"In security, there is no 'that's not my job.' When it comes to defending the organization, security practitioners need to be able to put their egos aside, roll up their sleeves, and do what the team needs them to do to make sure the security posture of the organization continues to improve."

Whether you're looking to hire a good security practitioner, or trying to become one, there are certain attitudes and mindsets to look out for. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) and Joshua Goldfarb (Director of Product Management at F5) dive into his recent article - How to Spot an Effective Security Practitioner.

Listen to learn:
- How to communicate data security to executives
- Maintaining good relations with your security team
- Attitudes of an effective security practitioner

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

"If you want to engage your audience and get them involved in security rather than having to force them to do it, you need to give them something worth their time and attention."

Making trainings for any audience can be hard, especially when it's mandatory. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) chats with Ian Murphy (Founder of Cyber Off, CISSP, FBCS, CITP) about his approach to making trainings more enjoyable.

Listen to learn

• Tips to make your trainings more enjoyable
• How to have fun with boring topics
• How to respond to negative feedback

Connect with Ian on LinkedIn

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA), Matthew Heffelfinger (Director of SIEM Operations, GSTRT, CyRP (Pepperdine), GRCP, SSAP, ITIL4-F, GISF, PECB), and Forrest Barth (SOC Analyst, CISSP, CMNO, Security+) wrap up this season with the TOP 10 breaches of 2021!

Join us for SEASON 3 of SecurityMetrics Podcast this January!

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Learn more at SecurityMetrics.com

"That's one of the reasons why our audit team is so good, because we share the wing with forensics, and we're talking about what's happening out there. Our forensics consulting isn't theoretical. It isn't some monthly magazine saying 'look out for this... this might be happening,' this IS what's happening. This is the analysis of the very data we're collecting."

It can be difficult to build cybersecurity into your budget and receive approval from senior decision makers. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Lee Pierce (Director of Sales Operations for Security Metrics) about the factors that affect costs of various cybersecurity services.

Listen to learn:
-How much cybersecurity services generally cost
-What factors can affect pricing
-How to reduce compliance assessment costs

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

"One thing that I learned from the circle was how to come out of my comfort zone and tell my story to other people. When it comes to something technical, I can talk for hours, but apart from that it's very hard for me. So this was one take away for me, apart from all the learnings - both technical and non-technical - that really helped me a lot."

Making your way in cybersecurity is easier if you have a team supporting you. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Aastha Sahni (Lead CyberSecurity Instructor at Flatiron School | Founder & Global Lead - Breaking Barriers Lean in Circle), Shrutirupa Banerjiee (Web Application Security Analyst| Tech Lead at Breaking Barriers Lean in Circle), and Saman Fatima (Data Engineer at Macquarie Group | Management Lead at Breaking Barriers Lean in Circle) about the work they do to invite and support others on a cybersecurity career path.

Listen to learn:
-How a team can help support your cybersecurity journey
-Strides being made at Breaking Barriers
-What the future looks like for this supportive group

Connect with our guests:
https://cyberpreserve.com/community/
https://www.linkedin.com/company/breaking-barriers-women-in-cybersecurity-lean-in-circle/

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Everybody has their own path to finding the job that's right for them. It's often easy to get discouraged when you're in the middle of the path to reach your desired goal. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Luana Pascu (Cybersecurity Researcher, GSEC) about her personal journey, and how you can find the path in data security that's right for you.

Listen to learn:
- How to find your passion within cybersecurity
- Education steps to reach your desired role
- How to track your journey into the workforce

Connect with our guest: https://www.linkedin.com/in/luanapascu/

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

"With network segmentation, we really are looking for isolation. We want to get that 'thing' and put it into a safety deposit box where you have secure access to it. Nobody else has physical or logical access to it. That's really what we are trying to do with segmentation."

Network segmentation is often used to reduce the scope of a PCI DSS compliance assessment, but it is even more important as a security strategy for your environment.  Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Chris Skarda (PCI DSS QSA, CISSP, CISA, CCNA) about how network segmentation can support your compliance and security efforts.

Listen to learn:
-What “network segmentation” means
-How network segmentation can reduce the scope of your compliance assessment
-Why network segmentation can improve your security stance

SHOW LESS

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

"Zero Trust is essentially a security initiative saying that you are going to assume that attackers are present in any environment you're working in. The main goal of that is to remove implicit trust in the design and implementation of whatever you're doing."

“Zero trust” is something we hear a lot about but in many cases it seems to be a buzzword used to sell us something. However, it can be an excellent approach to security when done well. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Geoffrey Sanders (Senior Member of the Technical Staff/Situational Awareness Team, Software Engineering Institute/CERT Division, Carnegie Mellon University) about the tenets of zero trust and where to get started in implementing zero trust in your environment.

Listen to learn:

• How privacy and security are related
• Where to start when you need to understand how laws and regulations apply to you
• What direction policy and legislation are taking to address cybercrime

Connect with our guest: 

• https://www.linkedin.com/in/sandersgeoffrey

Learn more:

• SEI Website: https://www.sei.cmu.edu/ 
• Zero Trust Adoption: Managing Risk with Cybersecurity Engineering and Adaptive Risk Assessment (Blog): https://insights.sei.cmu.edu/blog/zero-trust-adoption-managing-risk-with-cybersecurity-engineering-and-adaptive-risk-assessment

Zero Trust Adoption: Benefits, Applications, and Resources (Podcast): https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=737526

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

Preparing for a third-party security assessment or compliance audit can be a daunting experience -- especially if it’s your first time.  Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Brian Gross (VP, Product & Technology, FISERV) about how he prepared his organization to respond successfully to a PCI DSS assessment, followed by a HIPAA audit.

Listen to learn:

• How a third-party assessment can benefit your business
• Where to start to build your security program
• What elements support successful completion of an audit

Learn more at SecurityMetrics.com

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/ 

"Some security is better than no security. If you are a small business, and you don't have all the resources to invest in a huge cybersecurity program, that's ok! Start with the basics, such as strong passwords, the use of VPNs, and trainings on cyber threats like phishing and malware."

Privacy and security considerations can be difficult to get your arms around; when laws and regulations come into play they add another layer of complexity. Tune in this week as Jen Stone (MCIS, CISSP, CISA, QSA) speaks with Victoria E. Beckman (Lead Digital Crimes Unit Americas - Corporate, External, and Legal Affairs for Microsoft) about the relationship between privacy, security, and legal matters in our digital world.

Listen to learn:

• How privacy and security are related
• Where to start when you need to understand how laws and regulations apply to you
• What direction policy and legislation are taking to address cybercrime

Connect with our guest: 
https://www.linkedin.com/in/victoriabeckman

A note from Jen: We built Practical Cybersecurity because we were tired of the fear-mongering in this industry. Security shouldn't be a secret club.

If you're trying to figure out PCI compliance or need a pen test, my team at SecurityMetrics can help you out: https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place 

But if you just want to learn how to protect yourself for free, start here:  https://academy.securitymetrics.com/