Discussion with AlgoSec around ransomware based off of the Extrahop Cyber Confidence Index 2022.  I cover numerous questions about what organizations are doing today and what they should change to improve cyber defenses.  The crux of this study shows the cognitive dissonance of cyber security leaders and IT decision makers.  They believe one thing whereas the evidence completely contradicts what they say.

In this episode I discuss cyber-attacks in the Summer of 2022.  I’ll review who was attacked, its impact, and the aftermath.  While I would love to go into the technical details about the attacks, that data becomes harder and harder to find with each breach and news release.  Victims are tight lipped and apparently being told more and more to not share technical details.    We know that both China and Russia have increased cyber-attacks due to global tension in Taiwan (Chinese Taipei) and...

This episode covers online tools and lab environments that cyber security students and early professionals can use to learn and increase technical skills.  While these environments are usually meant for those that want to get very deep with the technical side of cyber security, non-technical folks can certainly use these as well.  The tools/trainings go as deep as the user wants.  I also go over building a lab at home using Virtual Box or VMWare.  I also provide insight and recommendations...

In this episode I spend 30-minutes talking with Adrianus Warmenhoven, Defensive Strategist at Nordvpn.   We dove into virtual private networks (VPN) and networking.  Hear how VPN's work, when to use them and why.  We discuss real-world examples and talk security stories as well as some cyber security history. Send comments, questions, and episode ideas to: [email protected]  NordVPN RFC1918 Tim Berners-Lee OSINT Tools – Open-Source Intelligence Tooling For those interested in...

Here I talk about different avenues within cyber security.  We use terms such as red team, blue team, and purple team when discussing offense, defense, and a merger of the two.  I’ll go over different technologies, teams that cover each of these areas and jobs that involve each team.  We have these teams and terms due to the size and complexity of the overall cyber security profession.   This episode provides a lot of insight on technologies and jobs to help listeners better focus on their...

This episodes has me  talking about how employees can get enhanced benefits from their employer.  Most people figure salary is the only thing that matters from when it comes to the benefits of working.  This is a major mistake.  Healthcare alone can potentially bring thousands of dollars per year in additional compensation and companies vary greatly in this area.  401(k) programs have the potential of financially beating healthcare benefits depending on your salary, contribution, and company...

Conversation with Perry Carpenter, C | CISO, MSIA, who currently serves as chief evangelist and strategy officer for KnowBe4, the world’s most popular security awareness and simulated phishing platform.   Perry and I talked about the history of KnowBe4, his journey in cyber security, what students and early professionals can study to succeed in social engineering among other topics.  Perry talks about his background and how he took his Arts and Science education to become an extremely...

Podcast sponsored by AlgoSec where I discuss how applications impact network and security engineers.  This was a 1:1 conversation between me as an SME with a marketing leader  at AlgoSec.  You can find the full video interview here.  This topic provides detail on challenges experienced by network and security engineers related to applications and application security.  We talk about a business focus and the need for network and security engineers to know and focus on more than packets and...

In this episode, I discuss the detail and complexity inherent with software solutions including specific jobs that relate to cyber security applications.  Many of us tend to think that software is only skin deep.  In reality, applications go from involved to intricate to MASSIVELY COMPLEX.  Too often I’ve engaged with projects where I figure, oh, it’s a software program, no big deal.  Then I get surprised by the depth, detail, and breadth of the product. Listen in and hear about all of the...

In this episode I step away from my normal monologue style to interview a renowned guest, W. Curtis Preston.  Curtis, the Chief Technical Evangalist at Druva, is also known as Mr. Backup.  Curtis runs his own website, Backup Central dot com with his own Podcast called Restore It All.  He also participates in the No Hardware Required Podcast for Druva. Curtis and I discuss the relationship between backups and cyber security.  He also shares his professional journey and offers advice to...

This episode goes into great detail about a timeshare scam that directly targeted me.  I tell the story along with detailed steps the con artists took to try and make me their victim.  I provide steps taken to PROVE they were liars and thieves.  I conclude with 12 critical steps everyone should implement that will protect them from online scams.  We are all at risk to con artists through phone, text, and email.  Knowledge is power and this episode  empowers my listeners with critical data...

In this episode I discuss how to start a new cyber security job.  I talk about emotions associated with starting over, fear, stress, anxiety, excitement,  and joy, among others.  I touch on topics around people, processes and technology at the company.  This episode discusses change and how to deal with it.  Starting a new job happens to nearly every employee and it is important to know you are not alone and that the challenges with starting over are universal.  Herein I discuss what to focus...

Brief introduction to Season 4 - July 2022-Sept 2022 and then the full session I presented at for the MSS Forum in Phoenix on May 12, 2022.  The topic covers today's cyber security networking challenges.  I offer recommendations for solutions and provide advice on where security professionals can focus.  If you want a copy of the deck I used, send an email to [email protected]. Please donate to my Cyber Security mentee, Josh Gbemisola The Cuckoo's Egg The Phoenix Project IBM Cost of a...

Many people are threatened with losing their jobs or violating their conscience.  This episode talks about how you are not alone.  I talk about standing up for what you believe in.  Swim upstream if that's for you.  Do not "go along to get along" if that does not comport with your values.  Stand up.  Be strong.  Leave your employer if they force you to violate your beliefs.  Do not feel the need to justify yourself.  An employer is an employer, nothing more.  There are firms out there that...

Fireside chat with Garrettson Blight, Principal at Booz Allen Hamilton led  by Kate Rodgers, Director of Brand at Infosec virtually on October 19, 2021.  We discussed learning and development opportunities in our organizations and how important it is for employees.  Salary is only a single benefit to employment.  Learning and development along with healthcare comes in second for many professionals.  We discuss how employees can take advantage of training in the workplace.  "We need to appeal...

In this episode I talk about high profile cyber-attacks in the Spring and Summer of 2021.  I’ll review who was attacked, what the attack involved, it’s impact, the aftermath, and how it affected the economy.  Sign up for NewsBits from SANS at https://www.sans.org/newsletters/newsbites/ Review Security Intelligence periodically: https://securityintelligence.com/ Security Magazine offers solid content:  https://www.securitymagazine.com/ Executive Order 14208:...

In this episode I talk about incident response plans, what they are, why they are important and how to create one.  NIST, the National Institute of Standards and Technology has a fabulous document entitled Computer Security Incident Handling Guide, Special Publication 800-61 Rev. 2.  This document prescribes key data for incident response plans.  In this episode I’ll review key components of this document and how and why these components play a key role in cyber security incident response...

In this episode I talk about real situations I’ve experienced.  I won’t name companies, only industry and relative geography so as not to expose any entities.  Some of these are more egregious than others, all are good learning experiences, for early as well as experienced professionals.  Many look to join Cyber Security and wonder what it’s really like out there, these tales should provide some insight to that curiosity.   I encourage each of you to think of solutions to these problems. ...

While this podcast focuses on cyber security professionals, this episode provides general and wide-ranging interviewing and presentation tips.  The discussion goes into detail about how and why we communicate and then provides examples and performance tips.  Later there are examples, and recommendations for how to interview, present, and speak publicly overall.  I give suggested questions to ask interviewers and provide information on delivering more engaging and successful presentations.  I...

Audio recording of session at MSS Forum LA on June 30th, 2021.  Group discussion lead by Phelim Rowe of CTG Intelligence.  We review the top "post holder" and go into depth around who has responsibility for cyber security in an organization.   I was pleased to join Richard Staynings, Shawn Kohrman, Ashwin Krishnan, and Louis Arul-Doss on this round table discussion. You can watch the Zoom recording on YouTube at https://www.youtube.com/watch?v=uvvqbOMiTmE Look out for an MSS Forum in your...

In this special episode I'm sharing a real-world conversation I had with an early professional at my company.  This individual worked for a couple of years in the healthcare field as an administrator and then moved to an extremely large company.  He reached out wanting to know what to study and how and where to steer his career.  Listen to this real life conversation and understand a direction and path to take in the cyber security field.  I'm posting this special episode to help all of my...

Discussion on cyber security certifications.  Which make sense.  Where to focus.  How to proceed.  I cover certifications from GIAC, ISC2, ISACA, EC-Council, Amazon, Microsoft, Google, CompTIA, and others.   This episode discusses areas to find training and recommendations before taking certification exams.  These are recommendations only and based on my opinion and experiences.  Please do research before investing in any certification or training course. ISC2: https://www.isc2.org/ ISACA:...

Book reviews of four cyber security books published between 2019-2020. Dark Mirror: Edward Snowden and the American Surveillance State by Barton Gellman 2020, The Hacker and The State by Ben Buchanan, 2020, Sandworm by Andy Greenberg, 2019 and The Coming Cyber War by Marc Crudgington, 2020.  These books provide great insight to where we are in the cyber security profession.  They discuss history, technology, and attacks.  Cyber security professionals need to understand the threat landscape. ...

Financial guidance based on my 30 years’ experience, economic degree, financial education, and wonderful direction from my father, a 40+ year professional financial advisor.  I veer away from my standard cyber security talks in this episode to help students and early professionals learn, grow, and advance their financial well being.  I see a critical need for, and interest in, financial advice and take time herein to help my listeners. Note these are my opinions and recommendations only.  I...