The UNSECURITY Podcast – Episode 38 Show Notes

YES! I’m on time again. If I get good at this, I won’t need to make this comment anymore. Odds of that?

As usual, I’ll give a quick review of the week, then we’ll jump right into the show notes.

It was another good and productive week. Gooder and more productiver than I probably deserve, but this is what you get when you are surrounded by awesome people all the time. 

  • Monday started with UNSECURITY Podcast (episode 37). Our guest was the one and only MN State Representative Jim Nash. If you missed it, you should give it a listen. We call BS on some things, then chat about some other things. All in all it was a great show. After that, it was coffee with a friend and a lot of writing.
  • Tuesday started with coffee with SecurityStudio’s VP of Software Development, Ivan Peev. After coffee it was an executive leadership meeting (all executives rated it a 10, which is always good), more writing, and a global information security strategy meeting with an awesome vCISO client.
  • Wednesday was great. An FRSecure Customer Advisory Board (CAB) meeting, coffee with Peter Vinge (Director of Operations – FRSecure), more writing, a few more meetings, more writing, and a meeting with legal counsel.
  • Thursday started with a SecurityStudio User Advisory Group meeting, then the rest of the day was spent writing.
  • Friday (today) started with a coffee meeting with my good friend and SecurityStudio’s president, John Harmon. We had a cool discussion about family, health, and some security strategy stuff. After coffee came a SecurityStudio product strategy meeting, and now I’m writing again.

What’s with all the writing?

It’s been a while since I’ve updated people on the status of this second book. The first book (Unsecurity: Information security is failing. Breaches are epidemic. How can we fix this broken industry?) was published this year, and it’s been really well-received. This first book was written to information security professionals. This second book is an information security book written to information security amateurs, or common everyday people. The book’s parts are (for now):

  • Introduction
  • Part 1 – Current State of Affairs (nation-state, cyberwarfare, businesses, attackers, security, privacy, and safety)
  • Part 2 – Motivation (find your motivation to act, family, friends, community, country, and business)
  • Part 3 –  Application (applying the basics and building habits)
  • Part 4 – Introducing and Using S2Me (the assessment, recommendations, and conclusions)
  • Closing

If you read my first book, you might remember where I said that writing a book is a bitch. It still is. The amazingness of the experience is more than worth it though. More to come in the coming weeks and months.

Let’s get to the show…


SHOW NOTES – Episode 38

Date: Monday, July 29th, 2019

Today’s Topics:

We’re going to touch on the following topics this week:

  • Civic Ransomware Awareness Project update
  • The #100DaysofTruth follow-up
  • Project Bacon
  • Industry News

[Evan] – Hi everybody! Holy buckets, we’ve got a good show planned today. Good morning, and in case you don’t know the voice yet, this is Evan and this is episode 38 of the UNSECURITY Podcast. No Brad joining me today. He’s got a “vacation”. Who does that?! Anyway, in his place is my good friend and SecurityStudio’s president John Harmon. This is where you say “hi” John.

[John] He’s a quick thinker with a sharp tongue, so I’ll need to be on my toes with his response (probably).

[Evan] So, Brad’s on vacation. I joked a little about that, but I can hardly think of someone who deserves it as much as he does. Kudos to him for taking some time off to be with his family. Before we get into talking more about our guest and some cool things, I just want to give our listeners a quick update on our Civic Ransomware Awareness Project and an idea for a follow-up to the #100DaysOfTruth thing.

Quick Civic Ransomware Awareness Project Update and New Idea Discussion

John can talk here too, I just don’t have anything specific for him yet.

[Evan] This is our 38th episode of the podcast, and we finally have you on the show. Sorry it took so long. Now, I know you pretty well because we’ve been working together for quite some time now, but the listeners may not know who you are. Tell us about yourself.

[John] Tells us a story about himself

Talking About John

[Evan] I gotta tell you man, I love working with you every day. You’re a guy that truly gets what we’re trying to do and you’re absolutely sold out on our mission. Later this year, like October, you and I are embarking on a new journey. We affectionately call it Project Bacon. Where did the name come from?

[John] The name was John’s idea, but let’s hear him out.

[Evan] The name is awesome. Besides, who doesn’t like Bacon? So, we have this Project Bacon thing. What is it?

[John] Tells us what Project Bacon is.

[Evan] OK, I think I get it (of course I do, but I need to act like I don’t so the show is more interesting or something). Why are we doing this?

[John] Oh yeah! The “why” is the best part.

More Project Bacon Discussion

[Evan] I’m pumped about Project Bacon. It’s going to be a blast and we’re doing good things all along the way. John, you’ve listened to our podcast before. We always close this thing out with a few news stories. You game?

[John] John is always game.

Industry News

Here’s our news to discuss in this week’s show. The depth of the discussion will depend on our time.

Closing

[Evan] – OK. That’s how it is. So many cool things going on and too many things to talk about. Thank you John for filling in for Brad this week. Project Bacon is going to be great! Also, a special thank you to our listeners. Each week, the number of listeners to our podcast continues to grow, and each week we received great feedback from you. Please keep it coming. If we haven’t had a chance to respond, it isn’t because we don’t care, we just haven’t gotten around to it yet.

If you want to keep up with the haps, be sure to follow me, Brad, and/or John on Twitter. I’m @evanfrancen, Brad’s @BradNigh, and John is @HarmonJohn. Email the show at unsecurity@protonmail.com. Have a great week everybody!

The UNSECURITY Podcast – Episode 37 Show Notes

On time this week? Absolutely! We take these things seriously around here, you know that!

Happy Friday UNSECURITY Podcast listeners! It was a great week for us, hope yours was good (or better).

Weeks like this one at FRSecure and SecurityStudio are always special. We held our end of quarter meeting at our Minnetonka, MN headquarters. Our people fly in from all over the country to celebrate, collaborate, and have fun. It’s AWESOME to see everyone and spend time catching up.

This slideshow requires JavaScript.

We are all family here, and it’s an amazing experience when everyone gets to come home. We have people fly in for the week from Florida, Nevada, Kentucky, and soon to be Missouri. It’s magical when everyone gets together. One of our core values is “work hard, play hard”, and it’s fun to see everyone collaborating then going out and having fun afterwards. Seriously amazing people doing incredible things.

I love these people!

Like almost every quarter, the team killed it again. It was another record quarter revenue and profit-wise, but this is secondary to the impact this team is making in our industry.

The mood was awesome. Blessings everywhere.

On to the show notes, eh? (What am I Canadian now?)

Originally, we were planning to cover a new SecurityStudio initiative we affectionately call “Project Bacon”. We’re going to put that off until next week because we have a special guest joining us for this show. Our special guest is Jim Nash, who represents District 47A in the Minnesota State House of Representatives.


SHOW NOTES – Episode 37

Date: Monday, July 22nd, 2019

Today’s Topics:

We’re going to touch on the following topics this week:

  • Civic Ransomware Awareness Project update
  • The #100DaysofTruth update
  • Calling BS on BS
  • Industry News

[Evan] – Hey oh. Good morning everyone. My name is Evan Francen. My show to host this week, so if you don’t like it, blame Brad. Speaking of Brad, he’s here. Hi Brad.

[Brad] Hi (or something similar)

[Evan] Also joining us this morning is Mr. Jim Nash. Now, I’ve got a special affinity for Jim. He’s a good friend, and he also represents my home district in the Minnesota State House of Representatives. Hi Jim.

[Jim] He also says “hi” or something of the like.

[Evan] Jim, I’m grateful for the work you do for the people of our district and I’m also very thankful for advocating like you do for information security. You’re a tremendous advocate for FRSecure, for the State, and for the US as a whole. Thank you.

[Jim] Graciously accepts my gratitude and says something wisdomy that will awe his constituents. I’ll probably have to cut him short because politicians sometimes like to talk.

[Evan] Let’s jump right in, shall we? We have a lot to cover in this week’s show. Real quick, like real real quick, what did you think about last week?

[ALL] Stuff.

[Evan] Yeah, it was a great week for sure. Quick update on the civic ransomware call to action stuff. I actually gave this thing a real name now, “Civic Ransomware Awareness Project”. We received a few more updates; a couple from our backyard here in Minnesota and one as far away as Idaho.

Civic Ransomware Awareness Project discussion

[Evan] I hope we’ll continue the efforts to work together, people from all walks and backgrounds, including the private and public sector, to make information security better for everybody.

[ALL] Maybe they say something maybe they don’t. It’s early Monday morning for crying out loud.

[Evan] Another thing from last week. Don’t know if you guys noticed, but I finished my #100DaysofTruth series. What did you think?

#100DaysofTruth discussion

[Evan] It was a fun exercise. People have been asking me “now what”? Here’s the plan, and you heard it here first. The FRSecure Marketing Team is summarizing all one hundred days into a single blog post, we’re going to produce an ebook out of the content, we’re going to create an audiobook, and I’m thinking about doing #100DaysofLies.

[ALL] Maybe some more comments, maybe I need to kick them under the table to wake them up.

[Evan] Alright, next thing I wanted to talk about was something that you, Jim, brought to my attention last week. This should be a good discussion. Jim came to me an told me that there’s this guy (he didn’t recall his name at the time) who is out there preaching that there are companies in the United States that are unhackable. As you can probably imagine, I’m not buying it. So I wrote a blog post here at evanfrancen.comblog post here at evanfrancen.com, and I’d like to talk about it. Whatya say guys? Game?

[ALL] Of course they’re game!

Calling BS on BS discussion

NOTE: Go into the background some more, then talk about the BS.

[Evan] Alright. Good spirited discussion. Let’s wrap this thing up with some news, then get on with what is sure to be another great week!

Industry News

Here’s the news to discuss, just two this week because we covered so much other stuff and we’re running out of time:

Closing

[Evan] – Well, damn. That’s how it is. We do a ton of things around here and we talk about a lot of stuff. Special thanks to Jim Nash for joining us this week. Jim, you’re a good man. Also, a special thanks to our listeners. You guys give us awesome feedback every week and tips about what you’d like us to talk about. Be sure to follow me, Brad, and/or Jim on Twitter. I’m @evanfrancen, Brad’s @BradNigh, and Jim’s  @JimNashMN. Email the show at unsecurity@protonmail.com. Have a great week everybody!

Denver ISSA Incident Management Workshop Recap

Finally. I’m finally getting around to posting about this event. The fine folks of the Denver ISSA chapter invited me to speak at their chapter event on May 23rd. The event was a three-hour incident management workshop (titled Incident Management – Panic or Plan).

‘Wait! What?! Three hours?!

Yes. These poor folks endured three hours of my preaching. Read on…

About Denver ISSA

The Denver ISSA Chapter is the largest chapter in the world with more than 800 members. I’ve attended numerous ISSA chapter events over the years, and the Denver ISSA Chapter is one of the best! Read about the Denver ISSA Chapter here.

I spent some time with James Johnson, the Chapter President, and Shannon Welton, the Chapter Training Coordinator while I was there, and they are both top notch! Seriously. They’re good, and it was great conversation (for me anyway).

Can’t say enough good things about Denver ISSA. Loved every minute I spent there.

About the Workshop

Shannon Welton was my primary contact for the workshop. She’s a pleasure to work with. I was given liberty to create and present whatever content I wanted to, and she made sure I had everything I needed at every step of the way.

Flight in the morning from Minneapolis to Denver. Grabbed a Lyft. Made the trip from the airport to Maggiano’s Little Italy (16th St Mall). Lunch started at noon, and I got there at 12:05. Not bad. 😉

From the moment I arrived, I felt welcomed. There seemed to be ~100 people there, and they were all engaging. They showed genuine interested in each other and it felt good to be there. Lunch ran from noon til 12:45, at which time Shannon kicked off the workshop with an introduction. When she introduced me, she asked if anyone had heard of me. Funny! Only one person raised their hand.

After three hours together, they’ll all have heard of me now!

I’m the sort of guy that could talk for three days about information security (and incident management), so three hours wasn’t going to be a problem for me. The challenge is/was keeping people engaged for three hours.

Here’s the learning objectives.

Here’s the agenda.

I used two things to keep people awake; a 15-minute break at 2:15 and Dad jokes. We made it through to 4:00pm, and the group was very engaged. More than I expected. There were great questions, good eye contact, and I felt as though we all got something from the experience together.

Workshop Content

Get it here.

  • ISSA-Denver_PanicOrPlan-052319.pdf, the slide deck.
  • CSIR-Maturity-assessment-tool_Info1.pdf, the CREST Cyber Security Incident Response Maturity Assessment Tool introduction document.
  • Maturity-Assessment-Tool.xlsm, CREST Cyber Security Incident Response Maturity Assessment Tool (Summary).
  • Maturity-Assessment-Tool_Detailed.xlsm, CREST Cyber Security Incident Response Maturity Assessment Tool (Detailed)
  • ISSA-SAMPLE_Incident_Log&Categorization_Tool.xlsx, the FRSecure basic information security incident logging and categorization workbook.
  • ISSA-SAMPLE_Security_Incident_Response_Plan-052319.docx, the FRSecure basic incident management/response plan template.

Summary

The Denver ISSA is awesome! If I lived in Denver, I’d be at every event. If you live in Denver, you should go to every event. Seriously, get there.

A dozen of so people came up to speak with me after the workshop. More great questions and some great connections. I felt bad that I had to run shortly after the workshop in order to catch my plane back to Minneapolis. Next time (if/when there is one), I will stay longer.

Presenting this workshop was a real privilege, and I’d go back anytime.

P.S. Another example of their awesomeness; I received a beautiful “thank you” gift basket at my office from these guys. Too cool!

2019 New Directions in IT Education Conference

This was a wonderful opportunity to talk to some fascinating people; people tasked with helping us create the future talent of our industry.

It was also the fourth talk at the fourth conference of the week, so things were getting a little weird. Regardless, I always enjoy this and I’m having fun!

About the 2019 New Directions in IT Education Conference

This is an annual conference attended by “educators and industry experts”, sponsored by the Minnesota State IT Center of Excellence.

According to the conference website:

Minnesota State IT Center of Excellence, invites industry professionals, employers, and Minnesota State faculty members to convene at our annual free IT conference that takes place in May.  Explore emerging employer needs, identify specific implications for student learning outcomes, and map out actions that individual faculty and departments can implement, and identify comprehensive innovations to be developed collaboratively.

A really cool opportunity to speak and collaborate! I was here for two reasons:

  1. Deliver a keynote talk
  2. Participate on a panel of experts

I was with some experts, but I’ll apply that word loosely to myself. The full conference schedule is here.

Keynote Plan A

If you know me, you know that I wing it a lot. This makes me very hard to manage, and it can get frustrating for people who work with me. It’s just how I roll.

I prepared my talk for this conference four (maybe five) days ahead of time. That’s crazy good for me! My talk was/is titled “Seven Facts About Unicorns”. I put a lot of work into the presentation and I was excited to give the talk (at the time I wrote it).

Keynote Plan B

There wouldn’t be a need for Plan B if I had just stuck with Plan A, but what fun would that be? Driving on the way to the venue, I changed my mind. I didn’t want to talk about unicorns anymore. I even said to myself in the truck, “Seriously Evan?! Don’t do it.” Thankfully, I was 45 minutes ahead of schedule, so I pulled off at a local coffee shop to create a new presentation.

Some people (I/me) never learn.

I grabbed a cup of coffee, tore my laptop out of my bag, and begin pounding away on the keyboard. What would I talk about though? Hmm. Got it! I will cover the first 38 of 100 truths about information security. I started the #100DaysofTruth series 38 days ago, at the time of the talk (at the time of this writing, I’m on day 50). I felt like hitting some hard truth with the educators in the audience. So, that’s what I did. The title of Plan B was “38 of the 100 Truths About Information Security”.

Whipped the slides together, and away we went!

The talk went extremely well. The audience was engaged, and there were some great questions afterwards. We’ll save the unicorn talk for another day. 😉

Here’s a copy of the presentation if you want to look at it or use it.

Want to see the Seven Facts About Unicorns talk? What’s it worth to you? Just kidding, here it is. I still might deliver this talk someday.

Panel of Experts

This was cool! I just got to sit there and answer questions. Not all the questions, but only the ones where the other two panelists didn’t answer. I suppose I also added a few things here and there to their answers, but the other panelists were dead on I think. You know how you have to add something once in a while to make people think 1) you’re still paying attention and 2) you’re smart and stuff? I did some of that.

It was an honor to sit on the panel with Ryan Manship from RedTeam Security and Sahar Ismail from Legacy Armour

Overall, it was an awesome conference and a great way to end a crazy week.

#100DaysofTruth – Week One

If you follow me on Twitter or LinkedIn, you may have noticed that I started a new campaign. The name of the campaign is #100DaysofTruth, and it’s a pretty simple concept. Each day at 8:00am CDT I’ll post a new truth about information security, one per day. See?! Simple.

I have two reasons for doing the campaign:

  1. I want to educate. Over the years, it’s been a tremendous blessing to see the ways people do things, and they ways they solve problems. I take it for granted some days that I get to steal the cool things that extremely talented people do and make them my own. This is a HUGE benefit to being a consultant! Every single client I meet, every single CISO, is another opportunity to put a cool tool in my bag of tricks. I want to share the wisdom I’ve learned with others.
  2. I want to engage. You will either agree or disagree with what I say. If you agree, let’s reinforce each other’s view and encourage each other. Lord knows, this industry could use more reinforcement of good practice and encouragement. If you disagree, let’s respectfully challenge each other’s views, thoughts, and opinions. I am a believer in diverse perspectives. They lead to the best solutions.

I’m doing the campaign this way because it doesn’t take more than a few minutes each day. Who can’t donate a few minutes each day? Don’t answer that.

THE WORDS ABOVE WILL STAY EACH WEEK

Truths From Last Week

The slideshow (below) contains each of the truths from last week as depicted in my Twitter feed.

This slideshow requires JavaScript.

Do you agree with the truths or disagree. Follow me and comment to let the world know.

Next week’s truths are already queued up. Have a great week!