Cyber Work

Paul Giorgi of XM Cyber, a man who told me his favorite way to learn new skills is to break things and put them back together, walked me through the basics of setting up your own cybersecurity practice lab at home for not too much money. But watch out because he says that once you start, your excitement about hands-on practice and buying old servers on eBay can get overwhelming! 

0:00 - Build your own cybersecurity practice lab
1:30 - How to practice with a home cybersecurity lab
5:48 - Resource requirements for a cybersecurity lab
8:48 - Cost of a cybersecurity lab
10:28 - First projects for a cybersecurity lab
13:02 - Learn more about Paul Giorgi and XM Cyber
13:42 - Outro

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Karen Worstell is a 25-year veteran of the tech, IT and security space; she?s a senior cybersecurity strategist at VMware and a chaplain. This episode goes to many fascinating places, from her days learning coding on a TRS-80 computer, how her extremely visual and right-brained approach to learning has influenced her security journey, her experiences as a woman in the industry and how her work as a chaplain brought her back from a security industry hiatus to help people suffering chronically from burnout. There?s also a bit about XDR ? and its a big deal! 

0:00 - Burnout in cybersecurity
3:06 - Karen Worstell's start in cybersecurity
6:11 - A family of inventors
9:35 - Physical sciences and computer sciences
16:00 - Work as a senior cybersecurity strategist
18:18: - Working as a woman in cybersecurity
23:15 - Changes to make cybersecurity equitable
31:40 - Strategies for hiring equity in cybersecurity
34:00 - Burnout in cybersecurity
48:35 - Helpful cybersecurity organizations
51:37 - Why is XDR so important?
56:10 - Learn more about Worstell
56:44 - Outro

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Today on Cyber Work, Nir Valtman, CEO and co-founder of Arnica, discusses developer behavior-based security. In short, there are lots of ways that backdoors or vulnerabilities can make their way into developer code. One door we can close on these intrusions is implementing processes that detect behavior anomalies in developers. Think of your bank monitoring for unusual purchases calling you to ask whether you really just spent $300 on a bobblehead from The Last of Us that?s shipping from Brazil. If you did, not judging, full speed ahead. If not, then we?ve got a problem on our hands. Valtman explains the benefits and the limitations of behavior-based security measures, as well as tips for developers-in-training.

0:00 - Developer behavior-based security
2:56 - Nir Valtman?s start in cybersecurity
4:40 - Moving into the developer world
8:20 - Working as a cybersecurity CEO
10:33 - A typical day for a cybersecurity CEO
19:30 - Monitoring product features
20:15 - DevSecOps behavior-based security
27:42 - Flagging irregular online purchases
30:35 - Impact of pre-fab code on behavior anomaly detection
33:28 - GitHub impact on developer behavior and security
38:09 - Ensuring you don?t skimp on sec in DevSecOps
42:35 - What should future developers know?
44:56 - Skills and experiences for budding developers
51:09 - What is Arnica?
54:57 - Outro

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

These days, keeping your security, IT or research team close now that more of us than ever work remotely is a challenge. How do you keep team bonds strong when your main interaction path is your tiny little colleagues trapped in little squares on a computer monitor? Susan Morrow has been managing a remote team for almost two decades. She dispenses wisdom on coordinating schedules in multiple time zones, ensuring everyone?s moving toward the same goal and helping team members of all work styles to do and feel their best. 

0:00 - Cybersecurity team remote work
2:30 - Remotely working with multiple teams
4:16 - What doesn't work remotely? 
5:51 - Avoiding remote work pitfalls
7:27 - Solving team drift
9:19 - Learn more from Susan Morrow
9:58 - Outro

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

James Stanger, chief technology evangelist at CompTIA, walks through their new Data+ certification. Infosec is proud to provide bootcamp and course training for a range of CompTIA certifications, and James helpfully breaks down the basics of data analytics, the types of learning you?ll need to engage in to pass and why security professionals have a lot more data analyst in their job role than they might think. All that, and a bit of geeking out about the humanities.

0:00 - CompTIA Data+
3:40 - How did James Stanger get into cybersecurity?
5:00 - From literature to IT
9:50 - Working for CompTIA as a tech evangelist
13:22 - What makes up a tech evangelist role?
18:00 - CompTIA's new Data+ certification
26:06 - Why is Data+ important for pros?
32:38 - Prerequisites for Data+ certification
40:05 - What does Data+ teach you?
43:53 - Training materials for Data+ certification

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Today on Cyber Work, my guest, Jack Nichelson, wants you to know something. AI is coming! But it?s not SkyNet; it?s not the rise of the machines. Whatever unnerving story you?ve read in the past few weeks about ChatGPT and what it will or won?t do to humanity, I?d like you to join us here and get a much fuller picture of AI as a tool and our role in shaping and building it.

0:00 - ChatGPT AI
2:50 - How Jack Nichelson got into cybersecurity
4:45 - Types of IT cybersecurity roles
6:57 - AI versus human value
10:46 - Life as a CISO
15:12 - The ChatGPT story
19:37 - Where is AI at right now?
24:20 - Actual applications of AI in the future
30:04 - Areas of study to enter cybersecurity and AI
34:27 - Where AI tools may lead cybersecurity
37:00 - Training for future AI malware
40:20 - Software to spot AI malware
44:50 - What is Inversion6?
46:55 - Learn more about Jack Nichelson
47:12 - Outro

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Amber Schroader, CEO of Paraben, explains the different ways to pursue a career in digital forensics, like pursuing a college degree or studying toward a certification. And if a certification, which one will take you on the path you want? Schroader also talks about what doors can open for you, where to get started, and which upper-level certs you should work toward so you?re prepared for the job you want.

0:00 - Breaking down digital forensics certifications 
1:08 - Different ways to learn digital forensics 
2:07 - Digital forensics college courses versus certifications
3:45 - Main digital forensics certifications and paths
5:20 - Finding a digital forensics niche
6:18 - Hands-on projects for digital forensics experience
7:25 - How to get started in digital forensics 
8:34 - Learn digital forensics
9:01 - Outro

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Jacob DePriest, the VP and deputy chief security Officer at GitHub, talks about development security. In 2021, GitHub significantly ramped up its security department. DePriest told me all about the commitment to security and how you can move your organization toward a developer-focused security team. Whether you?re just hearing about GitHub now or you?re using GitHub from the moment your work day starts, you?ll want to check out this episode.

0:00 - GitHub's cybersecurity strategy
2:30 - How did you get into cybersecurity?
5:00 - Moving up in cybersecurity
8:57 - Working with NSA
10:08 - Working as a chief security officer
13:35 - Communication in cybersecurity
15:00 - What is GitHub?
17:46 - Coding as a team
19:30 - GitHub's security team
21:18 - Security threats GitHub faces
22:28 - GitHub's role in software security
25:10 - Navigating GitHub's tools
28:50 - How to study cybersecurity
30:54 - Entering software security
33:55 - Security tips for developers
36:45 - Learn more about DePriest and GitHub
38:25 - Outro

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Learn more about the (ISC)² CGRC certification: https://resources.infosecinstitute.com/overview/cgrc/

Enroll in a CGRC boot camp: https://www.infosecinstitute.com/courses/isc%C2%B2-cgrc-training-boot-camp/

Infosec instructor and returning guest Leighton Johnson talks about the recent (ISC)² CAP certification change: the Certified Authorization Professional (CAP) is now Certified in Governance, Risk and Compliance (CGRC). Why are they changing the name of the CAP certification? Is the CAP content going to change as well? What does this mean for the future? Let?s figure this out together.

0:00 - CAP vs. CGRC certification
1:40 - What jobs require a CGRC certification?
2:50 - Why change the CAP name to CGRC?
4:17 - Is CAP exam content different from CGRC?
6:00 - Should I upgrade CAP to CGRC?
7:35 - Study tips for the CGRC exam
9:13 - Learn more about CGRC
9:53 - Outro

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Yossi Appleboum, CEO of Sepio, talks about Cybersecurity and Infrastructure Security Agency (CISA)?s operational directive for non-military federal agencies to adopt a strict set of asset visibility and vulnerability detection system starting as early as April of 2023. Yossi discusses this directive, saying that it takes FCEB agencies out of the cybersecurity stone ages and into the future. Can it work in such a short time frame? Yossi has thoughts!

0:00 - Asset visibility and vulnerability detection
3:10 ? First getting into cybersecurity
6:21 ? Co-founding cybersecurity companies
9:30 ? What it?s like as CEO of a cybersecurity company
13:00 ? Ambassador of the Global Cyber Alliance
15:32 ? CISA?s operational directive for federal agencies
19:25 ? What are asset management and vulnerability?
24:40 ? What comes after asset protection?
28:40 ? CISA?s deadline for asset visibility compliance
30:40 ? Job outlook for asset visibility and vulnerability detection
35:07 ? Work experience needed for asset visibility roles
36:30 ? How to work in asset visibility
40:04 ? How will this CISA directive change cybersecurity?
41:50 ? What is Sepio?
43:56 ? Learn more about Yossi Appleboum
44:50 - Outro

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Infosec Skills author and Paraben founder and CEO Amber Schroader talks about how to quickly and inexpensively set up your own home digital forensics lab. 

0:00 - Creating your digital forensics lab
1:00 - Benefits of your own digital forensics lab
1:40 - Space needed for digital forensics lab
2:30 - Essential hardware needed for a forensics lab
5:01 - Important forensic lab upgrades
5:42 - Running your forensics lab
6:51 - Forensic lab projects
7:35 - Getting into forensic labs
8:04 - Outro

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Venafi solutions architect Steve Judd talks about the recent directive from the Pentagon that a zero-trust policy be implemented at the Department of Defense in the next four years. Is this a workable deadline? What are the hurdles to be jumped? Judd also tells me what a solutions architect does and why he thinks it?s the most fun job in cybersecurity.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Pentagon?s zero-trust policy and DoD
2:22- How did you get into cybersecurity?
5:10 - Cybersecurity solution architect work
9:05 - Scope of zero-trust policy
16:00 - Getting ahead of the zero-trust policy
17:49 - What skills do zero-trust make mandatory?
19:37 - New jobs via zero-trust
23:44 - DevOps and DevSecOps
28:48 - Areas of studies to emphasize
31:00 - Things not to study in cybersecurity
38:00 - What is Venefi
40:05 - Learn more about Steve Judd
40:36 - Outro

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Paul Giorgi of XM Cyber helps us wrap up 2022 by discussing some of the most unusual and complex attack paths he and XM have seen in the past year. We discuss some of the most common breaches and methods, as well as several attack paths that are the very definition of ?taking the scenic route,? which is, of course, why they worked so long. Also, tune in for some great advice about getting involved in risk management and access management.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Unusual attack vectors in 2022
3:00 - First getting into cybersecurity
6:35 - What is a sales engineer? 
11:50 - Average workday as director of sales
15:30 - Strangest attack vectors of 2022
20:08 - Lessons learned in 2022 cybersecurity 
22:06 - DoD and zero trust
24:32 - Successful security attacks
31:30 - The uber breach and security landscape
36:01 - Smart cars and cybersecurity 
39:03 - Working in cybersecurity solutions
42:21 - Learn about XM Cyber
46:27 - Learn more about Paul Giorgi
47:04 - Outro 

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Infosec Skills author Leighton Johnson talks about major changes to CISM in 2022. CISM has shifted qualitatively from the ?Manager? side of the cert name to the ?Security? side.

0:00 - Changes to CISM's focus
2:21 - Why did CISM's focus change?
3:43 - How to study for the new CISM changes
6:47 - Important CISM skills to know
8:28 - Find Leighton Johnson
9:31 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

A.N. Ananth of Netsurion joins us to talk about the future of SOCs. Security operations centers used to look more like bunkers crowded with network traffic analysts who rarely got to see the sun. Ananth sees the Covid-induced era of remote SOCs to be a new reality but also a way to bring new professionals in from small towns are far-away locations, making it a partial fix to the security skills gap.

0:00 - Changes to SOC
2:59 - How A.N. Ananth got into cybersecurity
4:07 - Ananth's projects and career
6:25 - Management in cybersecurity
8:40 - What is the SOC?
11:08 - How large is a SOC team?
14:30 - The SOC mentality
17:07 - Remote SOC work
18:52 - Security challenges for remote SOC work
20:55 - Bringing in new SOC talent
23:13 - How to get your foot into cybersecurity
28:53 - What should be on a SOC resume?
32:00 - What is Netsurion
34:00 - Connect with Ananth
34:57 - Outro

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

About Infosec
Infosec?s mission is to put people at the center of cybersecurity. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and phishing training to stay cyber-safe at work and home. More than 70% of the Fortune 500 have relied on Infosec Skills to develop their security talent, and more than 5 million learners worldwide are more cyber-resilient from Infosec IQ?s security awareness training. Learn more at infosecinstitute.com.

Cyberis? Matt Lorentzen talks all things pentesting, red teaming, the changing roles that red teaming has in fine-tuning and interrogating modern security and why you don?t have to stop doing the fun stuff even when you?re climbing the career ladder. 

0:00 - Intelligent pentesting, red teaming and modern security
2:30 - Matt Lorentzen's interest in cybersecurity
3:51 - What is a security consultant
8:02 - Pentesting and red team operations 
10:30 - Continued learning in cybersecurity 
15:54 - Read teaming and testing cyberattacks
21:40 - Intelligence-driven red teaming
23:40 - Surprising attack vectors 
26:53 - Common gaps in cybersecurity 
28:46 - School systems and cybersecurity 
32:33 - Adjustments to cybersecurity for school systems
36:14 - How to get into pentesting and red teaming
44:28 - Cybersecurity threats in the next decade
46:43 - What is Cyberis? 
48:02 - Learn more about Matt Lorentzen 
48:38 - Outro
 
About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Whether you?re studying for the CEH, CISSP, Pentest+, or even the Security+, there?s always one question about cryptography, and it?s easy to miss! Want to hear a cool trick to keep symmetric and asymmetric cryptography straight in your head? Keatron Evans has one, and he told it to me ? stay tuned and listen closely because it?s a Cyber Work Hacks!

0:00 - Cryptography exam tips
0:23 - Certifications with cryptography questions
1:15 - Symmetric versus asymmetric cryptography
3:40 - Learn more about cryptography
4:50 - Find and learn from Keatron Evans

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Returning guest Ken Jenkins stops by to talk about his work as the head coach of the US Cyber Games. If you?re intrigued by this emerging e-sport, you will want to keep it here: Jenkins discusses the selection process for the athletes, the roles of the coaches and mentors, and the intense, real-time collaboration going on during the competitions.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - US Cyber Games 
3:38 - How does the security scorecard work
9:06 - Ken Jenkin's typical workday
12:20 - Head coach at the US Cyber Games
18:20 - How do Cyber Games teams work? 
20:50 - Cyber Games events
21:28 - Cyber Games draft
26:30 - Challenges for Cyber Games teams
30:00 - The makeup of a Cyber Games team
32:46 - Cyber Games participation explained
38:35 - Cyber Games red teaming
41:13 - How to get into the Cyber Games
44:31 - How Cyber Games translate to real-world skills
48:27 - Tackling a new cybersecurity challenge
51:12 - Follow the US Cyber Games
55:05 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Ameesh Divatia, CEO of Baffle, Inc., talks about data privacy, data security, cloud security and how a skillset in the middle of that triangle will be your best asset in the years to come. All that, and a little bit of local-focused philanthropy.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Data privacy, data security and cloud security 
2:43 - Ameesh Divatia's start in cybersecurity
7:13 - Founding cybersecurity companies
10:19 - Security innovation
12:41 - Cybersecurity regulatory compliance
17:00 - Transferring skills to data security
21:23 - Cybersecurity interviews and knowledge
25:03 - Data privacy policies 
27:44 - Data privacy requirements
30:22 - Confluence of data privacy, security and cloud
33:32 - Volunteering on a city's technology council
41:02 - What is Baffle?
44:11 - Connect with Divatia 
44:43 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Michael Wilkinson leads the digital forensics and incident response team at Avertium. The team is dedicated to helping clients investigate and recover from IT security incidents daily. Wilkinson talks about threat research, the threat of Vice Society, how K-12 cybersecurity can improve and much more.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Digital forensics and incident response 
3:12 - Getting interested in computers
6:00 - How had digital forensics changed over the years
9:03 - Handling overwhelming amounts of data
12:53 - The threat of Vice Society 
17:20 - Why is Vice Society targeting K-12?
19:55 - How to minimize damage from data leaks
24:25 - How schools can improve cybersecurity
25:54 - What schools should do if cyberattacked 
31:36 - How to work in threat research and intelligence
34:42 - Learn more about Avertium
36:40 - Learn more about Mike Wilkinson
37:08 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Tony Cook of GuidePoint Security knows a lot about threat intelligence and incident response. But he?s also used these skills while working in ransomware negotiation! Cook has handled negotiations for all the big threat groups ? REvil, Lockbit, Darkside, Conti and more ? and he told me about what a ransomware negotiator can realistically accomplish, which threat groups are on the rise, and why negotiating with amateurs is sometimes worse and harder than dealing with elite cybercriminals. 

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Ransomware negotiating 
2:42 - How Tony Cook got into cybersecurity
4:00 - Cook's work at GuidePoint 
9:31 - Life as a ransomware negotiator 
11:41 - Ransomware negotiation in 2022
13:52 - Stages of a successful ransomware negotiation 
15:23 - How does ransomware negotiation work?
19:11 - The difference between threat-acting groups
20:43 - Bad ransomware negotiating
22:43 - Ransomware negotiator support staff
25:21 - Ransomware research
26:26 - Is cyber insurance worth it? 
29:14 - How do I become a ransomware negotiator? 
32:25 - Soft skills for a ransomware negotiator
33:46 - Threat research and intelligence work
37:45 - Learn more about Cook and GuidePoint
38:17 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Infosec instructor and 40-year cybersecurity veteran Leighton Johnson talks to us about all things CMMC. After last year?s attempted rollout, CMMC pulled back and retooled its entire framework. But why? Johnson gives you all the details, including how to train to be a CMMC-certified auditor.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - CMMC in 2022
3:12 - Getting started in cybersecurity
4:15 - How to be CMMC compliant
5:15 - The evolution of CMMC
7:18 - CMMC compliance timeline
10:28 - Being assessed for CMMC compliance
14:30 - Becoming a CMMC auditor 
18:08 - What if you don't meet CMMC compliance?
21:40 - Skills comparable with the CMMC auditor 
23:25 - Evaluating your company and CMMC needs
28:54 - CMMC auditor job opportunities
31:03 - How to become a federal CMMC auditor
35:04 - What is ISFMT?
37:47 - Learn more about ISFMT and Johnson
38:18 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Lisa Tetrault of Arctic Wolf talks about the adhesives that hold cybersecurity together: communication, collaboration and strong teamwork. First, Tetrault discusses how public speaking at conferences and events made her a better cybersecurity professional; second, she talks about how her work mentoring cybersecurity students helps them fast-track their way into the cybersecurity community; and third, with her work in organizations with Women in Cyber and siberX, she helps bring diverse cybersecurity professionals into the community, build stronger, more multi-faceted teams, and with them, a more multi-faceted face of the industry!

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Public speaking in cybersecurity 
3:17 - Getting into cybersecurity via Atari
4:59 - Network analyst to technician and more
9:10 - Cybersecurity public speaking
19:30 - How to promote yourself as a speaker
22:27 - Learn how to speak in cybersecurity
25:25 - Mentoring cybersecurity students
32:30 - Gender diversity in cybersecurity 
36:14 - Where cybersecurity fails job mobility
38:29 - Cybersecurity diversity initiatives in 10 years
39:17 - Learn more about Lisa Tetrault 
40:04 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Susan Morrow returns for her fourth time on the Cyber Work Podcast and the first since 2019. Morrow, simply put, is plugged into every aspect of digital identity currently being discussed, and she takes us deep into the security, ethical, practical and UX hurdles of current identity practices and gives us both an optimistic and pessimistic version of the digital identity practices in 10 years.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Digital identity 
3:00 - Current digital identity concerns
7:07 - Complicating digital identity
8:22 - Digital identity and daily work
13:00 - Secure coding
14:03 - Biggest problems in identity
20:54 - Competing identity systems
24:50 - How identity affects other areas
28:52 - The tech and processes of identity
30:04 - Identity in the next decade
34:24 - Jobs in identity
40:00 - Identity evangelist 
42:20 - Women in identity 
45:-02 - What is Avoco Secure?
47:28 - Learn more about Susan Morrow
48:40 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Stephen Cavey, co-founder and chief evangelist of Ground Labs, talks about the jagged jigsaw puzzle of data collection, data privacy and the dozens ? if not hundreds ? of privacy regulations and frameworks that govern them. Cavey and I talk about the bad old days of indiscriminate data collecting and grossly insecure payment process. We also address the places where the privacy experts of the future will shape the use and protection of personal data in all industries.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free 
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Bad data privacy protocols
2:36 - How Stephen Cavey got into cybersecurity
4:55 - Shifting into cybersecurity privacy
8:30 - Business hurdles in cybersecurity 
13:10 - Why do companies store my data? 
20:20 - Breaking cybersecurity privacy law
25:45 - International privacy laws
28:07 - A universal privacy doctrine 
31:30 - Principles for collecting user data
34:22 - Skills for working in data privacy
37:44 - Data privacy officer work
39:25 - The future of data collection and privacy
42:08 - What is Ground Labs? 
43:30 - Learn more about Cavey and Ground Labs
43:43 - Outro 

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Noriswadi Ismail of Breakwater Solutions and the Humanising 2030 campaign joins us to talk about privacy as it pertains to international business, cybersecurity and why it?s important not just to learn the certification variants but also the cultural variants that shape them. And via the Humanising 2030 campaign, Noriswadi and colleagues hope to bring a more ethical and diverse approach to programming and guiding AI in the coming decade.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Privacy and international business
2:53 - Noriswadi's first interest in tech
6:38 - A path toward patent law
11:32 - Managing director at Breakwater
16:05 - State of international security and risk plans
18:52 - Certifications internationally
22:58 - Experience versus certification
25:40 - Humanising 2030
29:24 - AI bias and geopolitical impact
32:30 - Diversity and including in cybersecurity
38:23 - Other goals of Humanising 2030
41:22 - What is Breakwater Solutions? 
44:44 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Dave Monnier of Team Cymru talks about the state of attack surfaces, the strengths and shortcomings of attack surface managers and why something we refer to as a ?soft? skill might be the hardest skill of all! Plus, we touch on shadow IT.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Attack surfaces 
2:55 - Dave Monnier's first interest in cybersecurity
7:30 - Instinctual cybersecurity learning
9:20 - Monnier's work as a chief evangelist 
14:00 - Cybersecurity soft skills
16:30 - What are attack surface managers? 
28:25 - ASM 1.0 to ASM 2.0
32:22 - State of attack surfaces
34:58 - Asset infrastructure in your business
40:00 - Key skills cybersecurity novices need
43:07 - Learning in cybersecurity 
45:42 - Learn more about Team Cymru
47:19 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Today on Cyber Work, Giora Engel of NeoSec talks about securing APIs. Find out why APIs are the new network, why their very nature makes them vulnerable to abuse and how to position yourself as an authority in the ever-growing field of API security. All that and a little entrepreneur talk.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - API security and PII
2:40 - Giora Engel?s cybersecurity beginning
4:20 - Israeli Defense Force and CEO of NeoSec
5:22 - Starting a cybersecurity company
9:20 - What is API security?
13:15 - Misconfiguration errors in API
17:21 - API and privacy regulation
20:02 - How to work in API security
22:06 - Security plan for PII
24:44 - Skills and experience needed to work in API security
27:10 - API hiring practices
28:58 - Fragility of API
31:07 - What is NeoSec?
32:35 - Learn more about NeoSec and Engel
32:55 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Mathieu Gorge of VigiTrust talks about the Marriott Hotel data breach that happened back in June, including the facts of the event and why once-per-year security awareness training isn?t enough when many employees only work seven months of the year. He also offers some privacy tips that will keep your hotel system privacy compliant under a whole host of different compliance frameworks. 

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Security awareness and data breaches
2:50 - Elephant in the boardroom book
5:42 - Gorge's latest projects and book
9:38 - Hacking of the Marriott Hotel
19:22 - Marriott's privacy and data collection policies
23:20 - Ensuring data privacy worldwide 
30:13 - How hotel franchises handle security
34:32 - Skills needed for securing the hotel industry
38:12 - What is DigiTrust?
41:20 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Today's Cyber Work Podcast features Dr. Chanel Suggs, the Duchess of Cybersecurity®. Dr. Suggs is a teacher, business owner and thought leader and has appeared on TV and podcast platforms around the world to talk about cybersecurity and the hacker mentality. She also had an incredibly challenging and seemingly insurmountable upbringing. Her tumultuous story can be found in her book, ?Against All Odds: Overcoming Racial, Sexual and Gender Harassment on the Digital Battlefield.? This episode contains a lot of heartbreak and some challenging stories, as well as incredible insights and some thoroughly important takeaways.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:56 - Overview of today's episode
1:58 - Who is Chanel Suggs, the Duchess of Cybersecurity?
3:12 - Overcoming family obstacles
4:50 - What drew her to a career in cybersecurity
8:10 - First steps to learning IT and cybersecurity
10:45 - Earning cybersecurity certifications
12:20 - Making a cybersecurity training "dungeon"
14:40 - Workplace abuse and harassment
18:28 - Issues with hiring diverse candidates
22:23 - What is Wyvern Security?
27:25 - Changing the workplace culture
32:47 - Social media is key to finding diverse candidates
36:55 - Preventing burnout with employees
40:10 - Advice on earning advanced degrees
42:03 - Contract work vs. full-time employee
43:34 - Free resources and services
44:52 - What's Chanel Suggs book about?
47:48 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Learn all about emergency response ? and the myriad techniques and skills that term implies ? in today's episode featuring Christopher Tarantino, CEO of Epicenter Innovation. Is there a physical security component? Yes! Is there a cybersecurity component? Big time! Is there an educational element? Absolutely! Find out how disaster planning, preparation, remediation and post-event rebuilding and improvement are all opportunities to strengthen your security posture.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:56 - Overview of today's episode
1:47 - Who is Christopher Tarantino?
3:25 - What does an emergency response team do?
4:38 - Resilience in emergency response
7:45 - Importance of boring innovation
9:30 - Higher ed emergency response example
13:13 - Healthcare, higher ed and government resilience
16:00 - Years-long education around disasters
21:03 - Biggest cybersecurity blind spots
25:00 - Skills required for emergency response careers
30:00 - Importance of communication across community
35:50 - Transitioning careers from cybersecurity to emergency response
44:10 - Learn more about Epicenter Innovation
44:35 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

If you want to learn more about working with operational technology (OT) and internet-connected devices, then don't miss today's episode with Francis Cianfrocca, CEO of Insight Cyber Group. He discusses security problems around OT and IoT systems and shares some surprising stories of intruders in the electrical grid. He also talks about why it?s so hard to secure a set of machines that often pre-date computer technology and the small changes in your community that can make huge differences in the entire security industry.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:56 - Overview of today's episode
1:48 - Who is Francis Cianfrocca and Insight Cyber? 
2:15 - Getting into tech and cybersecurity
4:13 - Francis' job roles and companies
5:22 - Early days of ICS systems security
10:15 - CEO duties at a cybersecurity startup 
12:19 - Why is infrastructure security so bad?
16:05 - Different approaches needed for ICS and IOT systems
20:23 - Catching intruders early on with industrial systems
22:45 - Using artificial intelligence in ICS security
24:50 - Bad actors are really good at reconnaissance
27:20 - ICS and IOT environments cannot have downtime
30:00 - Asset and behavioral inventory is difficult
31:42 - Real-world examples of rogue ICS software
36:30 - ICS vs. IOT security
42:57 - How to promote industrial security careers
46:07 - Impact of AI on cybersecurity careers
48:40 - Preparing for an ICS cybersecurity career
51:07 - What's Insight Cyber working on?
52:45 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Last year, Cyber Work Live brought you into the world of cybersecurity project management ? with tips for acquiring your skills, improving your resume and getting your foot in the door. But what does the day-to-day work of cybersecurity project managers look like?

Jackie Olshack and Ginny Morton return to answer that question. They?ll also share experiences they?ve gained while working on some of their biggest projects!

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Intro
0:50 - Who is Jackie Olshack? 
1:24 - Who is Ginny Morton? 
2:52 - Can non-technical PMs move into the tech space?
8:50 - Best way to manage projects with limited resources
13:30 - What certificates are needed for project management jobs?
18:52 - How do you kick off a cybersecurity project?
28:41 - How do you keep the project on schedule?
34:15 - Tips for networking in remote working situations
36:55 - Dealing with slowdowns and delays in projects
43:35 - Importance of a supportive environment in projects
47:40 - Dealing with delays from other teams in projects
50:35 - Tips for managing multiple projects at once
55:35 - How can teams support their project manager
56:35 - Transitioning into a cybersecurity career
59:00 - Outro and Infosec Skills giveaway

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

On today's episode, our old pal John Wagnon, Infosec Skills author and keeper of the secrets of OWASP, joins me to talk about the big changes in the OWASP Top 10 that happened at the end of 2021, his own class teaching the Top 10, and some job tips, study hints and career pivots for people interested in these vulnerabilities. Find out why access managers are going to rule the world someday!

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:56 - Overview of today's episode
1:43 - Who is John Wagnon? 
2:50 - Working in cybersecurity and teaching OWASP
4:18 - What is the OWASP Top 10?
7:51 - How did the OWASP Top 10 change in 2021?
15:48 - Why do these security issues never go away?
19:06 - Cybersecurity roles using the OWASP Top 10
23:43 - What's covered in John's OWASP Top 10 courses?
26:42 - How to get hands-on cybersecurity experience
30:24 - Vulnerability-related cybersecurity career paths
34:16 - What is John working on with Infosec and Fortinet?
35:37 - Using your career as a learning opportunity
37:16 - Learn more about John Wagnon and OWASP
38:30 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Today on the Cyber Work Podcast, Mark Kapczynski of OneRep reminds us of an awful truth most people either don?t know or don?t like to think about. Your personal information ? your address, your phone number, your age ? all of these things are on the public internet! Mark talks about OneRep?s mission to scrub personal information from these sites, suggests changes that could help prevent this problem, and shares ways you could base a career in this fight for data privacy and autonomy. All that and a detour into grade-school home computer shenanigans on today's episode.

? Get your FREE cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:56 - Overview of today's episode
1:50 - Who is Mark Kapczynski? 
2:44 - Data breaches are a way of life
3:36 - Getting started in IT and cybersecurity
5:41 - Helping the film industry go digital
7:31 - Transitioning industries from paper to digital
9:53 - What types of personal data are on the internet?
12:40 - How people search sites sell PII and make money
14:50 - How to get personal information removed from sites
18:07 - What type of services does OneRep offer?
19:19 - How is public personal data used in cybercrime?
23:01 - How can consumers limit personal data exposure?
26:38 - Regulatory changes needed to protect personal data
29:00 - Who owns your personal data?
30:55 - Web 3.0, smart contracts and other tech needed
33:58 - Jobs and careers related to data privacy
36:38 - Every professional needs to understand data
39:50 - What makes a data professional's resume stand out?
41:50 - What is OneRep?
44:30 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Today's episode is all about email fraud. John Wilson, head of the cyber intelligence division at Agari by HelpSystems, discusses Business Email Compromise (BEC), spearphishing, whaling, romance fraud and more. If you can name it, John?s studied it. And he's likely collected intel that?s managed to freeze cybercriminals? assets ? and even put them away. He gives career tips and advice for engaging in threat research at all levels, we discuss the pyrrhic victory that is the modern spam filter, and John tells me why BEC fraud hunters? best asset is a degree in psychology! All that and loads more, today on Cyber Work!

? Get your FREE cybersecurity training resources:  https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Free cybersecurity training resources
0:58 - Overview of today's episode
1:58 - Who is John Wilson? 
3:02 - Getting into cybersecurity
4:58 - How spam has evolved over the years
8:12 - Why pursue a career in fraud?
11:10 - 3 primary vectors for email attacks
15:20 - Is BEC ever an insider threat?
16:16 - Is education making a difference on BEC attacks?
20:55 - Tracking down BEC actors and recovering assets
23:50 - Two angles to preventing BEC attacks
29:12 - Careers related to BEC and phishing prevention
34:42 - How to gain cybersecurity experience and get hired
37:25 - Agari and email fraud protection
42:16 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

On today's episode, we're breaking down phrases you've heard a million times: ?security is everyone?s job,? ?humans are the weakest link in the security chain,? ?it?s not if you get breached, but when.? Returning guest Alyssa Miller drills into these comforting nostrums and explains why, even when they?re used for well-intended purposes, they often act to limit the conversation and the options, rather than address the hard work needed to overcome these evergreen problems. You?re not going to want to miss this one, folks! It?s all that, plus a little bit of book talk, today on Cyber Work!

? Start learning cybersecurity for free: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast
? Get the Cybersecurity Career Guide by Alyssa Miller: https://alyssa.link/book

0:00 - Intro
1:38 - Alyssa's tweet that inspired this episode
4:00 - Why you need to read the Cybersecurity Career Guide
9:10 - Cybersecurity platitudes and clichés
11:30 - Cliché 1: "It's not if you get breached, but when"
18:44 - Cliché 2:"Just patch your shit"
24:58 - Cliché 3: "Users are the weakest link"
32:34 - Cliché 4: "Security is everyone's job"
35:52 - Cliché 5: What is a "quality gate"?
44:14 - Cliché 6: "You just need passion to get hired"
48:14 - How to write a better cybersecurity job description 
50:15 - Business value of diversity and inclusion
52:52 - Building a security champions program
55:12 - Where can you connect with Alyssa Miller?
56:44 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Secure coders are responsible for developing and writing secure code in a way that protects against security vulnerabilities like bugs, defects and logic flaws. They take proactive steps to introduce secure coding methodologies before the application or software is introduced into a production environment, often following recommendations from the Open Web Application Security Project (OWASP) Foundation.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
? Learn more here: https://www.infosecinstitute.com/skills/train-for-your-role/secure-coder/

0:00 - Intro
0:25 - What does a secure coder do?
5:48 - How do you become a secure coder?
9:46 - What skills do secure coders need?
12:28 - What tools do secure coders use?
17:08 - What roles can secure coders transition into?
19:50 - What to do right now to become a secure coder

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Diana Kelley returns to the show to discuss her work as a board member of the Cyber Future Foundation and the goings-on at this year?s Cyber Talent Week. Whether you?re a cybersecurity hiring manager who doesn?t know why you?re not getting the applicants you want, a candidate who hears the profession has 0% unemployment but still can?t seem to get a callback or anyone in between, DO. NOT. MISS. THIS. EPISODE. This is one for the books, folks.

? Start learning cybersecurity for free: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Cybersecurity hiring and job searching
4:30 - Diana Kelley of Cyber Future Foundation
9:00 - Cyber Future Foundation talent week
13:58 - Reexamining cybersecurity job descriptions 
21:52 - Cybersecurity hiring manager and applicant training
27:10 - Strategies to bring in diverse talent from other industries
33:06 - Narrowing your cybersecurity job pursuit
39:37 - Using different educations in cybersecurity roles
41:32 - Implementing an educational pipeline
44:40 - Hiring based on strong skills from other trades
48:22 - Cybersecurity apprenticeships 
53:22 - Fostering cybersecurity community value 
59:09 - Diana Kelley's future projects
1:00:30 - Outro

Today on Cyber Work Ché Wijesinghe of Cape Privacy talks about the safe and ethical collection of user data when creating machine learning or predictive models. When your bank is weighing whether to give you a loan, they can make a better choice the more info they know about you. But how secure is that contextual data? Hint: not as secure as Wijesinghe would like!

? Start learning cybersecurity for free: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Machine learning and data collection
2:37 - Getting started in cybersecurity
3:15 - Being drawn to big data
4:35 - What data is driving decision-making?
9:04 - How is data collection regulated?
15:02 - Closing the encryption gap
16:50 - Careers in data privacy
19:07 - Where can you move from data privacy?
21:20 - Ethics of data collection 
23:25 - Learn more about Wijesinghe 
23:55 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

A Privacy Manager is responsible for the development, creation, maintenance and enforcement of the privacy policies and procedures of an organization. They ensure compliance with all privacy-related laws and regulations. The Privacy Manager takes an active lead role when a privacy incident or data breach occurs and will start the investigation. They will then monitor, track and resolve any privacy issues. The Privacy Manager builds a strategic and comprehensive privacy program for their organization that minimizes risk and ensures the confidentiality of protected information.

Advanced knowledge of privacy law and data protection is critical to success in this role.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
- Learn more about privacy managers: https://www.infosecinstitute.com/role-privacy-manager/

0:00 - Working as a privacy manager
0:40 - What does a privacy manager do? 
3:02 - Experience a privacy manager needs
5:15 - Is college necessary for a privacy manager?
8:05 - Skills needed to be a privacy manager
10:30 - What tools does a privacy manager use?
11:15 - Where do privacy managers work? 
12:15 - Roles privacy managers can move to
13:30 - How do I get started becoming a privacy manager?

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Just getting started?  This role is for you!

The Cybersecurity Beginner role focuses on the foundational skills and knowledge that will allow anyone to take the first step towards transitioning into a cybersecurity career.  No prior knowledge of cybersecurity or work experience is required. The only prerequisite is a passion for technology and cybersecurity.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
? Learn more about the role here: https://www.infosecinstitute.com/role-cybersecurity-beginner/

0:00 - Working as a cybersecurity beginner
0:41 - Tasks a cybersecurity beginner may take on
4:15 - Cybersecurity work imposter syndrome
5:49 - Common tools cybersecurity beginners use
9:08 - Jobs for cybersecurity beginners
13:50 - Get started in cybersecurity 

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Industrial control system (ICS) security practitioners are responsible for securing mission-critical SCADA and ICS information systems. They are responsible for restricting digital and physical access to ICS devices, such as PLCs and RTUs, to maximize system uptime and availability. Extensive knowledge of OT and IT protocols, incident response, Linux and Windows OS, configuration management, air-gapped or closed networks, insider threats and physical security controls are important competencies for any ICS security practitioner.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
? Learn more about ICS security practitioners: https://www.infosecinstitute.com/skills/train-for-your-role/ics-security/

O:00 - ICS security practitioners 
0:25 - What is an industrial control system practitioner?
2:22 - How to become an ICS practitioner 
4:00 - Education required for an ICS practitioner 
5:00 - Soft skills ICS practitioners need
6:05 - Common tools ICS practitioners use 
7:59 - Where do ICS practitioners work? 
10:05 - Can I move to another role after ICS practitioner? 
12:18 - Getting started as an ICS practitioner 

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Join Infosec Skills authors Chris Stevens, John Bandler and Ralph O?Brien as they discuss the intersection of privacy and cybersecurity. They?ll help you walk a path that will lead to an engaging career as a privacy specialist ? a job role that grows with more opportunities year after year!

This episode was recorded live on April 12, 2022. Want to join the next Cyber Work Live and get your career questions answered? See upcoming events here: https://www.infosecinstitute.com/events/.

0:00 - Intro and guests
3:45 - What is privacy as a career? 
8:15 - Day-to-day work of a cybersecurity privacy professional?
16:45 - Intersection of law and tech degrees
20:30 - What beginner privacy certifications should I pursue? 
25:45 - Best practices for studying for IAPP certifications
33:00 - How to gain experience in cybersecurity privacy work
40:27 - How to interview for a cybersecurity privacy job
45:00 - GDPR and ransomware 
51:52 - Implementation of privacy laws and security positions 
58:15 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Security engineers are responsible for implementing, and continuously monitoring security controls that protect computer assets, networks and organizational data. They often design security architecture and develop technical solutions to mitigate and automate security-related tasks. Technical knowledge of network/web protocols, infrastructure, authentication, log management and multiple operating systems and databases is critical to success in this role.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
? Learn more: https://www.infosecinstitute.com/skills/learning-paths/security-engineering/

0:00 - What is a security engineer? 
3:39 - How do I become a security engineer? 
4:52 - Studying to become a security engineer
5:47 - Soft skills for security engineers
7:05 - Where do security engineers work? 
9:43 - Tools for security engineers
12:10 - Roles adjacent to security engineer 
13:15 - Become a security engineer right now

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Information risk analysts conduct objective, fact-based risk assessments on existing and new systems and technologies, and communicate findings to all stakeholders within the information system. They also identify opportunities to improve the risk posture of the organization and continuously monitor risk tolerance.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
? Learn more: https://www.infosecinstitute.com/skills/train-for-your-role/information-risk-analyst/

0:00 - Information risk analyst career
0:30 - Day-to-day tasks of an information risk analyst
2:09 - How to become an information risk analyst
4:00 - Training for an information risk analyst role
5:42 - Skills an information risk analyst needs
9:24 - Tools information risk analysts use
10:51 - Jobs for information risk analysts 
13:08 - Other jobs information risk analysts can do
18:05 - First steps to becoming an information risk analyst

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Moshe Zioni of Apiiro talks about threat research and how to properly report discovered code vulnerabilities. We discuss the ways that vulnerabilities can find their way into code despite your best intentions, the difference between full disclosure and responsible disclosure, and being in the last generation to still grow up before the internet changed everything.

? Free cybersecurity training resources: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Cybersecurity threat research 
2:21 - Getting interested in computers
3:25 - Penetration testing and threat research 
6:15 - Code vulnerabilities 
10:58 - Research process for vulnerabilities 
17:05 - Proper reporting of threats
23:11 - Full disclosure vs proper disclosure
25:53 - Current security threats
30:20 - Day-to-day work of security researchers 
32:02 - Tips for working in pentesting 
35:32 - What is Apiiro?
39:11 - Learn more about Moshe Zioni 
39:42 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

TEDx speaker, security researcher, host of the podcast MiC Club and all-around expert on security awareness and social engineering, Dr. Erik Huffman, is today's guest. Huffman spoke at the 2021 Infosec Inspire virtual conference, and for those of you who were captivated by his presentation, prepare for another hour of Dr. Huffman?s insights on why we need to teach security awareness from insight, rather than fear or punishment, how positive name recognition in an email can short-circuit our common sense and how to keep your extrovert family members from answering those questions online about your first pet and the street you lived on as a child.

? Start learning cybersecurity for free: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Clicking on phishing attacks
3:13 - First getting into cybersecurity
5:00 - Higher education and cybersecurity 
7:41 - Cybersecurity research projects
10:05 - Impacting a cybersecurity breach 
11:14 - Security awareness and social engineering
15:45 - Common social engineering tricks 
23:00 - Changing security habits
30:15 - Cybersecurity communication avenues
33:30 - Getting family members cyber safe
38:00 - Harvesting info via social media
42:13 - Working in security awareness and threat research
44:54 - Importance of white papers and documentation 
55:04 - Learn more about Erik Huffman
56:00 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Marcus Fowler, senior vice president of strategic engagement and threats at DarkTrace, talks about attack vectors currently facing embedded journalists, their need to be available at all times for potential sources and how that openness makes them, their company and their confidential sources potential attack vectors for cybercriminals. Fowler talks about security hardening strategies that don?t compromise journalistic availability, the work of threat research and why people with natural interests in cybersecurity will have their career path choose them, not the other way around.

? Start learning cybersecurity for free: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Cybersecurity threats to journalists 
3:00 - Getting into cybersecurity 
5:50 - CIA cybersecurity training
7:18 - Joining DarkTrace in engagement threat roles
10:22 - Tasks with engagement threat jobs
13:22 - Cybersecurity work balance
17:49 - Advanced persistent threats against media
23:33 - Attack vectors journalists face
26:14 - Journalist cybersecurity savvy 
28:08 - A truly secure journalism source 
32:58 - Damage from a compromised source
36:05 - Main cybersecurity threats right now
38:37 - Qualifications needed to work as a threat researcher
42:52 - Safe cybersecurity jobs 
47:05 - What is DarkTrace?
49:06 - Learn more about Marcus Fowler
50:11 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.

Justin Pelletier is the director of the cyber range program at the ESL Global Cybersecurity Institute at the Rochester Institute of Technology. Infosec Skills has some great cyber ranges, but Pelletier shows the organization?s massive, immersive simulations. Because they?ve also included cyber range technology for beginning cybersecurity pros transitioning from other jobs, we cover what?s involved in making a good cyber range, how to break down those early barriers of fear and self-doubt and how quickly you can move into a cyber career after hands-on training.

? Start learning cybersecurity for free: https://www.infosecinstitute.com/free
? View Cyber Work Podcast transcripts and additional episodes: https://www.infosecinstitute.com/podcast

0:00 - Immersive cyber ranges
3:13 - Getting into cybersecurity
5:06 - Studying data breaches
11:03 - Cybersecurity at the Department of Defense
14:02 - Cyber range education at the RIT
16:20 - Work of the Global Cyber Range
24:20 - Cyber range scenarios 
38:30 - What makes a good cyber range? 
42:00 - Successfully getting into cybersecurity
45:33 - Cyber range upskilling 
48:47 - Cybersecurity hiring changes
51:30 - Learn more about the cyber range center
52:30 - Outro

About Infosec
Infosec believes knowledge is power when fighting cybercrime. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. It?s our mission to equip all organizations and individuals with the know-how and confidence to outsmart cybercrime. Learn more at infosecinstitute.com.