The Virtual CISO Podcast

Latest Episodes:

19. Why Application Security is a Team Sport and How Your Team Can Win w/ Joe Manico Jun 30, 2020

Show notes

If you’re a business leader, especially at a SaaS firm or if you’re a developer at a SaaS firm, this episode with Jim Manico will provide a ton of value. You'll hear practical advice on how to approach application security that even the most technically un-savvy listeners can understand. Joe Manico is an application security powerhouse. He is the Founder of an application security training company, Manicode Security, is a major contributor to a number of OWASP projects, and he has a really great passionate approach to his work. What we talked about:

ASVS 101
Where should you start when addressing your security needs?
Comprehensive tips and advice for application security business leaders

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here.

18. IT & Security: How to Do More with Less w/ Jose Ciriaco Jun 24, 2020

Show notes

Information security is a well easily fallen into. There is so much on the market. So many things to consider. It’s hard to determine what you actually need, and sometimes companies tend to just grab everything in sight to assure themselves that they are on point… Or not do enough for fear of wasting time and money on the wrong solutions. There are plenty of ideas, platforms, papers, and regulations to keep in mind, but sometimes, less really is more. Jose Ciriaco, Director of Sales and Marketing at Tekscape, Inc. shares some refreshing ideas about keeping things streamlined while promoting diverse product sets and services in the B2B marketplace. What we talked about: - Real-world strategies around consolidation - Analyzing valuable streamlining on a case by case basis - Digging through vendor options (and how to get the most out of them) Additional Resources:

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

17. CMMC Certification Audits—Can You Leverage ISO 27001? w/ Thomas Price Jun 17, 2020

Show notes

If you want a glimpse into what one of your future CMMC audits will be like, this is the show for you. On this episode of The Virtual CISO Podcast, we welcome Thomas Price, Client Manager/IT and Information Security Auditor/Quality Management Professional at BSI. Working with clients to determine strategic direction, achieve objectives, and improve quality and service delivery, Thomas is one of the most accomplished and respected auditors in the security industry. What we talked about: - The differences between ISO 27001 and CMMC - CMMC requirements- an in depth look - Insights from an auditor's perspective on how to prepare for certification - Real-life examples of how to leverage ISO 27001 to nail CMMC certification Check out these resources we mentioned during the podcast:

DOD on CMMC

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

16. Why Buyers of Security Services Need to Leverage CREST w/ Ian Glover Jun 09, 2020

Show notes

Who do you trust with your network? Would you give a random person access to the infrastructure that runs your business? Anyone with a computer and an Internet connection can set themselves up as a penetration testing or cyber incident response service provider. But what methods does your organization have in place for vetting an individual or company that you are potentially allowing unfettered access to your entire network? Ian Glover, President of CREST, is on the podcast to talk about how CREST provides internationally recognised accreditations for organisations, and professional level certifications for individuals providing penetration testing, incident response, threat intelligence and Security Operations Centre (SOC) services. What we talked about: - CREST and a CISO’s decision making process - The rigorous process of CREST accreditation and certification - Why having a certifying body evens the playing field Check out these resources we mentioned during the podcast:

This post is based on The Virtual CISO podcast hosted by John Verry and featuring special guest, Ian Glover To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

15. The OWASP Top Ten is Great, but is it Enough? w/ Andrew van der Stock Jun 02, 2020

Show notes

We all have things we consider “the best”. Things we look to. Rely on. What happens when one of those old reliable, gold standard things that have been our go-to for so long winds up being #2, instead of #1? Andrew van der Stock, Senior Application Security Leader at OWASP Foundation stops by the podcast to dispel some industry myths about The OWASP Top 10. What we talked about: - Is The OWASP Top 10 really the gold standard? - Next level considerations to take on as you progress on your journey - Risk assessment and threat modeling is just a game Check out these resources we mentioned during the podcast:

14. How Computer Forensics Protects Your Data During Litigation w/ Brian Dykstra May 26, 2020

Show notes

The word forensics usually makes us think of homicide, but it applies to computers, too. Computer forensics simply just means telling the story of what happened on a computer. In this episode, we hear from Brian Dykstra, President and CEO of Atlantic Data Forensics, about who needs computer forensics, when, and why. What we talked about: - The need for computer forensics is widespread and underrecognized - It gives you protection against future litigation, especially in IP and employment cases - 50% of CISOs graduated at the bottom half of their class… and what that means - 3 free, easy ways to reduce your attack surface
To hear this episode, and many more like it, you can subscribe to Virtual CISO here. If you don’t use Apple Podcasts, you can find all our episodes here.

13. Why ISO 27701 is the Answer to Privacy Compliance w/ Debbie Zaller May 19, 2020

Show notes

As the first data privacy certification available, ISO 27701 can greatly reduce the complexity of managing privacy, risk and proving compliance with regulations like CCPA, GDPR. Those organizations that already have a 27001 certification or are considering that certification can add on 27701 to change an Information Security Management System (ISMS) into an Information Security & Privacy Management System (ISPMS) Debbie Zaller, Principal and co-owner at Schellman & Company, shares her in-depth knowledge of ISO 27701 on this episode of The Virtual CISO Podcast. What we talked about:

Unpacking the this new certifiable extension
Why “ISO 27701 Certified” and “GDPR fully compliant” are not the same (but VERY clos)
Why 27701 is the answer to reputable privacy compliance

Resources we mentioned:

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

12. Disaster Recovery, Business Continuity, and Data Resilience w/ Cosmo Gazzani May 12, 2020

Show notes

Getting a flat tire is a disaster. Knowing where you keep the spare is disaster recovery. Changing a tire in under 7 minutes to get right back on the road is business continuity. In this episode, I interview Cosmo Gazzani, Director of Business Development at Continuity Centers and wekos, about information continuity and the importance of backing up your data. What we talked about:

The nuance between disaster recovery and business continuity
How SMBs can know whether they should have an information continuity plan
3 buckets for planning for business continuity
How & why to backup your data, even if you’re a one-man show

This post is based on a Virtual CISO podcast with Cosmo Gazzani. To hear this episode, and many more like it, you can subscribe to Virtual CISO here.
If you don’t use Apple Podcasts, you can find all our episodes here.

11. OWASP ASVS: The Go-To Standard for Application Security w/ Daniel Cuthbert May 05, 2020

Show notes

Your application is probably vulnerable. “But how?! We hired a company to pen test our application. They did a thorough test against the OWASP top 10!” On this episode of the Virtual CISO podcast, we talk with Daniel Cuthbert. He's one of the premier authors of the OWASP ASVS, and he says OWASP Top 10 is not enough. We chat about:

Why the ASVS is so important
Why we shouldn’t be putting all our faith in the OWASP top 10 (only)
How to incorporate threat modelling into your assessments and your ASVS test

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

10. Exostar and Their Role in Your CMMC Certification w/ Stuart Itkin Apr 28, 2020

Show notes

Is your organization ready for CMMC?
As CMMCs roll out over the next 6 years, it’s going to become a reality for more and more DoD subcontractors. As many as 50,000 organizations by 2025. Thankfully there are folks out there who are experts at this. On this episode of The Virtual CISO podcast, we heard from Stuart Itkin. Stuart is the Vice President of Marketing & Product Management at Exostar, and he and his team are leading the charge when it comes to CMMC readiness. We talk all about:

The need for robust CMMC readiness
Why your organization may need to adhere to several different certifications depending on the specific project or RFP
How Exostar can help get your organization CMMC ready

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected