In this part 1 of our 2-part podcast, Gerard Scheitlin from Orion Health looks at the state-run health information exchanges (HIEs) and how patient data is collected, accessed, and shared, giving us some insight into how population health and precision medicine are provided through their leveraging of these systems. The big question is, are we as patients automatically opting in to share our personal health information with the state (and federal) government?

In this podcast, Ashwin Krishnan converses with Daniel Gallant, the Executive Director of the Nuyorican Poets Cafe, about how a self-taught social marketer learned to adapt to the continually-changing seismic plates of the Facebook platform. Listen to the practical advice he has for fellow small and medium businesses (SMBs) and non-profit organizations that might be struggling with the same challenges he had to face.

Meanwhile, the discussion touches on the divide between the 'free' Facebook platform - which offers services that are conceived to appeal and retain users, such that they stay engaged and keep feeding a huge amount of personal data back in to the machine, while the ‘other' Facebook, the 'paid' one, can profit from businesses of every size by offering marketing solutions that gets more precise and valuable as time and interactions go by.

Head spinning? It's ok, listen up!

Charity Pulliam and Kristi Pulliam chat with ITSPmagazine’s Selena Templeton on Diverse IT about the challenges of getting into the male-dominated IT field and how it takes just one person to believe in you to help you achieve your dreams. Tune in to hear why Charity transitioned from the medical field to IT and how she navigates professional technology events when men get her number to offer her a job and wind up asking her out for a date, and how her passion for what she does gives her the strength to keep going in a male-dominated field. Kristi shares how she got into the tech field just three years after she learned how to turn a computer on, what made her do a 180-degree turn from cybersecurity to chaplain in the Air Force Reserve, and some specific advice for young women interested in the field.

Eoin Keary, CEO of Dublin-based edgescan, talks to ITSPmagazine about his entry into cybersecurity, starting off in software development. Eoin describes how the agile software development lifecycle (SDLC) has changed the way organizations need to view risk as they build and deploy their applications throughout their business environment.

Per Eoin's experience as both a developer and a breaker and now as the CEO of a successful SaaS-based vulnerability assessment solution provider, organizations need to address security up and down the operational stack and all the way through the SDLC; it’s important to give the developers the proper tools, making it nearly invisible to the developers to make their applications secure. As Eoin describes, however, the solution needs to extend beyond the tools and needs to be combined with training to make the engineers aware of the cyber risks they face in logic and implementation bugs they might introduce into their application's code.

With a goal to combine the technical and human elements of vulnerability management, Eoin describes how and why he and his team started edgescan, highlighting the unique challenges they are looking to solve for their customers via the combination of machine-learning-enabled automation and hands-on human intelligence which they use to validate the findings.

Some clients call edgescan their "virtual penetration testing team," with a number of them leveraging edgescan's APIs to integrate continuous application vulnerability assessments within their existing CDCI- (continuous development / continuous integration) enabled DevSecOps processes.

"Security is everybody’s problem now," says Eoin. "It is getting attention at the board level; you need to get yourself into these meetings, and you need to be prepared to present metrics."

White Men as Full Diversity Partners co-founder Bill Proudman chats with ITSPmagazine’s Selena Templeton for the Diverse IT podcast about his unique approach to engaging white male business leaders in diversity and inclusion efforts. Tune in to hear about the importance of recruiting the best talent and not just the best talent that looks like us, about white, male privilege and how ignorance often gets misinterpreted by others as stupidity, and why it’s not just the job of women and minorities to be educators of equality.

EXPERT CYBERSECURITY WEBCAST SERIES FOR SMALL AND MEDIUM BUSINESSES

Watch Episode III

History Of Cybersecurity And Hacking

Hacking is not a new concept—it’s been around for as long as humans can remember. With each new technology introduced into society, people and businesses find ways to push it to the edge; getting more done, sometimes in new and exciting ways. Yet, at the same time, cybercriminals and other malicious actors are also pushing these same technologies to their own edge. Most business don’t think of the technologies they use in this way. Most only think of the business benefit they will get from their investment. The issue, of course, is that while they are looking at this innocently from their own perspective, cybercriminals are looking for ways to make a buck of their own. History repeats itself, however, and we can—and should—learn from the past. Join us for this webcast as we look back in time to apply the tried-and-true learnings and best practices to today’s business environment.

EDUCATORS

Diana Kelley, Cybersecurity Field CTO, Microsoft

Chris Roberts, Chief Security Architect, Acalvio Technologies

Gabriel Lawrence, GM Cybersecurity Protection, Toyota

MODERATORS

Sean Martin, CISSP, Co-Founder and Editor-in-Chief, ITSPmagazine

Marco Ciappelli, Co-Founder, ITSPmagazine

The complete series of webcasts, podcasts, articles, and supporting material can be found on ITSPmagazine at: https://itspmagazine.com/cybersecurity-for-small-medium-business

Enjoy, get involved, and share!

How was AppSec Cali 2018?

We asked Richard Greenberg and Cassio Goldschmidt.

This was the 5th Annual AppSec California, brought to you by Open Web Application Security Project (OWASP).

Every year it gets better and better and in fact, it sold out several weeks in advance. One of the benefits of being a smaller conference (about 600 attendees) is that the InfoSec professionals, developers, pen testers and QA folks who attend each year find that networking and catching up is much easier with old colleagues and new friends.

Listen to the final thoughts about this fantastic event.

Eoin Keary, CEO of edgescan, and Sean Martin from ITSPmagazine, catch up in Dublin, Ireland. Eoin shares some of the key findings captured during their latest vulnerability assessment and management research activities his team of experts performs and the trends and stats of these activities that his firm tracks for their clients around the world.

AppSec Cali 2018 Overview

Sitting at an outdoor table gazing out at the beach with palm trees silhouetted by a pink and orange sunset in 78-degree “winter” weather...not a bad way to attend a conference!

I am, of course, talking about the 5th Annual AppSec California, brought to you by Open Web Application Security Project (OWASP). Every year it gets better and better and in fact it sold out several weeks in advance (so remember to register early next year!).

One of the benefits of being a smaller conference (about 600 attendees) is that the InfoSec professionals, developers, pen testers and QA folks who attend each year find that networking and catching up is much easier with old colleagues and new friends.

Conference highlights included the welcome address from OWASP Chapter Leader Richard Greenberg, a session from Edgescan’s Founder/CEO Eoin Keary and COO Rahim Jina about “Project Edgeguard,” an open framework that allows you to detect malicious content, a women in security panel, closing keynote from Cory Doctorow (Science Fiction Author, Activist and Journalist), and a beautiful poolside reception under the stars.

ITSPmagazine’s Marco Ciappelli and Selena Templeton were on hand to talk to conference attendees and speakers about what stood out most for them at AppSec Cali 2018, and what it means nowadays - as a professional - to be “at the intersection of IT Security and Society.” We’ve compiled some of our conversations into a quick “highlights reel” podcast for you.

Enjoy, share, and check out ITSPmagazine.com

Chad Loder, former co-founder and VP of engineering at Rapid7 and now co-founder and CEO of Habitu8, connected with Sean Martin to share his views on the recently-exposed "researcher" toolkit aptly referred to as the "automated mass exploiter" and named "AutoSploit."

According to Loder, AutoSploit is a small piece of Python code created by a researcher and published on Github. The code automates the collection of Internet-connected device data pulled via APIs from Shodan and feeds that data into an existing automated exploitation tool, metasploit. Loder describes how this combination, while not the end of the world, connects the exploit framework in metasploit directly to the Internet at large, essentially creating a mass exploitation toolkit that lowers the bar for many to use.

"It’s akin to keeping the spray paint locked up in the do-it-yourself home improvement store to prevent teenagers from spray painting every wall in town," says Loder. "It's like handing out the spray paint to a bunch of high school kids. It won't hurt anyone, but it can be super annoying," Loder adds.

From a business perspective, organizations will likely see an increase in the chance of getting hit by a really common exploit. It’s more of a question of who is doing the attack, and not so much about the amount of traffic or the type of traffic they will see. Essentially, exploits can be conducted more quickly with this tool. And, where most companies are already struggling, this simply adds to their already-mounting infosec stress.

When it comes to small and medium businesses, especially those that use the wireless routers provided by their Internet Service Provider (ISP) and that never get patched or updated, they are probably in for a rude awakening. Loder suggests, however, that this problem shouldn't land on the SMBs shoulders to bear; information security should be handled for them, just like they get clean power and clean water.