The Tea on Cybersecurity

"The thing about security also is the threats are always changing. So you can't just keep doing what you've been doing and think you're going to be fine. You have to adapt to the changing threat landscape."

In the world of Cybersecurity, things are everchanging. This week Cybersecurity expert and CEO & Co-Founder of Trava Security Jim Goldman and Ben Phillips CPA and Director at KSM, discuss the differences between an audit and an assessment when it comes to information security internal risk assessments. 

Understanding the difference between a cybersecurity audit and assessment is crucial whether you are a business owner, IT professional, or auditor. Jim and Ben shed light on the motivation behind each - whether they are customer-driven or regulatory - and offer thoughts on which is right for you. If you are seeking cybersecurity certifications like SOC2 or ISO, knowing the difference is an important part of the process - along with patience, lots of patience!

What you’ll learn in this episode:

1. The differences between audits and assessments and why they should be conducted. 
2. How audits and assessments work together, and how often they should be conducted.
3. Why are both internal and external audits important in the journey to getting certified?

Want to dive deeper into cybersecurity risk assessments, read this blog to learn more about the different types: https://travasecurity.com/pod-assessments Things to listen for:

[02:47] Various certifications and audits for data security.

[07:53] The main difference between an audit and an assessment 

[09:40] Internal audit vs External audit.

[15:54] Information security assessment and preparation advice given.

[21:07] Differences between type 1 and type 2 SOC 2 reports.

Connect with the Guests:

Jim Goldman’s LinkedIn - https://www.linkedin.com/in/jigoldman/

Ben Phillips' LinkedIn - https://www.linkedin.com/in/ben-phillips-cpa-cisa-citp-ccsfp-chqp-093b0111/

Connect with the host:

Jara Rowe’s LinkedIn - https://www.linkedin.com/in/jararowe/

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

“When a customer compares between vendors, the one with an ISO certification is going to have an edge.”

We’ve covered the concept of compliance frameworks in previous episodes, but now we’re taking a deep dive into what it takes to obtain a specific certification: ISO 27001.

If you’ve ever wondered about the benefits of ISO compliance and the potential challenges you may face during the certification process, you’re in the right place.

In this conversation, Marie Joseph, Senior Security Solutions Engineer at Trava, and Anh Pham, Senior Security Engineer at Trava, discuss the benefits that ISO compliance brings not only to your organization, but also to your stakeholders and customers.

What you’ll learn in this episode:

1. ISO 27001 is an international standard for managing your security.
2. ISO certification gives you a competitive advantage over your competitors and builds customer confidence.
3. It’s crucial to budget enough time and bandwidth to work on ISO certification.
4. Don’t stress about doing things perfectly. Use a checklist to stay organized through the process and you should be good to go.
5. Starting with ISO certification can give you a head  start on other compliance frameworks you may want to pursue in the future.

In this episode, Anh Pham and Marie Joseph take us behind the scenes of Trava's own path to certification. For more "un-stoppable" advice on balancing the technical controls with organizational buy-in, read our full story: https://travasecurity.com/pod-iso

Things to listen for:

[02:00] What ISO 27001 is and how it fits into a broader cybersecurity strategy

[05:00] The benefits of achieving ISO 27001 certification

[08:00] What to expect during the certification process

[11:00] Anh and Marie’s advice for organizations considering ISO 27001 certification

Connect with the Guests:

Marie Joseph’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

“Compliance isn’t something that happens overnight.”

If the phrase ‘compliance frameworks’ makes you want to run for the hills, hang in there – we've got you covered. 

In this conversation, Marie Joseph, Senior Security Solutions Engineer at Trava, unpacks the different compliance frameworks and explains which certifications you need to meet your business goals. 

While compliance frameworks aren’t as scary as they may sound, they do take significant time and effort to put into practice. Marie shares what to expect as you start down this path and gives advice for prioritizing the frameworks that provide the most benefit to your organization. 

What you’ll learn in this episode:

1. Compliance frameworks are like grocery lists from regulatory agencies – you should follow a checklist and mark items off as you complete them.
2. There are several categories of compliance frameworks, including government and privacy.
3. You can lean on GRC tools for help as you implement compliance frameworks in your organization.

Marie Joseph demystifies the "grocery list" of compliance—from ISO 27001 to privacy standards like GDPR and CCPA. To see how these frameworks differ and which one your business actually needs to win more deals, check out our guide: https://travasecurity.com/pod-frameworks 

Things to listen for:

[02:00] What compliance frameworks are and why they’re important

[07:00] Common challenges companies face when implementing compliance frameworks

[11:00] How to get started with compliance frameworks

[12:00] Why compliance frameworks matter to your customers

Resources:

Season 1 SOC 2 episode with Marie: Explain SOC2 to Me Like I’m a Child

SOC 2 Compliance Checklist

Trava Blog: What is the NIST Framework?

Trava Blog: How to Ensure a Successful Start to Your Cybersecurity Program

Connect with the Guest:

Marie Joseph’s LinkedIn

Connect with the host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com 

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

“A cyber risk assessment is nothing more than a diagnosis.”

As a small or medium business, you may assume you’re not a primary target for cyber attacks. Cybersecurity expert and CEO & Co-Founder of Trava Security Jim Goldman reveals that small and medium businesses are actually more likely targets than large enterprise customers. 

Whether you’re a Fortune 500 company or a brand-new startup, it's time to take a proactive approach to your cyber security with cyber risk assessments. In this episode, you'll discover the essential frameworks and standards needed to prioritize vulnerabilities and maintain an acceptable level of risk exposure. Don't wait until it's too late–learn how to safeguard your business today.

What you’ll learn in this episode:

1. Cyber risk assessments like going to the doctor for a diagnosis or annual physical.
2. The type of cyber risk assessment you need is dependent on the type of framework you want a certificate in.
3. Prioritize the vulnerabilities exposed in a cyber risk assessment by potential impact.

To understand the different types of "tests" your business might need—from baseline assessments to vulnerability scans—check out our guide: https://travasecurity.com/pod-assessments

Things to listen for:

[02:00] Why it’s crucial for companies of all sizes to conduct cyber risk assessments

[10:45] What information a cyber risk assessment uncovers

[13:25] How frameworks and risk assessments work together

[14:30] How to prioritize the vulnerabilities uncovered in a cyber risk assessment

Connect with the Guest:

Jim Goldman’s LinkedIn

Connect with the Host:

Jara Rowe’s LinkedIn

Connect with Trava:

Website www.travasecurity.com

Blog www.travasecurity.com/blog

LinkedIn @travasecurity

YouTube @travasecurity

We’re back for the second season of your favorite cybersecurity podcast, The Tea on Cybersecurity. In season one, host Jara Rowe covered the basics of cybersecurity for SaaS companies, and season two will take a deeper dive into newer topics, such as cyber risk assessments, compliance frameworks, and security certifications. The podcast is a must-listen for decision-makers with cybersecurity tasks, who may not be experts themselves. Tune in and boost your cybersecurity knowledge!

Connect with the Host: Jara Rowe’s LinkedIn

Connect with Trava:

Website - www.travasecurity.com

LinkedIn -@TravaSecurity

Instagram -@TravaSecurity

Twitter -@TravaSecurity

Facebook -@TravaHQ

YouTube - @TravaSecurity 

Blog - www.travasecurity.com/blog

We did it! We made it to the end of season 1 of The Tea on Cybersecurity.

So we’ve spilled the tea on a lot of cybersecurity in Season 1, but now it’s time for some mega receipts. Podcast host, Jara Rowe, breaks down what past guests have shared with listeners that are essential to keep in mind - what cybersecurity truly means, why it’s important, how it should be implemented, and when you should take it seriously. Listen in as she shares the top key takeaways that all of us need to know in order to be as safe as possible with our technology.

What you’ll learn in this episode:

1. When you ignore a cyber problem because you don’t understand it, it can become a very costly mistake. Rob Beeler says it’s critical for us to continually educate ourselves in the cybersecurity space to avoid these mishaps.
2. What is the asset that we're really trying to protect with cybersecurity? It's not the cyber device, it's not the laptop, it's not the phone. It's the data that one can get to through those things.
3. Cybersecurity can make or break your company. Jake Miller says it should be about more than just your product. It should be about your organization as a whole because it affects everything. Develop a roadmap!
4. Cybersecurity is important for a business, but no matter how much you prepare, there are mistakes that can be made. So how can a business overcome this? Cyber insurance.

Things to listen for:

[01:27] How to avoid the costly mistake of cybersecurity mishaps

[02:28] An explanation, in detail, of what cybersecurity is

[04:45] Why cybersecurity is important

[05:46] Cybersecurity in the business realm and why it’s essential

[07:03] Cybersecurity can boost your B2B company’s competitive edge

[08:13] The importance of cyber insurance and what it entails of

[09:34] How to keep ourselves as secure as possible

[11:56] Who’s at fault when a cybersecurity attack happens

[12:52] Watering Hole cyber attacks

[15:59] The importance of passwords for cybersecurity

[17:46] Breaking down what SOC 2 is

[19:00] When the right time is to start your cybersecurity program

Connect with the Guests:

Rob Beeler - https://www.linkedin.com/in/rob-beeler-945ab33/

Jake Miller - https://www.linkedin.com/in/jakemillerindy/

Jim Goldman - https://www.linkedin.com/in/jigoldman/

Adam Patarino - https://www.linkedin.com/in/adampatarino/

Shea McNamera - https://www.linkedin.com/in/sheamcnamara/

Scott Schlimmer - https://www.linkedin.com/in/cybersecurityintelligencecia/

Marie Joseph - https://www.linkedin.com/in/marie-joseph-a81394143/

Connect with the Host: Jara Rowe’s LinkedIn - https://www.linkedin.com/in/jararowe/

Connect with Trava:

Website - https://www.travasecurity.com/

LinkedIn - https://www.linkedin.com/company/travasecurity/

Instagram - https://www.instagram.com/travasecurity/

Twitter - https://twitter.com/travasecurity

Facebook - https://www.facebook.com/travaHQ

YouTube - https://www.youtube.com/@travasecurity

Blog - https://www.travasecurity.com/blog

“It’s so important to build your security programs early on because there's an expectation in the market, especially for enterprise grade SaaS companies, that you have at least started to take those programs seriously.”

Jake Miller, the Chief Executive Officer of the Engineered Innovation Group, has a long background in software and product development and focuses on helping companies to design and build new digital products. As security programs are needed now, more than ever, Jake explains why it’s important for Saas companies to build security into the company, not just the product, from day one. Listen in as he shares his roadmap to security.

What you’ll learn in this episode:

1. The reason why it’s crucial for SaaS companies to not only implement cyber security programs for their products, but ALSO for your company - starting from day one!
2. Jake Miller’s roadmap for implementing security into you company, seamlessly
3. How to develop an appropriate budget for implementing security programs within your company

Jake Miller highlights that for SaaS companies, security must be built into the company, not just the product. To see the specific roadmap and budgeting guidelines Jake discusses in this episode, read our companion guide: https://travasecurity.com/pod-implementing-cybersecurity 

Things to listen for:

[01:25] Why cyber security is a foreign topic for people

[03:27] Jake explains what MVP stands for and what it encompasses

[05:16] Why SaaS companies need to build security into the company, not just the product

[10:41] How much money a company should budget for a cyber security program

[12:43] Where to start when implementing a security program

[15:14] The number one thing that needs to be in a security roadmap

[18:24] The right timing and approach to investing in cyber security

[19:45] Jakes advice for a person starting a SaaS company

[22:09] Closing thoughts from Jake

Connect with the Guest: 

Linkedin - https://www.linkedin.com/in/jakemillerindy/

Engineered Innovation Group Website - https://www.engineeredinnovationgroup.com/

Connect with the Host: Jara Rowe’s LinkedIn - https://www.linkedin.com/in/jararowe/

Connect with Trava: 

Website - https://www.travasecurity.com/ 

LinkedIn - https://www.linkedin.com/company/travasecurity/ 

Instagram - https://www.instagram.com/travasecurity/ 

Twitter - https://twitter.com/travasecurity 

Facebook - https://www.facebook.com/travaHQ 

YouTube - https://www.youtube.com/@travasecurity

Blog - https://www.travasecurity.com/blog

“Because people don’t fully understand technology, hackers and criminals find this as an opportunity to attack and get an edge. This is why cybersecurity is so important.”

Shea McNamara, the Co-Founder and Head of Sales at Limit, focuses on melding technology and risk management for people and businesses around the world so they can achieve their aspirations. Due to the increasing amounts of cyber attacks happening in businesses, Shea shares why it’s important to invest in Cyber Insurance to counteract these pitfalls. Listen in as Shea explains what Cyber Insurance is and why every business should take time to obtain it to stay safe and secure.

What You’ll Learn in this episode:

1. The reason why we are seeing an increase in Cyberattacks, how to fix that, and what can happen when you don’t have Cyber Insurance
2. Why smaller companies are hot spots for cyber attacks and how cyber insurance can keep your brand reputable
3. Why you should enable MFA in any program that you’re using

Things to listen for:

• [00:01 - 00:54] Introduction
• [02:10 - 03:42] What is a brokerage system
• [07:35 - 12:59] The in’s and out’s of Cyber Insurance
• [13:34 - 14:42] The difference between Cyber Insurance and Cyber Liability Insurance
• [15:01 - 18:08] Who is Cyber Insurance for and why is it important?
• [18:31 - 21:10] How Cyber Insurance has evolved over the years
• [21:20 - 24:33] Shea’s predictions for the future
• [25:08 - 27:25] Why Trava and Limit’s partnership is beneficial for customers on both sides
• [27:43 - 28:17] Closing thoughts from Shea
• [28:38 - 31:19] Jara's receipts

Connect with the Guest:

Linkedin - https://www.linkedin.com/in/sheamcnamara/

Limit’s Website - http://www.limit.com

Connect with the Host:

Jara Rowe’s LinkedIn - https://www.linkedin.com/in/jararowe/

Connect with Trava:

Website - https://www.travasecurity.com/

LinkedIn - https://www.linkedin.com/company/travasecurity/

Instagram - https://www.instagram.com/travasecurity/

Twitter - https://twitter.com/travasecurity

Facebook - https://www.facebook.com/travaHQ

YouTube - https://www.youtube.com/@travasecurity

Blog - https://www.travasecurity.com/blog

“Two-thirds of small, medium-sized businesses are the ones that are most attacked. Hackers specifically look for these!”

Marie Joseph, the Security Solutions Engineer at Trava, specializes in helping companies start their security program, and/or help mature it. With the rise in attacks of cyber security in businesses, Marie talks all about when the appropriate time to start a security program to avoid any pitfalls, how to keep up with security and technological changes, and what it looks like for a company being ‘forced’ to start a cyber security program. listen in as Marie dives into all of these aspects while providing tips to keep your technology and business safe.

What You’ll Learn in this episode:

1. Suggested timeframe to start cyber security to avoid any attacks on your business

2. The five components to a strong cyber security program that every business needs to look at

3. Whether you should start a cyber security program out of force from a regulatory agency, or out of wanting to for your own sake

Things to listen for:

• [00:01 - 01:01] Introduction
• [02:42 - 03:32] The various stages where businesses start their security programs
• [03:48 - 04:54] Ways cyber-risk has been changing
• [05:18 - 05:50] What it looks like to be ‘forced’ into a security program
• [06:35 - 07:56] Key components to a strong cybersecurity program
• [08:19 - 09:32] Regulatory agencies and compliance certificates
• [09:45 - 09:53] One thing a cybersecurity plan MUST have
• [11:55 - 12:35] Cybersecurity predictions over the next 5 years
• [13:47 - 15:51] Closing thoughts

Connect with the Guest:

Linkedin - https://www.linkedin.com/in/marie-joseph-a81394143/

Connect with the Host:

Jara Rowe’s LinkedIn - https://www.linkedin.com/in/jararowe/

Connect with Trava:

Website - https://www.travasecurity.com/

LinkedIn - https://www.linkedin.com/company/travasecurity/

Instagram - https://www.instagram.com/travasecurity/

Twitter - https://twitter.com/travasecurity

Facebook - https://www.facebook.com/travaHQ

YouTube - https://www.youtube.com/@travasecurity

Blog - https://www.travasecurity.com/blog

"Make sure you stay up to date on the latest trends and technologies - it's the key to success!"

As a Cyber Risk Specialist at Trava, Scott Schlimmer is in charge of evaluating a company’s security posture and creating a plan on how to best strengthen security and reduce risk. But the question he is answering today is WHO’S TO BLAME?? Cybersecurity risk can be a scary subject for any company, and on today’s episode, Scott talks with host, Jara Rowe about the process companies take when there is a security breach and the intricacies based on what security framework they have in place. Listen in for this as well as his thoughts on AI, multi-factor authentication, and some key terms to know. Head over to YouTube for our extended version of the interview.

What You’ll Learn in this episode:

1. How are privacy laws changing?
2. The latest advances in AI technology
3. Who is to blame for a security breach?

Things to listen for:

• [00:01 - 01:03] Introduction
• [01:52 - 02:12] Why people find cybersecurity confusing and intimidating
• [03:25 - 04:20] Common cyber risks that come with cloud platforms
• [04:31 - 05:35] Importance of multi-factor authentication
• [05:57 - 07:17] Taking responsibility for a security breach - who’s to blame
• [08:12 - 08:54] Ways companies can check the security of a third party
• [11:55 - 12:41] Scott’s cybersecurity prediction for 2023
• [13:48 - 14:24] Final thoughts from Scott
• [14:38 - 15:57] Jara’s receipts

Connect with the Guest:

Linkedin - https://www.linkedin.com/in/cybersecurityintelligencecia/

Connect with the Host:

Jara Rowe’s LinkedIn - https://www.linkedin.com/in/jararowe/

Connect with Trava:

Website - https://www.travasecurity.com/

LinkedIn - https://www.linkedin.com/company/travasecurity/

Instagram - https://www.instagram.com/travasecurity/

Twitter - https://twitter.com/travasecurity

Facebook - https://www.facebook.com/travaHQ

YouTube - https://www.youtube.com/@travasecurity

Blog - https://www.travasecurity.com/blog