In this episode I get a chance to talk to Kevin Peterson about Network Observability in a Hybrid Cloud World.  Kevin is great information security evangelist who works for Arista. One of the many challenges that I face in the healthcare industry is handling devices that live On-Prem and send data to multiple cloud environments.

Kevin and I talk about some very common use cases and the challenges that come along with it.  We also tag about how to handle segmentation across multiple domains.  So if you can relate to having to secure data that transverses to many cloud environments, this episode is for you!

Podcast Sponsor:

This episode is sponsored by Arista and proceeds will be going toward youth autism programs here in Michigan.  Arista Networks is an industry leader in data-driven, client to cloud networking for large data center, campus and routing environments.  Arista has recently made a big push into the information security space using their vast experience with networks.  Arista is based out of Santa Clara California.

In this special episode I speak with Peter HJ van Eijk about the CCSK and  CCAK cloud security certifications from the Cloud Security Alliance.  Peter is the owner of Club Cloud Computing and an authorized CCSK and CCAK trainer.

I have personally taken his training course and thought it was one of the best ones out there.  He also offers free refresher courses and online focus sessions.  If you want to learn more about CSA certifications, then definitely listen in!

In this episode I had the pleasure of talking with Jonathan Jesse about medical device security.  Jonathan is a Senior Systems Engineer for Forescout.  In fact, he has been working for the same information security company for over 6 years!  That is pretty unheard of nowadays in the security vendor space.

What prompted this interesting discussion you say? Well Forescout recently acquired CyberMDX.  They are company that specializes in medical device security protection.  Since I have to work protecting medical devices sometimes as part of my 'real job'.  I have several different business use cases to discuss.  Including one around a urinalysis device.  Intrigued yet?

Talking Points:

• Brief overview of why Forescout acquired CyberMDX
• What is Device Centric Risk Management?
• How to 'fingerprint' different medical devices that may be from the same manufacturer?
• Compliance and Governance - Are medical manufacturers still using FDA regulations as an excuse not to patch
• What are some good preventative measures?

Episode Sponsor:

I want to thank Forescout for sponsoring this episode.  They are a network security solutions vendor based out of San Jose California.  Part of the proceeds from this sponsorship will be going towards Youth Mental Health programs here in Michigan!

In this episode I talk with Richard Melick about mobile security. Richard is the Director of Threat Reporting for Zimperium, so he knows a thing or two about what is happening out in the mobile world right now.

We definitely took a deeper look at the current state of mobile security and the talking points cover a bunch of key areas.

Talking Points:

• What is more important and more secure to have, your wallet or your phone?
• Mobile threats can happen when you least expect it or in the last place you may suspect, subways anyone?
• There is no more 'consumer' grade mobile security
•  A closer look at the global mobile threat report

Zimperium's Global Mobile Threat Report:

https://www.zimperium.com/global-mobile-threat-report/

In this episode I had a chance to talk with Rebecca Harvey about Cloud Identity. Rebecca does regional sales for SailPoint and she is also a co-founder of the Women's Security Alliance (WomSA).

Her and I talked about why companies are still getting Cloud Identity wrong.  We also did a deeper dive into cutting edge items like Robot Identity and Robotic Process Automation.

Episode Sponsor:

This episode was sponsored by SailPoint.  SailPoint is an Identity Security Solutions Provider that is based out of great city of Austin, Texas.  Proceeds from this sponsorship will be going to Spectrum Health Foundation's Youth Mental Health program.

Reference Links:

NIST Guidelines: https://pages.nist.gov/800-63-3
IDSA: https://www.idsalliance.org/identity-defined-security-framework/best-practices/ Forum link to discussion around MFA for RPA: https://forum.uipath.com/t/robot-guidance-for-handling-multi-factor-authentication/345476 

In this episode I had a chance to talk with Brian Philips about 5G security.  Brian is the Chief Solutions Architect for NetScout.  We had a chance to dive into various parts of 5G and what does it mean for the future of the 'Mobile Office'. We also talked about future use cases that are not as far as away as you think.

• How is 5G going to impact security?
• 5G Internet to home isn't 'private' yet
• Cellular security is wider than it needs to be right now
• How companies like Amazon could utilize 5G for both a private network and a 'near me' cloud service

Episode Sponsor:

This episode is sponsored by NetScout.  NetScout is a Security and Communication Service Provider based out of Westford, Massachusetts. Proceeds from this sponsorship will be going towards a youth mental health progream here in West Michigan.

In this episode I had a chance to talk with Brian Schneble, Claudio Catti and Chuck Chessor about mobile security and rethinking 'trust' in the new Digital Transformation age. This was a more detailed discussion from the holiday fundraiser episode and has some great real world examples.

Talking Points:

• As WFH becomes permanent, do we need to rethink 'trust' in the digital transformation age?
• How many companies are well verse in SASE philosophy?
• General Motors CEO asked her employees to turn off their VPN. What are the ramifications of that precedence?
• The rise of SaaS apps being delivering malware is Google Apps.
• Do we need to stop saying 'zero trust'?

In this first episode of 2022 I am reaching into my distance security past and invited a former colleague, Mike Ahrendt, to join Natasha Young and myself to take a close look at digital forensics.

Mike has worn many security hats, including recent leadership roles, but his heart lies in the SOC.  Mike shares some insightful stories and answers from tough questions from Natasha!

Talking Points:

• What is the difference between Public Sector vs Private Sector?
• How come some companies don't prioritize digital forensics investigations?
• Why can't forensics data be subjective (hint: legal reasons and hack journalism)?
• Why can more incidents be public (hint: brand damage)?
• Should there be more government regulations in this area?
• What is the problem with the current Threat Intel pipeline?

Reference Links:

To learn more about the FBI's Infragard initiative visit their website here.

Episode Disclaimer:

The views and opinions in this episode are my own and not a reflection of my employer or my awesome leaders. If you want the official stance of my employer on the incident from 2016 then use DuckDuckGo and research the issue from 2016. Stay safe and stay informed!! 

In this brief end of the year episode I talk about a recent phishing attack on a 3rd party vendor that was compromised via email in a very unique way. I reveal how it happened and why defense in depth in so important.

Talking Points:

• What is a lookalike domain?
• The importance of having a defensive domain strategy
• How bad guys used an operating system and email applications default behavior against the user

In this episode I had a chance to talk with Israel Barak about a listener submitting topic, 'How do I prepare for a ransomware attack?'. Israel is the CISO for Cybereason and has intricate knowledge of ransomware and cybersecurity dating back to his days in the Israeli Defense Force.

Using his extensive knowledge we talked through his concept of having different security 'pillars' to help navigate the lifecycle of ransomware: 

• Security Hygiene - Checklists are in security hygiene - you don't build a program around ransomware
• People - Executive Leadership (how to educate exec leadership), Awareness (do you know what to do when you have already clicked), Security People (surgery example)
• Recovery - How do you plan for a recovery process
• Insurance - Do you really need it, do you trust it with your CFO

Episode Sponsor:

This episode is sponsored by Cybereason. Cybereason is an eXtended Detection and Response solution company with Global Headquarters based out of Boston Massachusetts. Proceeds from the sponsorship fee will be going towards a local Youth Mental Health program that is happening in 2022.