“The single biggest contributor to data breaches is a lack of testing. You have to be testing, you have to be reviewing, you have to have pentests.”

After experiencing a data breach as a small business owner 20 years ago, SecurityMetrics CEO Brad Caldwell (CISSP, CISA, QSA, PFI) set out to provide affordable data breach prevention and remediation to businesses of all sizes. Since then, SecurityMetrics has tested over a million systems and provided cybersecurity services and audits for tens of thousands of businesses.   

In a special episode of the podcast, Brad sits down with Host and Principal Security Analyst Jen Stone (MCIS, CCSFP, CISSP, CISA, QSA) to discuss how security complexity has evolved and what he’s learned from over 20 years in the cybersecurity and PCI compliance industry data breach investigations, and tips to keep a cool head in the wake of a data breach

Listen in to learn:

• Common mental roadblocks people face in making security a priority
• The number one problem with incident response plans
• Tips to keep a cool head when experiencing a data breach

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

John Elliot has a knack for illuminating the relationship between security and compliance. With over ten years in information protection and compliance consulting, and as Director of Industry Standards at Mastercard, John helps explain the relevance of security and industry standards to customers and those in the wider payment ecosystem. Today he sits down with Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) to reveal the three biggest myths about PCI DSS compliance and how they hinder security. 

Listen in to learn: 

• How the PCI Security Standards Council and the major card brands work together.
• The areas of compliance that are most critical and timely to preventing data breaches. 
• Tips for organizations to make PCI “business as usual,” maintain compliance controls, and stay compliant through major changes.

Download our Guide to PCI Compliance!

Download our Guide to HIPAA Compliance!

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

“If we think we’re fluent in security because we’re using the same words we’ve always used, we’re in danger.”

With over 30 years in the FinTech industry, Dale Laszig has a long-range view of trends and technology that she has turned into a busy tech journalism career. Dale spoke with Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) about the language of security: how the way we talk about it affects the way we approach it. Dale and Jen wax poetic to uncover the meta “matrix” that supports commerce and makes the world go ‘round. 

Listen in to learn: 

• How payments security attitudes have changed and why it matters today
• The concept of “zero trust,” and the practical application of a security perimeter
• Jen’s quick take as a Security Analyst on industry trends and myths 

Connect with Dale:

LinkedIn

DSL Direct

[email protected]

Northrop Grumman Fan

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

“Gaps in security are behavioral . . . find out what drives behavior at your company, and you will find your vulnerabilities.” As the Strategic Lead of Amazon Web Service’ Global Security Services Team, Dutch Schwartz talks with SecurityMetrics Podcast Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) to define what CISOs need to understand about human motivation in order to strategize security programs, utilize company culture, and protect critical data.

Listen in to learn: 

• How the CISO position has changed in the last decade and how it’s currently defined. 
• The surprising differences in intellectual property between companies and the role those differences play in security.
• Why culture and social strategy should be more important to a CISO than technology, and tips for facing company culture challenges. 

Resources:

https://www.linkedin.com/in/dutchschwartz/

https://twitter.com/dutch_26

Download our Guide to PCI Compliance! - https://info.securitymetrics.com/pci-guide

Download our Guide to HIPAA Compliance! - https://info.securitymetrics.com/hipaa-guide

Access our free cybersecurity and compliance conference - www.securitymetrics.com/summit   

[Disclaimer] Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

When your organization has 300 Merchant IDs (MIDs) in a multi-modality environment, leading a PCI DSS compliance program is no easy task. This week, Host and Principal Security Analyst Jen Stone welcomes guest Robbyn Lennon, Senior Merchant Services Program Coordinator at the University of Arizona, along with SecurityMetrics Principal Analyst Michael Simpson to talk about large-scale PCI DSS compliance from both a QSA and a client perspective.

Robbyn explains in detail how she established a PCI DSS compliance program at the University of Arizona. With over 10 years of experience, she shares her three-part strategy: “Engagement, leadership, and encouragement.” 

• How to reduce scope in a large PCI DSS compliance program by organizing merchants into “pods.”
• Why a focus on leadership as opposed to management helps employees take accountability for their job processes.
• The tools, training, and documentation you need to empower merchants and improve your PCI program.

Robbyn on LinkedIn

Learn more at SecurityMetrics.com

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

“It’s our friends and family–our moms and dads–who shop online and are affected when a bad guy gains access. So we take it personally,” said SecurityMetrics SOC/SIEM Director, Heff. 

Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) continues this sentiment by saying “When businesses go down, people suffer. Every business we can protect helps elevate the quality of life for the people who are associated.”

At SecurityMetrics, we monitor the threat landscape around the clock. And currently, that landscape is not only vast, it’s complex. Never have companies faced so many challenges, and hackers know it. Data protection measures need to be based on our new global landscape and the latest threats. Today, Heff, Jen, and SOC Analyst Forrest Barth discuss the threat landscape in depth and cover the five most important things you can do now to prevent an attack. Listen to this episode to learn:

• What the “Fujiwhara Effect” is and why it can make cybersecurity feel overwhelming.
• New terms and trends demystified: cyber empathy, vishing, endpoint definition, and Zero Trust architecture.
• Why bringing work computers home and social engineering make for a disastrous combination. 

Heff, SIEM Operations Director
Forrest Barth, Analyst

Learn more at https://www.securitymetrics.com/

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

“A lot of people in the security world want to talk about security, not compliance. But you can’t help secure things if you don’t know what you’re supposed to be securing,” says host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA). 

In this episode, NuSkin Data Governance Analyst, Gabrielle Harris (CIPP/E, CIPM, MSML) explains how security and compliance are permanently entwined, “Even though ‘compliance’ has a negative connotation and ‘security’ has a positive one, the truth is that compliance builds brand reputation and trust with customers. Protecting data is an ethical thing, and we would all hope that whoever is protecting ours is taking it seriously.

With experience in over 50 markets, Harris brings a big-picture understanding, a positive attitude, and a tireless work ethic to privacy programs. Listen to this episode to learn:

• Pervasive attitudes and pitfalls that can hinder GDPR, HIPAA, and CCPA compliance 
• Critical points in your step-by-step compliance process that build rapport and respect, including whom to involve and when
• What you need to understand about the differences between security standards and privacy law

Gabrielle Harris LinkedIn

CIPP Certification

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Subscribe to the SecurityMetrics Podcast

“Something has happened.” Your company has experienced the worst: a data breach. You’ll need to answer questions. You’ll need to implement emergency operations and plans, run backup and talk to investigators. Not a convenient time to start your Incident Response Plan.

According to Dave Ellis, SecurityMetrics VP of Investigations (GCIH, PFI, QSA, CISSP), an Incident Response Plan is, in short, “What you do ahead of time, in preparation for an event that you hope never happens.” Ellis sits down with Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) to discuss in detail the phases of an IRP, along with the circumstances, variables, and options surrounding this “worst case scenario.”

Listen to learn:

• Emergency-Mode Operations, contingency planning, and the recovery phase
• How to get initial buy-in from your executives, C-suites, and decision makers
• Case studies and examples from the field: the practical realities involved in maintaining a current Incident Response Plan
• Tips to avoid, handle, and learn from data breaches, ransomware, and other types of malware

Learn more

2020 SecurityMetrics HIPAA Guide

2020 SecurityMetrics PCI Guide

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

When Liberty Mutual offered Craig Olsen a lateral leap from Developer to Security Analyst, he took it–and hasn’t looked back since. Now a Cybersecurity Architect, Olsen reflects on the last fifteen years and his role in the transition from one-person internal security departments, to a full-blown industry with unique technologies, solutions, and issues.

When it comes to the cloud, many companies are unsure or hesitant. Some may not even know for sure if they’re using it. Often, this is based on a lack of understanding or familiarity with cloud security.

Olsen and Host Jen Stone sit down for an in-depth discussion about cloud solutions, including:

• What we can learn from companies who’ve experienced data breaches in the cloud
• How to leverage the unique qualities of the cloud to improve security and support growth
• Simple steps anyone can take to build foundational layers of security–areas like passwords, policies, encryption, and compliance

Craig Olsen on LinkedIn
Learn more

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

In today’s podcast, Dr. Eman El-Sheikh (Director of the Center for Cybersecurity at the University of West Florida) sits with Host and Principal Security Analyst Jen Stone to discuss how we can creatively approach cybersecurity careers from all perspectives.

“We have over half a million open cybersecurity jobs as we speak. And, unfortunately that number is trending up.”

Dr. Eman El-Sheikh is the Director of the Center for Cybersecurity at Western Florida and plays a vital role in recruiting future cybersecurity leaders. Today, she sits with Host and Principal Security Analyst Jen Stone to discuss how we can creatively approach cybersecurity careers from all perspectives.

Listen in to learn:

• What is required for a career in cybersecurity. Do you need a degree? Certifications? Or neither?
• How a skills-based approach can compliment–not contradict–an educational approach
• How we as a cybersecurity industry can foster innovation and diversity while continuing education and training

“We take a multi-disciplinary approach, and our message is that regardless of what you’re interested in: programming, IT, engineering, policy, law, management, psychology, or criminal justice, there are pathways to gain cybersecurity knowledge and skills, and there are great jobs waiting for you on the other side.” 

You can learn more about Eman’s work at:

Center for Cybersecurity at University at Western Florida

NIST National Initiative for Cybersecurity Education (NICE)

Learn more at Securitymetrics.com

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

Whether you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/