Listen to three guys talk about some funny and insightful stuff!
…
continue reading
The Virtual CISO Podcast is a frank discussion that provides the very best information security advice and insights for Security, IT and Business leaders. If you’re looking for the latest strategies, tips, and trends from seasoned information security practitioners, want no-B.S. answers to your biggest security questions, need a perspective on how your peers are addressing the same issues, or just simply want to stay informed and proactive, then welcome to the show. Our moderator, John Verry ...
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 142: CNAPP - Secure Cloud Apps in a Snap
43:06
43:06
Play later
Play later
Lists
Like
Liked
43:06
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 141: Stopping Business Email Compromise with a Novel Malicious File Reconstruction Approach
38:22
38:22
Play later
Play later
Lists
Like
Liked
38:22
In this episode of The Virtual CISO Podcast, your host, John Verry, engages in a conversation with Aviv Grafi, CTO and founder of Votiro, as they discuss innovative solutions to combat business email compromise. Join us as we discuss: The mechanisms of business email compromise How malicious files are used in cyberattacks The limitations of traditi…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 140: DIB/CMMC Cybersecurity – Interesting Observations from a Significant Study
47:44
47:44
Play later
Play later
Lists
Like
Liked
47:44
Join us for an engaging episode of the Virtual CISO Podcast with host John Verry. This episode features Chris Petersen, co-founder of LogRhythm and current CEO of Radical. Chris brings over two decades of experience in cybersecurity, offering deep insights into the industry's challenges and advancements. In this episode, we'll explore: - The surpri…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 139: How adding Crisis Management to your Incident Response Plan can save your bacon?
38:53
38:53
Play later
Play later
Lists
Like
Liked
38:53
Join us for an engaging episode of the Virtual CISO Podcast with host John Verry. This episode features Kevin Dinino, President of KCD PR, who delves into the critical aspects of crisis management and communications. Kevin brings over 20 years of experience in guiding companies through the complexities of strategic communications, particularly in t…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 138: Is Consuming SaaS an Information Security Faustian Bargain? w/ William Eshagh
44:30
44:30
Play later
Play later
Lists
Like
Liked
44:30
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 137: Strategies and Insights w/ Sagi Brody
30:57
30:57
Play later
Play later
Lists
Like
Liked
30:57
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 136: AI Risk Management – Is ISO 42001 the Solution? w/ Ariel Allensworth
52:45
52:45
Play later
Play later
Lists
Like
Liked
52:45
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 135: Can Distributed Ledger Technology Simplify Privacy Compliance? W/ Zenobia Godschalk
43:06
43:06
Play later
Play later
Lists
Like
Liked
43:06
In this episode of The Virtual CISO Podcast, your host, John Verry, engages in a conversation with guest Zenobia Godschalk, Senior Vice President of Hedera Hashgraph, as they discuss distributed ledger technology and its effects on privacy compliance. Join us as we discuss the following: The erosion of Privacy Online Distributed Ledger Technology (…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 134: Understanding TISAX w/ Alexander Häusler
49:47
49:47
Play later
Play later
Lists
Like
Liked
49:47
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Kubernetes Security – Simplified Shauli Rozen, CEO of ARMO
48:12
48:12
Play later
Play later
Lists
Like
Liked
48:12
In this episode of The Virtual CISO Podcast, your host, John Verry, engages in a conversation with guest Shauli Rozen, CEO and Co-Founder of ARMO, exploring the intricacies of Kubernetes, the orchestration tool that's reshaping how we deploy, scale, and manage containerized applications. Join us as we discuss: What a container is Implications of co…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 132: Optimize Your SOC 2 - Lessons Learned from the 2023 Benchmark Study w/ Scott Woznicki
43:31
43:31
Play later
Play later
Lists
Like
Liked
43:31
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 131: The New CMCC Proposed Rule w/ Jeff Carden & Warren Hylton
51:44
51:44
Play later
Play later
Lists
Like
Liked
51:44
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 130: Revolutionizing Security Training with Kevin Paige CISO and VP of Product Strategy at Uptycs
46:56
46:56
Play later
Play later
Lists
Like
Liked
46:56
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 129: Empowering Diversity in the Cybersecurity Industry with Larry Whiteside Jr.
40:08
40:08
Play later
Play later
Lists
Like
Liked
40:08
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Episode 128: Understanding the ISO 27001:2022 Update with Andrew Frost and Leigh Ronczka
36:40
36:40
Play later
Play later
Lists
Like
Liked
36:40
In this episode of The Virtual CISO Podcast, your host, John Verry, sits down with Andrew Frost and Leigh Ronczka of CBIZ Pivot Point Security to discuss the updates needed to successfully transition from ISO27001:2013 to ISO 27001:2022. Join us as we discuss: How simplistic it is for a company to transition to ISO 27001:2022 The level of effort re…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 127: The Future of Security: Unraveling the World of Social Engineering
57:11
57:11
Play later
Play later
Lists
Like
Liked
57:11
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 126: Unlocking AI's Potential: Risks, Optimism & Challenges in the Current Wave of AI Technology
57:30
57:30
Play later
Play later
Lists
Like
Liked
57:30
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep: 125 - Understanding the New FTC Safeguards Rule: Key Changes and Requirements Explained
36:52
36:52
Play later
Play later
Lists
Like
Liked
36:52
Tune into an insightful conversation with Jeremy Price, co-leader of a national cybersecurity practice. In this engaging discussion, Jermey explains the updated FTC safeguard rules that went into effect in June and what they’re intended to do. In this episode, your host, John Verry, and Jeremy Price discuss: - The Gramm Leach Bliley Act updates and…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
An Introduction to AI and its Place in the Work Place with CEO of Private AI Patricia Thaine
45:22
45:22
Play later
Play later
Lists
Like
Liked
45:22
Join us for an insightful conversation with Patricia Thaine, Founder and CEO of Private AI, as we delve into the world of artificial intelligence, language models, and data privacy. In this engaging discussion, Patricia sheds light on the transformative potential of AI, particularly language models like GPT-3.5, in various industries. In this episo…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 123: Navigating IT-OT Dynamics: Cybersecurity, Integration, and Collaboration
45:44
45:44
Play later
Play later
Lists
Like
Liked
45:44
By John Verry
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 122: Navigating New Horizons: CMMC, NIST 800-171 Updates, and Compliance Insights
40:34
40:34
Play later
Play later
Lists
Like
Liked
40:34
In this episode of the "Virtual CISO Podcast," your host John Verry speaks with guest Warren Hylton, a FedRisk consultant at CBIZ Pivot Point Security, to explore recent updates in cybersecurity regulations. The conversation revolves around the Cybersecurity Maturity Model Certification (CMMC) and the updated NIST Special Publication 800-171 (R2 to…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 121: Strategies for Reducing the Cost of Your Cyber Liability Insurance Policy
23:16
23:16
Play later
Play later
Lists
Like
Liked
23:16
Like many other businesses, law firms are at significant risk of cyber-attack and increasingly are turning to cyber liability insurance (CLI) to transfer some of their cyber risk. But many are being denied coverage or face high premiums due to shortfalls in their cybersecurity controls. In this episode, your host John Verry, CBIZ Pivot Point Securi…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 120: A FedRAMP ATO – The Good, The Bad, and the Ugly
38:42
38:42
Play later
Play later
Lists
Like
Liked
38:42
To do wide-scale business within the US federal government, cloud service providers (CSPs) need a FedRAMP ATO. The prospect can be daunting as few CSPs have federal cyber compliance expertise. Misconceptions and misinformation can create additional roadblocks. In this episode, your host John Verry, CBIZ Pivot Point Security Managing Director , sits…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 119: What is a Microservice Architecture and how do I secure it?
46:46
46:46
Play later
Play later
Lists
Like
Liked
46:46
Whatever kind of software application a team is building, the identification and remediation of cybersecurity issues needs to be part of every stage of the software development lifecycle (SDLC). But making that happen takes a wealth of skills and approaches, as well as an eye on compliance and the ability to keep pace with the ever-changing online …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 118: The Simplest Way to Transition from ISO 27001:2013 to ISO 27001:2022
39:17
39:17
Play later
Play later
Lists
Like
Liked
39:17
If you are ISO 27001 certified, or considering it, you are likely wondering how the transition from ISO 27001:2013 to ISO 27001:2022 affects you. With the notable changes, there are many uncertainties. For example, how soon can you get certified to ISO 27001:2022? Can you still get certified to 27001:2013? For anyone already certified, how soon can…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 117: Eight Key Takeaways from the RSA 2023 Conference
17:37
17:37
Play later
Play later
Lists
Like
Liked
17:37
In this week's episode of the Virtual CISO podcast, your host John Verry, Pivot Point Security CISO and Managing Partner, shares his valuable insights from the 2023 RSA conference. As the security industry evolves, with an increasing number of vendors and products, John advises against adopting a product-based security strategy. Instead, he recomme…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 116: What is an SBOM & Why Are My Customers Suddenly Asking for One?
36:45
36:45
Play later
Play later
Lists
Like
Liked
36:45
With the release of President Biden’s Executive Order 14028 on “Improving the Nation’s Cybersecurity” from May 2021 the US public and private sectors have been alerted to the significant cybersecurity risks within our software supply chain. As of the March 2023 release of the National Cybersecurity Strategy, which will shift liability for software …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 115: If Your Asset Management Sucks, Your Security Sucks
47:00
47:00
Play later
Play later
Lists
Like
Liked
47:00
Asset management is a crucial aspect of information security. It refers to the processes and procedures involved in identifying, organizing, tracking, and protecting an organization's assets. The security of these assets is paramount, as you can’t protect what you don’t know about. To learn more about how to Fix Cyber Asset Management, your host Jo…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 114: 4 Tactical Steps To Implementing DevSecOps In 2023
51:44
51:44
Play later
Play later
Lists
Like
Liked
51:44
DevSecOps is the practice of integrating security testing at every stage of the software development process. With DevSecOps, training and educating all teams in risk, security, and mitigation at all stages of development is a top priority– traditionally, app developers don't pay much attention to security, which increases the risk of vulnerable co…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 113: Should we be in Microsoft 365 GCC, GCC High, or Commercial?
46:45
46:45
Play later
Play later
Lists
Like
Liked
46:45
Microsoft 365 was launched in 2011 in hopes of revolutionizing cloud-powered productivity platforms. Since then, Microsoft 365 has grown to the point where it is now one of the largest cloud-powered productivity platforms on the market, competing with the likes of Google and more. To give organizations a clear picture of their Microsoft 365 options…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 112: When should you move to ISO 27001:2022?
50:28
50:28
Play later
Play later
Lists
Like
Liked
50:28
ISO 27001:2022 is the first update to the global "gold standard" for provable cybersecurity in ten years. Notable changes from the 2013 version will likely significantly impact most organizations' Information Security Management Systems (ISMS). In this episode, your host John Verry sits down with Ryan Mackie and Danny Manimbo from Schellman & Co. t…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 111: How to use the Software Assurance Maturity Model (SAMM) to Build Highly Secure Applications
37:30
37:30
Play later
Play later
Lists
Like
Liked
37:30
The “buzz” in building more secure applications is “shift security left,” which means integrating security into and throughout the Software Development Lifecycle (SDLC). The Software Assurance Maturity Model (SAMM) is an excellent tool from OWASP that provides a framework for assessing and improving your development processes, resulting in more sec…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 110: Understanding TISAX (Trusted Information Security Assessment Exchange)
33:00
33:00
Play later
Play later
Lists
Like
Liked
33:00
Trusted Information Security Assessment Exchange (TISAX) is a vendor due diligence standard used in the automotive industry to verify that third-party suppliers’ cybersecurity programs provide adequate protection for the information the automotive supplier shares. In this episode, your host John Verry, CISO and Managing Partner at Pivot Point Secur…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 109: Understanding How Cybercriminals Operate Can Protect Your Business
45:39
45:39
Play later
Play later
Lists
Like
Liked
45:39
In today’s cyber landscape, business leaders and security professionals need every edge they can gain to better protect their organizations and plan their defense against attackers. . Why do hackers do what they do? What are they trying to steal from you? Who do they partner with to make money and avoid getting caught? In this episode, hosted by Jo…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 108: Understanding the Legalities Around CUI
51:05
51:05
Play later
Play later
Lists
Like
Liked
51:05
Orgs in the DIB need to protect CUI in alignment with the NIST 800-171 cybersecurity standard—and soon the Cybersecurity Maturity Model Certification (CMMC) requirements—or face legal and compliance penalties as well as potential lost business. To clarify the biggest questions and reveal the most dangerous unknowns in the convoluted realm of CUI, y…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 107: An AWS Security Guru’s Recommendation for Securing your AWS Infrastructure
47:57
47:57
Play later
Play later
Lists
Like
Liked
47:57
Over 90% of security breaches in the public cloud stem from user error, and not the cloud service provider. Today, your host John Verry sat down with one of Amazon Web Services (AWS) own Temi Adebambo, to understand what is going wrong with public cloud security, and how you can eliminate your biggest risks. This episode features Temi Adebambo, Hea…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 106: Strategies to Manage Cybersecurity through an Economic Downturn
23:50
23:50
Play later
Play later
Lists
Like
Liked
23:50
Managing Cybersecurity through an Economic downturn is no easy task. With increasing concerns on how to stay secure and compliant in a down economy, John Verry tackles this podcast himself giving you his ten best fundamental practices. This episode features your host John Verry, CISO & Managing Partner, from Pivot Point Security, who provides answe…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 105: Solving the Problems of Cloud Native Apps.
34:55
34:55
Play later
Play later
Lists
Like
Liked
34:55
Building Cloud Native Applications can bring about many operational and security problems. Today, we sat down with an expert in this field to talk about building cloud native applications, and deploying applications that are secure in the cloud. This episode features Fausto Lendeborg, Co-Founder & CCO, from Secberus, who provides answers and explan…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 104: Is Digital Business Risk Mgt. The Future of ASM
46:14
46:14
Play later
Play later
Lists
Like
Liked
46:14
Digital Business Risk Management helps companies track and disrupt the most advanced bad actors. Team Crymu specializes in Digital Business Risk Management & Attack Surface Management, giving clients insight and help relating to cyber threats. This episode features David Monnier, Chief Evangelist and Team Cymru Fellow, from Team Cymru, who provides…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 103: The Complexity of Deploying a Secure Application in the Cloud
50:30
50:30
Play later
Play later
Lists
Like
Liked
50:30
Governance, Risk, and Compliance (GRC) platforms can be tricky to construct. Today, we sat down with an expert in this field to talk about building and deploying secure applications in the cloud. This episode features Jeff Schlauder, Information Security Executive, from Catalina Worldwide, who provides answers and explanations to a variety of quest…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 102: The Intersection of Privacy and Security
38:55
38:55
Play later
Play later
Lists
Like
Liked
38:55
You cannot have privacy without security. While they once existed quite distinct from one another, they are now so delicately woven that they are nearly indistinguishable. Over time, the GDPR has cemented the relationship between physical security and information security, and now, it’s incorporating data privacy. This compliance triad has become t…
…
continue reading
CMMC (Cybersecurity Maturity Model Certification) can raise many red flags and concerns - As CMMC rulemaking approaches in 2023, we take a break from our normal podcast and answer the most asked CMMC questions to date to help ease the unknown. This episode features George Perezdiaz, FedRisk Practice Lead, with Pivot Point Security, who provides ans…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Ep 100: The Two Audiences For Privacy & How They Drive Data Collection
36:43
36:43
Play later
Play later
Lists
Like
Liked
36:43
This marks our 100th episode of The Virtual CISO and an insightful journey into having the opportunity to have frank discussions with thought leaders that provide the very best information security advice and insights. I am happy to have invited Dimitri Sirota, CEO & CoFounder of BigID, to walk through BigID’s approach to privacy, security, and dat…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Unpacking Critical Elements of Supply Chain Risk Management
46:11
46:11
Play later
Play later
Lists
Like
Liked
46:11
Supply chain risk management can prove to be a slippery slope—why should you take pains to conduct a proper risk assessment, and how do they impact IT and business continuity? From international restrictions to balancing generic and specific risk assessments, any guidance is welcome in the world of supply chain management. I invited Willy Fabritius…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Breaking Down the Latest in Software Security Standards & the Impact on SaaS Businesses
37:45
37:45
Play later
Play later
Lists
Like
Liked
37:45
What are the merits of the Software Assurance Maturity Model (SAMM), and how does it differ from the Application Security Verification Standard (ASVS) model? And why should you care? From design to operations, there are several crucial considerations to hold regarding business functions and use cases. I invited Taylor Smith, Application Penetration…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
What You Need to Know about APIs and API Security
43:35
43:35
Play later
Play later
Lists
Like
Liked
43:35
Application development is moving from a web-centric world to an API-centric world. If you’re wondering what that looks like, what the security implications are and what an API is, you’re in the right place. There is no shortage of new application security strategies to familiarize ourselves with as cybersecurity adapts to changing times. That’s wh…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
How to Measure the Value of Information Security
30:14
30:14
Play later
Play later
Lists
Like
Liked
30:14
Most recognize the value preservation in cybersecurity. But forward thinking professionals also see the value creation in having a secure information posture. Cybersecurity is the foundation of preserving sensitive data and providing peace of mind but does it create value for the organization and if so, how do we measure that value? Tracking the re…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Understanding NIST’s Secure Software Development Framework
45:55
45:55
Play later
Play later
Lists
Like
Liked
45:55
What exactly is a Software Development Life Cycle, and how does NIST’s Secure Software Development Framework impact that cycle and your organization? Of note, the SSDF will definitely impact you if your software is used by the US Government and will likely impact you even if it isn’t. There are a few choice practices that can help make sense of the…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
US Gov. Cybersecurity Roadmap: Where it came from and Where is it Going?
58:10
58:10
Play later
Play later
Lists
Like
Liked
58:10
Today, information is worth more than riches. The new currency is data. With this being true, the state of cybersecurity within the upper branches of the government was shockingly under-prepared. In this episode, I speak with Mark Montgomery, the former Executive Director of the Cyber Solarium Commission, about the report the commission published i…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Confronting the Wild West of Database Security
47:05
47:05
Play later
Play later
Lists
Like
Liked
47:05
Don’t wait for an emergency; secure your database correctly right out of the gate. Think of everything outside of your database as the wild west. What can you do to create the most controlled environment possible for all of your most sensitive data? I invited Robert Buda, President of Buda Consulting, Inc, and an expert in database technology, onto…
…
continue reading