The Virtual CISO Podcast

Latest Episodes:

What Does the New ISO 27002 Update Mean for You? Mar 01, 2022

Show notes

After years, ISO 27002 is finally here. What does that mean for your business? Luckily, the transition should be pretty seamless… But if you’re worried, have no fear because in today’s episode I’m joined by Danny Manimbo and Ryan Mackie, Company Principals at Schellman, who helped design the new standard. Join us as we discuss: - What’s new with ISO 27002 - What has stayed the same - The reasoning behind the update to the standard - The grace period for getting certified To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player

CMMC 2.0 & Continuous Compliance w/ Andrea Willis Feb 15, 2022

Show notes

If you look around at what’s happening in the world of cybersecurity, you’ll notice one thing: Security never stops… Which means neither should compliance. That’s why I invited Andrea Willis, Senior Product Manager at Exostar ,an expert in continuous compliance onto the show to help you figure out how to stay compliant. Join us as we discuss: -The importance of continuous compliance -How CMMC 2.0 and continuous compliance interact -How cybersecurity is like the immune system of your organization To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player

8 Information Security Predictions for 2022 Feb 04, 2022

Show notes

We’ve had another bumpy year in 2021. So, what’s coming down the pike in 2022? And what impact will the ongoing information security challenges of today have on the world of tomorrow? In this episode, I answer those questions and more. Plus, I will assume the role of Nostradamus and make 8 information security predictions for 2022. To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Government Security Guidance: How We Got Here Jan 28, 2022

Show notes

NIST, ISO, CMMC… If you’re beholden to government security guidance — and let’s face it, if you’re a company operating in the US, you very likely are — the list can be overwhelming at first. So, it helps to look back on where we’ve been and how we got where we are today. And in this solo episode, Our Host John Verry does exactly that — and hopefully, shine a light on what the guidance means and why you should care. To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

How Hardware Hackers Exploit IoT Vulnerabilities w/ Joe Grand Dec 16, 2021

Show notes

You’ve probably heard the hype: IoT is the next frontier in the information revolution that promises to make all our lives easier… And that’s doubly true for hackers. In this episode, I’m joined by Joe Grand, also known as Kingpin, a computer engineer, hardware hacker, product designer, teacher, advisor, daddy, honorary doctor, TV host, member of legendary hacker group L0pht Heavy Industries, proprietor of Grand Idea Studio (www.grandideastudio.com), and partner in offspec.io, a cryptocurrency wallet recovery service. He has been creating, exploring, and manipulating electronic systems since the 1980s and is hereto take a look at the vulnerabilities hackers exploit in IoT (and how you can defend against them). Join us as we discuss: - Why, despite what many believe, hardware is no less vulnerable than software - The common vulnerabilities in IoT devices and what you can do about them - How security standards factor into IoT security To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Bridging the Gap Between Security & Development Teams w/ Harshil Parikh Dec 09, 2021

Show notes

There is an age-old conflict between security and development teams. Development teams are focused on time-to-market and packing features into the product. Security teams are often seen as speed bumps on the way to achieving those goals. How can we bridge the gap between the two? According to Harshil Parikh, CEO at Tromzo, new methodologies are presenting an incredible opportunity for security teams to get involved in the development process in a much more effective way. Plus, there’s some exciting new software that is solving this challenge in interesting ways. In this episode, we discuss: - Opportunities presented by agile development methodologies and DevSecOps - The root of the conflict between security and development - How to close the gaps between the two teams - How Tromso is solving the challenge through software To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Why Cloud Is More Secure Than Your Average On-Prem Solution w/ Mark Richman Dec 02, 2021

Show notes

What’s more secure? A cloud-based or on-prem document management system? It’s a question that gets asked a lot in our industry. So, I invited Mark Richman, Principal Product Manager at iManage, on to the show for a wide-ranging discussion on the topic. In this episode, we discuss: - Why a SaaS-based document management system is more secure than on-prem - Implementing compensating controls to mitigate potential damages - iManage’s customer-managed encryption keys and threat manager - What a cloud provider should be doing from a security perspective To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

How Configuration Management Makes Security Simple w/ Brian Hajost Nov 23, 2021

Show notes

Configuration management is the best kept secret in security. Not only will it save time and money, it also helps you marry compliance and security — something we all need to get used to. The question is: Why isn’t everyone using it? Today’s guest, Brian Hajost, Founder and COO at SteelCloud, joins me on the show to give some compelling reasons why you should. In this episode, we discuss: - What configuration management is - How it saves you time and effort - How it saves you money To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

CMMC 2.0 is Here! Find Out What It Really Means for DIB and Non-DIB USG Nov 12, 2021

Show notes

The US Department of Defense (DoD) has just announced CMMC 2.0, a new strategic direction for its cybersecurity program based on public comment and internal assessment. So what does it all mean? Many sources say that CMMC 2.0 is about "less requirements,"—but it's really much more about changing how the DoD will hold defense contractors accountable to the NIST SP 800-171 requirements that have been in place all along. We're speaking to two of our best Security Consultants from right here within our ranks at Pivot Point Security: George Perezdiaz, CMMC / NIST Security Consultant, and Caleb Leidy, CMMC Consultant/Provisional Assessor. In this episode, we discuss: - What's new and what's not with CMMC Level 1 (for securing FCI) and what is now called CMMC Level 2 (for securing CUI) - The overall realignment of the US government's cybersecurity audit program with NIST 800-171 - "Bifurcation" and who will and won't need a third-party audit if you handle CUI - How CMMC 2.0's new accountability process fits with the recent cybersecurity executive order, the Civil Cyber-Fraud Initiative, the False Claims Act, and upcoming rule changes to 32 CFR and 48 CFR - Why "letters of affirmation" are a boon to SMB security and IT leaders compared to the threat of a third-party audit Mentioned during the podcast: eCFR :: Home To hear this episode and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don't use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can't see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

How Simply Cyber Helps People Pivot to a Cybersecurity Career w/ Gerald Auger Nov 10, 2021

Show notes

A lot of people want to break into cybersecurity. And why not? Where else can you have a blast, work with really smart people, earn a great living, have awesome job security, and do something truly impactful for the company you work for. However, it can be a particularly difficult industry to break into, especially if you don’t have the financial resources to pursue the education necessary to get hired. Gerald Auger, Chief Content Creator at Simply Cyber, noticed this gap between the haves and the have nots and he’s been working hard to create a pool of resources that are accessible to anyone, anywhere, for free. In this episode, we discuss: - Giving people access to a free cybersecurity education - The catch-22 of listing entry-level jobs that require 2-3 years of experience - Which cybersecurity roles serve as the best entry points into the industry - Where Simply Cyber will go over the next few years Mentioned during the podcast: - Cybersecurity Career Master Plan - Simply Cyber YouTube Channel To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here. Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected