Cybersecurity Chronicles

Stanley Li and Sean Mahoney from Netswitch are joined by James Watson to discuss the return and rise of Ryuk ransomware - one of the most dangerous types of targeted enterprise ransomware:

-- What exactly is Ryuk ransomware?

-- Which types of organizations are being targeted?

-- What is the typical value of a Ryuk ransomware demand?

-- What are the simple, low-cost ways organizations can protect themselves from Ryuk?

Sponsored by Netswitch Technology Management - netswitch.net

Stanley Li and Sean Mahoney from Netswitch discuss the increasing importance of 'RegTech' - where compliance meets technology:

-- What exactly is RegTech and SupTech?

-- How to bring visibility of both inside a single dashboard.

-- How today's world has multiple regulatory compliance standards, not just 1 or 2.

-- Why 'managing by spreadsheet' is no longer an option in this complex world.

-- A real-world story of the challenges facing one IT Integration architect manager. 

-- Why communication with auditors can cause more issues than doing the compliance work itself.

Sponsored by Netswitch Technology Management - netswitch.net

Sean Mahoney, Stanley Li and James Watson discuss a new case of a construction company that may incur a $1m cost because of a single email deleted by an employee 2 years ago.

-- Why Governance Risk and Compliance (GRC) is driving the agenda for security controls, policies and procedures for small and mid-size businesses.

-- How automation can be used to manage and mitigate enterprise risk.

-- Why managed service providers are evolving to combine support for network administration, security and risk management.

Sponsored by Netswitch Technology Management - netswitch.net

In this episode, Sean Mahoney, Stanley Li and James Watson discuss the latest US Dept of Treasury advisory on potential sanctions risks for facilitating ransomware payments.

Why the OFAC (Office of Foreign Assets Control) is watching.

The rumour about why Garmin didn't engage with their ransomware attackers directly.

The importance of ESG - Environmental and Social Governance

Canadian Internet Registration Authority report says 90% of people will avoid companies that have been breached. 

The ethical dilemma - should hospitals pay ransomware?

The 3 things small and mid size businesses need to have in place to protect themselves from a Ransomware attack.

Ransomware used to be a 'last thought' from hackers after breaking into a network. Now its the primary source of 'easy money' for them.

The Hiscox report said 350 firms (16%) reported paying ransoms off the back of a malware or ransomware attack. Why the real numbers are much higher.

How researchers figured out how to put ransomware on a coffee maker.

There is good news.. why tools and open-source resources have never been more cost-effective to protect infrastructure from attackers.

The #1 cheapest way to protect yourself from hackers.

Sponsored by Netswitch Technology Management - netswitch.net

On this episode Don Cox, former CISO at Mednax, Inc joins Stanley Li and Sean Mahoney of Netswitch to discuss the key differences between a Managed Detection and Response (MDR) Service compared to a Managed Security Service Provider (MSSP).

Topics include:

- What is MDR and what is an MSSP?

- How does the MDR model differ from an MSSP?

- Why would I use MDR?

- Can MSSPs provide MDR?

- What types of organizations typically use MDR?

- Can I replace my MSSP with MDR?

- Would I ever use MDR and an MSSP?

Sponsored by Netswitch Technology Management - netswitch.net

-Why risk management and technology are totally different skill sets.

-The #1 problem involving products, vendors, compliance and security.

-The 2 top questions CEOs are asking right now about risk.

-What Covid-19 means for global security budgets.

-Who's becoming the real driver of technology decisions today.

-Why risk is a business problem, not an IT one.

-Why the roles of CIOs and CFOs are broadening to include risk.

-The first question risk managers always ask (hint - its not about tech).

Sponsored by Netswitch Technology Management - netswitch.net

In this episode Stanley Li and Sean Mahoney from Netswitch are joined by James Watson to discuss exactly what is Penetration Testing as a Service (PTaaS) and the increasing trend for businesses to move away from once-a-year pen tests to more regular, monthly ones instead.

Episode highlights:

- 15 years ago, when manual vulnerability scanning and assessments were the only options.

- Why manual plus automated testing combined is essential to get the highest quality results from pen tests.

- The new CVE 2020 1472 vulnerability Microsoft recently announced that won't be patched until 2021, and what this means for your testing schedule.

- Why insecure configurations created by your IT admins could be increasing your risk more than you realise.

- How the increasing number of regulatory and certification requirements have changed the testing landscape.

- Why companies now have to demonstrate they're consistently pro-active in testing their networks.

- Why the increase in remote working has only amplified these issues.

- Why penetration testing as a service is much more affordable than annual tests of years gone by.

- Which types of companies are particularly increasing their testing frequency.

- Why vulnerability assessments alone will not protect you from Ransomware attacks.

- What data penetration tests can identify that vulnerability assessments are unable to.

- How to effectively manage security risk if you're a small business with a limited budget.

- How an international hotel group client has increased their vulnerability assessment frequency from annually to monthly.

- Why they jumped at the chance to deploy Penetration Testing as a Service.

- How the old way of manual penetration testing could take over a month.

- Why the new combination of automation and manual effort can now perform the testing and deliver a report with remediation in just one business week.

- Why this means more time can be spent on remediation efforts and less on the testing itself.

- Why consistency is the key to effectively managing your cyber risk in an increasingly insecure world.

Sponsored by Netswitch Technology Management - netswitch.net

In this episode Sean Mahoney is joined by Stanley Li and Professor Michael Lassiter from Netswitch to discuss some of the most commonly asked questions about penetration tests, which include:

• How do I know a pen test is effective?  
• How do we set the goals of the pen test? Will you make recommendations to the business?
• How can we trust your automated tool? 
• Do I need a black box test for PCI-DSS or HIPAA compliance?
• When you send the post pen test report to us, what are supposed to do with it? 
• How long should it take to do the remediation work?
• Do we have to remedy the vulns or do you?
• How do we know the vulns found in the pen test are corrected properly?
• My vendor (or customer) wants to see the pen test results as part of their supply chain review. Should I share it with them?

Sponsored by Netswitch Technology Management - netswitch.net

Sponsored by Netswitch Technology Management - netswitch.net

Sponsored by Netswitch Technology Management - netswitch.net