who Code https://girlswhocode.com/ Women in Tech https://women-in-tech.org/ Women’s Society of Cyberjutsu (WSC) https://womenscyberjutsu.org/page/WhoAreWe WoSEC – Women of Security https://twitter.com/WoSECtweets The Diana Initiative https://www.dianainitiative.org/ Code Like a Girl https://code.likeagirl.io/tagged/cybersecurity Women in Technology https://www.womentech.net/

There is a worldwide shortage of over 3 million in the ranks of cybersecurity professionals, with half a million of that shortage in North America alone. The problem is only expected to get worse as the demand for infosec talent is expected to grow dramatically in the coming months and years.

One troubling fact about this shortage of talent is that the gap could be dramatically filled if only one segment of the population were proportionately represented in the cybersecurity industry – women!

Join us as Kevin, Jason, and their very special guests, Kristen Twining (Senior VP of Sales) and Madison Beane (Commercial Account Executive) from Illusive Technology as we rip the Band-Aid off the issue and expose it for what it is, a societal travesty!

Gender bias is certainly part of the issue, as evidence suggests that young females, often during high school or even before that point in life have already formed preconceptions about their place in the world. Let’s face it, the world of technology is intimidating enough without the additional issues of biases.

The good news is that evidence suggests that things are turning around. We have a long, long way to go to eliminate gender biases, however, we are making progress! We must all do our part to encourage the female population to join the exciting field of cybersecurity. Help us fight the good fight. WE NEED YOU!

In this exciting two-part episode, join us for some fun and we talk all about how tear down some of these walls and get more women interested in this fantastic field and career path.

Join us this Cybersecurity Awareness month, as we hit on many important topics and focus on WOMEN in CYBERSECURITY!

 

CITATIONS:

ISC2 Women in Cybersecurity Report

Download the report here: https://www.isc2.org/research/women-in-cybersecurity

Frost & Sullivan (Agents of Change: Women in the Information Security Profession)

            https://1c7fab3im83f5gqiow2qqs2k-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/Women-in-the-Information-Security-Profession-GISWS-Subreport.pdf

Cybercrime Magazine

Women Know Cyber: The Documentary

https://www.youtube.com/watch?v=Kpc31WJ6l2M

York University School of Continuing Studies

What Challenges do Women Face in Cybersecurity

https://www.youtube.com/watch?v=0S7kGvug4m4

Other Great Resources:

Women in Cybersecurity.org

https://www.wicys.org/

Girls Who Code

https://girlswhocode.com/

Women in Tech

https://women-in-tech.org/

Women’s Society of Cyberjutsu (WSC)

https://womenscyberjutsu.org/page/WhoAreWe

WoSEC – Women of Security

https://twitter.com/WoSECtweets

The Diana Initiative

https://www.dianainitiative.org/

Code Like a Girl

https://code.likeagirl.io/tagged/cybersecurity

Women in Technology

https://www.womentech.net/

If you’re like many others in information security, you too may struggle with understanding the concept and basic premise of “zero trust.” Well, we have good news for you! After this episode, you can rest-assured that we intend to clear the fog over this very confusing topic.

Join us as Kevin, Jason, and their very special guest, Brad Moldenhauer as they help unravel the mystery of zero trust by bring in one of the resident experts on the topic.

Brad is the VP and CISO at Z-Scaler who comes with a lengthy history in many facets of dealing with risk throughout many verticals in IT. Brad is an expert in the field, and his passion for helping others is evident in this fun-filled episode.

Brad is an accomplished cybersecurity leader with over 20 years experience in aligning security strategy and delivering security outcomes that balance risk with business value and IT efficiency. Throughout his career he has held roles in cybersecurity auditing, consulting, and operations management in government, healthcare and the legal industries.

 

Prior to joining Z-Scaler, Brad was the Global Director of Information Security for Steptoe & Johnson LLP, an Am Law 100 international law firm where he developed, implemented and managed the information security program that addressed the legal business risk landscape along with geolocation and industry-specific security requirements of the firm’s global clientele. Brad is passionate about solving cybersecurity challenges that CISOs regularly deal with while balancing the impact towards employee productivity, client service, and the bottom line.

 

Get your popcorn ready! It’s time to learn all about ZERO TRUST!

This episode MIGHT** contain an easter egg on a Black Hat/DEFCON 30 SWAG drop!!

 

**Definitely does

 

CITATIONS:

Z-Scaler Resources:

https://www.linkedin.com/company/zscaler/

https://www.zscaler.com/

https://twitter.com/zscaler

Brad’s LinkedIn Page:

https://www.linkedin.com/in/secpro/

In this exciting episode, we cover the very fascinating topic of “Social Engineering” aka: Human Hacking! Anyone that lives in Cybersecurity knows that the weakest link in any company’s cyber defenses is sitting between the keyboard and the chair. Tonight, we talk all about how malicious actors try to take full advantage of that weakness and exploit it to steal your company or your personal data.

Join us as Jason and Kevin converse with a special guest Ragnhild "Bridget" Sageng on all facets of this controversial topic.

Bridget has several years of experience in the IT industry, working with IT-support before transcending into a career within pentesting. Today, she works as an ethical hacker at Orange Cyberdefense in Norway.

Prior to her IT career, “Bridget” educated herself in the field of human psychology and healthcare due to her interest in understanding the human mind. She has always had an interest in cybersecurity and completed her bachelor’s degree in Cybersecurity recently at Noroff University College.

Due to her interest in both the human mind and IT security, “Bridget” specializes in social engineering and Open-source investigation (OSINT). In 2020, she won an international social engineering CTF hosted by Temple University. In 2021, “Bridget” became a Certified Social Engineering Pentest Professional (SEPP) and has since dedicated her focus toward social engineering pentesting. Her hands-on experience with social engineering pentesting has prompted her to further research the topics of ethically handling people affected by the tests.

It's important to mention that no Princes were harmed during the making of this episode.

CITATIONS:

Bridget’s DEFCON30 talk “The Aftermath of a Social Engineering Pentest. - Are we Being Ethically Responsible?”

https://www.se.community/presentations/#sageng

Pentest Your Users with the help of a Company Like Orange Cyberdefense:

https://www.orangecyberdefense.com/

Temple University CTF Contest Links: https://sites.temple.edu/collegiatesectf/ Interested in Learning Social Engineering and Getting Certified? Social-Engineer Training Website: https://www.social-engineer.com/ Black Hat & DEFCON Official Websites: https://www.blackhat.com/ https://defcon.org/

When the world comes crumbling down and your entire existence is burning to the ground, will you be prepared to handle it? What am I talking about anyway? The post-breach apocalypse, of course. What else?!

You see, we have all heard it said so many times, “It’s not a matter of IF you get breached; it’s a matter of WHEN!” Well, if that is true, do you think you should be making every possible effort to get as prepared as possible ahead of time? We do! That is precisely why have handpicked the special guest for this episode.

Stephen Cracknell is an Amazon best-selling author with experience in a very critical area that we know you can improve in by absorbing his wisdom. We know that, because we all can improve in this area.

Stephen and his team at USM Technology are passionate about helping business leaders repel cyberattacks. They work with IT leaders across Texas to build out comprehensive incident response plans designed to ensure that the IT team, as well as the company’s leadership, work effectively during the critical first 72 hours after a cyberattack.

Their focus is helping IT leaders develop a plan that brings critical business processes back online quickly, so their leadership team is not forced to pay the hacker’s ransom. Your well-designed recovery plan also avoids data loss, business downtime, irate customers as well as injury to your company’s reputation and your career.

So, sit back, refill your coffee mugs, and pull up a chair. It’s time to dive into an episode we’ve titled DOOMSDAY BREACH PREPPING 101! Yee-haw!

 

Citations:

USM Technology Pentesting Services:

https://www.usmtechnology.com/uncover.html

 

Purchase Stephen’s Book on Amazon

 

Find Stephen on LinkedIn:

https://www.linkedin.com/in/stephencracknell/

 

Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin Pentecost is a CISSP, CISM, CEH, CPT, MCSE, CCA, ITIL-F and serves as an Information Security Director for a manufacturing company.

Electronic Blinky-Bling?!! What the heck is that?! Take a quick walk around the Las Vegas strip around mid-summer at the DEFCON Hacking/Security Conference and you’ll find out pretty darned quick!

#BADGELIFE is a sub-culture of creators, hackers, programmers, and like-minded pseudo geniuses that craft some of the coolest electronic gadgetry you’re ever going to see! Imagine a sea of LEDs dancing to the music of a DJs mix, on a PCB designed to look artsy and cool. Oh, also imagine that you can hack that bad boy and play games, and set the LCD screen to your favorite animated GIF. Imagine using the latest programming languages and technologies to link hundreds of badges together on their own network of social awesomeness! That’s a fraction of what Badgelife is really all about.

In this light-hearted episode, we talk with our pals Zapp and Hyr0n at AND!XOR about how they continue to set the badgelife world ablaze with their creative masterpieces every single year.

It should go without saying that their work is some of the absolute best as they start planning for the next masterpiece over 18 months ahead in many cases. You can rest assured, they always have a virtual line out the door filled with people looking to string an AND!XOR PCB medallion around their necks. Why?! Because their creations are always EPIC A** Kickery!

Join Cybersecurity professionals and CISSP brethren, Jason (Redeemer) and Kevin (Sabotage66) as they bring another hard-hitting and action packed episode. This one centers on all of the intricacies of this amazing sub-culture of the awesome DEFCON conference.

Strap on your best hacker gear, throw on your black hoodie, or your bucket hat, and if you’ve got it, flip on your coolest blinky-bling and join us as we pick the brains of half of the AND!XOR team!

Let’s get DISTORTED (in a full on Cybery kind of way)!!

 

Helpful DEFCON websites:

Official DEFCON Website:

https://defcon.org/

Official DEFCON SWAG:

https://shop.defcon.org/

Registration for DC30:

https://shop.defcon.org/products/def-con-30-pre-registration-ticket

                DEFCON Forums:

                https://forum.defcon.org/

Helpful AND!XOR websites:

 

AND!XOR Twitter: https://twitter.com/andnxor

AND!XOR YouTube: https://www.youtube.com/channel/UCPn2tbrSo1Pi92k9TTJgmyg

Other podcasts featuring AND!XOR:

Macrofab Ep#66

Macrofab Ep#109

Macrofab Ep#144

Macrofab Ep#238

Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin Pentecost is a CISSP, CISM, CEH, CPT, MCSE, CCA, ITIL-F and serves as an Information Security Director for a manufacturing company.

In this episode, Jason and Kevin join guest Ross Ingersoll, Executive Risk & Cyber Account Executive at Holmes & Murphy & Associates. We discuss the topic of cyber insurance and how being protected from today’s Cyber risks can better position your company in the event of a major breach event.

If you’ve ever wondered about what Cyber Insurance covers, or what types of things you need to be considering before you even think about applying for Cyber Insurance, then this episode will hit home! In today’s Cyber climate, does your company have the risk appetite to go without the added protection of Cyber Insurance to fall back on? Ross shares his valuable insight on why YOU might want to at least consider a policy for your business.

We’ll also play the “Cyber Claim Game” where we take a look at how some of today’s larger breaches played out and what other companies have paid out due to lack of preparedness. You will take away some valuable insight around this topic and several key actionable items that you can consider if you want to look into cyber insurance for your company! Lastly, you’ll discover the Key Carrier Provisions that every underwriter looks at before inking a policy.

Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin Pentecost is a CISSP, CISM, CEH, CPT, MCSE, CCA, ITIL-F and serves as an Information Security Director for a manufacturing company.

In this episode, join Jason & Kevin as they discuss the journeys they both took to obtain the coveted CISSP (Certified Information Systems Security Professional) certification from the governing body of (ISC)2. Anyone who knows ANYTHING about Cybersecurity and has aspirations of becoming a manager know that the CISSP is the most sought after certification offered. In this episode, they discuss why that is. We also discuss the various domains covered in the exam, the weightings of each domain, the exam format, and many helpful tips and tricks to help get you over the hump as you traverse your studies. We know the effort required to obtain this certification and we are familiar with the full experience, even the failure of each of our first exams. That’s a painful pill to swallow but we have some sage advice that might just help you to succeed on your next attempt.

We hope that this episode is considered just one more tool to add to the virtual tool belt for all aspiring future CISSPs that are embarking on this prestigious and esteemed certification. We KNOW that you’ll find this information valuable. After all, don’t you need a light-hearted break from your books and flash cards anyway?!?! =)

 

Jason Popillion is a CISSP and serves as a CIO/CTO of a SaaS company and Kevin Pentecost is a CISSP, CISM, CEH, CPT, MCSE, CCA, ITIL-F and serves as an Information Security Director for a manufacturing company.

 

CITATIONS: 

Matt Elliott

Blog Post: A Journey Through Hell. My CISSP Experience.

https://medium.com/@pentesta/my-cissp-experience-a-journey-through-hell-56790c4f569e

 

(ISC)2 Official Website

The Pathway to Certification

https://www.isc2.org/Certifications/CISSP

 

How to Think Like a Manager for the CISSP Exam

Luke Ahmed

https://www.amazon.com/Think-Like-Manager-CISSP-Exam/dp/1735085197/ref=sr_1_1?crid=2LO79N1BUYEIS&keywords=Luke+Ahmed&qid=1651298957&sprefix=luke+ahmed%2Caps%2C99&sr=8-1

 

Cybrary.IT

Video Course by Kelly Handerhan – Certified Information Systems Security Professional (CISSP)

https://www.cybrary.it/course/cissp/

 

Host Unknown – The Very Fine Chaps

Host Unknown presents: I'm a C I Double S P (CISSP Parody)

https://podcast.hostunknown.tv/

https://hostunknown.tv/

https://youtube.com/user/HostUnknownTV

 

LMFAO – Yes Instrumental

https://www.karaoke-version.com/mp3-backingtrack/lmfao/yes.html