Advertise on podcast: Cyber Security Grey Beard®

Brief introduction to Season 4 - July 2022-Sept 2022 and then the full session I presented at for the MSS Forum in Phoenix on May 12, 2022.  The topic covers today's cyber security networking challenges.  I offer recommendations for solutions and provide advice on where security professionals can focus.  If you want a copy of the deck I used, send an email to [email protected]. Please donate to my Cyber Security mentee, Josh Gbemisola The Cuckoo's Egg The Phoenix Project IBM Cost of a Data Breach MSS Forum Phoenix AlgoSec

Many people are threatened with losing their jobs or violating their conscience.  This episode talks about how you are not alone.  I talk about standing up for what you believe in.  Swim upstream if that's for you.  Do not "go along to get along" if that does not comport with your values.  Stand up.  Be strong.  Leave your employer if they force you to violate your beliefs.  Do not feel the need to justify yourself.  An employer is an employer, nothing more.  There are firms out there that align with your beliefs and moral fortitude, find them if that's in your best interest.

Fireside chat with Garrettson Blight, Principal at Booz Allen Hamilton led  by Kate Rodgers, Director of Brand at Infosec virtually on October 19, 2021.  We discussed learning and development opportunities in our organizations and how important it is for employees.  Salary is only a single benefit to employment.  Learning and development along with healthcare comes in second for many professionals.  We discuss how employees can take advantage of training in the workplace.  "We need to appeal to the staffs, they have lot of other options." - Garrettson Blight, Principal, Booz Allen Hamilton.

In this episode I talk about high profile cyber-attacks in the Spring and Summer of 2021.  I’ll review who was attacked, what the attack involved, it’s impact, the aftermath, and how it affected the economy.  Sign up for NewsBits from SANS at https://www.sans.org/newsletters/newsbites/ Review Security Intelligence periodically: https://securityintelligence.com/ Security Magazine offers solid content:  https://www.securitymagazine.com/ Executive Order 14208: https://www.cisa.gov/executive-order-improving-nations-cybersecurity We are at War, Cyber War: https://www.securitymagazine.com/articles/96125-we-are-at-war-a-cyber-war 16 Sectors off limits: https://www.itsecurityguru.org/2021/06/17/biden-says-16-sectors-should-be-off-limits-to-attack/ Arctic Wolf Survey: https://arcticwolf.com/resources/press-releases/arctic-wolf-global-survey-reveals-lack-of-confidence-in-cybersecurity-defenses-and-government-action-amid-fears-of-state-sponsored-attacks Insurance and Ransomware: https://www.barrons.com/articles/ransomware-attack-cyber-insurance-industry-51633075202 Infant death tied to ransomware 2019: https://threatpost.com/babys-death-linked-ransomware/175232/ Colonial Pipeline: https://www.securezoo.com/2021/05/pipeline-ransomware-attack-shuts-down-for-45-of-east-coasts-fuel-us-passes-emergency-waiver https://medium.com/cloud-security/colonial-pipeline-hack-4486d16f2957 JBS Breach: https://minnesota.cbslocal.com/2021/06/01/meat-producer-jbs-hit-by-cyberattack-worthington-plant-closes-for-the-day/ https://www.bloomberg.com/news/articles/2021-05-31/meat-is-latest-cyber-victim-as-hackers-hit-top-supplier-jbs Iowa Co-Op Links: https://www.foxbusiness.com/technology/ransomware-attack-new-cooperative-agriculture-grain-pork-chicken-supply https://www.securezoo.com/2021/09/iowa-based-farm-service-provider-new-cooperative-hit-by-blackmatter-ransomware-attack/ Minnesota Attack https://www.reuters.com/technology/minnesota-grain-handler-targeted-ransomware-attack-2021-09-23/ https://www.cybersecuritydive.com/news/agriculture-food-ransomware-coop/607080/

In this episode I talk about incident response plans, what they are, why they are important and how to create one.  NIST, the National Institute of Standards and Technology has a fabulous document entitled Computer Security Incident Handling Guide, Special Publication 800-61 Rev. 2.  This document prescribes key data for incident response plans.  In this episode I’ll review key components of this document and how and why these components play a key role in cyber security incident response planning.  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 

In this episode I talk about real situations I’ve experienced.  I won’t name companies, only industry and relative geography so as not to expose any entities.  Some of these are more egregious than others, all are good learning experiences, for early as well as experienced professionals.  Many look to join Cyber Security and wonder what it’s really like out there, these tales should provide some insight to that curiosity.   I encourage each of you to think of solutions to these problems.  While I give some throughout the episode, there are many ways to solve problems.  Don’t just think about technical solutions.  What processes or procedures could these organizations implement?  How about training, not just their IT and security staff but their end users as well.  Spending money may solve a problem; however, if the product or service is not installed or utilized properly, will money really make it better?  Use these stories to grow yourself and help you understand what the real world of cyber security, on the ground, really looks like.

While this podcast focuses on cyber security professionals, this episode provides general and wide-ranging interviewing and presentation tips.  The discussion goes into detail about how and why we communicate and then provides examples and performance tips.  Later there are examples, and recommendations for how to interview, present, and speak publicly overall.  I give suggested questions to ask interviewers and provide information on delivering more engaging and successful presentations.  I also give a handful of tips on speaking and presenting virtually including how to handle the camera, backgrounds, and suggestions for dress.  This episode delivers real world tips for elevating professionals interviewing skill and presentation ability. 

Audio recording of session at MSS Forum LA on June 30th, 2021.  Group discussion lead by Phelim Rowe of CTG Intelligence.  We review the top "post holder" and go into depth around who has responsibility for cyber security in an organization.   I was pleased to join Richard Staynings, Shawn Kohrman, Ashwin Krishnan, and Louis Arul-Doss on this round table discussion. You can watch the Zoom recording on YouTube at https://www.youtube.com/watch?v=uvvqbOMiTmE Look out for an MSS Forum in your area.  I've spoken at L.A., Denver, and Phoenix and look forward to participating at future conferences.

In this special episode I'm sharing a real-world conversation I had with an early professional at my company.  This individual worked for a couple of years in the healthcare field as an administrator and then moved to an extremely large company.  He reached out wanting to know what to study and how and where to steer his career.  Listen to this real life conversation and understand a direction and path to take in the cyber security field.  I'm posting this special episode to help all of my listeners understand choices and opportunities.  If you would like to have a similar conversation, reach out at [email protected].

Discussion on cyber security certifications.  Which make sense.  Where to focus.  How to proceed.  I cover certifications from GIAC, ISC2, ISACA, EC-Council, Amazon, Microsoft, Google, CompTIA, and others.   This episode discusses areas to find training and recommendations before taking certification exams.  These are recommendations only and based on my opinion and experiences.  Please do research before investing in any certification or training course. ISC2: https://www.isc2.org/ ISACA: https://www.isaca.org/ Offensive Security: https://www.offensive-security.com EC-Council: https://cert.eccouncil.org/ GIAC: https://www.giac.org/ GIAC Roadmap: https://www.giac.org/certifications/get-certified/roadmap AWS: https://aws.amazon.com/certification/ 12 MS Azure certifications https://cloudacademy.com/blog/microsoft-azure-certifications-which-is-right-for-you-and-your-team/ Google Cloud Certifications: https://cloud.google.com/certification/ SANS: https://www.sans.org/ Infosec Institute: https://www.infosecinstitute.com/ UDEMY: https://www.udemy.com/ Cloud Academy: https://cloudacademy.com/

Book reviews of four cyber security books published between 2019-2020. Dark Mirror: Edward Snowden and the American Surveillance State by Barton Gellman 2020, The Hacker and The State by Ben Buchanan, 2020, Sandworm by Andy Greenberg, 2019 and The Coming Cyber War by Marc Crudgington, 2020.  These books provide great insight to where we are in the cyber security profession.  They discuss history, technology, and attacks.  Cyber security professionals need to understand the threat landscape.  These books all help with that in their own way. Dark Mirror: https://www.barnesandnoble.com/w/dark-mirror-barton-gellman/1122928803?ean=9780143110477 Hacker and The State: https://www.barnesandnoble.com/w/the-hacker-and-the-state-ben-buchanan/1132885872?ean=9780674987555 Sandworm: https://www.barnesandnoble.com/w/sandworm-andy-greenberg/1129288539?ean=9780525564638 The Coming Cyber War:  https://www.barnesandnoble.com/w/the-coming-cyber-war-marc-crudgington/1137913105?ean=9781735916309 PRISM:  https://www.masslive.com/politics/2013/06 codename_prism_secret_program_data_mining.html Shadow Brokers:  https://darkwebjournal.com/shadow-brokers/ Stuxnet:  https://www.csoonline.com/article/3218104/what-is-stuxnet-who-created-it-and-how-does-it-work.html Wiper:  https://iranprimer.usip.org/blog/2019/oct/25/invisible-us-iran-cyber-war Fancy Bear: https://www.crowdstrike.com/blog/who-is-fancy-bear/ Sandworm: https://resources.infosecinstitute.com/topic/apt-sandworm-notpetya-technical-overview/ Gucifer:  https://www.justice.gov/opa/pr/romanian-hacker-guccifer-sentenced-52-months-prison-computer-hacking-crimes Eternal Blue: https://www.cisecurity.org/wp-content/uploads/2019/01/Security-Primer-EternalBlue.pdf Sands Casino Hack: https://money.cnn.com/2015/02/27/technology/security/iran-hack-casino/index.html DNC Hack: https://www.wusa9.com/article/news/russians-hack-the-dnc-a-timeline/65-bd1326a7-7ed5-4cd7-92a3-63eed75f1bd9

Financial guidance based on my 30 years’ experience, economic degree, financial education, and wonderful direction from my father, a 40+ year professional financial advisor.  I veer away from my standard cyber security talks in this episode to help students and early professionals learn, grow, and advance their financial well being.  I see a critical need for, and interest in, financial advice and take time herein to help my listeners. Note these are my opinions and recommendations only.  I am not a professional or certified financial advisor and cannot be held liable or responsible for others’ financial decisions. One item I didn't mention - tracking your finances.  Make sure to use a tool such as Quicken, Mint.com, or a similar financial tracking program.  Consolidate ALL financial data into one place. Check out: 1)  Warren Buffet 2)  Rule of 72 3)  The difference between investing and gambling 4)  ETFs vs. Mutual Funds 5)  Diversification 6)  Dollar cost averaging 7)  Budgeting 8)  Quicken, Mint, or another financial tracking tool