In this episode I talk about an approach to deal with burn out on your team. This is based on a study located here. I also look at the GPEN versus the OSCP certification in this episode.

CISO Dojo

Dealing with Burn Out and GPEN Versus OSCP

Paul Tucker CISO of Bank of Oklahoma joins us for this episode of the CISO Dojo Podcast. Paul Tucker is Senior Vice President and Chief Information Security and Privacy Officer at BOK Financial. In this role Tucker leads the cybersecurity team responsible for the banks efforts to protect information important to the banks operation, while ensuring the overall cyber resiliency and privacy of the bank.

Meet Paul Tucker CISO of Bank of Oklahoma

Joe Sullivan and Stacy Dunn wrap up the the third part of their cloud security series. The episode extends into current events with casino ransomware attacks, supply chain attacks, and why casinos should not be getting breached. We also talk about Social Media happenings like INFOSEC Bikini, the negative element on Twitter, and haters of pants.

Cloud Security, Casinos, Supply Chain Attacks, INFOSEC Bikini, and Haters of Pants

Alex Tarter joins us on the podcast to discuss attack surface management and threat intelligence. Alex is one of the founding members of TurgenSec which has recently had an interesting string of responsible disclosures related to: Virgin Media The Gates Foundation Charity 190+ Law Firms The Philippines Government Check out Alex at: www.turgensec.com security@turgensec.com  

Attack Surface Management & Threat Intelligence with Alex Tarter

Part 3: Action items and actionable information; Give insights into how to support marginalized people and adopt better hiring practices.  Sources: https://www.thisishowyoucan.com/post/__wheel_of_power_and_privilege  https://www.forumone.com/ideas/why-and-how-to-prioritize-dei-at-your-organization/  http://greenlining.org/wp-content/uploads/2018/03/DEI-Framework.pdf  https://globewomen.org/globaldiversity/wp-content/uploads/2020/03/Korn-Ferry-Diversity-and-Inclusion-Maturity-Model-2020-Andres-Tapia.pdf  https://www.diversitybestpractices.com/sites/diversitybestpractices.com/files/attachments/2018/01/kaiser_final_part_2_3.pdf  http://www.triangledei.org/blog/the-deloitte-diversity-and-inclusion-model  https://www.slideteam.net/six-months-diversity-and-inclusion-initiative-competition-strategy-roadmap.html  https://www.businessinsider.com/free-online-courses-diversity-equity-inclusion-2020-10  https://www.microsoft.com/en-us/inclusion-journey https://blogs.microsoft.com/blog/2021/02/18/include-2021-a-global-event-to-engage-on-challenging-topics-to-accelerate-diversity-and-inclusion/ https://blog.powertofly.com/diversity-conferences-2021  https://www.cio.com/article/3564791/professional-organizations-focused-on-diversity-in-tech.html  https://blog.techinclusion.co/25-organizations-bringing-diversity-and-inclusion-to-tech-1c0dec0e151d  https://mdciowa.org/ 

Stacy Dunn on Diversity, Equity, and Inclusivity | Part 3

Chad Kliewer, CISO of Pioneer Telephone shares his journey in information security where he overcame nearly insurmountable challenges.  Chad has faced broad use of credential sharing, placing the mouse on the monitor, because this is how it's supposed to work right? Chad has survived Sox audits and even the SolarWinds attack. There's so much to learn from this episode from a CISO and information security perspective! Connect with Chad on Twitter @ChadKliewer  

Meet CISO Chad Kliewer

The White House just release a special document to the private sector about responsibility and steps to prevent ransomware. Quoting directly from the document: Companies that view ransomware as a threat to their core business operations rather than a simple risk of data theft will react and recover more effectively. The document goes on to talk about best practices such as: Utilizing Multifactor Authentication Endpoint Detection and Response Threat Hunting Utilizing Threat Intelligence Backing up your data and keeping it offline Updating and patching systems Testing your incident response plan Penetration Tests Segmenting Networks These are all basic activities organization need to start implementing now. The ransomware threat is escalating, and your organization can be a target.

CISO Dojo Ransomware Special Edition

Part of being an effective security leader is understanding and including people from all types of backgrounds. Usually, it’s talk tech, security, and strategy, but for these episodes, it’s time to discuss the 8th layer and how acceptance is not just 1’s and 0’s. In this short solo three-parter, Stacy will take you through the who, what, when, and why of Diversity, Equity, and Inclusivity. (DEI) Sources for Part 2: https://www.hrc.org/resources/hate-crimes-timeline  https://www.aaaed.org/aaaed/History_of_Affirmative_Action.asp#:~:text=Kennedy's%20Executive%20Order%20(E.O.),1964.  https://historyengine.richmond.edu/episodes/view/1161  https://www.mentalfloss.com/article/71353/8-things-women-used-be-banned-doing  https://www.encyclopedia.com/social-sciences-and-law/law/crime-and-law-enforcement/domestic-violence  https://www.washington.edu/doit/what-individuals-disabilities-education-act  https://adata.org/learn-about-ada  https://www.encyclopedia.com/finance/finance-and-accounting-magazines/equal-employment-opportunity-act-1972  https://en.wikipedia.org/wiki/LGBT_employment_discrimination_in_the_United_States  https://lgbtbar.org/programs/advocacy/gay-trans-panic-defense/  https://sloanreview.mit.edu/article/the-trouble-with-homogeneous-teams/  A link to my own Medium Article: https://findstacyhere.medium.com/an-open-letter-from-a-woman-in-tech-f552628565c9

Stacy Dunn on Diversity, Equity, and Inclusivity | Part 2

In this episode Stacy Dunn talks about Diversity, Equity, and Inclusivity and how we can get better at improving the culture of the information security workplaces and community. Part of being an effective security leader is understanding and including people from all types of backgrounds. Usually, it’s talk tech, security, and strategy, but for these episodes, it’s time to discuss the 8th layer and how acceptance is not just 1’s and 0’s. In this short solo three-parter, Stacy will take you through the who, what, when, and why of Diversity, Equity, and Inclusivity. (DEI) Sources for Part 1: https://globaldiversitypractice.com/what-is-diversity-inclusion/  https://www.thisishowyoucan.com/post/__wheel_of_power_and_privilege  https://builtin.com/diversity-inclusion  https://medschool.duke.edu/sites/medschool.duke.edu/files/field/attachments/explaining_white_privilege_to_a_broke_white_person.pdf  http://eprints.lse.ac.uk/73664/ and https://blogs.lse.ac.uk/politicsandpolicy/  https://pubmed.ncbi.nlm.nih.gov/30765101/  https://hbr.org/2018/07/the-other-diversity-dividend  https://www.forbes.com/sites/paologaudiano/2020/07/13/how-inclusion-improves-diversity-and-company-performance/?sh=152da2e56a65  https://www.mckinsey.com/~/media/mckinsey/business%20functions/organization/our%20insights/delivering%20through%20diversity/delivering-through-diversity_full-report.ashx 

Stacy Dunn on Diversity, Equity, and Inclusivity | Part 1

Chris Elgee is a senior security analyst and Core NetWars Tournament design lead for Counter Hack, and commander of the Army National Guard's 126th Cyber Protection Battalion. At Counter Hack, Chris is responsible for the design and implementation of NetWars challenges and has created some of the player-favorite challenges throughout NetWars and the Holiday Hack Challenge. Chris also teaches SEC560 for the SANS Institute. Read more about Chris Elgee at: https://www.sans.org/profiles/christopher-elgee/ Follow Chris on Twitter: @chriselgee  

Hiring Pen Testers, Hacking Holidays, and Hand Grenades

Lenny is the CISO at Axonius, which is a cybersecurity tech company. Lenny has also helped build anti-malware software at an innovative startup and oversaw security services at a Fortune 500 technology company. He has also lead the consulting practice at a leading cloud services provider. Lenny is also a Fellow Instructor at SANS and is the primary author of FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques.  Lennny maintains a popular malware analysis tool kit called Remnux as well. REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. Lenny is also the author of the SEC402: Cybersecurity Writing: Hack the Reader which is designed exclusively for cybersecurity professionals, that teaches the key topics to address in security reports and other written communications and how to pick the best words, structure, look, and tone. Catch Lenny on Twitter at: https://twitter.com/lennyzeltser

From Reverse Engineering Malware to CISO

In this episode we discuss concerns with security in the cloud that organizations need to be aware of. Moving to the cloud doesn't automatically mean it's more secure. We'll take a look at the CIS Controls and how you can implement them in a cloud environment to better secure your networks and data. The topics discussed in this episode are: Malware Defenses in the Cloud Limiting Network Protocol Ports and Services Cloud Security Data Recovery Capabilities Cloud Security Configurations 

Cloud Security Part 2

In this episode we discuss concerns with security in the cloud that organizations need to be aware of. Moving to the cloud doesn't automatically mean it's more secure. We'll take a look at the CIS Controls and how you can implement them in a cloud environment to better secure your networks and data.

Cloud Security

Stalking- What is it, exactly? And, more importantly, what do you do if it happens to you? What are the steps you can take and how can you understand ways to better protect yourself? What are the avenues for reporting stalking? How has technology impacted stalking and what can we do, as a society, to keep these behaviors from perpetuating?  National Resources:  https://www.thehotline.org/ (1-800-799-SAFE) https://victimsofcrime.org/  https://www.stalkingawareness.org/ https://www.ywca.org/ https://www.justice.gov/ovw/stalking  https://www.womenshealth.gov/relationships-and-safety/other-types/stalking Local Resources:   https://palomarokc.org/  https://www.ywcaokc.org/  https://www.oag.ok.gov/victims-services-resources  https://oklegalconnect.org/#/login  Stalking definition: The Department of Justice defines stalking as "A perpetrator engaging in a course of conduct directed at a specific person that would cause a reasonable person to fear for their safety or the safety of others or suffer substantial emotional distress."    The Office on Women's Health defines stalking as "Any repeated contact that makes you feel afraid or harassed."   This communication or behavior could involve repeated visual, physical, verbal, written, or implied threats, nonconsensual communication, or a combination of these measures.    Stalking is against the law. Stalking is a crime.  Stalking can be charged as a state or a federal crime, and depending on the case, it can be: Misdemeanor - punishable by imprisonment for up to 1 year or a fine that cannot exceed $1,000, or both. Felony - for aggravated stalking, punishable with up to 5 years in prison or a fine of maximum $10,000, or both. Who can be stalked: Anyone. However, 1 in 6 women experience stalking their lifetime and women are twice as likely to be stalked as men are. (This is according to the National Center for Victims of Crime.)   Stalking falls into three broad categories: Intimate or former intimate partner stalking- The stalker and victim may be in a relationship, may have lived together, may be serious or casual partners, or former partners to some facet. Acquaintance stalking- The stalker and victim may know one another casually, such as a coworker, neighbor, or something similar.  Stranger stalking- The stalker and victim do not know one another. This usually includes cases where the victim may be a celebrity.  Examples of stalking:  Following you around or spying on you Befriending or manipulating your family, friends, or coworkers to intrude on your inner circle  Sending you unwanted emails, messages, or letters Calling you often Harassing you on social media Creating fake profiles to keep tabs on you Attempting to gain access to your computer, email, or social media accounts Tracking your computer or internet use Using technology such as GPS to track your location Showing up uninvited to your house, school, work, or places you frequent Leaving you unwanted gifts or tokens of affection Damaging your home, car, or other property Threatening you, your family, your friends, or your children and pets with violence Misconceptions about stalking:  "Stalking is only stalking if they keep doing it after you've asked them to stop or have confronted them in some way." -I hear this sentiment a lot. If someone has been following you, tracking you, or harassing you and you're just discovering it, it's been stalking the whole time. They don't get a magical free pass to do so until you've said no, it's stalking regardless. And, confronting the perpetrator can often be dangerous. "Only celebrities are stalked." -As previously mentioned, anyone can be stalked. In fact, 1.4 million people are stalked every year in the United States.  "If you ignore the stalker, they will go away." -If only this were true. Each case varies, but stalking is dangerous, it's against the law, and anyone that experiences stalking should seek help. "You can't be stalked by someone you're dating." -Big huge nope. Biggest nope. You absolutely can. If an intimate partner is tracking your location, following you around, and making you feel smothered and afraid, that is stalking. It doesn't matter your relationship with the person.  When is stalking categorized as cyberstalking?:   Nowadays, stalking usually includes cyberstalking. As security professionals, we have to be cognizant of how people use technology in a way that's malicious.  Cyberstalking falls under the stalking umbrella. It's yet another form of stalking and is widely used among perpetrators because it gives them a relatively easy way of monitoring someone, particularly if their "digital footprint" is very wide.  Cyberstalking is the use of the internet or other electronic means to stalk or harass an individual, group, or organization.  As mentioned, cyberstalking is often accompanied by real-time or "offline" stalking, but may be exclusively used as the primary or only means of stalking.  Physical or real-time stalking is not necessary for the act to be considered a crime. Cyberstalking, in of itself, is also a crime.  Something to note: States vary in how they categorize offenses. By 2009, 14 states adopted legislation on high-tech stalking, punished by up to 18 months imprisonment and a $10,000 fine for a fourth-degree charge to 10 years in prison and a $150,000 fine for a second-degree charge.   What to do if you're being stalked:   The obvious answer may be to blanketly tell everyone to call 911 or contact the authorities. However, the unfortunate truth is that not all law enforcement officers are trauma-informed nor are all of them equipped to handle stalking. And, sadly, some of them may not take the case seriously. Even with that, I highly suggest reporting, if you feel safe to do so.    Sometimes, your stalker may even be a police officer or someone that is powerful. It's not always easy to go to the authorities, particularly if you have been let down in the past or get grilled by law enforcement as if the stalking is your own fault.    Here are a few other suggestions of who to contact to assist you: National Domestic Violence or Victim Resources such as The Hotline Dot Org, Victims of Crime Dot Org, Stalking Awareness Dot Org, and so on. We will link all of these resources in the show notes.  Local Domestic Violence Coalitions such as YWCA, Palomar, and other non-profits that may be exclusive to your area. Legal Resources or Lawyers that are trauma-informed specialize in domestic violence, sexual assault, and stalking cases.  A trusted friend, family member, mentor, teacher, counselor or therapist.  Some steps you can take to help protect yourself and mitigate a stalker's ability to gather more information about you:   In an ideal world, we would want to stop the stalkers from stalking. The onus is on them. It's not your fault you're being stalked, and these preventative measures do not suggest that this is in any way your fault, but please- Take these measures into consideration if you are being stalked. Document everything. Record dates. Take screenshots and keep everything organized. Describe the actions as well as how they made you feel in the moment. Keep a running timeline, if possible.  Inform someone you trust of the stalking.  Carry your cell phone with you and inform your trusted friend or family member on your whereabouts, especially if the person is capable of physically finding you.  On the topic of your cellphone, ensure that it does not have any unknown applications, tracking, or compromised accounts on it. Review your installed applications, accounts, and enable multi-factor authentication where possible.  Use unique and secure passwords for all of your accounts. (Make sure your passwords are not easily "guessable." Depending on the situation, stopping all communication with the stalker is ideal. Your circumstances may dictate that completely cutting them off is actually less safe, so trust your instincts and document your decision.  That said, block the stalker on all platforms, if it is safe to do so. Limit your social media posts to friends and family. Avoid posting anything publicly. Be cognizant of sharing, tagging, and what is shown in images. Minimize mutual contacts.  Do not share your home address or place of work online. Additionally, do not share when you're at home, and when you are not.  If physical stalking is present: Vary your travel schedule, try not to use the same route or routine every day if travel is required.  

Cyberstalking

Data governance is a huge undertaking when you don't build it in at the start. In this episode Stacy and Joe discuss data governance programs, the NIST Privacy Framework, and how to build a successful data governance program.

hubhopper

CISO Dojo

hubhopper