“Gaps in security are behavioral . . . find out what drives behavior at your company, and you will find your vulnerabilities.” As the Strategic Lead of Amazon Web Service’ Global Security Services Team, Dutch Schwartz talks with SecurityMetrics Podcast Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) to define what CISOs need to understand about human motivation in order to strategize security programs, utilize company culture, and protect critical data.

Listen in to learn: 

• How the CISO position has changed in the last decade and how it’s currently defined. 
• The surprising differences in intellectual property between companies and the role those differences play in security.
• Why culture and social strategy should be more important to a CISO than technology, and tips for facing company culture challenges. 

Resources:

https://www.linkedin.com/in/dutchschwartz/

https://twitter.com/dutch_26

Download our Guide to PCI Compliance! - https://info.securitymetrics.com/pci-guide

Download our Guide to HIPAA Compliance! - https://info.securitymetrics.com/hipaa-guide

Access our free cybersecurity and compliance conference - www.securitymetrics.com/summit   

[Disclaimer] Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

When your organization has 300 Merchant IDs (MIDs) in a multi-modality environment, leading a PCI DSS compliance program is no easy task. This week, Host and Principal Security Analyst Jen Stone welcomes guest Robbyn Lennon, Senior Merchant Services Program Coordinator at the University of Arizona, along with SecurityMetrics Principal Analyst Michael Simpson to talk about large-scale PCI DSS compliance from both a QSA and a client perspective.

Robbyn explains in detail how she established a PCI DSS compliance program at the University of Arizona. With over 10 years of experience, she shares her three-part strategy: “Engagement, leadership, and encouragement.” 

• How to reduce scope in a large PCI DSS compliance program by organizing merchants into “pods.”
• Why a focus on leadership as opposed to management helps employees take accountability for their job processes.
• The tools, training, and documentation you need to empower merchants and improve your PCI program.

Robbyn on LinkedIn

Learn more at SecurityMetrics.com

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

“It’s our friends and family–our moms and dads–who shop online and are affected when a bad guy gains access. So we take it personally,” said SecurityMetrics SOC/SIEM Director, Heff. 

Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) continues this sentiment by saying “When businesses go down, people suffer. Every business we can protect helps elevate the quality of life for the people who are associated.”

At SecurityMetrics, we monitor the threat landscape around the clock. And currently, that landscape is not only vast, it’s complex. Never have companies faced so many challenges, and hackers know it. Data protection measures need to be based on our new global landscape and the latest threats. Today, Heff, Jen, and SOC Analyst Forrest Barth discuss the threat landscape in depth and cover the five most important things you can do now to prevent an attack. Listen to this episode to learn:

• What the “Fujiwhara Effect” is and why it can make cybersecurity feel overwhelming.
• New terms and trends demystified: cyber empathy, vishing, endpoint definition, and Zero Trust architecture.
• Why bringing work computers home and social engineering make for a disastrous combination. 

Heff, SIEM Operations Director
Forrest Barth, Analyst

Learn more at https://www.securitymetrics.com/

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

“A lot of people in the security world want to talk about security, not compliance. But you can’t help secure things if you don’t know what you’re supposed to be securing,” says host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA). 

In this episode, NuSkin Data Governance Analyst, Gabrielle Harris (CIPP/E, CIPM, MSML) explains how security and compliance are permanently entwined, “Even though ‘compliance’ has a negative connotation and ‘security’ has a positive one, the truth is that compliance builds brand reputation and trust with customers. Protecting data is an ethical thing, and we would all hope that whoever is protecting ours is taking it seriously.

With experience in over 50 markets, Harris brings a big-picture understanding, a positive attitude, and a tireless work ethic to privacy programs. Listen to this episode to learn:

• Pervasive attitudes and pitfalls that can hinder GDPR, HIPAA, and CCPA compliance 
• Critical points in your step-by-step compliance process that build rapport and respect, including whom to involve and when
• What you need to understand about the differences between security standards and privacy law

Gabrielle Harris LinkedIn

CIPP Certification

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

Subscribe to the SecurityMetrics Podcast

“Something has happened.” Your company has experienced the worst: a data breach. You’ll need to answer questions. You’ll need to implement emergency operations and plans, run backup and talk to investigators. Not a convenient time to start your Incident Response Plan.

According to Dave Ellis, SecurityMetrics VP of Investigations (GCIH, PFI, QSA, CISSP), an Incident Response Plan is, in short, “What you do ahead of time, in preparation for an event that you hope never happens.” Ellis sits down with Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) to discuss in detail the phases of an IRP, along with the circumstances, variables, and options surrounding this “worst case scenario.”

Listen to learn:

• Emergency-Mode Operations, contingency planning, and the recovery phase
• How to get initial buy-in from your executives, C-suites, and decision makers
• Case studies and examples from the field: the practical realities involved in maintaining a current Incident Response Plan
• Tips to avoid, handle, and learn from data breaches, ransomware, and other types of malware

Learn more

2020 SecurityMetrics HIPAA Guide

2020 SecurityMetrics PCI Guide

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

When Liberty Mutual offered Craig Olsen a lateral leap from Developer to Security Analyst, he took it–and hasn’t looked back since. Now a Cybersecurity Architect, Olsen reflects on the last fifteen years and his role in the transition from one-person internal security departments, to a full-blown industry with unique technologies, solutions, and issues.

When it comes to the cloud, many companies are unsure or hesitant. Some may not even know for sure if they’re using it. Often, this is based on a lack of understanding or familiarity with cloud security.

Olsen and Host Jen Stone sit down for an in-depth discussion about cloud solutions, including:

• What we can learn from companies who’ve experienced data breaches in the cloud
• How to leverage the unique qualities of the cloud to improve security and support growth
• Simple steps anyone can take to build foundational layers of security–areas like passwords, policies, encryption, and compliance

Craig Olsen on LinkedIn
Learn more

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

In today’s podcast, Dr. Eman El-Sheikh (Director of the Center for Cybersecurity at the University of West Florida) sits with Host and Principal Security Analyst Jen Stone to discuss how we can creatively approach cybersecurity careers from all perspectives.

“We have over half a million open cybersecurity jobs as we speak. And, unfortunately that number is trending up.”

Dr. Eman El-Sheikh is the Director of the Center for Cybersecurity at Western Florida and plays a vital role in recruiting future cybersecurity leaders. Today, she sits with Host and Principal Security Analyst Jen Stone to discuss how we can creatively approach cybersecurity careers from all perspectives.

Listen in to learn:

• What is required for a career in cybersecurity. Do you need a degree? Certifications? Or neither?
• How a skills-based approach can compliment–not contradict–an educational approach
• How we as a cybersecurity industry can foster innovation and diversity while continuing education and training

“We take a multi-disciplinary approach, and our message is that regardless of what you’re interested in: programming, IT, engineering, policy, law, management, psychology, or criminal justice, there are pathways to gain cybersecurity knowledge and skills, and there are great jobs waiting for you on the other side.” 

You can learn more about Eman’s work at:

Center for Cybersecurity at University at Western Florida

NIST National Initiative for Cybersecurity Education (NICE)

Learn more at Securitymetrics.com

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

A successful PCI DSS assessment requires a fair amount of preparation and scheduling far in advance. These activities may seem like a lot of work, but they are actually the best way to make your assessment less overwhelming, help you control time and cost, and avoid worst-case scenarios. 

With thousands of PCI DSS assessment hours between them, SecurityMetrics Principal Analysts George Mateaki (CISSP, CISA, CISM, QSA, PA-QSA) and Jen Stone (MCIS, CISSP, CISA, QSA) sit down to “talk shop” and share stories from the field. 

Listen in to learn:

• How remote assessments work and tips to make them go more smoothly.
• What you should do a year, 9 months, 6 months, and 3 months before your first assessment. Plus, what to do in between assessments to save time and resources.
• An overview of the PCI audit timeline–from initial contact to signing of the report on compliance (ROC).
• How to balance the need for functionality and access at organizations with the goal to protect data.

Learn more

*Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

Paul Poh (CISSP, CISM, CRISC, CIPP/US) has had an interest in cybersecurity since before the internet as we know it existed. From his first exposure to the “Morris Worm” in the early ‘90s as a software engineer at Tufts University, to his current role as Partner at Radical Security, Paul’s mixture of curiosity and wisdom have helped him maintain the perspective needed to be a successful penetration tester. He shares his insights with our Host Jen Stone (Principal Security Analyst, CISSP, CISA, QSA) on why it’s the small things that can take down an organization’s security. 

“Your Software Development, Engineering, and DevOps can all be great. But a malicious actor can still break a password, attack your source code, and insert a backdoor that would then be pushed into production. You can do a great job protecting production, but if a hacker can find something small, they will.”

Listen in to learn

• Case studies that compare typical security measures to actual threats and vulnerabilities
• Penetration testing requirements, preparation, tips, timing, timeline, and best practices 
• Tips for choosing a penetration testing firm and the surprising qualities that make for a good penetration tester

Paul Poh on LinkedIn

2020 SecurityMetrics PCI Guide

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place

As a former US Air Force Cyber-Warfare Technician, Vince Romney (CISSP) has been able to leverage his unique military experience in the private sector–most recently as CTO of SK2 Technology, developing high-security encryption applications. In this episode, he joins Host Jen Stone (Principal Security Analyst, CISSP, CISA, QSA) to explore cloud security challenges in the corporate world, but also to share the valuable insights about risk analysis and mitigation which he gained during his military service. 
Listen in to learn: 

• Common misconceptions about the security, implementation, and risk management required for cloud solutions.
• How decision makers in the corporate world can apply specific risk assessment principles and methods used in the military.
• Lessons learned in military operations that will help you increase the discipline, honesty, and problem-solving ability within your organization’s security program.

“You can live a much calmer life if you accept that your work is never done. Readjust your mindset to see that if you want to succeed in cybersecurity, you should be constantly engaged in learning new concepts and trying new tactics.” –Vince Romney
Vince Romney on LinkedIn
SecurityMetrics Guide to PCI DSS Compliance

[Disclaimer] Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.

Request a Quote for a PCI Audit ► https://www.securitymetrics.com/pci-audit

Request a Quote for a Penetration Test ► https://www.securitymetrics.com/penetration-testing

Get the Guide to PCI DSS compliance ► https://www.securitymetrics.com/lp/pci/pci-guide

Get FREE security and compliance training ► https://academy.securitymetrics.com/

Get in touch with SecurityMetrics' Sales Team ► https://www.securitymetrics.com/contact/lets-get-you-to-the-right-place