In this episode I got a chance to have a tough conversation with Naomi Buckwalter about the current state of cybersecurity careers. Naomi is the Director of Information Security for a confidential company based out of the US. Be warned that you need to have an open and reflective mind to listen to this one.

 Talking Points: 

• What's an example of a cybersecurity career myth?
• Truth: Is there is a workforce shortage?
• What is a gatekeeper?
• Myth: A Cybersecurity Job Needs Experience
• What areas of cybersecurity are truly a place for entry level to start?
• Let's rethink job shadowing with security jobs
• Why is there such animosity right now?
• Are security vendors gatekeepers also?

 Related Links:

UK Government Cyber Skills Tech Report for 2021

In this episode I had a chance to speak with Rob Bowker about using DMARC and other secure email tools to prevent domain spoofing.  Rob is the Director of Sales North America for EasyDMARC.

Talking Points:

• How to use DMARC reports to move from 'quarantine' to 'reject'
• What is process of applying a percentage when moving to quarantine
• How to get around DNS limitations for SPF records
• What is BIMI?
  • What are the pre-requirements for implementing it?
• How to use domain scanners and reputation checks

Episode Sponsor:

The sponsor for this episode is EasyDMARC. EasyDMARC is a phishing protection solution company based out of  Middleton, Delaware. As always part of the sponsorship fee goes towards helping charities in the West Michigan area!

In this episode I get a chance to talk with Jonathan Jesse about Network Access Control. Jonathan is a Senior Systems Engineer with Forescout. 

Talking Points:

• What are the biggest challenges that you are seeing with NAC during the pandemic?
• What are your employees going to bring back in?
• What has been on your home network that is now coming into your company network?
• Has the asset been patched?
• Do you plan on putting home devices into a quarantine segment before it gets on?
• Do you do compliance checks while there on or before they get on?
• Do we limit it to just Office 365 while you are having your coffee and then when the posture check is complete they can have full access?
• Who's watching the Watcher?
• Is Network Access Control a compliance issue?

Episode Sponsor:

This episode is sponsored by Forescout. They are a security solution that specializes in network access control, network segmentation and asset inventory. They are based out of San Jose California.

Topic:

What is Security Orchestration Automation and Response?

Guest:

Jeff Gardner of Rapid7

Co-Host:

Anthony Coggins from Acrisure

Episode Description:

In this episode Anthony and I get a chance to talk with Jeff Gardner about Security Orchestration Automation and Response.  Jeff is a Practice Advisor for Rapid 7.

Podcast Sponsor:

This episode is sponsored by Rapid7. They are multi-faceted security vendor based out of Boston, MA (Let's get some Chowdah!)

In this episode I sit down with two Spectrum Health colleagues, Robb Wesche and Jon Bult, to talk about our secure email journey.  Robb is a Email Messaging Engineer and Jon is a Security Engineer with Spectrum Health.

Talking points:

• Life before a good secure email gateway
• A near miss with business email compromise story
• What is DKIM?
• What is SPF?
• How does DMARC tie things that together
• What is IP warming?
• The importance of defensive domains
• Separating the 'Wheat from Chaff' with email security AI

In this episode I talk with Kevin Foisy and Justin Taylor about Identity Automation. Traditional Identity Governance Administration is not adapting as the same business processes are in this digital transformation era.  So how do you evolve the identity systems/solutions that you have put a considerable amount of money into?  Let's take a deep dive.

Talking Points:

• The 'Lifecycle' of Identity
• How do you do Identity Automation when you don't know where all of your data points are?
• Is it easier to clean up 'On-Prem' identity or 'Cloud' identity?
• What about Multi-Tenant Governance?
• Can automation help you take action when certain identity criteria is met?

Podcast Sponsor:

ReadiBots is a Identity Solutions company based out of our northern neighbor Canada is the wonderful town of Kanata.

In this episode I talk with Jim Kuiphof and Aaron Silver from Spectrum Health Information Security. We take a look at the last 5 years of the security program to glean some lessons learned about Security Metrics.

Talking Points:

There are three key principles in any security metrics program:

• It’s a Journey - You are going to have to be OK with taking a faceplant at first before you can mature and get quality metrics. Think of metrics are a ‘lifecycle’
• The ‘Why’ - What is the problem are you trying to solve e.g. How to effect change from your metrics. (Not getting numbers to just getting numbers) 
• Build Partnerships - It’s a team effort. Invite help. Don’t do this in a vacuum. The first time a director sees a metric shouldn’t be in an all director meeting. Shaming isn’t going to help your cause.

In this episode I get a chance to speak with Dave Stycos who is a Senior Security Engineer for Spectrum Health.  Dave was part of the Security Operation Center that helped thwart a Wannacry attack on a major healthcare system in West Michigan.  We talk about what a day in the SOC looks like and what is going through the SOC analyst's mind during an active incident.

Talking Points:

• What does a typical day look like? Is it like it is in Hollywood movies?
• What are some of the tools that you use everyday?
• What is the hardest part of your job?
• What is the coolest experience?
• Is there a fundamental difference between incident like 'Red October' and the HVAC incident that Jim talked about at Cloud Con last year?

In this episode I had the pleasure of doing a state of security in 2021 panel with guests from several different security backgrounds. My guests were Steve Barnes from Fortinet, Doug Copley from Data Protection Partners and Mike Peterson from Cadre Information Security.

Talking Points in a Round Robin Format:

• Endpoint Security for Remote Workers
• Thoughts on Solar Winds Fallout
• F5 and Other Security Vendor Patching Issues
• DevSecOps and Automation

Podcast Sponsor:

 This episode is sponsored by Optiv.  Optiv is a security solutions integrator based out of Denver Colorado. Proceeds from this sponsorship will be supporting bring a Minecraft server to the Spectrum Health Helen DeVos Children's Hospital in Grand Rapids Michigan.

In the episode I am very grateful to have my first female co-host, Maril Vernon.  Maril and I got a chance to talk with two talented colleagues of mine who are both on the board of the Women's Security Alliance (WOMSA), Rebecca Harvey and Diana Volere.  The topic that we delve into this security mentoring and the state of DEI in 2021.

Talking Points:

• Is there a shortage of quality mentors?
• What does a good mentoring experience look like?
• Push your comfort zone when looking for a mentor
• What has change since you both started your careers in cybersecurity?
• The value of diversity in security
  • Diversity fatigue?
  • Resistance to diversity?

Podcast Sponsor:

This episode is sponsored by SailPoint.  Sailpoint is a cloud identity solution based out of Austin, Texas.  Most of the proceeds from this sponsorship will be going to the Helen DeVos Children's Hospital Foundation.