The virtual CISO is not a new discipline, but it is evolving. Like other security specialties, there are different approaches and skills offered. This is the first of several upcoming discussions on the virtual CISO space.  [email protected]

After a hiatus, The Virtual CISO Moment returns with useful information from security experts who understand small and midsized business (SMB) security needs. No frills, no glamour, no transparent whiteboard text, no complex graphics, and no script - just a few minutes every Tuesday discussing SMB information security risk issues.

Metrics - security leaders talk about them often. But what is the one critical question they, and you, should ask about information security metrics?

The episode compares COVID-19 and information security risks...through a Chihuahua.

Many small business owners are frightened now, unsure of how their business will survive. Many in the United States have applied for the PPP. But the combination of economic calamity, fear of infection, stress from lives upended , all create an environment for criminals to exploit. It's okay to be afraid, but don't let it lead you to becoming a victim.

The COVID-19 pandemic has disrupted business operations on an unprecedented scale. It also presents an opportunity to learn and grow business operations. This will end, and the time to prepare for the "new normal" is now.

The "hacker in a hoodie" image has been used for years by the media to call attention to articles about cyber security incidents. It's time that graphic is retired. Here's why.

FUD - Fear, Uncertainty, and Doubt - is sometimes used to sell products or services. One popular FUD element is statistics, whether spinning valid numbers or making them up. Regardless of the type of FUD, bowing to the instinctual urges to respond can obfuscate genuine information security risks.

Information security theater, improvements that look and sound good but make no real impact to overall security stance of an organization, can do more harm than good. Are you understanding the information security risks of your organization before designing and implementing controls?

Information Security and Information Technology Security are not the same. If your program is focused on Information Technology Security only, you've got gaps.