In this episode...

• Raf sits down with Howard Shmidt to talk about Cyber Security from the public to private sectors and everything in between.
• Howard & Raf talk through challenges of cyber security in the board room
• Howard gives us some of the challenges that government faces, from his experience
• Don't miss this episode!

Guest

• Howard A. Schmidt ( @HowardAS ) - Former Supervisory Special Agent,Director of Computer Crime and Information Warfare, AF OSI, Former CSO Microsoft Corp. Former Chairman of White House Critical Infrastructure Protection Board, VP, CISO eBay Inc. Special Agent, US Army CID (Reserves). Law Enforcement Officer Chandler Police Department, AZ

In this episode...

• Standard & Poor's Adding Cybersecurity to Ratings
  • The headline
    • In a report issued this week, the rating agency says it could issue a downgrade before a cyberattack if a bank looked ill-prepared, or following a breach that causes significant damage to a bank's reputation or which leads to substantial monetary losses or legal damages.
  • Behind the curve? Stop.
    
    • Michael wrote about it this week - stop calling it gaps…
  • 16 questions… good start?
    • How long has it typically taken to detect a cyberattack?
    • What containment procedures are in place if the bank is breached?
    • How many times was the business the target of a high-level attack during the past year, and how far did it reach in the system?
    • What's the internal phishing success rate?
    • What kind of expertise about cyberattacks exists on the board of directors?
    • How much does the bank spend on cybersecurity, what resources does it devote, and what is the total tech budget this year versus last?
  • Including security in the ratings - and we’re crying?
  • Claim this leads to more insurance… how about that…
  • http://www.bankinfosecurity.com/sps-cybersecurity-warning-late-to-game-a-8556
• Crisis Services Top Insurers’ Cyber Claims Payouts; Average Claim at $674K
  • This is interesting; and it’s a good data point, too -- in contrast to the “costs” we hear about in briefings all the time.
  • Saw other stories that suggested the insurance is going to get jacked… of course they are.
  • More insurance, more insight, more claims, more data…. this is all good
  • http://www.insurancejournal.com/news/national/2015/10/05/383785.htm
• New California law requires warrants for online data
  • Same warrant requirements as files in your filing cabinet
  • Doesn’t change Federal law capabilities to not have warrant.
  • Worth remembering: feds can compel your biometric, but not your password
  • Do you encrypt? policies? practices?
  • http://www.cnet.com/uk/news/new-california-law-requires-police-to-get-warrants-for-online-data/
• Obama administration opts not to force firms to decrypt data (for now)
  • for now….
  • opportunity for involvement
  • great chance to connect with your legal and other groups; what is the best way for your organization to handle it
    
  • https://www.washingtonpost.com/world/national-security/obama-administration-opts-not-to-force-firms-to-decrypt-data--for-now/2015/10/08/1d6a6012-6dca-11e5-aa5b-f78a98956699_story.html
• Apple removes several apps from store, they could be spying on you
  • Key issue: root certificates installed
  • http://arstechnica.com/security/2015/10/apple-removes-several-apps-that-could-spy-on-encrypted-traffic/

In this episode...

• Raf asks why we talking about global supply chain, 3rd party risk again
• Josh discusses what little things we are not thinking about today, that we should
• Josh discusses what happens as companies move critical data to the cloud
• We discuss regional IT in a global data world
• Raf opens up the “tiny company 3rd party” can of worms
• We discuss the cyber crime survey and CISO board reporting results; link:
  http://www.csoonline.com/article/2978020/security-leadership/do-boards-of-directors-actually-care-about-cybersecurity.html
  
• What about supply-chain issues with electronic components, software?

Guest:

• Josh Douglas - CTO for Raytheon Cyber Products – has nearly two decades of experience in helping global enterprises and government agencies secure their most prized business/mission assets. During his past 9 years at Raytheon, he has overseen Raytheon’s Cyber Security Intelligence Operations, Malware Concepts, Security Infrastructure Operations and Research Technologies tasked to produce effective forward-looking cyber software solutions to contain and control advanced threats. These solutions are used to help commercial and government entities protect their enterprises and the global cyber supply chain from ever-changing advanced persistent threats and malware.
  
  Prior to joining Raytheon, Joshua has a successful track record in network security operations and engineering management positions, securing enterprise environments while promoting contextual response. Prior employers include Enterasys Networks, Kronos, Genuity, MIT Lincoln Laboratory and other prominent enterprises. Joshua earned a Bachelor of Science Degree in Computer Science from Appalachian State University and currently holds a number of technical computer and network security certifications. LinkedIn: https://www.linkedin.com/in/jdouglas

In this episode...

• Patreon got hacked, but it's OK
  • This is a lesson in how to do security in a reasonable manner
  • Great response, good security
  • https://www.patreon.com/posts/important-notice-3457485
• The double-edged blade of the DMCA could have helped VW cheat emissions
  • Reverse-engineering illegal
  • Definitions of 'researcher' and further 'independent researcher' are interestingly defined - lots of room for discussion
  • http://www.itworld.com/article/2986856/enterprise-software/how-the-dmca-may-have-let-carmakers-cheat-clean-air-standards.html
• CFOs are getting involved in security whether they want to or not
  • Good to-do checklist for CFOs
  • http://ww2.cfo.com/accounting-tax/2015/09/deals-demand-prior-cfo-involvement-data-security/
• Lawsuits preventing disclosure of vulnerabilities in the news
  • We're "chilling security research" again
  • Good points made, on top of bad points and half-truths
  • Stems from the Fireeye vs ERNW fight
  • http://ww2.cfo.com/accounting-tax/2015/09/deals-demand-prior-cfo-involvement-data-security/
• Verizon reports on the state of network transformation
  • security still an issue, and top priority
  • human talent is still a problem
  • lots of leadership opportunities here
  • http://www.enterprisenetworkingplanet.com/netsysm/verizon-reports-on-the-state-of-digital-network-transformation.html