Why do so many business leaders insist on using unsecure systems and software development practices? Often to skimp on IT budgets and to race to production. Or leaders with marketing expertise, but no actual tech understanding, make bad decisions to align with their sales tactics and marketing messages. Or, for other reasons. But with demonstrably ongoing damaging consequences. In this episode we speak about the critical need for secure software engineering, development and testing, and the need to follow stringent, secure software development practices to stem the consistently increasing digital hemorrhaging of security incidents and privacy breaches. Listen to this episode to learn the importance of building security into the full software and systems development lifecycle from Dr. Rhonda Farrell. Dr. Farrell is a worldwide recognized cybersecurity expert and instructor, with multiple cybersecurity and privacy certifications, including those in software security development. Learn actions that need to be taken to improve the current inadequate state of systems and software development and maintenance security practices. Also hear the need to engage pre-school through secondary and post-graduation education students about the absolute need to build secure technology, and how to do so. Dr. Farrell will also provide information about the Cyber & STEAM Global Innovation Alliance (CSTGIA) she founded, CSTGIA goals, the resources it provides, and describe how everyone can get involved. See more about Dr. Rhonda Farrell in the bio posted with this episode description on this VoiceAmerica show site. #Cybersecurity, #RiskManagement, #RhondaFarrell #SSDF, #SoftwareSecurity, #SystemsSecurity, #ApplicationsSecurity, #SDLC, #WomenInTech

Data Security and Privacy with the Privacy Professor

Software Development Security Practices Suck! Wise Up Now!

Listen to this episode to learn from Judy Selby, a worldwide recognized and award-winning cyber insurance expert, about the considerations to take into account for different types of cyber insurance, and how recent, and growing numbers of, ransomware and cyberattacks and hacks are impacting the cyber insurance coverage packages. Throughout the recent history of ransomware and other types of malware and cybercrime and hacking, organizations have become increasingly dependent upon cyber insurance to cut their losses. But with ransoms becoming so huge, and cyber-attacks becoming so prevalent, are cyber insurers going to change the conditions for which they will provide cyber insurance? Can cyber insurance requirements actually change, even possibly improve, cybersecurity practices within organizations who get cyber insurance? And what else does cyber insurance cover besides ransomware and other types of malware? What are the different types of cyber insurance that businesses do have available to them? What are complicating factors in establishing actuarial tables, and then coverage packages and premium rates, for cyber insurance? Do new laws impact cyber insurance coverage and rates? Will premiums be impacted by the policy holders if they use cybersecurity tools that have been compromised, such as SolarWinds? Listen to this episode to hear Judy Selby, Partner in the New York office of the Kennedys global law firm, answer these questions, and many more! Also, hear how you can get a free copy of her best-selling book, Demystifying Cyber Insurance: 5 Steps to the Right Coverage. #Cybersecurity, #RiskManagement, #JudySelby, #CyberInsurance, #CyberLiability, #CyberLiabilityInsurance

Demystifying Cyber Insurance: Facts to Get the Right Coverage!

Before the Solarwinds hack made global news daily for many weeks starting in December, 2020, most of the public had never heard the term “supply chain,” let alone know about the inherent data and cyber security risks they bring to organizations. You know it is a significant issue when the President of the United States issues an Executive Order (on Feb. 24, 2021) to significantly strengthen supply chain security in all industries. The risks have always been there, but the number, types and methods capable of exploiting the risks have increased exponentially in recent years as new technologies, and tech companies, have proliferated throughout the world. The Solarwinds incident spotlighted to everyone paying attention to cybersecurity how protecting supply chains needs to be a top cybersecurity and privacy priority for every business using purchased technologies and/or contracting third parties to do work for them. Bills of Materials (BOMs) are tools that have been around since at least the 1960s to support business. They can also be used to support securing the supply chain. Do you know how? Do you know what BOMs are? In this episode we chat with cybersecurity expert Chris Blask, VP of Strategy at Cybeats, and the inventor of the Digital Bill of Materials (DBOM), for the details! What are SBOMs? What is the relationship between an SBOM and a DBOM? What are the cybersecurity benefits of SBOMs and DBOMs? What are other business benefits? Do SBOMs and DBOMs change the functionality of the associated hardware, software, firmware, system? What portion of organizations use SBOMs and DBOMs? How long have SBOMs and DBOMs been in use? Hear the answers to these questions, and much more, in this episode! #Cybersecurity, #Privacy, #ChrisBlask #Cybeats #SupplyChainSecurity #RiskManagement #SupplyChain #SupplyChainManagement

The BOM Episode! DBOMs! SBOMs! And...Supply Chain Cybersecurity!

The recent take-down of 300 criminal syndicates in more than 100 countries by the DoJ, selling their own 12,000 encrypted devices and services to which they had the decryption keys, has resurrected the question of encryption and lawmakers’ claims that backdoors into encryption are necessary. Lawmakers, and even some data security personalities, point to this event saying it proves encryption should have backdoors. There are also claims that the fourth amendment supports this view. But wait! Doesn’t it prove otherwise? And, doesn’t the long history of failures for creating encryption backdoors prove that encryption solutions with backdoors built in put everyone at risk? Why can’t encryption be engineered to let in only the good guys and those meant to encrypt and decrypt the data, and not allow others access? Listen in as cybersecurity and encryption pioneer and multi-award-winning security and cryptography expert, owning many patents on cryptographic and network protocols, Dr. Steven Bellovin, answers these questions and many more in this highly informative discussion with Rebecca. You will hear insights and facts about encryption that have not been discussed anywhere else!

4th Amendment Does Not Give LE the Right to Access Encrypted Data

What are “high-speed streaming analytics data pipelines”? What is the function of a data pipeline? Are there more security risks associated with data pipelines, or less, compared to VPN transmissions, and network transmission technologies that have been used for decades? What are “data lakes”? How are they different from data warehouses? Is it possible to meet data protection compliance requirements using data pipelines and data lakes? What are the security risks with using data lakes? What is a MiNiFi? Listen in as Gal Shpantzer, cybersecurity expert and the architect of the largest supported MiNiFi deployment in the world, answers these questions and many more in an informative discussion with Rebecca. You will hear security and privacy insights, and learn important facts about data lakes and data pipelines, that have not been discussed anywhere else! Follow Gal on Twitter: @Shpantzer #Cybersecurity #Privacy #DataPipelines #DataLakes #MiNiFi #RiskManagement

Data Pipelines & Data Lakes Security & Compliance Answers & Info

There have been many news reports in the past several months about nation-state espionage, and in particular nation-state cyberthreats and cybersecurity warfare attacks. So, what exactly are nation-state cyberthreats? What countries are the sources of the cyberthreats? What countries are launching cyberattacks? Russia? China? The USA? Others? Who should be defending against these cyberthreats? Government? Corporations? Individual citizens? In what ways have US citizens committed cyberattacks against their own country on behalf of other nation-states? Why is profiling based on an individual’s nationality and heritage a very bad idea for defending against nation-state cyberattacks? And in what ways does it actually do much more harm than good, and does not protect against the actual nation-state cyberwarfare practices? Listen in as Christopher Burgess, a 30+-year CIA security expert, nation-state cyberthreats and cyberwarfare expert, writer, speaker and commentator on security issues, answers these questions and many more in an informative discussion with Rebecca. Follow Christopher on Twitter: @burgessct #Cybersecurity, #Privacy, #NationalSecurity, #NationStateThreats #CyberWarFare #NationalSecurity #CyberWarfareAttacks

Defending Against Nation-State Hacking & Cyber Warfare Attacks

In 2021 there have been at least 253 voting bills proposed in at least 43 US states. These bills are restricting voting methods, times, and even criminalizing such practices as the provision of food and drink to those who are in waiting line for hours to vote. All due to “concerns about voter fraud,” even though hundreds of audits, hundreds of ballot recounts, and hundreds of independent voting machine security assessments have found no voter fraud. What security measures are actually established for poll centers on voting day? For early voting locations? And for mail-in and absentee voting ballots? What would election officials tell you about those images and videos claiming to be evidence? Are they really evidence? Or, are they bogus? And how can you tell? Can boxes of ballots actually be brought into election centers and processed? What controls are in place for elections centers where ballots are collected, processed, and sorted? Listen in as Genya Coulter, named as one of the Top 25 Women in Election Security and Tech, as well as being the Polk County, Florida, Election Clerk who oversees all her precinct operations and manages her team during election season, answers these and many more questions, as well as describes the facts about voting and ballot security controls, and answers questions about voting fraud claims during the 2020 US election during this conversation with Rebecca. Follow Genya on Twitter: @ElectionBabe

Voter Fraud Facts No One is Talking About…Until Now

There continue to be more lessons to learn from the past 8+ years of election cycles in the US. Lessons that can be applied throughout the world, about the need to build in strong security and privacy protections to the associated processes, systems, and physical components of elections to strengthen democracy as well as to establish verifiable and validated election results. The FBI reports verified election interference attempts and goals of China, Russia, Iran & domestic groups; often through election candidates’ campaign organizations and associated groups. What kind of interference is targeting campaigns and candidates? How does strengthening security practices help to prevent these interference goals from being fulfilled? What is the goal and mission for CyberDome? Why is US CyberDome well-suited to help fight interference with election campaigns? Listen in as Matt Barrett, co-founder of US CyberDome, provides insights, research findings, advice to campaigns, and describes the goals of CyberDome to protect election campaigns during this conversation with Rebecca.

Fighting US Elections & Campaigns Interference with Cybersecurity

Health data is considered personal data gold to cybercrooks. Hospitals, clinics and telehealth situations involve a lot of complexity that brings many threats and vulnerabilities to patient data. • Is your healthcare and patient data safe? • Are hospitals and clinics doing all they can to protect your data? • What would you like to ask your hospital about this? • Would they know how to answer? • Are HIPAA requirements effective for protecting patient data? Listen in as Mitch Parker, a healthcare security expert and executive at multiple large hospital systems, provides answers to these questions and more. Mitch will cover longtime, current and emerging challenges for corporate information security officers (CISOs) at the largest hospitals as well as the smallest, rural clinics. Mitch also provides insights and his thoughts on HIPAA updates during this conversation with Rebecca.

Healthcare CISOs: Securing Patient Data & HIPAA Compliance

For Data Privacy Day month Rebecca is speaking with Kim Hakim, CEO & Founder of FutureCon Events, about how she handled needing to move...almost overnight!...all her 2020 conferences to being online events at the beginning of 2020 when COVID-19 started spreading through the USA. Kim also discusses some of the key privacy issues she had to address when doing so. Kim will also describe the most requested privacy topics for the FutureCon events. Some topics covered in this episode include: • What makes FutureCon events unique from all other cybersecurity and privacy events? • What were the most requested topics in 2020 & for the upcoming 2021 events? • What are the inventive ways that Kim arranged for online FutureCon event attendees to interact with speakers & sponsors? • What makes a great cybersecurity and privacy speaker? • What advice does Kim have for those who want to be speakers at cybersecurity and privacy conferences? Tune in to hear these topics covered, and much more!

Holding Privacy Events in a Pandemic World

The numbers of women & people of color are still a woefully small percentage of the IT and cyber/data/network/applications security workforce. Such lack of diversity results in weak and flawed IT, security and privacy practices, applications, networks, and data protection. Rebecca discusses the related issues with cybersecurity expert, industry leader & long-time mentor, Dr. Cheryl Cooper: • What is Dr. Cooper working to change in society with her mentoring work? • Many displaced workers in their 40s, 50s and beyond, with no IT or cybersecurity background would like to start a cybersecurity career. What advice does Dr. Cooper have for them? • What are common challenges that all ages of women and people of color face in cybersecurity careers & what type of support do members of WINS provide to them? • What is Dr. Cooper’s greatest achievement in her career? • What advice does Dr. Cooper have for those who would like a career in cybersecurity but do not know where to start?

How A Trail-Blazing STEM Mentor Is Revolutionizing Cybersecurity

With 2020 being the year of the global COVID-19 pandemic, it has also become the year of globally widespread working from home offices, and attending school online from home. Cybercrime is increasing dramatically in many ways never before seen as a result of these quickly established new working and learning environments. • How has cybercrime increased since the COVID-19 pandemic started becoming noticed? • Which new types of cybercrimes were created to take advantage of the many different COVID-19 circumstances? • What do Europol and Interpol research reports reveal about cybercrimes? • Are existing laws insufficient for new types of cybercrimes? Rebecca discusses these issues, and many more about cybercrime, with world renown cybercrime expert and member of United Nations Office on Drugs and Crime expert team, Pauline Reich. Contact Pauline at: cyberasia2@gmail.com

How Cybercriminals Take Advantage of the COVID-19 Pandemic

Voter fraud conspiracy theories have reached a fever pitch. There are even claims that mail-in ballots are “a scam.” What’s the truth? Voting security experts & researchers Jennifer Kavanagh & Quentin Hodgson describe in-depth research revealing verifiable facts about security of all types of voting including absentee/mail-in, voting machines & paper at polling locations, & drop boxes. They provide research results for questions such as: • How are voter registration databases kept up-to-date & when do errors occur? • How is signature matching done? Can poll workers throw out ballots claiming signature mismatches then submit different ballots for the voter? • How can voters determine if their mailed-in ballots were rejected because of a signature mismatch prior to election day? • What controls do poll workers follow? Are “poll watchers” who interact with voters legal? • Is it possible for someone to send “unsolicited millions of ballots”? • Does “ballot harvesting” actually occur?

Data Proves Voting Fraud is Rare; Don’t Believe Conspiracy Theories Claiming Otherwise

Since 2018 Rebecca has invited many tech giants to explain if & how they are collecting & selling personal data to govt & other entities to profile & target subsets of populations while making huge profits. For example, one tech company reportedly made over $1.6 billion from the US federal government from 2017 – 2019. No tech company has accepted the invitations. However, Mijente, which has performed significant research into tech surveillance activities, agreed to answer questions such as: • How widespread is the collection of everyone’s personal data? • What companies are providing personal data to the tech organizations? • Why don’t the data sources notify the general population about all the entities to whom everyone’s data is being shared & used? • How is tech being used to surveil & monitor specific populations? • How have people been harmed by resulting actions from surveillance of personal data? Hear Rebecca discuss these questions and more with Jacinta González from Mijente.

Surveillance Pandemic: How Tech Giants Collect & Use Personal Data for Profiling & Huge Profits

There are more information security and privacy threats than ever before. As more technologies emerge, more big data analytics are used, and more artificial intelligence systems are deployed, cybersecurity and privacy risks grow exponentially. Rebecca has spent her entire career working to improve information security and privacy protections, by not only raising awareness of the issues within businesses and other types of organizations, but also by raising the awareness of these risks in the public and helping them to understand how to better protect their own personal data, allowing them to take their privacy protections into their own hands. Rebecca offers you information about these existing and emerging security and privacy risks and provides fresh insights into the impacts of exploiting these risks, and gives guidance, tips, expert advice, news, with fascinating guests, to help all organizations, and the general public, understand what they need to do to mitigate these risks.

hubhopper

Data Security and Privacy with the Privacy Professor

hubhopper