Caffeinated Risk

Richard LaTulip joins Caffeinated Risk for a candid conversation connecting cybercrime investigations, threat intelligence, and practical business risk. Richard is a Field CISO with Recorded Future , a former United States Secret Service special agent, and both the author and real-life main character behind the true crime story Operation Carder Kaos . The discussion starts with Richard’s experienc...

Visiting the Jacobs Engineering website you'll undoubtedly encounter the phrase "challenging today",  an acknowledgement that the world is much more complex than ever before.  While "it ain't like it used to be" can be said of any risk manager's portfolio,  Joe Olivarez became the first global security leader in Jacobs history more than a dozen years ago. How muc...

Joshua Copeland's cyber security moniker is "The Unpopular Opinion Guy",  while most of us in security roles have been that person with an unpopular opinion at least a time or two, Copeland turned it into both a book and a bit of a movement through numerous posts on Linkedin about many of the challenges in our industry. That said, this is not a mud slinging episode,  Joshua had nume...

"Legal and Regulatory" is a common receptor category  in most enterprise risk matrices but with any luck most organizations have limited direct experience with cyber litigation matters.  This episode jumps right into the deep end with one of Canada's preeminent cyber lawyers,  Brent Arnold .  Business law has evolved over hundreds of years, cybersecurity precedents began to appear o...

Cyber crime is now a daily fact of life and a significant concern in both the private and public sectors but our response capabilities do not seem to be keeping up.  This episode dives deep into one organization that is combatting this problem with a combination of academic research, industry expertise and hands-on training with the founder and CEO, Herbert Fensury .  While cyber security is a glo...

20 years after their paths first crossed, three Canadian security professionals regroup to discuss a new risk management strategy book based on hard won field experience.  Patrick Hayes was a security strategist before organizations knew this was success differentiator. For decades he has been guiding organizations large and small, public, private and government on balancing business objectives wi...

Part 2 of this summer break episode takes a bit of a light hearted look at the cyber security industry predictions that become the norm in late December and early January.  Eight or nine months later, how accurate where they? Take a listen, there are a couple surprises. The conversation uncovers a few ongoing challenges with the cyber security industry, from the digital divide associated with agin...

The summer show started with the light hearted goal of evaluating the top security predictions that fill the internet in late December each year.  Forever unscripted, Tim and Doug wind up reflecting on the growing gap between physical and virtual information systems.  While it is easy to lament, from a cognitive perspective there is little hope, the BSides movement, alive and well in Western Canad...

Enterprise Security Risk Management (ESRM) principles appear in almost every episode and this one is a bit more overt because it features two of the three people responsible for promoting ESRM in the early days of it's reintroduction through ASIS.  John Petruzzi is now the CEO of Unlimited Technology and leading them toward an expanded influence in the enterprise security industry , sharing i...

The Caffeinated Risk hosts navigate time zones and catch up with Dominic Bowen traveling between meetings to discuss risk management with an international expert on the subject. Mr. Bowen is a partner and Head of Strategic Advisory at 2Secure , one of Europe's leading risk management consulting firms, as well as the host of the International Risk Podcast .  Political tensions are higher than...

A while back we were fortunate enough to spend time with Jack Freund, coauthor and thought leader responsible for bring the FAIR methodology and practice into the main stream. A bonus from that original recording is now an espresso shot discussing how to fast track an assessment when the threat vectors are numerous.  While the metaphor Jack used is somewhat unexpected it's both memorable and...

At 45-50%, depending on your statistical source, there is no denying that small to medium sized businesses are a significant economic engine from both an employment and innovation perspective.  In 1978 Microsoft numbered 11 people. Unfortunately small businesses are also the least likely to survive a major disruption, an experience that changed Rochelle Clarke's corporate leadership trajector...

A surprising number of digital innovations began in Alberta, be it the world's first public digital cellular network in 1985, the DNP3 industrial controls protocol and  becoming the first Google international research lab in 2017.   CyberAlberta is another innovative collaboration focused on strengthening the cyber resilience of Alberta organizations.  At almost 330 billion annually, protecti...

Ever wondered how top universities protect their cutting-edge research from prying eyes while ensuring seamless access for their scholars? Join us as Michael Spaling, Principal Security Architect at the University of Alberta , takes us behind the scenes of this high-stakes balancing act. Just like any other large organization, research universities have many different stakeholder, operational and...

The practice of engineering dates back thousands of years, incorporating science and mathematics to solve problems in the ancient world, and remains a key requirement for developing the complex digital systems controlling the physical systems core to our modern way of life. Unfortunately connectivity and complexity have created a vulnerability we must now engineer our way out of, and just like ris...

Technological change is inevitable and often one of the aspects that attracts people toward careers in information and operational technology. Although risk management is a part of navigating advancement in any area, the fundamental flaw in any management system is our human tendencies. This episode explores how organizations can make slow, steady migration from first principles to risky undertaki...

Whether it's the NIST CSF, 8276 or the new European Cyber Resilience Act there is no denying the expectation that supply chain management (SCM) is a risk management area no organization can ignore.  While SolarWinds is recent common reference in many SCM discussions, this episode's guest takes us back to Target's major data breach that resulted in significant changes to the PCI-DSS...

Long before the Matrix captured peoples imaginations, Winn Schwartau was steadily offering red pills for those reading his many books on information warfare.  A scholastic level researcher without the pretense, Mr. Schwartau has been recognized internationally as one of the leading security thinkers of our time and has a special capability for distilling complex security concepts into every day la...

Almost all incident response plans include a "lessons learned" step, and in the post adrenalin phase that follows many breaches,  reviewing what worked and what needs improving doesn't excite a lot of people. Adam McMath is clearly the exception,  leading incident response activities in both the cyber realm and physical. How do resilience and incident response  lessons learned while...

Amongst the industry verticals classified as critical infrastructure, few would argue that telecommunications belongs in the top that list, placing even more weight on a risk management program due to cascading impacts. Consequently, safe reliable operations are essential for success while continuing to grow in a highly competitive marketplace.  A security risk management challenge across many dim...

Regulatory frameworks from PCI-DSS to NERC-CIP  to  the newly minted NIST CSF 2.0 each require organizations of all sizes to have cyber incident response plans.  Most of us who have spent any time in cubicle filled office towers are familiar with fire drills to clear the building and gather staff at muster points, and that is as close as we get to the real thing.  Unfortunately that same lucky str...

Those running a business today who have not experienced disruption due to cyber issues or attacks know it is only a matter of time. Even if their organization is not directly targeted, the  modern marketplace comprised of multiple, interconnected  supply chains, means impact is unavoidable but this episode's guest, Steven J Ross contends planning, design and clear priorities can provide mitig...

The U.S. Security Exchange Commission defined new rules for cyber risk matters facing publicly traded corporations in July of 2023.  Although the SEC's mandate is limited to publicly traded companies in the United States, where one regulator goes others are apt to follow.  Brian Allen is the co-author of a brand new book putting form, structure and traceability around the SEC mandated require...

The ISA 99 standards body is one of the most recognized authorities on cyber physical security covering many aspects of a cyber security management system for industrial control systems including risk management.  This episode features John Cusimano, former chairman of the ISA subcommittee  responsible for authoring the risk management portion of the standard 62443-3-2:2020  Mr. Cusimano takes us...

Security and crime are often in close proximity but not always studied together. This month's episode features Martin Gill a criminologist who made the study of crime and security his life's work.  After a decade as a lecturing professor at the University of Leichester,  Mr. Gill started Perpetuity Research i n 2002 and continues to provide very high quality research, both qualitiative a...