Who do you trust with your network?   Would you give a random person access to the infrastructure that runs your business?    Anyone with a computer and an Internet connection can set themselves up as a penetration testing or cyber incident response service provider.    But what methods does your organization have in place for vetting an individual or company that you are potentially allowing unfettered access to your entire network?   Ian Glover, President of CREST, is on the podcast to talk about how CREST provides internationally recognised accreditations for organisations, and professional level certifications for individuals providing penetration testing, incident response, threat intelligence and Security Operations Centre (SOC) services.    What we talked about:   - CREST and a CISO’s decision making process   - The rigorous process of CREST accreditation and certification   - Why having a certifying body evens the playing field   Check out these resources we mentioned during the podcast:

• CREST
• Sir Ranulph Fiennes
• Bloodhound SSC 1k

This post is based on The Virtual CISO podcast hosted by John Verry and featuring special guest, Ian Glover   To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

We all have things we consider “the best”.   Things we look to.   Rely on.   What happens when one of those old reliable, gold standard things that have been our go-to for so long winds up being #2, instead of #1?   Andrew van der Stock, Senior Application Security Leader at OWASP Foundation stops by the podcast to dispel some industry myths about The OWASP Top 10.   What we talked about:   - Is The OWASP Top 10 really the gold standard?   - Next level considerations to take on as you progress on your journey   - Risk assessment and threat modeling is just a game   Check out these resources we mentioned during the podcast:

• Cornucopia-the game
• The OWASP Foundation   

The word forensics usually makes us think of homicide, but it applies to computers, too.   Computer forensics simply just means telling the story of what happened on a computer.   In this episode, we hear from Brian Dykstra, President and CEO of Atlantic Data Forensics, about who needs computer forensics, when, and why.   What we talked about:   - The need for computer forensics is widespread and underrecognized   - It gives you protection against future litigation, especially in IP and employment cases   - 50% of CISOs graduated at the bottom half of their class… and what that means   - 3 free, easy ways to reduce your attack surface
To hear this episode, and many more like it, you can subscribe to Virtual CISO here. If you don’t use Apple Podcasts, you can find all our episodes here.

As the first data privacy certification available, ISO 27701 can greatly reduce the complexity of managing privacy, risk and proving compliance with regulations like CCPA, GDPR.   Those organizations that already have a 27001 certification or are considering that certification can add on 27701 to change an Information Security Management System (ISMS) into an Information Security & Privacy Management System (ISPMS)   Debbie Zaller, Principal and co-owner at Schellman & Company, shares her in-depth knowledge of ISO 27701 on this episode of The Virtual CISO Podcast.   What we talked about:

• Unpacking the this new certifiable extension
• Why “ISO 27701 Certified” and “GDPR fully compliant” are not the same (but VERY clos)
• Why 27701 is the answer to reputable privacy compliance

  Resources we mentioned: 

• https://www.aicpa.org/
• https://gdpr-info.eu/
• https://oag.ca.gov/privacy/ccpa

  To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Getting a flat tire is a disaster. Knowing where you keep the spare is disaster recovery. Changing a tire in under 7 minutes to get right back on the road is business continuity. In this episode, I interview Cosmo Gazzani, Director of Business Development at Continuity Centers and wekos, about information continuity and the importance of backing up your data.   What we talked about:

• The nuance between disaster recovery and business continuity
• How SMBs can know whether they should have an information continuity plan
• 3 buckets for planning for business continuity
• How & why to backup your data, even if you’re a one-man show

  This post is based on a Virtual CISO podcast with Cosmo Gazzani. To hear this episode, and many more like it, you can subscribe to Virtual CISO here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Your application is probably vulnerable.  “But how?! We hired a company to pen test our application. They did a thorough test against the OWASP top 10!”  On this episode of the Virtual CISO podcast, we talk with Daniel Cuthbert. He's one of the premier authors of the OWASP ASVS, and he says OWASP Top 10 is not enough.   We chat about:

• Why the ASVS is so important
• Why we shouldn’t be putting all our faith in the OWASP top 10 (only)
• How to incorporate threat modelling into your assessments and your ASVS test

  To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Is your organization ready for CMMC?

As CMMCs roll out over the next 6 years, it’s going to become a reality for more and more DoD subcontractors.  As many as 50,000 organizations by 2025. Thankfully there are folks out there who are experts at this.  On this episode of The Virtual CISO podcast, we heard from Stuart Itkin. Stuart is the Vice President of Marketing & Product Management at Exostar, and he and his team are leading the charge when it comes to CMMC readiness.    We talk all about: 

• The need for robust CMMC readiness
• Why your organization may need to adhere to several different certifications depending on the specific project or RFP
• How Exostar can help get your organization CMMC ready

  To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

As an SMB, you’re probably thinking you’re too insignificant for a targeted cyberattack. That’s not even a little bit true. In this episode, I interview Danielle Russell, Director of Product Marketing Management at AT&T Cybersecurity, about SIEM solutions for SMBs.   What we talked about:

• Why an organization needs a SIEM
• Small orgs are definitely a target
• How to get started with a SIEM
• The #1 characteristic of a good SIEM for SMBs

To hear this episode in its entirety and others like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

You’re a CISO at an SMB, and you see that the AUP is called the SCA now.   So now what?   Actually, there are 3 applications for this great tool alluded to by the relabeling.   In this episode, I interview Tom Garrubba, VP and CISO at The Shared Assessments Program, about applications for the SCA.   What we talked about:

• SCA application
• Resilience Guidance and the SCA
• 3 ways for SMBs to use the SCA
• How the SCA compares to SOC 2 and ISO 27001

  To hear this episode in its entirety and others like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

If you thought this podcast was supposed to be about information security, you might be confused about why we’re featuring heart disease. Bottom line: Dead CISOs don’t get bonuses. On this episode, I interview Dr. Joel Kahn, triple-board certified cardiologist, author of 6 books, and restaurant owner — also my physician — about techniques for managing stress and preventing heart disease.   What we talked about:

• The truth about stress
• 3 techniques and tools to invest in your health
• How to uncover silent health risks
• What Dr. Kahn is excited about for the future of preventative medicine

  Check out these resources we mentioned during the podcast:

• #kahnchronicle
• Dr. Kahn’s website, which is full of free resources and articles

 

• Dead Execs Don’t Get Bonuses

 

• Forbes article on Cybersecurity Mental Health

  To hear this episode, and many more like it, you can subscribe to Virtual CISO here.
If you don’t use Apple Podcasts, you can find all our episodes here.