The Virtual CISO Podcast

Latest Episodes:

Unpacking Critical Elements of Supply Chain Risk Management Aug 30, 2022

Show notes

Supply chain risk management can prove to be a slippery slope—why should you take pains to conduct a proper risk assessment, and how do they impact IT and business continuity? From international restrictions to balancing generic and specific risk assessments, any guidance is welcome in the world of supply chain management. I invited Willy Fabritius, Global Head of Strategy & Business Development, Information Security Assurance at SGS, onto the show to provide insights into supply chain risk management. Including definitions, best practices, and where to turn for guidance. To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player

Breaking Down the Latest in Software Security Standards & the Impact on SaaS Businesses Aug 16, 2022

Show notes

What are the merits of the Software Assurance Maturity Model (SAMM), and how does it differ from the Application Security Verification Standard (ASVS) model? And why should you care? From design to operations, there are several crucial considerations to hold regarding business functions and use cases. I invited Taylor Smith, Application Penetration Testing Lead at Pivot Point Security, onto the show to provide insights into SAMM. Including definitions, the differences between SAMM, ASVS, and BSIMM, and how these models are relevant in today’s software development environment. To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player

What You Need to Know about APIs and API Security Aug 09, 2022

Show notes

Application development is moving from a web-centric world to an API-centric world. If you’re wondering what that looks like, what the security implications are and what an API is, you’re in the right place. There is no shortage of new application security strategies to familiarize ourselves with as cybersecurity adapts to changing times. That’s why I invited Rob Dickinson, CTO at Resurface Labs, to explain APIs, continuous API operation observability, and prevalent challenges in the API economy. Join us as we discuss:

Moving from a web-centric to an API-centric world
The value of opbersing API operation in production environment
Tackling security issues in the API economy

To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player

How to Measure the Value of Information Security Aug 02, 2022

Show notes

Most recognize the value preservation in cybersecurity. But forward thinking professionals also see the value creation in having a secure information posture. Cybersecurity is the foundation of preserving sensitive data and providing peace of mind but does it create value for the organization and if so, how do we measure that value? Tracking the return on investment on cyber security can be challenging. Much like auto insurance, you gain the most obvious value when something goes wrong—however, that doesn’t mean insurance isn’t valuable during smooth sailing. I invited James Fair, Senior VP at Executech, to discuss the value of compliance, measuring ROSI, the Return on Security Investment, and budgetary considerations in cybersecurity. Join us as we discuss:

The value of cybersecurity vs the costs of a breach
Convoluted cybersecurity budgets and industry averages
How compliance supports value preservation and value creation

Understanding NIST’s Secure Software Development Framework Jul 26, 2022

Show notes

What exactly is a Software Development Life Cycle, and how does NIST’s Secure Software Development Framework impact that cycle and your organization? Of note, the SSDF will definitely impact you if your software is used by the US Government and will likely impact you even if it isn’t. There are a few choice practices that can help make sense of these two critical processes and provide the highest chance for success. I invited Elzar Camper, Director of Cyber Security Solutions & Practices at Pivot Point Security, onto the show to unpack SDLCs, the SSDF and lay out the shifting landscape of government regulations and software development. Join us as we discuss:

Defining SDLC’s and the SSDF
Four core best practices in cybersecurity
Assessing existing procedures and adapting to the SSDF
How you can use the SSDF to your advantage

US Gov. Cybersecurity Roadmap: Where it came from and Where is it Going? Jul 19, 2022

Show notes

Today, information is worth more than riches. The new currency is data. With this being true, the state of cybersecurity within the upper branches of the government was shockingly under-prepared. In this episode, I speak with Mark Montgomery, the former Executive Director of the Cyber Solarium Commission, about the report the commission published in March 2020 and how that document has influenced the US Government’s roadmap to improve cybersecurity, prevent cyber attacks, and protect the nation's data. Join us as we discuss:

Critical steps forward for cybersecurity
Six pillars of importance in federal circles
Challenges in the cybersecurity workforce

Confronting the Wild West of Database Security Jul 12, 2022

Show notes

Don’t wait for an emergency; secure your database correctly right out of the gate. Think of everything outside of your database as the wild west. What can you do to create the most controlled environment possible for all of your most sensitive data? I invited Robert Buda, President of Buda Consulting, Inc, and an expert in database technology, onto the show to help us learn the value of database security and what you can do today to improve your security measures. Join us as we discuss:

Why database security is undervalued
Critical risks to be aware of regarding your database
Avoiding a sense of false security with the cloud
Ensuring your database is as secure as possible

Bridging the Gap Between Cybersecurity and the Business World Jun 28, 2022

Show notes

Ron Gula, President and Co-Founder of Gula Tech Adventures, has a very specific goal: To defend the country in cyberspace by investing in companies and nonprofits that help close the gap in technology and the workforce. He also knows that in order to successfully achieve this goal, organizations must understand the basics of data protection. Today, Ron joins the show to talk about the mindset shift that can start in the information security disciplines through communication. Join us as we also discuss:

The importance of asking the right questions of business owners
Building a trusted ecosystem within the information security disciplines
Creating a measure of security to determine the safety of your company’s data
The small business IT shops defining corporate America

Legal and Infosec strategies to deal with exploding Cyber Liability Insurance premiums Jun 21, 2022

Show notes

There’s no denying that cybersecurity risks in the workplace have increased exponentially in recent years. From the pandemic causing employees to work from home to Russia’s invasion of Ukraine, organizations are more vulnerable than ever. That’s why it’s crucial to understand how to best protect yourself and your business. On this episode, Eric Jesse, Partner at Lowenstein Sandler LLP, joins the show to give an attorney's perspective on the importance of cyber liability insurance. Eric talks about protecting your company as a policyholder in today’s new landscape. Join us as we discuss:

Why companies should have their cyber liability insurance policies reviewed by knowledgeable attorneys
Strategies for improving your security posture to reduce premiums
How best to ensure your Cyber Liability insurance dovetails with other insurance policies to confirm you are covered across all types of cyber incidents

Important Clarifications on CMMC v2 from CMMC Day May 9, 2022 Jun 14, 2022

Show notes

To invest in CMMC or to not invest in CMMC, that is the question. CMMC (Cybersecurity Maturity Model Certification) is a lofty yet necessary investment for the Defense Industrial Base. With all signs pointing to May 2023 for when we can expect CMMC to be included in contracts, anyone who is considering CMMC should do it sooner rather than later as implementing any comprehensive cyber security program could take a company 9 to 12 months. On this episode, our host John Verry recaps his most important takeaways from the recent CMMC Day conference held in Washington DC on May 9, 2022. Join us as we discuss:

CMMC Level 2 and 3 requirements
CMMC’s three-year certification process
False claims acts and the impact CMMC will have on the review process by the Justice Department
Differing opinions of CMMC from conference attendees and CMMC experts

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Virtual CISO Podcast

Related Podcasts

1

2

3

4

5

6