In this episode...

• We discuss what in the world is going on in the healthcare space, and why they’re such a target for attackers
• Dustin discusses why the explosion in digitalization in health care is both amazing and terrifying
• We discuss future-proofing “smart” healthcare
• I stumble on “the fundamentals”
• Dustin discusses the security of “data analytics” in the healthcare space
• I ask how we can make health care professionals better security people, without making them security people
• I ask Dustin what the healthcare industry should be doing, going forward into 2016

Guest

• "Dustin" is a progressive CISO at a Fortune 250 Healthcare organization

In this episode...

1. Vizio is getting sued, over data their TVs collect?
   • James provided security tips on the local news station and one of those tips was around the privacy details of your gadgets
   • Companies need to be considering what they are doing with their data
   • At what point does data go from an asset to a liability?
   • Do companies understand the difference?
   • http://www.consumerreports.org/lcd-led-oled-tvs/vizio-sued-for-smart-tv-data-sharing
2. Wyndham settles (caves to) the FTC
   • Agrees to legally be bound to do things they should already be doing .. ?
   • 20 years of audits
   • Interesting ending to the long saga, assuming the courts approve
   • https://www.ftc.gov/news-events/press-releases/2015/12/wyndham-settles-ftc-charges-it-unfairly-placed-consumers-payment
3. The US Federal Bureau of Investigation (FBI) admits to using 0day vulnerabilities
   • Why is anyone surprised?
   • Goes to a question of trust, and that's it.
   • Are these being found anyway through programs like bug bounties?
   • http://searchsecurity.techtarget.com/news/4500260464/FBI-admits-to-using-zero-day-exploits-not-disclosing-them
4. Google introduces DLP into Google Apps
   • So far it's just for their Unlimited customers
   • Are we reaching a tipping point where security becomes a feature and not a stand-alone discipline?
   • Definitely a game-changer
   • Basic patterns and detection built-in FREE
   • http://techcrunch.com/2015/12/09/new-google-apps-feature-helps-businesses-keep-sensitive-information-out-of-emails/
5. Black boxes on ships can be hacked
   • Could be worse, someone could be claiming to make the boat float sideways?
   • Is this a big deal, probably; is it a bigger deal than other things wrong?
   • Who is exploiting this, and how do the good guys fix the problem?
   • http://arstechnica.com/information-technology/2015/12/hacked-at-sea-researchers-find-ships-data-recorders-vulnerable-to-attack/

Thanks for joining us! This is a very important episode with true experts on the topic of cyber insurance. I was lucky enough to get an attorney and a VP of an insurance firm who specialize in the topic and their depth of knowledge and candor may shock you.

The net is that cyber insurance is a positive for our industry.

In this episode..

• Eran says that if you don’t do good security, the courts will frown down upon that
• Keith tells us why insurance covers security, but it does not cover negligence
• We start back on the discussion on the importance of knowing your critical assets
• Keith discusses why the insurance market is essentially a mirror of your program
• Eran talks about how his team dissect and investigate breaches to improve understanding
• Keith and Eran discuss how the process of buying cyber insurance can actually lead to improved security

Guests

• Eran Kahana ( https://www.linkedin.com/in/erankahana ) - Attorney, Maslon, LLP with extensive data security experience and an expert in cyber insurance marketplace.
• L.Keith Burkhardt ( https://www.linkedin.com/in/keith-burkhardt-587b3772 ) - VP, Kraus-Anderson Insurance where he works towards innovative products and services for the industry and has been addressing the cyber insurance market for about two years.

In this episode

I interview Mike Daugherty - author of The Devil Inside the Beltway [Amazon.com link] live from the Security Advisor Alliance first-ever Summit in Dallas, TX. Mike was kind enough to sit down with me (twice, thanks to a tech failure) and tell his absolutely surreal story of what happened to him, his company at the hands of what can only be described as an insane situation.

If you own a business, or manage a business, or work in enterprise -- you need to hear Mike's story. If it wasn't documented and video recorded, you'd never believe it's true.

Truth be told, I've been a supporter of the FTC as an advocate for the victims of breaches - the person who's information is stolen. After hearing Mike's story... I have had my mind completely changed.

In this episode

• We start a constructive discussion addressing the problem of the ‘talent shortage’
• The panel discusses the general lack of understanding of the big picture challenge from both sides: business and security
• The panel discusses basic security issues in an expanding ecosystem of Internet connected things
• The panel discusses some real potential solutions to our talent issue

Guests

• Bryce Austin ( @BryceA )
• Holly Miller ( @OPSEC_Girl )
• Jeff Man ( @MrJeffMan )
• Mike Kearn ( @MichaelKearn )

In this episode...

• Is this seriously the FBI suggestion to companies hit with ransomware?
  • http://thehackernews.com/2015/10/fbi-ransomware-malware.html
  • Sets an awful precedent ... or does it?
  • What other options are there?
  • Would you take this advice?
• Microsoft is opening a data center in the UK ...why?
  • http://thehill.com/policy/cybersecurity/259656-microsoft-opens-uk-only-data-center-following-eu-ruling
  • Have the US spying revelations finally hit home?
  • What about EU Safe Harbor?
  • What do you think, if you're a multi-national Internet company?
• Is healthcare really that far behind enterprise security?
  • http://www.cnbc.com/2015/11/11/us-health-care-way-behind-on-data-security-says-forrester.html
  • Forrester calling out the healthcare sector for being far behind on security
  • Is there more pressure, less attention, or more legacy? (or all?)
  • How do you fix this situation?
• Disheartening (but predictable) state of human weakness
  • http://www.scmagazineuk.com/many-uk-workers-willing-to-sell-their-companys-ip-study/article/452428/
  • Are your employees willing to sell your company's intellectual property?
  • What can you do about it?
• YikYak not so anonymous, can reveal user data to cops
  • http://bigstory.ap.org/article/8535dd899f554fb3b5dd1c9498d610b5/yik-yak-social-media-service-can-reveal-user-data-police
  • Is there any anonymous social media, really?

In this episode

• Rob & Liam discuss the practical applications of threat intelligence for today's enterprise
• We discuss what enterprise threat intelligence really is (and also what it isn't)
• We discuss the place of feeds, tools, processes and people in the mechanics of the program
• We discuss the need to conduct a program-based intelligence approach for the enterprise

Guests

• Liam Randall ( @hectaman ) - With a career spanning 20 years, Liam Randall has worked at every level of the information systems pipeline- from building and operating large networks, developing and maintaining large 100M+ e-commerce solutions, to designing and implementing global network security monitoring sensor grids. A frequent speaker and trainer at security conferences Liam has trained over 1000 students on advanced incident response with a focus on leveraging the open source Bro Platform. 
  • https://www.linkedin.com/in/hectaman
• Robert M. Lee ( @RobertMLee ) - Robert M. Lee is the founder and CEO at Dragos Security LLC where he helped design and build CyberLens - a cyber situational awareness software tool for critical infrastructure networks. He is also a non-resident National Cybersecurity Fellow at New America focusing on policy issues relating to the cyber security of critical infrastructure. For his research and focus areas, Robert was named one of Passcode’s Influencers and awarded EnergySec's 2015 Cyber Security Professional of the Year.
  • https://www.linkedin.com/in/robert-m-lee-b2096532

In this episode...

• Turn any old car into a "smart car" for $200 with this new miracle device
  
  • "BACKED BY FROGVENTURES, VOYOMOTIVE IS TACKLING THE BURGEONING CONNECTED-CAR SPACE"
  • Could be a fantastic idea
  • Could be an awful idea
  • Has anyone considered the security ramifications?
  • What about privacy?
  • http://www.fastcodesign.com/3052012/this-device-will-turn-your-clunker-into-a-smart-car-for-200?utm_source#4
• OMB preps cyber sprint follow-up
  • Michael's take on "gap focus": http://www.csoonline.com/article/2992553/security-leadership/stop-focusing-on-gaps-to-gain-influence-as-a-security-leader.html
  • Hoping for 75% authentication for 2FA - not exactly great
  • Lots of challenges here, but is this the right thing to do?
• TalkTalk breached, 3 teenagers arrested, CEO goes tone deaf
  • CEO says they "were not legally required to encrypt client information"
  • Teenagers arrested in breach
  • The poster child for having a breach preparedness plan, before the cameras start rolling and media starts calling
  • https://hacked.com/british-police-arrest-15-year-old-telecom-hack-ransom-demanded-bitcoin/
  • http://www.theregister.co.uk/2015/02/27/talktalk_admits_massive_data_breach/
• Lots of talk on security - but is anyone talking to each other?
  • http://www.eenews.net/stories/1060026736
  • http://cjonline.com/news/2015-10-25/bbb-small-business-cybersecurity-hackers-are-not-just-trick-or-treaters

In this episode...

• Raf sits down with Howard Shmidt to talk about Cyber Security from the public to private sectors and everything in between.
• Howard & Raf talk through challenges of cyber security in the board room
• Howard gives us some of the challenges that government faces, from his experience
• Don't miss this episode!

Guest

• Howard A. Schmidt ( @HowardAS ) - Former Supervisory Special Agent,Director of Computer Crime and Information Warfare, AF OSI, Former CSO Microsoft Corp. Former Chairman of White House Critical Infrastructure Protection Board, VP, CISO eBay Inc. Special Agent, US Army CID (Reserves). Law Enforcement Officer Chandler Police Department, AZ

In this episode...

• Standard & Poor's Adding Cybersecurity to Ratings
  • The headline
    • In a report issued this week, the rating agency says it could issue a downgrade before a cyberattack if a bank looked ill-prepared, or following a breach that causes significant damage to a bank's reputation or which leads to substantial monetary losses or legal damages.
  • Behind the curve? Stop.
    
    • Michael wrote about it this week - stop calling it gaps…
  • 16 questions… good start?
    • How long has it typically taken to detect a cyberattack?
    • What containment procedures are in place if the bank is breached?
    • How many times was the business the target of a high-level attack during the past year, and how far did it reach in the system?
    • What's the internal phishing success rate?
    • What kind of expertise about cyberattacks exists on the board of directors?
    • How much does the bank spend on cybersecurity, what resources does it devote, and what is the total tech budget this year versus last?
  • Including security in the ratings - and we’re crying?
  • Claim this leads to more insurance… how about that…
  • http://www.bankinfosecurity.com/sps-cybersecurity-warning-late-to-game-a-8556
• Crisis Services Top Insurers’ Cyber Claims Payouts; Average Claim at $674K
  • This is interesting; and it’s a good data point, too -- in contrast to the “costs” we hear about in briefings all the time.
  • Saw other stories that suggested the insurance is going to get jacked… of course they are.
  • More insurance, more insight, more claims, more data…. this is all good
  • http://www.insurancejournal.com/news/national/2015/10/05/383785.htm
• New California law requires warrants for online data
  • Same warrant requirements as files in your filing cabinet
  • Doesn’t change Federal law capabilities to not have warrant.
  • Worth remembering: feds can compel your biometric, but not your password
  • Do you encrypt? policies? practices?
  • http://www.cnet.com/uk/news/new-california-law-requires-police-to-get-warrants-for-online-data/
• Obama administration opts not to force firms to decrypt data (for now)
  • for now….
  • opportunity for involvement
  • great chance to connect with your legal and other groups; what is the best way for your organization to handle it
    
  • https://www.washingtonpost.com/world/national-security/obama-administration-opts-not-to-force-firms-to-decrypt-data--for-now/2015/10/08/1d6a6012-6dca-11e5-aa5b-f78a98956699_story.html
• Apple removes several apps from store, they could be spying on you
  • Key issue: root certificates installed
  • http://arstechnica.com/security/2015/10/apple-removes-several-apps-that-could-spy-on-encrypted-traffic/

In this episode...

• Raf asks why we talking about global supply chain, 3rd party risk again
• Josh discusses what little things we are not thinking about today, that we should
• Josh discusses what happens as companies move critical data to the cloud
• We discuss regional IT in a global data world
• Raf opens up the “tiny company 3rd party” can of worms
• We discuss the cyber crime survey and CISO board reporting results; link:
  http://www.csoonline.com/article/2978020/security-leadership/do-boards-of-directors-actually-care-about-cybersecurity.html
  
• What about supply-chain issues with electronic components, software?

Guest:

• Josh Douglas - CTO for Raytheon Cyber Products – has nearly two decades of experience in helping global enterprises and government agencies secure their most prized business/mission assets. During his past 9 years at Raytheon, he has overseen Raytheon’s Cyber Security Intelligence Operations, Malware Concepts, Security Infrastructure Operations and Research Technologies tasked to produce effective forward-looking cyber software solutions to contain and control advanced threats. These solutions are used to help commercial and government entities protect their enterprises and the global cyber supply chain from ever-changing advanced persistent threats and malware.
  
  Prior to joining Raytheon, Joshua has a successful track record in network security operations and engineering management positions, securing enterprise environments while promoting contextual response. Prior employers include Enterasys Networks, Kronos, Genuity, MIT Lincoln Laboratory and other prominent enterprises. Joshua earned a Bachelor of Science Degree in Computer Science from Appalachian State University and currently holds a number of technical computer and network security certifications. LinkedIn: https://www.linkedin.com/in/jdouglas

In this episode...

• Patreon got hacked, but it's OK
  • This is a lesson in how to do security in a reasonable manner
  • Great response, good security
  • https://www.patreon.com/posts/important-notice-3457485
• The double-edged blade of the DMCA could have helped VW cheat emissions
  • Reverse-engineering illegal
  • Definitions of 'researcher' and further 'independent researcher' are interestingly defined - lots of room for discussion
  • http://www.itworld.com/article/2986856/enterprise-software/how-the-dmca-may-have-let-carmakers-cheat-clean-air-standards.html
• CFOs are getting involved in security whether they want to or not
  • Good to-do checklist for CFOs
  • http://ww2.cfo.com/accounting-tax/2015/09/deals-demand-prior-cfo-involvement-data-security/
• Lawsuits preventing disclosure of vulnerabilities in the news
  • We're "chilling security research" again
  • Good points made, on top of bad points and half-truths
  • Stems from the Fireeye vs ERNW fight
  • http://ww2.cfo.com/accounting-tax/2015/09/deals-demand-prior-cfo-involvement-data-security/
• Verizon reports on the state of network transformation
  • security still an issue, and top priority
  • human talent is still a problem
  • lots of leadership opportunities here
  • http://www.enterprisenetworkingplanet.com/netsysm/verizon-reports-on-the-state-of-digital-network-transformation.html

In this episode...

• Kirby tells us what OSINT is
• We discuss how much we are giving away on digital channels?
• We discuss if there is such a thing as anonymity anymore
• Location sharing in apps — the bad, the ugly, the scary
• Kirby and Michael discuss “checking up on your executives”
• Raf talks about “logo pages” — why do these still exist?!
• Kirby gives us some thoughts on OPSEC
• Kirby leaves us with a dose of reality about privacy in today’s world

Guest

• Kirby Plessas ( @kirbstr ) - Kirby is the CEO of Plessas Experts Network, Inc. She did some things before this too, but we can't tell you about them or we'd have to black-bag you and send you to Gitmo. You can get her LinkedIn bio here: https://www.linkedin.com/in/kirbyp.

On this episode of the NewsCast

• Intel forms new Automotive Security Research Board (ASRB) to focus on security of their automotive platform
  • http://newsroom.intel.com/community/intel_newsroom/blog/2015/09/13/intel-commits-to-mitigating-automotive-cybersecurity-risks
  • Good security as a competitive advantage?
  • Interesting development in the effort to secure cars as a technology platform
• Appeals court forces the issue of 'fair use' in DMCA case
  • http://www.engadget.com/2015/09/14/appeals-court-copyright-holders-must-consider-fair-use-before/
  • Interesting development in the case against Universal Music Group's malicious prosecution and nonsense take-down orders
• Bitpay sues their insurance company after giving away $1.8M
  • http://www.coindesk.com/bitpay-sues-insurer-after-losing-1-8-million-in-phishing-attack/
  • Interesting argument in court - indirect loss
  • Company exec got phished for credentials
  • Execs fall for "transfer large quantity of money" scam
  • Follow this case!
• China making demands of US tech companies
  
  • http://www.engadget.com/2015/09/17/china-us-tech-companies-security-policies/
  • This has happened before...US companies found ways around this once
  • Essentially it appears as though China is asking for 'backdoors' and secret access to source code, etc in order to do business in China
  • Talk about anti-competitive!
• The Kardashian train wreck exposes fans' information due to web flaw
  • http://techcrunch.com/2015/09/16/kardashian-website-security-issue-exposes-names-emails-of-over-half-a-million-subscribers-payment-info-safe/#.gofm76:EZbS
  • Some 'developer' wanted to see how the site worked, poked around and found an interesting flaw and posed it to owners
  • ~500,000 subscribers info exposed

In this episode...

• Brandon, Michael and I discuss the challenges of leadership and how leadership is more than just telling people what to do. Brandon gives us some of his back-stories and anecdotes to illustrate his points on leadership along the way.
• I promise you'll love this episode, and I highly encourage you to go donate what you're able to, to Red Circle Foundation (http://redcirclefoundation.org).

Guest

• Brandon Webb ( @BrandonTWebb ) - Brandon is a former Navy SEAL, bestselling author and CEO of Force12 Media. He founded Red Circle Foundation as a way to give back to the families of the Special Ops community in a meaningful way.

Links

• Red Circle Foundation - http://redcirclefoundation.org/ 
• SOFREP - http://sofrep.com
• Brandon's website - http://brandontylerwebb.com/