The Virtual CISO Moment

Information security theater, improvements that look and sound good but make no real impact to overall security stance of an organization, can do more harm than good. Are you understanding the information security risks of your organization before designing and implementing controls?

Information Security and Information Technology Security are not the same. If your program is focused on Information Technology Security only, you've got gaps.

In order to stay healthy, we need to exercise regularly. To maintain our information security program's fitness, we need to exercise it as well.

Information security policies direct the governance of the information security program. What are elements of effective policies, and what mistakes do SMBs often make with their information security policy program?

Learn how quantitative information security risk assessments can help community institutions (and all small and midsized businesses). A presentation to the Bankers' Bank of the West Information Security for Community Institutions conference October 25, 2019.

Governance, Risk, and Compliance - how it can benefit information security for businesses of all sizes.

In this extended episode, vCISO Services principal Greg Schaffer speaks at InfoSec Nashville 2019 about what a virtual CISO is and how they help small and midsized businesses.

vCISO Services principal Greg Schaffer discusses the virtual CISO role in a short interview at the National Cyber Summit.

Greg discusses the announcement of vCISO Services, LLC's licensed quantitative information risk assessment offering based on The Open Group Open FAIR™ Body of Knowledge. https://www.prnewswire.com/news-releases/an-answer-for-cybersecurity-cost-exposure-300911336.html

Greg concludes a three-part series breaking down ISO 27001 and ISO 27002, international standards for information security. Part three dives into the second half of the ISO 27002 control requirements.

Greg continues a three-part series breaking down ISO 27001 and ISO 27002, international standards for information security. Part two dives into the first half of the ISO 27002 control requirements.

Greg begins a three-part series breaking down ISO 27001 and ISO 27002, international standards for information security. Part one lays out the history and a glimpse at the structure of ISO 27000 and why it's important for SMBs.

Taken from a Facebook Live video July 26th (hence the lower video quality), Greg explains why the Virtual CISO Minute is now the Virtual CISO Moment,  talks about possible future use of the Facebook Live channel to help small and midsized businesses with information security topics, and invites current vCISOs or those interested in the space to join the Virtual CISO Exchange LinkedIn group at...

There is a growing rift between the information security “haves” and “have nots,” and the threat actors know that as well. Cyber criminals increasingly target small and midsized businesses (SMBs) because they know SMBs likely do not have information security programs as robust as those large organizations have in place. Nor do they have experienced information security leadership, as the average a...

Thirty-four years ago, I worked as a porter (janitor) at a hotel in New Jersey. I took a year off between high school and college to decide where I wanted to direct my life - and to earn money for college. I promised myself that one day, when I had become successful, I would stay in that hotel. Recently it happened. I realized I learned an early lesson applicable to information security then. Watc...

You've heard the term, but what is a Virtual CISO, or vCISO? This week's Virtual CISO Minute explains

Compensating Controls: Is an audit exception regarding a failing primary control absolute? Maybe, maybe not. The risk may be mitigated by other methods - compensating controls.

The Nashville Technology Council's Veterans Peer Group helps veterans land civilian jobs and enhance their careers in IT and information security in the Nashville/Middle Tennessee region. SMBs should look to a veteran when trying to fill these positions.

Quantitative risk assessments and how they can help your SMB's information security posture.

Qualitative risk assessments - the ones that produce those "heat maps" with the red (high risk), yellow (medium risk) and green (low risk) are a standard method for communicating information security risk. But they have limitations.

Information security risk assessments - why are they important?

SOC1, SOC2, what do they mean for your small business?  Find out in this week's installment of The vCISO Minute.

A recent breach highlights the need for incident response testing, particularly about notification.

Microsoft released a patch for out-of-support operating systems this week, but that's usually not the case. If your business requires running old operating systems, usually due to legacy software or systems,  you need to reduce the risk running an outdated operating system brings by not relying on patches. Music by https://www.bensound.com/

The annual Verizon Data Breach Investigation Report will come out soon. What is it, and how does it benefit small and midsized businesses?