In episode 47 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Sawyer Miller, Senior Manager of Cyber Risk at risk3sixty LLC. Together, they discuss security and compliance. Their discussion explores various ways that security and compliance can align even though they are different business considerations. (Spoiler alert: risk and balance are key.) Sean and Sawyer also touch on how evolving technologies and threats are changing our understanding of security and compliance. They conclude with some recommendations on how your business and security leaders can begin to navigate these developments.

Resources

• Follow Sawyer on LinkedIn
• Security Best Practices: Cybersecurity & Compliance at Scale
• How to Build Cybersecurity Compliance with Free CIS Resources
• The Risk Conversation
• Mapping and Compliance

In episode 46 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager discuss their cybersecurity predictions for 2023 along with those from a few other CIS experts. "Integration" is the word of the day for their conversation. Sean and Tony feel that this concept will shape how we measure the progress of cybersecurity in a number of areas, from managing vendor risk management in the open-source landscape to promoting meaningful discussions about security.

Resources

• Our Experts' Top Cybersecurity Predictions for 2023
• Making Security Simpler for Organizations Big and Small
• Log4j Zero-Day Vulnerability Response
• Episode 44: A Zero Trust Framework Knows No End
• Where Risks Meet Controls

In episode 45 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Valecia Stocchetti who is a Sr. Cybersecurity Engineer on the CIS Critical Security Controls team here at CIS. Valecia and Sean discuss how their mentorship took shape and how it worked as a partnership from the very beginning. Together with Tony, they go over mentorship vs. career counseling and note that a vetting process can help you spot the difference. They conclude by exploring why it's important to pay it forward whether you're a mentor or mentee.

Resources:

• Security Pros Need a Mentor: Here’s Why and How
• MS-ISAC Members: The Most Valuable MS-ISAC Resource
• CIS Leadership Principles

In episode 44 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Scott Hall, Security Architect at the Center for Internet Security (CIS). Together, they identify resources and buy-in as some of the key elements for implementing a zero trust framework. So begins a journey that evolves with your organization's changing business processes and functions. To be successful, it's important to accept that you'll always be tweaking things to fit your needs. It's also invaluable to take a business-centered approach. This includes maintaining an inventory of what you have so that your zero trust journey can drive, not inhibit, business growth.

Resources

• Follow Scott on LinkedIn
• Prioritizing a Zero Trust Journey Using CIS Controls v8
• Where Does Zero Trust Begin and Why is it Important?
• Episode 11: Remote Attestation Helps Zero Trust
• Simplifying Security

In episode 43 of Cybersecurity Where You Are, co-hosts Sean Atkinson and Tony Sager are joined by Amanda Flynn, Manager of Admin Services and Board Relations at the Center for Internet Security (CIS), and Elijah Cedeno, Sr. Account Management Specialist at CIS. Together, they discuss the work of CIS CARES, a CIS program that gives back to the community every year through campaigns focused on community, animals, resource conservation, and education. Their conversation looks back at the evolution of CIS CARES over the past 11 years, explores the program's focus for Q4 2022, and teases what's to come next year and beyond.

Resources

• Help CIS CARES support Middle Earth in Q4 2022
• Follow Amanda and Elijah on LinkedIn
• Learn more about CIS CARES
• CIS Cares Helps 15 Organizations in 2021, With More to Come
• A push for cybersecurity philanthropic giving launches
• CIS, Partners Donate Emergency Kits to Children in Need

In episode 42 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Mat Everman, Information Security Operations Manager at the Center for Internet Security (CIS). Together, they discuss the topic of advocating for the underserved. Both agree that there's no silver bullet that a person or business can use to minimize all cyber risk. In the absence of a cure-all solution, however, there are opportunities for improving the security maturity of the underserved more broadly. This process begins with a discussion of where the underserved are. It then focuses on security measures that they can use to establish a baseline and create a foundation for an ever-evolving security journey.

Resources

• Protect Your Identity This Cybersecurity Awareness Month
• Making Time for Ongoing Security Awareness Training
• Election Security Spotlight – Common Cyber Hoax Scams
• CIS Critical Security Controls Implementation Group 1
• CIS Software Supply Chain Security Guide

In episode 41 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Valecia Stocchetti, Sr. Cybersecurity Engineer of the CIS Critical Security Controls (CIS Controls); Megan Stifel, Chief Strategy Officer for the Institute for Security and Technology; and Davis Hake, Co-Founder and Vice President of Policy at Resilience Insurance. Together, they discuss their collaboration as members of the Ransomware Task Force to create the "Blueprint for Ransomware Defense." After situating this effort within the evolving ransomware landscape, they explain how organizations can best use the Blueprint as an internal and external resource to minimize their ransomware risk. They also offer insight into how the Blueprint stands apart from other anti-ransomware guides that are currently available.

Resources

• Follow Megan on LinkedIn

• Follow Davis on LinkedIn
• Register for the webinar: Foundational Safeguards: Building Your Cybersecurity Foundation
• A Blueprint for Ransomware Defense Using the CIS Controls
• Cybersecurity at Scale: Piercing the Fog of More
• CIS Software Supply Chain Security Guide
• CIS Community Defense Model 2.0

In episode 40 of Cybersecurity Where You Are, co-host Tony Sager is joined by Murray Kenyon, Vice Cybersecurity Partnerships Executive at U.S. Bank. Together, they discuss the human dimension of cybersecurity, that is, bringing people with different talents together to understand common problems and help both organizations and individuals make informed choices. This is the philosophy behind Cybersecurity Awareness Month, an initiative which Kenyon helps organize as a Board member of the National Cybersecurity Alliance. The purpose of this year's theme, "See Yourself in Cyber," is not to make users into cybersecurity experts, as Sager and Kenyon point out. It's to create resources and lines of communication for sharing basic steps that everyone can take to better protect themselves online.

Resources

• Follow Murray Kenyon on LinkedIn.
• Cybersecurity Awareness Month – National Cybersecurity Alliance
• Jumpstart Your Security Program with Essential Cyber Hygiene
• CIS Communities

In episode 39 of Cybersecurity Where You Are, CIS's Chief Information Security Officer Sean Atkinson discusses the importance of scaling in relation to cybersecurity. A business needs to be able to manage growth without risking security, while also managing security without hindering growth. Atkinson offers guidance on how to go about this and highlights the benefits organizations will see when scaling their cybersecurity strategy.

Resources

• How to Scale Cybersecurity for Your Business
• Jumpstart Your Security Program with Essential Cyber Hygiene
• How to Implement & Assess Your Cyber Hygiene
• CIS Critical Security Controls Implementation Group 1

In episode 38 of Cybersecurity Where You Are, co-host Sean Atkinson is joined by Theodore "TJ" Sayers, Manager of the Cyber Threat Intelligence (CTI) team at the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers (MS-ISAC and EI-ISAC), and Aaron Zaleski, Sr. Cyber Incident Response Team Analyst at the MS-ISAC. Together, they discuss how the cyber threat landscape is changing. Some cyber threat actors (CTAs) are now writing their payloads in different programming languages, for instance, while others are employing new types of delivery vectors. Their conversation wraps up by identifying steps that organizations can take to defend themselves against these and other developments going forward.

Resources

• What is Cyber Threat Intelligence?
• Breaking Down the BlackCat Ransomware Operation
• Brute Ratel: The New Red Teaming Tool Coopted by CTAs
• The Conti Leaks: A Case of Cybercrime’s Commercialization
• Real-Time Indicator Feeds
• Report an Incident