The Virtual CISO Moment

Small businesses aren't ready for a cyberattack, security leaders metrics and reporting, cloud migration, NIST supply chain guidance. https://www.cnbc.com/2022/05/21/americas-small-businesses-arent-ready-for-a-cyberattack.html https://biztechmagazine.com/article/2022/05/how-should-cybersecurity-leaders-report-their-progress https://securityboulevard.com/2022/06/six-things-to-check-before-moving-to...

James Farley, Partner Development Manager, Cybersecurity at ConnectWise (connectwise.com), discusses migrating from insurance to IT sales to supporting Managed Service Providers, as well as running to beat the stress, including reaching a goal many never achieve! 

Unpacking the Verizon Data Breach Investigations Report, a new "Man on the Side" attack (and what is that?),  this week's resource highlight - InfoSecSherpa, and "paying your dues". https://securityboulevard.com/2022/06/verizon-dbir-2022-whats-worth-acting-on/ https://thehackernews.com/2022/06/chinese-luoyu-hackers-using-man-on-side.html https://en.wikipedia.org/wiki/Man-on-the-side_attack ht...

Confluence zero day, Microsoft zero day exploitation example, Ransomware roundup, and my reaction to a LinkedIn post about virtual CISO services that went semi-viral for the wrong reasons. We need to do better in the virtual CISO space. https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-micr...

Rob Black, Founder and CEO of Fractional CISO (https://fractionalciso.com) talks about providing fractional/virtual CISO services to midsized SaaS technical organizations as well as other businesses, his story of starting Fractional CISO, and how he sees the SMB threat environment.

Microsoft Zero Day, CISA adds 75 vulns to critical list, and cybersecurity as Corporate Social Responsibility. Today we honor all who gave their life for freedom. https://thehackernews.com/2022/05/watch-out-researchers-spot-new.html https://www.forbes.com/sites/daveywinder/2022/05/26/us-cybersecurity-agency-strongly-urges-you-patch-these-75-actively-exploited-flaws/?sh=7c03a1b26381 https://venture...

Verizon DBIR, 10 exploited access points, email is still a problem (surprise), four tips for entry-level cyber analysts, and ransomware with a twist. Be kind to each other. Please. https://www.verizon.com/business/resources/reports/2022/dbir/2022-data-breach-investigations-report-dbir.pdf https://www.securitymagazine.com/articles/97676-cisa-outlines-10-initial-access-points-exploited-by-hackers ht...

Kyle Cravens, Founder/Managing Principal of the staffing and recruiting firm Key Resource Group, LLC (https://www.krgnow.com/), joins us to discuss the IT and Information Security recruiting environment including tips on how a candidate can improve their chances of landing the position; how COVID and remote work has changed the environment, and how his faith guides his journey.

Conti disbands, DOJ directs good-faith security research should not be charged, governments consider ransomware self-insuring, and just say no to saying no in information security. https://www.bleepingcomputer.com/news/security/conti-ransomware-shuts-down-operation-rebrands-into-smaller-units/ https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-frau...

Remote work, IT and infosec staff stress and ransomware - a canary in the coal mine? https://www.helpnetsecurity.com/2022/05/17/state-of-security/ https://www.helpnetsecurity.com/2022/05/18/it-help-desk-stress/ https://www.techtarget.com/searchsecurity/news/252518151/Iranian-APT-Cobalt-Illusion-launching-ransomware-attacks https://thehackernews.com/2022/05/russian-conti-ransomware-gang-threatens.h...

Clark Cummings joins us to discuss enterprise risk management, how to recognize "risk collisions", and provide practical risk management advice for small and midsized businesses.

What is the secret to security (or any business) success? Listen to find out.

The Virtual CISO Moment aims to inform and entertain. We hope you will join us! All episodes drop at 8:00 AM Central (US). Monday - The VCM Quick Strike (audio only) Tuesday - The Virtual CISO Moment Conversations (audio and video) Friday - The Virtual CISO Moment Wrap Up

Many topics, including Lincoln College, CISA and MSPs, SEC and Board of Directors, and Pegasus. https://www.engadget.com/lincoln-college-ransomware-attack-shut-down-covid-19-164917483.html https://www.cisa.gov/uscert/ncas/current-activity/2022/05/11/cisa-joins-partners-release-advisory-protecting-msps-and-their https://media-exp1.licdn.com/dms/document/C561FAQE9H1UdCeHoyg/feedshare-document-pdf-an...

Mike Rastigue with Crum & Forster joins us to discuss cyber insurance and one way that his organization is helping SMBs to be both better prepared to meet cyber insurance underwriting requirements and increase their security posture.

Last week I came across two instances on LinkedIn of apparent predatory practices in the information security field - one related to regulatory compliance, another for a consultant certification. We have to do better as an industry.

Conti continues, ransomware payouts, supply chain breach in higher ed, and NIST 800-161r1 release. https://www.providencejournal.com/story/news/politics/2022/05/04/malware-used-ripta-hack-identified-conti-strain-russian-cybercriminals/9635388002/ https://cybernews.com/security/russian-passport-details-exposed-by-database-leak/ https://thejournal.com/articles/2022/05/05/565-schools-over-1m-students...

Frank Platt of Infosec Alliance LLC (https://www.infosecalliance.com/) joins us to discuss many infosec topics, including risk management, and CMMC...and BBQ!

A business continuity exercise to continue operations after a nuclear attack? Maybe not as crazy a scenario to plan for as we might have thought. Today's Quick Strike touches on that, including an interesting option for a data center that could possibly survive such an attack. It's not what you think... https://www.amazon.com/Nuclear-War-Survival-Skills-Instructions/dp/1634502973/ https://www.amaz...

Advice and resources for those looking for a cybersecurity entry level position, updates on vulns/exploits. https://www.wgu.edu/blog/guide-entry-level-cyber-security-jobs2102.html https://blogs.cisco.com/security/the-more-you-know-job-searching-interviewing https://www.linkedin.com/company/breaking-into-cybersecurity/ https://www.darkreading.com/vulnerabilities-threats/cisa-log4shell-most-exploite...

All small businesses have their own genesis story. vCISO Services began as many do; an idea in a home office, then a migration to an outside work environment, and then further growth. Recognizing, honoring, remembering, and respecting roots is a critical component of the success of a business. Note - Because this was an on-site video and was not recorded in the studio; the video and audio quality...

CISA tools, improving communications, and scholarship recipient. https://www.cisa.gov/free-cybersecurity-services-and-tools

Conti, BlackCat/ALPHV, DDoSecrets. https://ddosecrets.substack.com/ https://www.csoonline.com/article/3657875/ransomware-plagues-finance-sector-as-cyberattacks-get-more-complex.html https://krebsonsecurity.com/2022/04/contis-ransomware-toll-on-the-healthcare-industry/ https://www.cisa.gov/uscert/ncas/alerts/aa21-265a https://www.cyber.nj.gov/alerts-advisories/blackcatalphv-ransomware-indicators-of...

Don Baham is very active in both the local and on-line information security communities, as well as having extensive experience helping SMBs with information security needs. He joins us to discuss challenges and opportunities including observations on the cyber security supply chain issue and possible ways to address.