In cybersecurity, teamwork is everything. Every part of the practice is about being part of a team, from playing your part in your organization to being part of the larger community and ecosystem. Cybersecurity conventions, such as the upcoming Blue Team Con, are a focal point for team building at every level, with knowledge sharing and training, networking, and volunteering. Many cybersecurity events are run by volunteers, seeking to learn more about cybersecurity and organizing, meet active and involved members of the community, and take part in building the culture.

In an interconnected world, the rapid proliferation of IoT (Internet of Things) devices and the integration of Operational Technology (OT) into critical infrastructure have unlocked tremendous opportunities. However, these technological advancements have also exposed us to unprecedented security risks.

To counter these risks, businesses can quickly and efficiently turn to the practice of maintaining a comprehensive asset inventory. By identifying and cataloging all IoT and OT devices, organizations can better understand their attack surface and implement targeted security measures to safeguard their networks.

Huxley Barbee, CISSP and CISM of RunZero, joins onShore Security CEO Stel Valavanis on this episode of onSecurity as we delve into securing IoT and OT systems, exploring the significance of asset inventory in fortifying these vital networks against potential cyber threats, and identifying common pitfalls.

Responding to cybersecurity incidents is no longer merely the responsibility of the IT team at a business. There are legal and financial actions that must be taken and the ability of a business to respond smartly and with speed can determine the fate of the organization after an attack.

Todd Rowe of Constangy Law joins Stel to talk about his experience practicing law in the cybersecurity space, how his work has evolved, and lessons learned on how to respond to ransomware and other cybersecurity incidents.

Planning and enacting a proper cybersecurity strategy requires data, usually in the form of metric data. These tracked statistics, qualitative and quantitative, are analyzed and organized into stories that can help a security operation see vulnerability and places to focus their attention. Metrics, however, can just as easily distract leadership and waste effort and expense. Knowing which metrics to consult and when is as valuable as tracking the data in the first place. 

Edward Marchewka, founder of 3LC Solutions, joins onSecurity to talk with Stel about what metrics are worth basing decisions on, times metrics don’t tell the whole story, and essential things to remember when considering qualitative and quantitative data.

One of the most important parts of the cybersecurity community's work to protect data is to educate their clients and inform the public of known risks and specific threats to their personal and professional data. In a space already filled with disinformation and out-of-date ideas, it is vital that leaders, practitioners, and experts know how to communicate essential security information in clear, credible, and actionable terms.  

Cybersecurity professionals are constantly honing their skills and adding to their knowledge set. Still, to stay ahead of attackers, defenders must make sure to continue to think outside of the box, see the obscure, and practice their ability to solve problems. Capture the Flag competitions are a popular exercise at cybersecurity events, offering an array of riddle-like security challenges. Blue Team Con 2022 hosted such a competition for attendees and it was won by onShore Security analyst Chris Spankroy.  Chris joins Stel to talk about his experience with Blue Team Con’s Capture the Flag competition, how it was designed to test “blue team” skills, and how he analyzed his way to victory.

Cybersecurity practitioners, as defenders of information, benefit from the fact that they are, in some ways, one large team, and the sharing of information and best practices as an industry and a community elevates everyone’s ability to protect their data. The passing of experience and expertise among peers is important, but staying ahead of emerging cyber threats requires recruiting and training the next generation.

onShore Security's podcast, onSecurity, explores a variety of topics in the cybersecurity field. Cybersecurity practice is typically the territory of experts in the field, but for large organizations, cybersecurity is a board-level concern and should factor into decisions in every department, from security and risk to marketing and customer experience.

Cybersecurity can seem a big obstacle and is a large source of risk for the unaware or ill-prepared, but for those leading with cybersecurity, it offers a new way to think about every part of your organization, at every level.

For our eleventh episode, Robert Barr joins onSecurity to discuss the importance of cybersecurity awareness at the board level and the work that the Private Directors Association is doing with their new Cybersecurity Governance Committee to ensure that leaders have the understanding and knowledge needed to make big decisions.