Security Confidential

Josh Harrington is a CISSP, CCSP certified Director of IT and Security at Wattpad. He has a degree in Information Technology with a specialization in Networking and IT Security and a minor in operations management. With nearly a decade of cyber and IT-related experience, Josh has utilized his knowledge of industry threats and emerging technologies to guide businesses in advisory roles from implementation to leadership development both internationally and in the Greater Toronto Area.

00:00 Introduction

01:22 Josh’s story

03:10 The challenge of a Cybersecurity career

04:00 How has your previous experience helped prepare you for your position today?

05:55 Hands-on Experience: required or not?

07:42 Wattpad

08:22 Security Challenges for open-source platforms

11:50 Top 3 areas of Security

15:10 Must have Security tools

16:20 The Future of Cyber: Where is it going?

21:13 3rd party risk

23:40 Key points for employees regarding security

27:32 Message for young cyber professionals

33:37 What has helped you grow in IT?

36:50 A must for a resume

42:27 Connecting with Josh

To learn more about Josh visit https://www.linkedin.com/in/harringtonjoshua/

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com 

SOCIAL MEDIA: Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec 

LinkedIn: https://www.linkedin.com/company/dark-rhino-security 

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #DarkRhinoSecurity 

Kicking off Season 7 with Ron Eddings. Ron is a Cybersecurity Advocate, Creative Director, and Podcast Executive Producer. Ron has been a cybersecurity practitioner. He has worked as an architect at Palo Alto Networks and Demisto. He is currently the Creative Director for Axonius and is also the Co-founder & Executive Producer of Hacker Valley Studios.    

00:00 Introduction 

01:20 How did you start in Cyber? 

06:13 Marcus Careys Guide to Success 

07:55 Your spiritual guide to pursuing your passion 

12:03 The Mind, the Body, and the Spirit 

15:50 Maintaining your Sense of Wonder 

19:40 Your Superpower 23:15 Learning and Teaching 

28:20 Making Cyber entertaining 

35:12 What is the value of Cybersecurity? 

39:20 Vulnerability management 

42:00 OKTA and Passwords 

43:00 Infosec programs that worked and ones that didn’t 

48:15 The Department of “no” 

49:25 News with Ron  

To learn more about Ron visit https://www.linkedin.com/in/ronaldeddings/ 

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com 

Managing Oneself: https://www.amazon.com/Managing-Oneself-Harvard-Business-Classics/dp/142212312X 

Hackervalley.com 

Axonius.com   

SOCIAL MEDIA: 

Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec 

LinkedIn: https://www.linkedin.com/company/dark-rhino-security 

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #DarkRhinoSecurity 

Articles mentioned: 

https://www.kaspersky.com/resource-center/threats/ransomware-attacks-and-types 

https://www.backblaze.com/blog/complete-guide-ransomware/ 

https://www.tomsguide.com/us/ransomware-what-to-do-next,news-25107.html   

To learn more about Ransomware, listen to our podcast video with Ransomware expert Dennis Underwood here 

https://www.youtube.com/watch?v=DJoVdcMGzE0   

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com

Jake is the SR. Director of Security Strategy at VillageMD. He has over 20 years of IT and Security experience building, operating, and enhancing: Risk Management, Security Awareness, and governance. He has worked with many "C-suite" executives and boards of directors. He is a graduate of the University of Pittsburgh Katz School of Business  

00:00 Introduction 

02:04 VillageMD 

03:28 Walgreens and the Minute Clinic 

05:01 How has Cyber security changed the Healthcare business? 

07:50 Why is patient healthcare data worth more money than credit card information?  

10:30 Making the data less valuable 

16:50 What are some policy positions we could take? 

18:57 What is motivating bad actors to get healthcare data?   

22:50 Cyber insurance 

26:40 3rd party risk 

30:05 Doctors and mobile devices vs HIPAA?  

39:10 More on Jake   

To learn more about Jake Belcher visit https://www.linkedin.com/in/jakebelcher/ 

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com 

SOCIAL MEDIA: 

Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec 

LinkedIn: https://www.linkedin.com/company/dark-rhino-security 

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #DarkRhinoSecurity

Greg Schaffer joins us on this episode of Security Confidential. Greg founded vCISO services in 2017 to help SMBs. He has over 33 years of experience in IT and security including over 15 years at the CISO level. Greg is the host of the virtual CISO moment podcast and authored information security for small and mid-sized businesses.

00:00 introduction

01:37 How did you get into Cyber?

04:40 What brought you to SMB?

07:00 Equifax Breach

10:30 Defense in Depth

13:05 Doing more than just checking the boxes

19:40 Cyber insurance

24:00 Some ways SMBs get breached

28:00 Ransomware

30:40 SMB: What to do if you don’t have the resources?

36:44 How much money should SMBs spend on cybersecurity?

38:24 Should the CISO work for the CIO?

42:17 Metrics for decision-makers

45:20 Russians and the Chinese

49:00 Meeting Greg  

CU Intersect conference is July 18-20. Link https://cuintersect.com/ 

RETR3AT Link: https://www.montreat.edu/about/events/retr3at/  

Greg's podcast: https://virtual-ciso.us/ 

Gregs Book: https://www.amazon.com/Information-Security-Small-Midsized-Businesses/dp/1733066845/

To learn more about Greg visit https://www.linkedin.com/in/gregoryschaffer/

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com

SOCIAL MEDIA:

Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!

Instagram: https://www.instagram.com/securityconfidential/

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/

Twitter: https://twitter.com/darkrhinosec

LinkedIn: https://www.linkedin.com/company/dark-rhino-security

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #DarkRhinoSecurity 

Eddie Thomason joins us for this week's episode of Security Confidential. Eddie is a Regional Sales Manager at DataLocker,  a bestselling author, and entrepreneur who has been featured on ABC, CBS, & FOX news affiliates. Eddie has worked with multiple Fortune 500 companies to improve their revenue and was named one of the top business professionals by the Chamber of Commerce. Eddie hosts the popular “Simply Secure Podcast” where he talks to cyber professionals about #InfoSec. When he is not talking or working in cyber, he can also be found creating cutting boards and wood furniture with his passion project ET Woodworks.   

00:00  Introduction 

04:07 How did you establish credibility with C-suite without trying to sell them anything? 

09:02 Referring clients to other companies. Has that gotten you into trouble?  

11:17 How SMBs should navigate through the sea of Cybersecurity? 

15:40 Questions to ask MSSPs  

19:22 Friction Security 

25:10 Risk Appetite  

32:35 Biggest mistakes Security teams have made 

38:10 Tips for transitioning into cyber

 46:00 How to use USBs correctly in your organization  

53:55 Simply Secure Podcast  

To learn more about Eddie visit https://www.linkedin.com/in/eddiethomason/ 

Listen to Eddie's podcast:  https://simplysecurepodcast.com/ 

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com 

SOCIAL MEDIA: 

Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio! 

 Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec 

LinkedIn: https://www.linkedin.com/company/dark-rhino-security 

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #DarkRhinoSecurity

Rory Meikle hosts this episode of Security Confidential with Erika Carrara. Erika is an influential, strategic, business-focused, and highly accomplished C-Suite executive. She has accomplished many things such as being a CISO, Director of Information Technology, Penetration Tester, IT Security Specialist, and many more. Erika is also a Veteran of the United States Army and Mentor. She is currently the CISO of Wabtec Corporation.  

00:00 Introduction 

00:49 How did you start your career in cybersecurity? Was it something you did while in the military?  

03:03 Advice for younger individuals stepping into cyber 

04:27 Advice for Veterans transitioning into Cyber 

06:29 Due diligence process when looking at an acquisition?  

13:40 ISO 27,001 

17:04 Security Frameworks for Small Businesses  

22:00 What motivates bad actors?  

26:40 Are there policies that you think the government should adopt that would better deter bad actors?  

34:18 Can you shed some light on what defense in depth should entail for critical infrastructure companies?  

37:45  3rd party risk mitigation 

41:14 Small businesses: expectations regarding cybersecurity? 

45:03 Code: Girl  

50:00 Connecting with Erika  

To learn more about Erika visit https://www.linkedin.com/in/infosecpainpoints/ 

To learn more about coding programs for girls, check out these websites: 

https://girlswhocode.com/ 

https://code.org/girls 

https://www.blackgirlscode.com/ 

https://www.coding-girls.com/ 

https://www.techgirlz.org/ 

https://djangogirls.org/en/ 

To learn more about Dark Rhino Security visit 

https://www.darkrhinosecurity.com 

SOCIAL MEDIA: 

Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec LinkedIn: https://www.linkedin.com/company/dark-rhino-security 

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #Darkrhinosecurity  

Endre Jarraux Walls is the EVP and CISO for Customers Bancorp and Customers Bank. He provides leadership to the Bank’s technology risk, digital compliance, security operations, governance, resilience, physical security, and cyber fraud departments of Customers Bank. He has held all 3 C-level roles in the technology industry, as an award-winning CIO, CTO, and now CISO. Prior to joining the Bank, he served as an executive in Healthcare, Telecom, and more. He was recently recognized as one of the top 40 under 40 leaders in the greater Philadelphia region, is a 2021 Top 100 CISO, was recognized as a top 10 global CISO in 2020, and received an American Cyber Awards honor in 2020.  He attended both Capella University in Minnesota for his BS in Information Technology and Yale University’s School of Management for Executive Education.  

00:00 Introduction 

01:17 How did you start your career in cybersecurity? 

03:05 Is (General Electric, Nuclear Industry) moving to the cloud? 

07:20 What do you see as the biggest threats in the financial sector 

08:40 Third-Party Risk- How to go about it 

11:38 Developing standards with Vendors 

15:07 Personal devices 

21:00 How do you communicate risks to the C-Suite? 

23:12 Do they see cyber as a business problem or IT Problem?  

27:40 How did you bring users in?  

35:40 What is the role of frameworks?  

41:20 What drives a bad actor? 

47:40 Upcoming News for Endre   

To learn more about Endre visit https://www.linkedin.com/in/endrewalls/  

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com  

SOCIAL MEDIA: Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/  

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/  

Twitter: https://twitter.com/darkrhinosec  

LinkedIn: https://www.linkedin.com/company/dark-rhino-security  

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos

#SecurityConfidential #DarkRhinoSecurity 

Nat Shere is currently a cybersecurity consultant, specializing in ethical hacking and secure coding. He has also worked as a product security engineer, where he worked directly with developers to integrate security into the development lifecycle. He has a Master's in Computer Security and has taught undergraduate-level courses in both math and computer science.

00:00 Introduction 

01:20 Penetration testing 

05:50 Walking through Risk Analysis  

08:07 SQL injections  

09:50 3rd Party Risk. What does it mean? 

11:30 How to protect yourself when using open sourced code 

15:33 Google, Amazon, and Microsoft 

16:30 Being on the Cloud and in the Cloud 

18:40 Communicating to the executives 

20:10 Cybersecurity as a Revenue Service 

25:55 MFA issues and vulnerability  

29:52 Smart Phones 

37:56 Penetration tests on Mobile Devices 

41:37 More about Nat  

To learn more about Nat Shere visit  https://www.linkedin.com/in/nathaniel-shere 

Links to Nat's blogs as mentioned in the video: 

https://www.craftcompliance.com/post/7-steps-to-website-security-worth-bragging-about 

https://www.craftcompliance.com/post/penetration-testing-the-what-the-why-the-how 

https://www.craftcompliance.com/post/getting-the-most-out-of-penetration-testing 

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com 

SOCIAL MEDIA: Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec 

LinkedIn: https://www.linkedin.com/company/dark-rhino-security

#SecurityConfidential #darkrhinosecurity  

Brian Haugli joins host Manoj Tandon on this week's episode of Security Confidential. Brian is a Managing Partner and Chief Executive Officer at SideChannel. Brian has been driving security programs for two decades and brings a true practitioner’s approach to the industry. He has led programs for the DoD, Pentagon, Intelligence Community, Fortune 500, and many others. Brian is a renowned speaker and expert on NIST guidance, threat intelligence implementations, and strategic organizational initiatives. He is also a contributing author for the latest book from Wiley, “Cybersecurity Risk Management: Mastering the Fundamentals Using the NIST Cybersecurity Framework“. Lastly, he is a professor at Boston College, in the Woods College of Advancing Studies, Master’s Program in Cybersecurity.  

00:00 Introduction 

01:50 How do you see the threat landscape changing in cybersecurity? 

05:00 Do you think the mid-market understands that cybersecurity is not an IT problem but a business problem? 

08:30 Why are SMBs such hot targets? 

12:35 Insurance brokers typically do not understand cybersecurity postures, they deal in applications. How can an SMB leverage the broker to get an underwriter to understand their posture? 

20:50 Is it possible for you the client to get in front of the carrier? 

23:42 How does a company access its security posture? 

27:00 How do these businesses go about this practically?  

33:20 News from Brian  

Brian and Cynthia’s Book https://www.amazon.com/Cybersecurity-Risk-Management-Mastering-Fundamentals/dp/1119816289 

To learn more about Brian visit https://www.linkedin.com/in/brianhaugli/   

To learn more about Dark Rhino Security visit https://www.darkrhinosecurity.com 

SOCIAL MEDIA: Stay connected with us on our social media pages where we'll give you snippets, alerts for new podcasts, and even behind the scenes of our studio!  

Instagram: https://www.instagram.com/securityconfidential/ 

Facebook: https://m.facebook.com/Dark-Rhino-Security-Inc-105978998396396/ 

Twitter: https://twitter.com/darkrhinosec

LinkedIn: https://www.linkedin.com/company/dark-rhino-security

Youtube: https://www.youtube.com/channel/UCs6R-jX06_TDlFrnv-uyy0w/videos