Topics covered

• Community health systems and UPS Stores breached - an analysis and contrast of the two breaches, the data, and the common message
  
  • http://regmedia.co.uk/2014/08/18/community_health_systems_8k.pdf
  • http://blogs.wsj.com/cio/2014/08/20/the-morning-download-community-health-systems-breach-stirs-up-heartbleed-fears/
  • http://time.com/3151681/ups-hack/
• The case of the pre-mature declaration of BYOD death, via an over-hyped court case?
  • http://www.cio.com/article/2466010/byod/court-ruling-could-bring-down-byod.html
• "Shadow clouds" (cloud services consumed by enterprises, not approved by security) are on the rise. No one on the show is shocked, and you aren't either.
  • http://www.computerworld.com/s/article/9250606/Shadow_cloud_services_pose_a_growing_risk_to_enterprises
• FaceBook gives the $50,000.00 away for the "Internet Defense Prize" joining Microsoft in trying to make being defensive-minded (and actually solving some security problems, rather than continuing to point them out) sexy
  • http://threatpost.com/new-facebook-internet-defense-prize-pays-out-50000-award

In this episode

• Jason tells us why he isn't hating on compliance
• Jason talks about how security people are often the source of the issues
• Jason gives us his perspective on compliance-driven security
• Jason correlates compliance to quality assurance in security
• We talk about security's unbroken streak of failing at the basics
• We lament poor metrics, why we suck at them, and what comes next
• We discuss how you can tell whether an investment in security 'is working'
• We discuss the need for repetitive and consistent security
• Jaason gives us his three things that he wants to leave you with

Guest

• Jason Oliver ( @jasonmoliver ) - Jason M Oliver, CISSP, CRISC is the Chief and CEO of Tikras Technology Solutions Corp, a Native American Owned Small Business, President at Arrow Ventures, a seasoned security industry veteran, leader, and lifelong pursuer of knowledge. His unique approach to solving security issues involves individualized plans tailored to meet each specific customer’s needs. His high level of unwavering integrity has been met by the highest regard from both customers and peers.

Topics covered

• Survey shows CISOs still struggle for respect (from business peers)
  • http://www.cio.com/article/2460165/security/cisos-still-struggle-for-respect-from-peers.html
• Hold Security uncovers 1.2 billion password heist on Russian hacker sites (but something smells funny) - draw your own conclusions folks... I'd love to hear 'em
  • http://www.theverge.com/2014/8/6/5973729/the-problem-with-the-new-york-times-biggest-hack-ever
  • http://www.youarenotpayingattention.com/2014/08/08/the-lie-behind-1-2-billion-stolen-passwords/
  • https://identity.holdsecurity.com/Submit/
  • http://krebsonsecurity.com/2014/08/qa-on-the-reported-theft-of-1-2b-email-accounts/
• Yet another Android core software blunder, called "Fake ID", essentially gives "highly privileged malware" a free ride.
  • http://arstechnica.com/security/2014/07/android-crypto-blunder-exposes-users-to-highly-privileged-malware/
• HP study says 70% of "Internet-of-Things" (IoT) vulnerable. There's a shock, we're carrying around legacy baggage? Perish the thought.
  • http://h30499.www3.hp.com/t5/Fortify-Application-Security/HP-Study-Reveals-70-Percent-of-Internet-of-Things-Devices/ba-p/6556284
• Civilian sector is better than the military at Cyber-War exercise. *rollseyes*
  • http://www.navytimes.com/article/20140804/NEWS04/308040019/In-supersecret-cyberwar-game-civilian-sector-techies-pummel-active-duty-cyberwarriors?sf29369064=1
• Target booking $148M due to data breach
  • http://fortune.com/2014/08/05/target-data-breach-profit/
  • http://investors.target.com/phoenix.zhtml?c=65828&p=irol-sec
• PF Chang's does an astonishingly good job at being transparent about their breach(es)
  • http://www.bankinfosecurity.com/pf-changs-breach-33-locations-hit-a-7153/op-1

In this episode

• Who is J.W. Goerlich (redux from episode - 
• How did he get to where he is now?
• How does the security executive deal with the "moving finish line"?
• JW discusses how 'security' people can break down barriers between "us" and "them"
• We discuss why we still fail at the basics, and what all this means...
• JWG tries to talk about his favorite controls framework
• We discuss what difference it makes where the CISO reports in the enterprise
• What will the CISO be, or need to do, in ~3-5 years?
• We discuss hiring into InfoSec - from outside, or within ... and why?
• JW gives us the one thing you need to remember

Guest

• J.W. Goerlich ( @jwgoerlich ) - Results-driven IT management executive with a track record of building high performance teams and providing flawless execution. Leverages background in systems engineering, software development, and information security expertise to consistently lower operating costs and raise service levels. Designs solutions that support long-term strategic planning and create immediate impact throughout product lifecycle in process and efficiency gains.