The Tea on Cybersecurity

“There's a converging of several forces or several trends going on right now that I think are going to potentially cause significant changes in 2024.”

@Jim Goldman, CEO of Trava Security, knows a thing or two about cybersecurity. In this episode, Jim and host @Jara Rowe dive into the latest scoop on what's happening in the world of cybersecurity and compliance and what you need to know to keep your business safe and secure in 2024. 

They discuss how ransomware is alive and well, and federal governments worldwide are taking a stand, which is great news for us, bad news for the cyber terrorists. They also talk about the changes in the compliance landscape in 2024, with a big focus on changing breach disclosures and cybersecurity risk management. They also filled us in on a very helpful resource – CISA, Cybersecurity and Infrastructure Security Agency – available for all of us to stay up-to-date on compliance. 

In this episode, you’ll learn:

• Ransomware is a real and growing threat. Learn how federal governments are joining forces to tackle this issue, and discover proactive measures like multifactor authentication to keep your business safe.
• Compliance equality through new regulations are ensuring that all companies, public and private alike, are held to the same standard for cybersecurity risk management and breach disclosures.
• How to secure company laptops and contractor access to ensure remote work resilience

Read Trava's guide, The Top 4 Cyber Threats to Be Aware of in 2024, to learn the latest trends in double extortion and supply chain attacks and fortify your business for the year ahead: https://travasecurity.com/2024-threats

Things to listen for:

[01:51 -5:14] Overview of Cybersecurity and Compliance Landscape in 2024

[5:14 - 6:38] Proactive Measures we can take to mitigate Ransomware attacks

[8:34 - 9:58] Cyber Insurance 

[9:59 - 13:40] Changes in Compliance Frameworks in 2024

[16:16 - 19:01] Other threats to be on the lookout in 2024 include work-from-home issues

[21:53 - 23:28] How to stay agile and resilient

[24:25 - 25:36] Final thoughts from Jim

[25:48 - 28:54] Jara’s receipts

Resources:

Unlocking Cybersecurity and Compliance Success in 2024

A Global Escalation: Ransomware Threats, Trends, and Solutions for 2024

Cybersecurity for Remote Workers: Best Practices for Securing Your Home Office

ISO 27001 Certification: What Is It and Why Does It Matter?

Connect with the Guest:

Jim Goldman's LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

You asked for it, so we’re back for another season of your favorite cybersecurity podcast, The Tea on Cybersecurity. In the last two seasons, host Jara Rowe covered everything from the basics – what is phishing? – to implementation – do I need cyber insurance? This season, we dive deep into compliance but, true to our word, simplify things and cover more basics – a must-listen boost your cybersecurity knowledge!

Visit the Trava website to find actionable guides, compliance solutions, and the tools you need to master MFA, asset control, and continuous vulnerability management: https://travasecurity.com/learn

Connect with the Host: Jara Rowe’s LinkedIn

Connect with Trava:

Website - www.travasecurity.com

Blog - www.travasecurity.com/blog

LinkedIn -@TravaSecurity

YouTube - @TravaSecurity 

"Having a really thorough cybersecurity plan is essential. It's honestly what everything comes down to."

We’ve reached the end of season 2 of the Tea on Cybersecurity, where we wrap up the season with the most important receipts learned from previous guests.

In this episode, we touch on the importance of conducting cyber risk assessments to understand the current risks in your business, the difference between audits and assessments, the significance of having a strong cybersecurity plan as your foundation, the steps to take in building a secure system, and more.

In this episode, you’ll learn:

• The importance of Multi-Factor Authentication 
• Why none of us are fully safe, but how we can become as safe as possible 
• Why cyber insurance policies are essential

Jara’s ultimate takeaway this season? Build a strong system from the start. Check out this blog post for a practical look at how to secure your SaaS platform while you scale: https://travasecurity.com/pod-saas-security Things to listen for:

[01:35 - 2:48] What are cyber risk assessments, and why are they important?

[03:01 - 5:03] The difference between audits and assessments.

[07:34 - 9:04] Why building a strong, secure system before looking into compliance framework is key.

[11:18 - 13:01] What proactive and reactive assessments are.

[13:23 - 14:08] The importance of pen testing.

[15:10 - 16:18] Why you should implement cybersecurity awareness training.

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"Cybersecurity awareness training is not about creating cybersecurity experts. It's about making staff and stakeholders aware of the threats and how to respond to them."

In this episode of The Tea on Cybersecurity, VP of Customer Success at Carbide, @Kathy Issac, joins host @Jara Rowe to discuss the ins and outs of cybersecurity awareness training and why every company must partake in it.

As the world leans increasingly into technology, cybersecurity awareness training is crucial for businesses and individuals. Without this training, companies are putting their business at risk for malicious attacks, data breaches, and cyber threats.

Join us as Kathy shares how to engage your company in this training effectively, the secrets to tailoring this practice to different audiences for effectiveness, and what could go wrong if not taught properly.

In this episode, you’ll learn: 

• What cybersecurity training is and why it’s important to tailor it to different audiences.
• Common but detrimental mistakes that companies make when it comes to cybersecurity awareness training.
• Why cybersecurity awareness training is crucial for remote work.

Want to learn more about cyber security awareness training? Check out this blog post on how to train your employees: https://travasecurity.com/pod-training Things to listen for:

1. [03:04] What is cybersecurity awareness training, and why it’s important.
2. [04:21] How companies can tailor cybersecurity awareness training to different audiences for effectiveness.
3. [07:53] How to make cybersecurity awareness training more effective and engaging.
4. [09:47] Common mistakes companies make regarding cybersecurity awareness training and best practices to take.
5. [13:13] How to measure cybersecurity awareness training effectiveness.

Connect with the Guest:

Kathy Isaac’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"The shift to remote work has transformed the cybersecurity landscape, forcing companies to rethink their approach to protecting their attack surface."

In this episode of The Tea on Cybersecurity, @Jara Rowe sits down with Trava Senior Security Engineer @Anh Pham to discuss the blend of remote work and cybersecurity. 

The shift to remote work has significantly transformed the cybersecurity landscape, forcing companies and cybersecurity professionals to rethink their approach to protecting their data and assets. Due to this, businesses face unique cybersecurity challenges. To address these challenges, organizations need to enforce security controls at the device and user level, consider individual protection for each tool and resource, and implement strong access management policies and identity management tools. 

Join us as Anh dishes practical tips for beginners, ensuring you're armed with the know-how to stay safe in the virtual world.

What you’ll learn in this episode: 

• The challenges businesses face and how they're adapting their security controls to protect against cyber threats in the remote work environment.
• Methods and approaches businesses can take to keep their files and content secure.
• Institute the Zero Trust rule when working from home: stay focused and err on the side of caution when an email or communication seems fishy.

Want to learn more about cyber security for remote workers? Check out this blog post on the best practices for securing your home office: https://travasecurity.com/pod-remote-workers

Things to listen for:

1. [01:56] Cybersecurity challenges that businesses face and how they address them.
2. [04:32] How remote work has changed the auditing process.
3. [05:50] How organizations can ensure the right individuals access sensitive resources.
4. [09:09] Anh’s best practices for educating on preventing remote work breaches.
5. [11:41] How the human factor in social engineering and phishing attacks come into play when considering remote work access security.
6. [13:37] Trends Anh foresees in terms of cybersecurity needs, particularly in the realm of remote access management.

Connect with the Guest:

Anh Pham’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"Proactive protection is not just about fixing vulnerabilities, it's about implementing a comprehensive security strategy and understanding your system boundaries and actively defending against cyber threats before they can breach your defenses."

In the latest episode of The Tea on Cybersecurity, @Jara Rowe talks with @Jim Goldman and @Ryan Dunn to uncover the importance of being proactive in cybersecurity management to avoid the pitfalls of a cyber attack.

To be proactive, companies need to implement various security processes and technologies. These include patching management to ensure systems are up to date with the latest security patches, multi-factor authentication to add an extra layer of protection for accessing sensitive information, and security awareness and training programs to educate employees about potential threats and best practices.

By implementing these measures, companies can reduce the number of vulnerabilities in their systems over time.

Make sure to listen to the end for tips on what being proactive looks like from Jim and Ryan.

What you’ll learn in this episode:

1. The importance of implementing proactive cybersecurity measures beyond vulnerability management to protect your organization from cyber attacks.
2. The significance of understanding and assessing third party risks in order to safeguard your business and customer data.
3. The need for agents in the insurance industry to adopt a proactive and creative mindset when dealing with cyber insurance, rather than relying on reactive approaches.

Things to listen for:

1. [1:33] What a proactive and reactive cybersecurity system is.
2. [3:22] How a proactive approach to cybersecurity helps organizations identify and mitigate potential threats.
3. [4:40] Why so many people typically lean towards being reactive in their cybersecurity systems.
4. [7:21] Tips for third party checking.
5. [9:26] What role technology can play in supporting a proactive cybersecurity strategy for both agents and their clients.
6. [13:55] Best practices for organizations looking to adopt a proactive cybersecurity stance.

Connect with the Guest:

Ryan Dunn’s LinkedIn

Jim Goldman’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"Whenever you have a piece of software that has an obligation to perform a duty, like a SaaS company, the intersection of cyber insurance and professional liability is crucial. It's important to transfer the risk with a comprehensive cyber insurance policy to protect against both code failures and potential cyber breaches."

In the latest episode of The Tea on Cybersecurity, @Jara Rowe chats with @Ryan Dunn, Director of Insurance at Trava, to discuss the importance of cyber insurance as it relates to SaaS companies.

Businesses heavily rely on their digital infrastructure to conduct operations, making them vulnerable to cyber attacks and breaches. This is where cyber insurance comes into play… 

Cyber insurance helps cover the costs associated with incident response, data recovery, legal fees, notification and credit monitoring services for affected individuals, and potential lawsuits. In today's digital age, where cyber threats are becoming increasingly common and sophisticated, having cyber insurance can help businesses mitigate the financial impact of a cyber incident and recover more quickly. Ryan breaks this all down in this episode of the Tea on Cyber Security by explaining exactly why cyber insurance is a necessity, the reasoning for why the relationship between a strong cybersecurity posture and insurance premiums is currently a challenge in the cyber insurance industry, and the key factors insurance companies should pay close attention to when it comes to assessing cyber risk of their company.

This is an episode filled with information you don’t want to miss out on. Listen to hear the tea on cyber insurance.

What you’ll learn in this episode:

1. The importance of cyber insurance for SaaS companies and why all businesses should consider procuring it.
2. How insurance companies assess the cyber risk of a SaaS company, including factors like master service agreements, MFA (multi-factor authentication), EDR (endpoint detection response), CVE vulnerabilities, and web app data scans.
3. The impact of a strong cybersecurity posture on insurance premiums and the ongoing challenge of finding ways to reward companies for investing in their cybersecurity stack.

Things to listen for:

1. [03:41] SAS policy and cyber breach liability, MFA and EDR requirements for insurance, and CVE vulnerabilities and vulnerability management.
2. [08:55] Cyber insurance frustrations: uncertain path to savings.
3. [11:50] Limited information hampers SaaS purchasing behavior.
4. [17:27] Continuous cybersecurity is a shared industry belief. Trava is a big supporter. Agents should check cybersecurity and deploy Atrava platform. Quarterly checks and monthly scans recommended.
5. [21:34] Key cyber insurance policies for SaaS companies.
6. [23:15] Essential coverage for small companies: email, ransomware, business interruption.

Connect with the Guest:

Ryan Dunn's LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"It's easier to protect your company's assets when you know exactly what your security posture looks like and where your problems are."

In the latest episode of The Tea on Cybersecurity, @Jara Rowe chats with @Christina Annechino, Cybersecurity Analyst at Trava, to delve into the world of penetration testing or “pen Testing” and its significance in the realm of cybersecurity.

Pen Testing involves carrying out controlled attacks that mimic real-world scenarios, allowing businesses to identify weaknesses before hackers can exploit them. This process enables companies to evaluate their security measures and implement more robust practices. 

Christina breaks down the various types of Pen Tests, including network, web application, and internal Pen Testing. She walks us through the different stages of a Pen Test, starting at reconnaissance through covering tracks and reporting,while highlighting the crucial role played by Pen Testers in uncovering vulnerabilities and offering strategies for remediation. 

Listen in to boost your understanding of Pen Testing to safeguard your digital assets effectively.

What you’ll learn in this episode:

1. Pen Tests help companies assess their security strength and implement better security practices.
2. The stages of a Pen Test include reconnaissance, scanning and enumeration, vulnerability assessment, exploitation, maintaining access, covering tracks, and reporting.
3. Certified ethical hackers not only  identify vulnerabilities but also provide remediation strategies to fix them. 

Want to see exactly how an ethical hacker uncovers your security gaps? Check out our blog post on the 7 Stages of Penetration Testing to learn how to proactively protect your business: https://travasecurity.com/pod-pentest-stages

Things to listen for:

[1:34] What is a Pen Test? 

[5:24] Stages of Pen Test: reconnaissance, scanning, vulnerability assessment, exploitation, maintaining access, covering tracks, reporting.

[09:03] How Pen Testers summarize vulnerabilities and remediation strategies and prioritizing the severity of the vulnerability.

[10:39] Difference between Pen Tests and ethical hackers. 

[11:34] Common tools and techniques used in penetration tests.

Connect with the Guest:

Christina Annechino’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"The more data you have, the more painful it's going to be if you mess up your cybersecurity and all that leaks out."

On the most recent episode of The Tea on Cybersecurity, host Jara Rowe is joined by Chris Vannoy from The Juice, a renowned MarTech firm, to dive into a discussion about data protection. 

Chris underscores the significance of SOC2 processes in ensuring data precision and controlling access, while also tackling the tough task of juggling ethical and legal restrictions with the growing need for customer data in the face of evolving privacy conditions. 

He offers a word of caution to companies about the importance of thoughtful data gathering and sharing protocols, emphasizing security from the get-go. The conversation also touches on the need for faith in vendors, the value of certifications like SOC2 or ISO, the privacy expectations among tech engineers, and the changing public attitude towards privacy, influenced by GDPR and the advent of new tech. 

This episode underscores the crucial necessity for enterprises to protect their data in order to adhere to privacy regulations.

What you’ll learn in this episode:

1. What MarTech software is and how it can assist marketers in their work. 
2. The different security measures for different data levels.
3. Precautions to prevent data from leaving the system.
4. How to balance ethics, regulations, and customer expectations in MarTech
5. Practical tips for breaking bad habits and implementing security measures

Chris Vannoy highlighted that any tool you use becomes your responsibility. Use our Vendor Cybersecurity Checklist to vet your MarTech stack and ensure your partners take privacy as seriously as you do: https://travasecurity.com/pod-vendor-checklist

Things to listen for:

[2:23] Marketing technology (MarTech) includes various tools such as email campaigns, custom landing pages, account-based software, and advertising. 

[4:57] Privacy concerns are rising both for users and businesses.

[8:54] Regulations and privacy consciousness impact marketers today.

[13:40] Data ownership and sharing responsibilities explained.

[17:48] Engineers prioritize privacy, security, and ethics.

[22:21] Ask for certification. 

[24:37] Jara’s Receipts

Connect with the Guest:

Chris Vannoy’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

"Security is all about the protection of your data. While privacy is determining how your data is being used."

On this episode of The Tea on Cybersecurity, join host Jara Rowe as she delves into the world of privacy and security certificates with expert guest @Marie Joseph, Senior Security Solutions Engineer at Trava.

Protecting sensitive data has become more important than ever. But with the vast array of privacy and security certifications available, it can be challenging to know where to start.

Marie helps us understand the different certifications and their importance. In this episode we discuss the most common privacy and security certifications, such as GDPR, CCPA, and SOC 2. 

We  explore the benefits of obtaining these certifications, the challenges organizations may face during the process, and how to verify if a company has a privacy or security certificate. Discover the differences between various certifications and gain valuable insights on how to navigate the world of cybersecurity certificates. 

What you’ll learn in this episode:

1. Understand the main differences between privacy and security certifications, and the benefits they offer
2. The challenges that organizations face when implementing cybersecurity and privacy measures and the importance of patience in the process. 
3. The potential benefits of partnering with a cybersecurity expert.

Want to learn more about the difference between security and privacy? Check out this blog post on the different types of certifications and how they overlap: https://travasecurity.com/pod-security-compliance

Things to listen for:

[5:54] Various frameworks create cybersecurity best practice lists.

[8:12] Focus on one, readiness, audit, and certificate renewal.

[9:50] Understanding the costly process.

[13:28] Be patient, take simple steps, and ensure feasibility.

[16:37] Patience is key. Privacy and security certificates.

Connect with the Guest:

Marie Joseph’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

Guest Information

Name: Marie Joseph  

Title: Senior Security Solutions Engineer at Trava

Bio: Marie Joseph is an Indiana University alumna. While studying law and public policy, she studied abroad in the UK and learned from government agencies about US and National Security—sparking her interest in cybersecurity. Marie then headed back to IU for a master's degree in cybersecurity. Marie now helps Trava customers begin and/or mature their security and compliance programs as a Sr. Security Solutions Engineer.

Social: https://www.linkedin.com/in/marie-joseph-a81394143/