The Virtual CISO Moment

David Leech is a vCISO using his global, operational, program management, and security experience together with leadership skills to drive digital transformation, product innovation, and risk reduction for business growth, involving work across Risk Management, Technical Architecture, Control Frame Works, HIPAA, FFIEC, PCI, HITRUST, FedRamp, and SOC compliance. He has supported clients in multiple...

Uber trial a lost opportunity to promote cyber governance, hacked IP scanning tool, leak of Alder Lake BIOS, LilithBot Malware as a Service, and healthcare provider IT incident likely malware - plus thoughts on the importance of business continuity table top exercises. https://www.forbes.com/sites/jodywestby/2022/10/08/uber-trial-a-lost-opportunity-for-cyber-governance/amp/ https://www.scmagazine....

Threat actors may influence US midterm elections, DIB org attached with APT, an interesting approach to password expiration policies, an updated primer and review on cyber insurance, and Uber's CISO convicted on two counts related to breach actions - plus more thoughts on ethics. https://www.ic3.gov/Media/PDF/Y2022/PSA221006.pdf https://www.bleepingcomputer.com/news/security/hackers-stole-data-fro...

From June 21, 2022 - Nick Santora, CEO of Curricula ( curricula.com ), discusses information security awareness and how Curricula uses storytelling to make both short term and long term impressions, resulting in increased security across the organization. He also discusses his path to entrepreneur, challenges in the SMB infosec awareness space, and "wisdom walks"!

Joe Jakubielski is a Cyber Defense Analyst with the Carolina Cyber Center. He discusses his recent pivot to a new career in cyber, including challenges and opportunities ahead. Recorded at RETR3AT Cyber Conference Montreat College September 23, 2022.

Gary Chan of Alfizo LLC helps businesses stay secure from hackers and insider threats, meet legal and regulatory compliance, and enable sales by meeting their customers' expectations for security. He is also a "security mentalist", and if you're like me and have never heard of this term, you need to check out this episode - it's fascinating! Gary's websites: • Creating memorable experiences for co...

ICO fines privacy-invading firms, disgruntled former admin does damage with unrevoked access, healthcare fraud results in fines and jail time, Comm100 supply chain attach, banks fined $1.8B for using unauthorized apps to communicate, and a few thoughts on shadow IT. https://www.infosecurity-magazine.com/news/ico-fines-four-predatory/ https://www.bleepingcomputer.com/news/security/fired-admin-cripp...

Microsoft Exchange zero days, Optus update, Brute Ratel cracked, 60% of cyber pros report "losing ground", more on the risk of deepfakes, and cyber insurance providers pivoting to requiring adherence to frameworks and risk management. https://thehackernews.com/2022/09/microsoft-confirms-2-new-exchange-zero.html https://www.bbc.com/news/world-australia-63056838 https://www.bleepingcomputer.com/news...

From June 14, 2022: Matt Santill, Founder and CEO of Cyber Security Services https://www.cybersecurityservices.com/ discusses the challenges of a vCISO, what is the most significant business risk, how he became interested in information security, and his career progression to CISO and on to business owner.

In this month's special end of month Wednesday episode Mark Burnette, Shareholder-In-Charge at LBMC Information Security, discusses his path from Senior IT Auditor to overseeing and directing LBMC’s Risk Services practice nationwide. He is very active in the information security community, including as co-founder and past president of the Middle Tennessee ISSA chapter (one of the largest in the wo...

Cy Sturdivant, Director at Forvis (Cybersecurity Division), joins us to discuss his path from accounting and finance to cybersecurity and the audit field. We dive into controls, the Three Line of Defense model, and how audit as the third line helps organizations achieve and maintain a solid information security posture.

Anonymous injects into the Iranian protests, ChromeLoader injecting ransomware, Optus extortion, 543,000 added to ECL breach, IHG disruption for "fun", and thoughts about the need for ethics in cybersecurity. https://cybernews.com/cyber-war/anonymous-takes-iran-in-support-of-women/ https://www.theregister.com/2022/09/21/vmware_microsoft_chromeloader_threat/ https://www.bankinfosecurity.com/optus-u...

A little different today - we are recording live from the RETR3AT conference at Montreat College! Look for discussions to drop Wednesdays.

From June 7, 2022: James Farley, Partner Development Manager, Cybersecurity at ConnectWise (connectwise.com), discusses migrating from insurance to IT sales to supporting Managed Service Providers, as well as running to beat the stress, including reaching a goal many never achieve!

Recorded at the Middle Tennessee Cyber Conference September 13, 2022 - host Greg Schaffer walks through his 33 year career in information technology and security, providing lessons learned and what he has determined is, for him, the secret for success in cyber security. We had technical issues with the primary video and audio recording so this recording is not quite up to our standards, but we sti...

Adam Bricker has led many career lives, from working on Tomahawk missiles to cofounding the Carolina Cyber Center, focused on hardening community resources and continuing education to address the nation's critical cybersecurity talent shortfall. He currently provides consulting services for businesses in high tech, IT-enabled and emerging markets as the founder of ePower Learning, and his testimon...

Criminals had internal access to LastPass for four days, Microsoft gaming click fraud, cyberattack costs increase, SaaS sprawl risks, and the necessity of collaboration in security and privacy. https://www.bleepingcomputer.com/news/security/lastpass-says-hackers-had-internal-access-for-four-days/ https://thehackernews.com/2022/09/microsoft-warns-of-large-scale-click.html https://www.darkreading.co...

Uber cybersecurity "incident", Teams critical vuln, Lorenz ransomware exploits Mitel, Meta and Google fined for violating privacy laws, White House releases software security requirements, and the one piece of career advice I would tell my 19 year-old self. https://www.digitaltrends.com/mobile/uber-investigating-cybersecurity-incident/ https://www.bleepingcomputer.com/news/security/microsoft-teams...

On this week's Throwback Thursday, from May 31, 2022, Rob Black, Founder and CEO of Fractional CISO (https://fractionalciso.com) talks about providing fractional/virtual CISO services to midsized SaaS technical organizations as well as other businesses, his story of starting Fractional CISO, and how he sees the SMB threat environment.

Elvis Huff is the Vice President - Director of Security/Information Security Officer for Wilson Bank and Trust. His path to bank ISO is not typical but is inspirational, with 12 years as a police officer prior to entering the world of banking. His reason for the transition involves faith and following a calling. He also produces an awesome security newsletter, Security Stuff with Elvis Huff - chec...

Americans lost nearly $7B to cybercrime in 2021, ports at risk of breach, FBI alert about Vice Society, Wordpress plugin BackupBuddy zero-day vuln, HP notebook high severity flaws remain wihtout a patch, and a few thoughts about 9/11 21 years later.  https://www.cbsnews.com/miami/news/fbi-americans-lost-nearly-7-billion-to-cybercrime-last-year/ https://www.darkreading.com/attacks-breaches/why...

IHG cyberattack disrupts booking systems, Tik-Tok-Hak, North Face credential stuffing attack, fake Android AV and cleaner apps install malware, posting photos and the information security risks they bring, and thoughts about technology debt. https://www.bleepingcomputer.com/news/security/intercontinental-hotels-group-cyberattack-disrupts-booking-systems/ https://www.msn.com/en-in/money/news/tiktok...

From May 24, 2022 - Kyle Cravens, Founder/Managing Principal of the staffing and recruiting firm Key Resource Group, LLC (https://www.krgnow.com/), joins us to discuss the IT and Information Security recruiting environment including tips on how a candidate can improve their chances of landing the position; how COVID and remote work has changed the environment, and how his faith guides his journey.

Donna Gallaher, President and CEO of New Oceans Enterprises, LLC, is a seasoned IT and information security pro providing virtual CISO and risk management services. She is a FAIR (Factor Analysis of Information Risk) evangelist and is passionate about growing the virtual CISO community, including serving on the Board of Directors for vCISO Catalyst, a Public Benefit Corporation supporting the impr...

IRS leaks taxpayer info, student loan breach, breach affects KeyBank and possibly others, REvil hits Fortune 500 company, phishing scam for American Express customers, and what I did on Labor Day, and how it ties in to information security. https://www.theepochtimes.com/mkt_app/irs-mistakenly-published-confidential-info-of-120000-taxpayers_4708384.html https://threatpost.com/student-loan-breach-ex...