Have you ever wondered what it takes to get into the information security field? Have you thought how hard could it be? What about all of the big money I hear people make in this space? Well in this episode I talk with Mattalynn Darden and Esther Muchai about how hard it really is to break in.

If you are wondering how these two talented young women know, here is a little background on what they are currently doing and why it is relevant to the this episode's topic.

Mattalynn is an Information Security Intern at Lear Corporation and Esther is pursuing your Master's Degree in Cybersecurity at Grand Valley State University. Both of them share some of the struggles that they are currently having and I give some advice on how to possibly overcome them.

So, if you are thinking of entering the crazy, foggy world that is Information Security, then this episode is for you!

Talking Points:

• What made you want to get into the cybersecurity field?
• What are some of the main challenges that you are facing right now?
• Did either of you go the 'paid' learning route (e.g. college or training classes)?
• What are some free training/tools you have found useful?

*Disclaimer* Thoughts and opinion in this episode are solely myself or my guests and not necessarily reflective of our employers.

In this episode I had a chance to sit down with Matt Nelson and do the podcast from a very cool location.  Matt is a Senior Security Architect for Guidepoint Security. The topic of our rant was centered around all of the things 'wrong' with cybersecurity sales and why it hurts everyone.

Talking Points Include:

• Ineffective Bad Behavior - You are doing you and your company a disservice 
• Improper In-person Event Etiquette
• Do Social Engineering for Good!
• What you as a Customer can do to help set expectations
• The importance of building relationships

Special shout outs to Maril Vernon, Michelle Beracy and Anthony Coggins!

In this episode I talk with Lloyd 'Lucky' Guyot and Alex O'Meera about The Center for Internet Security's Critical Security Controls. Lloyd is a Security Advisor for Optiv and President of the Grand Rapids ISSA Chapter. Alex is a Security Analyst for Stack Overflow and Secretary of the Grand Rapids ISSA Chapter.

Talking Points:

• How can the CIS 18 help an SMB build your security program?
• How can the CIS 18 help mature a security program?
• Which controls should a company start with?
• And many more!

Episode Sponsor:

Grand Rapids ISSA Chapter (with special thanks to Optiv). The GR-ISSA is the local chapter of the Information Systems Security Association.

Episode Charity:

The charity for the month of November is the Corewell Health Foundation. More specifically, the money will be going to assist children with various mental health challenges.

In this episode I had a chance to speak with Chris Jordan and Al Wissigner about where a small and medium sized business (SMB) should start their security journey. This is especially important in this day and age of the ever expanding cloud infrastructure and Software as a Service (SaaS) models.  Both of these fine gentlemen work for Fluency and have a TON of experience working SMBs.

Talking Points:

• The idea of bridging the gap between what they want to do and what they can afford to do?
• Why is it so important for an SMB to understand how to properly do cross-platform?
• Security companies are generally not targeting SMBs
• Why is BEC one of the most important things to do understand?
• How can a SMB use automation to help offset the lack of a large security team?

Episode Charity:

October's selected charity is called the Both Hands. Both Hands is an organization that helps local widows with chores/projects that are hard to do on their own, all while raising money for a family to adopt a child.

Episode Sponsor:

This episode was sponsored by Fluency. Fluency is a modern security operations platform that can handle today's agile environments. They are based out of Rockville, Maryland.

Despite the recent push by some old school (re: outdated) leaders to force employees to return the office, remote work is here to stay. While we all talk about the importance of making remote work secure, there isn't much talk about how the experience for the end-users. Fortunately, there are some companies out there that are understanding the need to balance security, business and end user needs.

In this episode I talk with Melinda Ann O'Neill about Digital Employee Experience (DEX). Melinda Ann is a Director of Strategic Accounts for Tanium. We covered several key areas of both business success and information security success.

Talking Points:

• Why is ensuring a remote employees' experience is critical to a company's success?
• What are some of the main challenges businesses are having when it comes to DEX?
• What are some ways that a multi-faceted solution can balance both security and business concerns?

Episode Charity:

October's selected charity is called the Both Hands. Both Hands is an organization that helps local widows with chores/projects that are hard to do on their own, all while raising money for a family to adopt a child.

Episode Sponsor:

This episode was sponsored by Tanium. Tanium is a End Point Solutions company based out of the West Coast state of Washington.

In this episode I head out to The Unicorn Tavern in Grand Haven, Michigan to talk Network Segmentation with Steve Barnes and Tyler Adams. Steve is an Enterprise Security Architect for Fortinet and Tyler is a Information Security Analyst for Corewell Health.

Talking Points:

• How has Network Segmentation changed in 2023?
• Who is responsible? Is that team being supported enough?
• How are you compartmentalizing things?
• Should you separate your IT and your OT?
• Does network segmentation make it easier to start a deception campaign?
• How can you get business buy it to make this happen?

Episode Sponsor:

This episode is sponsored by Fortinet. Fortinet is a Network Security Solutions company based out of Sunnyvale California.

Episode Charity:

Part of the sponsorship fees from this episode will be going to the Alex's Saints charity. Alex's Saints Foundation works to provide life-changing emotional and financial assistance to young adults who struggle with substance use disorder, while empowering long-term recovery.

Editor's Note:

A quick note about the charity comment in the episode. I mistakenly confused the topic of the charity we are working this month to one I am looking into. Alex's Saints is not a suicide prevention organization.  My sincerest apologies for the confusion.

A few years ago, the topic for the 3rd episode for the #RealTalk with Aaron Bregg podcast about Diversity 

And Inclusion in the Cybersecurity Industry. To this date it is one of the most downloaded episodes. Since that episode was publish a LOT has changed in the world. I felt that it was time to revisit the topic but with a little bit of a twist. The need for a twist comes from the fact that DEI in cybersecurity still where it needs to be.

As luck would have it I had met Angela Hill a few years back when Matt Nelson and I were looking to have her as a keynote speaker. While due to scheduling issues it didn't work out, it did lead to this moment.

Join me as I have a #RealTalk conversation about 'Rethinking DEI' and more specifically focusing on Latinas in Cybersecurity. Angela Hill from Palo Alto Networks, Samantha Bolet. from TikTok, Vanessa Morales. from NBC Universal who are some of the co-founders of Latinas In Cyber challenge me and themselves into taking a different approach to solving this problem.

Talking Points:

• What kind of restrictions do you run into? E.g. Cultural roadblocks, etc.
• What issues do you run into when it comes to showcasing your 'real world' experience?
• The importance of having a security 'brand' - Vanessa
• How do we need to change our approach to DEI? 
• The importance of DEI in academia and starting to embrace creativity - Sam

A HUGE thanks to SevCo, Cadre and NetSPI today the podcast donated $500 to support Latinas in Cyber!

In this episode I had a chance to dive into a topic that is ripped straight from my day job. Multi Cloud Compliance. My guest for this episode is Mike Roman. Mike is a Senior Security Sales Engineer for Orca Security, which happens to be  the company that just won the 'Best Swag' award at Cloud Con last week!

In all seriousness though, more and more companies are having to rely on multi-cloud environments in order to keep the lights on. You may be a Amazon AWS shop but you may use Snowflake for data analytics and something else for your ERP solution.

Getting compliant across the different environments not only means business success but may keep you from avoiding fines from regulators.

Talking Points:

• What is an overly permission role in a multi-cloud environment?
• Is it really over permissive or is it really right for the job?
• What is the 'real' world example for the principle of least privilege for multi-cloud?
• Stitching the flow from misconfigs back to identity 
• Taking a lot more inputs from many different spots including Behavioral Analytics information

Episode Sponsor:

 This episode is sponsored by Orca Security. Orca is a cloud security solution and is based out of Portland, Tel-Aviv and London.

Episode Charity:

 Part of the sponsorship fees from this episode will be going to the Alex's Saints charity. Alex's Saints Foundation works to provide life-changing emotional and financial assistance to young adults who struggle with substance use disorder, while empowering long-term recovery.

In this episode I break from the norm a little bit in order to delve into the minds of security leadership. These insights come from a recent Grand Valley State University Cybersecurity Masters Graduate, Isaac Beasley.

As part Isaac's Master's project, he interviewed 10 different cybersecurity leaders in the West Michigan area about a variety of different topics. For the sake of time, I concentrated on talking to the following key data points:

Hiring, Retention, & Advancement

• 80% reported not fully cyber staffed
• 60% struggle with team burnout
• 70% see diversity as a top challenge when building out a team
• GRC, Security Architects and Cloud Security where the most in demand roles

To help me with the intricacies of this episode is a security leader that participated in the interviews but also is very familiar with them, Jim Kuiphof, Deputy Chief Information Security Officer of Corewell Health.

While PenTesting (i.e. hacking) may be the most visible part of Information Security, it is sometimes can lead to a false sense of security. In this episode I had a chance to talk with Nabil Hannan about rethinking your penetration testing strategy and moving towards Attack Surface Management. Nabil is the Field Chief Information Security Officer for NetSPI  and has a ton of useful information to share about starting this journey.

Talking points include:

• What are the biggest misconceptions with PenTesting?
• The problem with buying security 'things'
• Understanding your Attack Surface using Breach and Attack Simulations
• Targeting your ransomware readiness

Episode Sponsor:

NetSPI is a penetration testing company based out of Minneapolis, Minnesota.

Episode Charity:

This episode's charity is Latinas in Cyber. LAIC is focused on continuing to break barriers and open paths for those who chose to pursue careers in cybersecurity. Our mission is to empower through mentorship, networking, support, and representation.