Posts

The UNSECURITY Podcast – Episode 84 Show Notes – Women in Security Pt1

Happy Monday!

Last week was another blur. The world hasn’t quite ended yet, but it seems to be getting closer.

Women in Security Series

Brad and I are starting a Women in Security Series this week. This will be (at least) a four-part series where we’ll talk about the topic of women in the information security industry. We’ll have a special female guest each week to give us their experiences, advice, opinions, etc. At FRSecure, we work with some amazing women, and we’ll start the series talking with them. After talking with some of our own, and if things seem to be going well, we’ll reach out to other women outside of FRSecure for an even broader perspective.

Our first guest in the series is Renay Rutter, FRSecure’s Chief Operations Officer. She’s pretty much all around awesome, and it will be great talking with her this week!

Let’s get on with the show!


SHOW NOTES – Episode 84

Date: Monday, June 15th, 2020

Episode 84 Topics

  • Opening
  • Introducing Our Special Guest: Renay Rutter
  • Catching Up (as per usual)
  • Recap of the 2020 FRSecure CISSP Mentor Program
  • Women in Security
  • News
  • Wrapping Up – Shout outs
Opening

[Evan] Hi everyone. Episode 84 of the UNSECURITY Podcast is upon us. Wow, it’s already mid-June! June 15th, 2020 to be exact. I’m your host, Evan Francen and joining me as usual is Mr. Brad Nigh. Good morning Brad!

[Brad] Brad does Brad.

[Evan] Brad, last week I mentioned that I wanted to do a Women in Security series on our show and you seem pretty excited about it. Well, I was talking about this for a couple weeks with a close friend of ours and an awesome business person, Renay Rutter. Renay has more than 30 years of IT and business leadership experience, and we’ve had the pleasure of working with her here at FRSecure for the past 2(ish). She’s currently FRSecure’s Chief Operating Officer, and she’s pretty much kicking butt. Welcome to the show Renay!

[Renay] Renay does Renay.

[Evan] We have a lot to cover today, and before we jump into the meat of the show, let’s check in like we always do. What’s up you two?

Catching Up

Quick discussion about last week, the weekend, family, safety etc.

[Brad] Brad shares his things.

[Renay] Renay shares her things.

[Evan] Alright, that’s that. Was it last week or the week before that we finished up the 2020 FRSecure CISSP Mentor Program? Ugh. I can’t remember.

Recap of the 2020 FRSecure CISSP Mentor Program

This was the BEST year yet, by far. Just some of the highlights:

  • We had 1,444 total registrations at the beginning of class.
  • There were three instructors this year, which made life a lot smoother (me, Brad, and Ryan Cloutier)!
  • There have been 5,398 views of Session One.
  • Already had a dozen or so people inform us they’ve already passed the exam!
  • Renay (our guest) attended too!

[Evan] It was a great season and I’m pumped about what’s to come. The CISSP Mentor Program has been such a blessing for us ever since we started it 11 years ago. Huge thank you to our instructors, Brad and Ryan. Also, a huge shout out to the people behind the scenes who make this thing happen:

  • Brandon Matis, FRSecure Content Marketing Specialist
  • Lori Blair, FRSecure Senior Security Analyst
  • Ryan Abraham, FRSecure Senior Security Analyst
  • Chad Spoden, FRSecure Senior Security Analyst

A great team effort and a great success. Here’s to next year!

Alright, now on to our series topic.

Women in Security, Part One

[Evan] This could be the start of something cool. We’re going to take a big portion of the next four shows (or so) to get real and be honest about the topic of women in the information security industry. Do we have a shortage of women in our industry? If so, what’s the big deal? Why is the topic important for us to talk about? Lot’s of questions and I’m sure just about everyone has an opinion. Instead of people listening to our opinions Brad, we’re going to talk to the people this relates to the most; women! What better way to get a woman’s perspective on things than to talk to a woman?

Who better to start the series off with than Renay. Let’s do this.

Open Discussion

  • How you got into the industry?
  • Your journey in the industry.
  • Advice you have for someone starting out.
  • Do you think we need more women in our industry and why?
  • Opinions about the talent shortage in our industry.
  • What can we do better in recruiting more people, and specifically more women in our industry?
  • Whatever else we’d like to share.

[Evan] Thank you Renay. Good information and things to think about more. Much appreciated! How about some quick news stuff?

News

[Evan] Between COVID-19, the social justice things going on around the world, and everything else. Yes, there is plenty of information security news too! Here’s just a few stories to bring your attention to quick:

Wrapping Up – Shout outs

[Evan] There you go. That’s it for episode 84. Thank you Renay for giving a great start to the Women in Security series. We’re lining up our guest for next week and it’s going to be a great show too! Either of you have any shout outs this week?

[Brad and/or Renay] We’ll see.

[Evan] Thank you to all our listeners! We dig all you folks (mostly). Let us know what you think about this show or share your ideas with us. You can email us at unsecurity@protonmail.com. You social types can follow us on Twitter if you’d like. I’m @evanfrancen, Brad is @BradNigh, and even Renay’s got some Twitter foo; she’s at @RenayRutter. The companies we work for are social too, heck everyone’s social nowadays. SecurityStudio’s Twitter is @studiosecurity and FRSecure’s Twiiter is @FRSecure.

That’s it! Talk to you all again next week!

The UNSECURITY Podcast – Episode 77 Show Notes – Lots Going On

Keeping the show notes short again this week. We’ve been swamped here at FRSecure and SecurityStudio, so not a lot of time to recap what we’ve been up to.

Let’s just get to it, episode 77 show notes below…


SHOW NOTES – Episode 77

Date: Tuesday, April 28th, 2020

Episode 77 Topics

  • Opening
  • Catching Up (as per usual)
  • Remote Working and COVID-19 Stuff
  • Quick Zoom Update
  • Other Things
  • News
  • Wrapping Up – Shout outs
Opening

[Brad] Welcome back! This is episode 77 of the UNSECURITY Podcast, and I’m your host this week, Brad Nigh. Today is April 28th, and joining me this morning as usual is Evan Francen. Good morning.

[Evan] Evan says his “blah, blah, blah”.

[Brad] We have a jam packed show this week for sure, but before we jump in, let’s catch up quick. Lots going on.

[Evan] Yep. LOTS going on! Good things, but a helluva lot of good things!

Catching Up

Quick discussion about some of the cool things we’re doing.

[Brad] Good! Let’s shift gears now quick and talk about security remote workers. We’ve briefly touched on it over the last few weeks but as this appears to be becoming the “new norm”, I would like to spend some time dedicated to the topic.

[Evan] Yeah man! Sounds good.

Remote Working and COVID-19 Stuff

Discussion about many news articles, topics, announcements and such…

[Brad] First up, a news article titled “Malware Risks Triple on WFH Networks: Experts Offer Advice”

[Brad] Obviously this is bitsight so we know the limitations however I think in this use-case the data is valuable. We’ve got some other good resources and guidance to share, including:

[Evan] Yeah, these are all great resources that are worth looking at. I think our listeners will appreciate them all. Quick announcement, S2Me version two is releasing this week! It’s a limited release, but it’s a VERY good one! We’ll get into S2Me and how it works with S2Team to offer a unique (and what we think is a better) approach to securing the remote workforce.

[Brad] Cool. Should be a good show next week then!

Quick Zoom Update

[Brad] Zoom has been all over the news since the COVID-19 outbreak, and the stories have been all over the place. Thought we’d mention some of the latest developments. As a quick aside, we’ve touched on Zoom the last few weeks and it’s interesting that some of the other options have flown under the radar despite attacks that seem to be more severe.

And Zoom has released quite a few new security features, there’s this good write-up on Tech Republic titled “Zoom 5.0 Includes Security and Privacy Improvementshttps://www.techrepublic.com/article/zoom-5-0-is-coming-with-improved-security-features-heres-whats-new/

Other Things

[Brad] Like we said, there’s always a lot going on around here at FRSecure and SecurityStudio. Quick list of things:

  • FRSecure CISSP Mentor Program (we started this 11+ years before the COVID-19 pandemic)
  • Safety and Cybersecurity at Home 101 Webinar Series (Videos here).
  • SecurityStudio Partner Community (Join here).
  • The Daily inSANITY Check-in (Join here).

[Brad] Good conversation. Thank you Evan. Let’s do some news quick.

News

[Brad] Always plenty of things to talk about in the news, and here’s a few stories that caught my eye:

Wrapping Up – Shout outs

[Brad] That’s it. Episode 77 is a wrap. Thank you listeners! We hope you’ve enjoyed the show. Any quick shout outs for you Evan?

[Evan] Yes, I have two…

[Brad] Keep the questions and feedback coming. Send things to us by email at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @BradNigh, and Evan is @evanfrancen. Lastly, be sure to follow SecurityStudio (@studiosecurity) and FRSecure (@FRSecure) for more goodies.

That’s it! Talk to you all again next week!

The UNSECURITY Podcast – Episode 76 Show Notes – Tough Times

Keeping the show notes short this week. We have a special guest, a great friend of mine, Serge Suponitskiy!

There are many, many things going on around here (@FRSecure and @SecurityStudio). I can’t recap everything for you, to do so would be very time consuming. There was one highlight from last week that stood out from the rest though…

2020 FRSecure CISSP Mentor Program

The 2020 FRSecure CISSP Mentor Program kicked off last week with Class #1 on Monday (4/13) and Class #2 on Wednesday (4/15)! It’s crazy, this is the 11th consecutive year of our free training program. With 1,444 students registered in 2020, we have now helped more than 2,825 students over the years!

We’ve had many people try to convince us to charge for this, even if only a small sum, but the answer is always “NO”. This is one of the ways we try to give back to our community, and we’ll continue to do this well into the future. We have done this since 2010, well before COVID-19 showed up at our front door.

Since COVID-19, we moved class to 100% online, with live streaming to YouTube. We archive the videos so anyone can watch any time (even those who never registered). The archives are here:

We’ve also setup an online study group. The study group, as of this morning, has 470 active members.

Here’s to a great 2020 program, and here’s to much success for the students!

On to the episode 76 show notes now.


SHOW NOTES – Episode 76

Date: Monday, April 20th, 2020

Episode 76 Topics

Opening

[Evan] Good morning everyone! This is the 76th episode of the UNSECURITY Podcast. The date is April 20th, 2020 and I’m Evan Francen. Joining me is my co-host Brad Nigh.

Good morning Brad.

[Brad] Brad says “hi”.

[Evan] We have a special guest! Let me give you a little background about this guy.

He’s a global business and technology leader with more than 20 years experience building enterprise innovative solutions. He’s guided many organizations through successful transformations, but arguably none more difficult than the one he’s currently facing with COVID-19. He’s currently working at Fight Centre, a global travel company, and as you know, the travel industry has been decimated by the pandemic.

His name is Serge Suponitskiy, and he’s the CTO, CISO, and now interim CIO at Flight Centre, Americas Region.

Welcome Serge!

[Serge] Serge does Serge.

Catching Up

[Evan] As is customary for us, before we jump in to the meat of the show, let’s catch up. If you’re a new listener, you might not know the first motivator for starting the UNSECURITY Podcast. It was to spend an hour shootin’ the breeze with Brad. So what’s up guys? How’s things?

Catching up. Recent events. Coping with *&#!

Introducing our Special Guest

[Evan] I invited Serge to our show for a couple of reasons, the first is, I really like the guy. He’s somebody I respect. The second reason I invited him was to get his perspective on dealing with COVID-19. Serge works in the travel industry, and everything in the travel industry has been turned upside down. He works for Flight Centre, a really great company, and it’s crazy what’s happening…

Topics for discussion:

  • Welcome Serge!
  • Our history and past together.
  • What’s happened to the travel industry since COVID-19?
  • What’s changed for you and your company?
  • What’s the focus for the next 3-6 months?
  • What do you think Flight Centre looks like on the other side?

[Evan] Thank you Serge. You’re a helluva guy and I’m sure everything will work out OK, even if it doesn’t seem like it sometimes.

Middle School Fight

[Evan] Interesting happenings last week between to industry middleweights; Rapid7 and Qualys. I’d like to get your take guys. On Thursday, I get this email…

It goes on…

[Evan] This sort of thing gets under my skin. In our industry, which is about serving and protecting people, we’re supposed to be better than this. So I wrote a short post on LinkedIn and reached out to my friend Chris Roberts for a sanity check.

Here this skinny:

[Evan] What do you guys (Brad and Serge) think about this?

Discussing the middle school playground fight between Rapid7 and Qualys.

News

[Evan] Just one news story this week; IT Services Giant Cognizant Hit by Maze Ransomware Cyber Attack.

Wrapping Up – Shout outs

[Evan] Alright, good show. Thank you for joining us Serge.

[Serge] May or may not say something.

[Evan] Lots going on this week. We continue our Daily inSANITY Checkins, everyone is welcome to join us. Just register online and you’ll get the invites. We also continue the CISSP Mentor Program with classes on Monday and Wednesday. Brad’s teaching tonight and Ryan (“cola”) Cloutier is teaching on Wednesday. I get the week off!

OK, shout out time. Brad, who you want to give a shout out to?

[Brad] We’ll see if he’s got someone.

[Evan] Serge, how about you? You have someone you want to give a shout out to?

[Serge] Maybe he does, maybe he doesn’t.

[Evan] I’d like to give a shout out to __________!

Well, that’s a wrap.

Huge thank you to our listeners. Episode 76 is about to go in the can. We love hearing from you, so if you’ve got something to say, email us at unsecurity@protonmail.com. If you would rather do the whole social thing, feel free to follow us on Twitter. You can find me @evanfrancen, you can find Brad @BradNigh, and you can find Serge too @SergeSup.

That’s it. Talk to you all again next week!

The UNSECURITY Podcast – Episode 75 Show Notes – Hope

Keeping the show notes short this week. Last week’s show notes post should have been broken into two or three posts!

I’m writing this on Easter Sunday, and I’m wishing everyone a Happy Easter! The meaning behind today is promise and hope. Hope is the key talking point for this episode of the UNSECURITY Podcast.

If you missed last week, we had Jim Nash on the show. Jim is our Minnesota State Representative. He shared his perspectives on things like COVID-19, information security in state government, etc. It was a good talk!

Give episode 74 a listen.

Let’s get right to it! Here are the episode 75 show notes…


NOTE: These are my show notes (Evan), but Brad is leading the show.

SHOW NOTES – Episode 75

Date: Monday, April 13th, 2020

Episode 75 Topics

  • Opening
  • Catching Up 
    • Easter Sunday
    • Another week at home.
    • What’s new?
  • Hope
    • Hope in our (information security) industry.
      • Signs we’ve seen during the pandemic.
      • Signs we hope to see post-pandemic.
    • How information security fits into the hope of economic recovery.
    • What’s FRSecure doing to instill hope?
    • What’s SecurityStudio doing to instill hope?
  • More About Zoom
    • What happened (without the BS)?
    • Is it safe to use Zoom or not?
  • Other Things
    • FRSecure CISSP Mentor Program (we started this 11+ years before the COVID-19 pandemic)
    • Safety and Cybersecurity at Home 101 Webinar Series (Videos here).
    • SecurityStudio Partner Community (Join here).
    • The Daily inSANITY Check-in (Join here).
  • Other News – Just one: Coronavirus-themed attacks April 05 – April 11, 2020
  • Wrapping Up – Shout outs
Opening

[Brad] Good morning everyone! This is the 75th episode of the UNSECURITY Podcast. The date is April 13th, 2020 and I’m Brad Nigh. Joining me is my co-host Evan Francen.

Good morning Evan.

[Evan] I’ll say good morning too, but the enthusiasm behind my words will depend on how early I got up today.

[Brad] We’re remote still, recording the show on Zoom. Yes, you heard that right. We’re on Zoom right now. We’ll talk more about this later on in the show.

First, as is customary for us. Let’s catch up a little.

Catching Up

[Brad] Yesterday was Easter Sunday. Did you have a good Easter, Evan?

[Evan] Maybe I did. Maybe I didn’t. Ooooh, the suspense!

Discussion between Evan and Brad

Hope

[Brad] Hope is a beautiful thing. Sometimes it’s all we have to hold on to. Let’s talk about the role that hope is playing these days, in our industry and in our companies.

Discussion about the following:

  • Hope in our (information security) industry.
    • Signs we’ve seen during the pandemic.
    • Signs we hope to see post-pandemic.
  • How information security fits into the hope of economic recovery.
  • What’s FRSecure doing to instill hope?
  • What’s SecurityStudio doing to instill hope?
More About Zoom

[Brad] The news and noise about Zoom and their information security issues didn’t slow much last week. Some of the issues are nothing more than FUD, but there are some legitimate concerns too. I think our listeners could really benefit from a continued discussion about this.

Discussion about Zoom issues.

[Brad] There are always two sides to the story. I can’t remember seeing a company go through such a roller coaster of ups and downs in such a short period of time.

Other Things

[Brad] Lots of other things happening around here, that’s for sure! The pandemic, the lockdown, working remotely, and everything else that comes along with those things has not stopped us for a second! We’re just as busy as always.

Discussion about other things.

  • FRSecure CISSP Mentor Program (we started this 11+ years before the COVID-19 pandemic)
  • Safety and Cybersecurity at Home 101 Webinar Series (Videos here).
  • SecurityStudio Partner Community (Join here).
  • The Daily inSANITY Check-in (Join here).

[Brad] Alright. Lots going on. We’ll see what this week brings!

News

[Brad] Just one news story this week. Let’s look at a recap of Coronavirus-themed attacks from this past week posted on Security Affairs.

Wrapping Up – Shout outs

[Brad] Alright, good show. Give someone hope and encouragement today and every day this week! Evan, who do you have a shout out for this week?

[Evan] Some people for sure…

[Brad] I’d like to give a shout out to ________.

Thank you for listening to episode 75. We love hearing from you, so if you’ve got something to say, email us at unsecurity@protonmail.com. If you would rather do the whole social thing, we tweet like that. I’m @BradNigh, and Evan’s @evanfrancen.

That’s it. Talk to you all again next week!

The UNSECURITY Podcast – Episode 74 Show Notes – COVID-19 MN Response

If you reading this, I hope you and your loved ones are well! From what I read, we have another few tough weeks ahead of us in the U.S. before (maybe) we turn the corner a little. Keep up the good work by staying at home and/or maintaining your distance from others. Now is NOT the time to let up.

If you missed last week’s show notes or episode 73 of the UNSECURITY Podcast, we had a great time taking with our special guest, Oscar Minks. Oscar leads FRSecure’s Technical Services Team, and he shared some great insight into their current incident response activities.

Episode 74 Topics

Topics for this episode of the UNSECURITY Podcast include:

  • Opening
  • Special Guest – Jim Nash
  • Catching Up 
    • Another week at home.
    • What’s new?
  • COVID-19 Talk With Jim Nash
    • What’s going on in MN state government
    • What’s he hearing from other states
    • How he’s helping our community and tips for listeners
    • Opinion about impact on information security
  • Web Conferencing Craziness (mostly Zoom)
    • The Rise
    • The Bug
    • Zoombombing
    • Other Stuff
    • Overreaction
    • Benefactors
    • Logic and Reason
  • Work From Home – S2Me
    • NASCIO – COVID-19 Response Resources for State IT
    • Safety and Cybersecurity at Home 101 Webinar Series
    • Version Two
  • Other News
    • The Daily inSANITY Check-in
    • FRSecure CISSP Mentor Program
  • Wrapping Up – Shout outs

You can find the full show notes later in this post.

Thoughts

It’s good to get things off your chest from time to time, and it doesn’t matter if anyone else reads what you write. If you are reading this, I hope you get some value from it.

Good News

It’s been hard the last few weeks to find good news. Seems like everywhere I look, there’s bad news. Most of the time is related to Covid-19, but now always. The bad news can come from another breach, vulnerabilities in some application (this week it was Zoom), or any number of things.

If you want to find good news, you have to be intentional about it.

Here’s some good news sources/stories:

See? There are lots of good things happening around the world. Look for them and be encouraged.

Struggling

In the middle of all that’s going on, there are many people struggling. I may be OK and you might be OK too, but the number of people who aren’t OK has grown fast and continues to increase every day. People are losing their businesses, losing their jobs, and losing their minds.

For people who have lost their business, it may feel like you’ve lost your dream. You haven’t! The dream is still alive, it’s just deferred. It’s paused. You may have to start over, or maybe not. The point is to NOT give up. Starting over gives you a chance to do it better this time, using all that you’ve learned from the last time.

For people who have lost their jobs, you might be worried about bills or even where your next meal comes from. When you’re in the middle of the crap, it’s hard to see the other side. Missing payments can be stressful, but it’s not the end of the world. Do what you can to survive this (and you WILL survive this) and try to focus on what you will do or be on the other side. Plan now for what’s to come.

Personal Story

When we started FRSecure in 2008, the U.S. was in the middle of a recession. I thought we could power through it, and succeed despite the odds. I was wrong. We couldn’t find customers, and within a year, it became evident that we wouldn’t be able to pay our bills, including our house payment. I could have given up on the dream of my business and entered the job market again, or I could believe that things would get better. 11-12 years later and FRSecure is a very healthy company, employing more than 70 people and serving more than 1,000 customers. Foreclosure with a wife and five kids was very hard, but we didn’t give up.

Mental Health

For people who have or feel like they’ve lost their minds, please get help. Maintaining mental health during times of crisis can be extremely difficult. It’s OK to not be OK, but it’s not OK to let it rule you. There are many people who care about you and want you to let them help. This is the truth! The most common lie (I think) is believing that you’re not worthy and nobody cares. That’s the lie. Believe and follow the truth, here are some people who care (100%):

Remember, there is hope and there is help! This is the truth, and you have to believe it.

Social Media Stuff

It dawned on me that we have a lot going on, and we share a lot of it on social media. Here’s the list of social media accounts for us:

Those are some thoughts right now. Let’s get to the show notes!


SHOW NOTES – Episode 74

Date: Monday, April 6th, 2020

Show Topics:

  • Opening
  • Special Guest – Jim Nash
  • Catching Up 
    • Another week at home.
    • What’s new?
  • COVID-19 Talk With Jim Nash
    • What’s going on in MN state government
    • What’s he hearing from other states
    • How he’s helping our community and tips for listeners
    • Opinion about impact on information security
  • Web Conferencing Craziness (mostly Zoom)
    • The Rise
    • The Bug
    • Zoombombing
    • Other Stuff
    • Overreaction
    • Benefactors
    • Logic and Reason
  • Work From Home – S2Me
    • NASCIO – COVID-19 Response Resources for State IT
    • Safety and Cybersecurity at Home 101 Webinar Series
    • Version Two
  • Other News
    • The Daily inSANITY Check-in
    • FRSecure CISSP Mentor Program
  • Wrapping Up – Shout outs
Opening

[Evan] Good morning everyone! This is the 74th episode of the UNSECURITY Podcast. The date is April 6th, 2020 and I’m Evan Francen. Joining me is my co-host Brad Nigh along with our special guest Jim Nash.

Good morning Brad.

[Brad] He’ll say what he wants.

[Evan] Welcome to the show again Jim and good morning!

[Jim] He’ll also say what he wants.

[Evan] Jim, do you remember the last time you were on the show? How long ago was that?

[Jim] Still saying what he wants.

[Evan] It’s customary now that we start the show by catching up a bit with each other.

Catching Up

Discussion between Evan, Brad, and Jim.

[Evan] Alright! We invited Jim to be on the show again for a couple reasons. #1 – We like him and #2 – We want to get his perspectives on COVID-19. He’s certainly got some unique things to share.

COVID-19 Talk With Jim Nash
  • What’s going on in MN state government?
  • What’s he hearing from other states?
  • How he’s helping our community and tips for listeners?
    • Supporting the community and small business.
    • Where can we find his videos, pictures, and updates?
  • Opinion about impact on information security

[Evan] For those who don’t know, Jim is my state representative. He represents the district in which I live and I couldn’t be prouder of the way he represents me!

OK, last week, news about Zoom was all the rage it seemed. There’s plenty of fear, misinformation and confusion about the web conferencing solution. I think our listeners could benefit from some straight talk about the issues.

I put together a series of stories and organized them into subtopics. It’ll be cool to get you guys’ perspective.

Web Conferencing Craziness (mostly Zoom) DIscussion

This slideshow requires JavaScript.

 

[Evan] Crazy. The plot is thick surrounding Zoom, isn’t it. The noise is loud and it’s hard to find the truth in all of it.

Let’s switch gears now and talk about something else that’s related. There is no shortage of articles and guidance for working from home. We built a simple assessment in the beginning of 2019, before all hype surrounding the pandemic. The simple assessment is known as S2Me, and it’s importance is higher than it’s ever been.

Work From Home – S2Me

Discussion about S2Me, including:

[Evan] There you go. S2Me is free and always will be free. Either of you guys feel comfortable sharing your personal S2Score?

Other News

[Evan] We had so many things to talk about this week. We’re going to skip other news stories again. Two quick things to tell you about though, before we go.

  • The Daily inSANITY Check-in
    • Still going strong.
    • Everyone is invited all the time!
  • FRSecure CISSP Mentor Program
Wrapping Up – Shout outs

[Evan] Well, that’s it for this week. Plenty going on and lots to do. Either of you guys have any shout outs?

Thank you for listening. We’re a couple of guys who really care about you. We’re hoping you all stay healthy and sane! We love hearing from you, so if you’ve got something to say, email us at unsecurity@protonmail.com. If you would rather do the whole social thing, we tweet like that. I’m @evanfrancen, and this other guy is @BradNigh. Jim, you’re all over the place. Want to share some places where people can interact with you online?

Jim, thank you for coming on and sharing with us today!

That’s it. Talk to you all again next week!

The UNSECURITY Podcast – Episode 73 Show Notes – COVID-19 IR

Hope you and your loved ones are well! We can’t understate the importance of physical, mental, and spiritual health, especially in times like these.

If you missed last week’s show notes or episode 72 of the UNSECURITY Podcast, there’s some pretty good stuff there.

Episode 73 Topics

Topics for episode 73 of the UNSECURITY Podcast include:

  • Opening
  • Catching Up 
    • The first full week with a closed office.
    • Staying sane and healthy at home.
  • COVID-19 Affects on Information Security (some of them)
    • Introducing our special guest, FRSecure’s Director of Technical Solutions and Services
    • Incident Response During COVID-19
      • Current Events/Incidents
      • FRSecure’s IR Risk Registration (what is it and why would I consider it?)
    • COVID-19 Scams and Attacks
      • What have we seen?
      • What are we planning for?
    • Physical Security Considerations
  • The Daily inSANITY Check-in
  • FRSecure CISSP Mentor Program Update
  • Wrapping Up – Shout outs

You can find the full show notes near the bottom of this post. Before getting there, I need to get some thoughts out.

Thoughts

It’s been 13 days since FRSecure and SecurityStudio closed their offices. All of us are still around and working, but it’s crazy how much life has changed. Personally, I’m still struggling to make sense of things and I’m mulling over COVID-19 data almost obsessively. The COVID-19 scoreboards plastered everywhere don’t help. On one hand, I like being informed. On the other, I’m tired of tracking the number of infections and deaths.

As I write this, there are 140,164 infections in the United States and 2,476 deaths. What does this mean in the context of everything else? How do I make sense of these numbers? Here’s one attempt:

What does a “normal” 30 days look like in the U.S. for deaths/mortality? According to the CDC, there were nearly 3,000,000 deaths in the U.S. in 2018 (the latest data available). Using this data, here are the number of people who died within an average 30 day window:

  • 53,867 from heart disease (the top killer in the U.S. with 655,381 deaths)
  • 49,255 from cancer (#2 – 599,274 deaths)
  • 13,736 from accidents/unintentional injuries (#3 – 167,127 deaths)
  • 10,029 from Alzheimer’s Disease (#6 – 122,019 deaths)
  • 3,973 from suicide (#10 – 48,344 deaths)

Compare these numbers to where we’re at now with COVID-19. I’m NOT at all minimizing the impact of COVID-19. I’m trying to make sense. I know the number of infected people and deaths will rise significantly over the coming weeks/months, and sadly, we’re in for more terrible news. I’m trying to understand what the numbers mean in the context of other things that aren’t as foreign to me.

A single sick person and/or a single death is sad enough, let alone thousands.

OK. Got that off my chest. Lots and lots of great things going on at FRSecure and SecurityStudio. The best place to keep up with them right now is probably on social media:

Let’s get to the show notes now!


SHOW NOTES – Episode 73

Date: Monday, March 30th, 2020

Show Topics:

  • Opening
  • Catching Up 
    • The first full week with a closed office.
    • Staying sane and healthy at home.
  • COVID-19 Affects on Information Security (some of them)
    • Introducing our special guest, FRSecure’s Director of Technical Solutions and Services
    • Incident Response During COVID-19
      • Current Events/Incidents
      • FRSecure’s IR Risk Registration (what is it and why would I consider it?)
    • COVID-19 Scams and Attacks
      • What have we seen?
      • What are we planning for?
    • Physical Security Considerations
  • The Daily inSANITY Check-in
  • FRSecure CISSP Mentor Program Update
  • Wrapping Up – Shout outs
Opening

NOTE: The show notes were written by me (Evan), but Brad’s leading this episode.

[Brad] Hello listeners, this is another episode of the UNSECURITY Podcast. My name is Brad Nigh, this is episode 73, and the date is March 30th, 2020. Joining me is my co-host Evan Francen. Good morning Evan.

[Evan] Good morning Brad!

[Brad] Also joining us for the show is our special guest and FRSecure’s Director of Technical Solutions and Services, Oscar Minks. Good morning Oscar!

[Oscar] Says good morning or something with his cool southern accent.

[Brad] We’ve got lots to talk about! As is our custom, let’s get started by catching up quick.

Catching Up

Topics here include how we’re coping with COVID-19, the first full week with a closed office, and staying sane (and healthy) at home. Brad found a really good video online; Covid-19 Protecting Your Family, Dr. Dave Price

[Brad] Here’s a can of worms (maybe). Let’s talk about some of the effects that COVID-19 has on what we do. Some of the effects on information security, starting with incident response and physical security. We already mentioned that we’ve got our special guest Oscar Minks here. He’s got some good insights to share, and this should be a good discussion.

Discussion – COVID-19 Affects on Information Security (some of them)
  • Introducing our special guest (again), FRSecure’s Director of Technical Solutions and Services
  • Incident Response During COVID-19
    • Current Events/Incidents
    • FRSecure’s IR Risk Registration (what is it and why would I consider it?)
  • COVID-19 Scams and Attacks
    • What have we seen?
    • What are we planning for?
  • Physical Security Considerations

[Brad] Sadly, the frequency of scams and attacks only increases during times of distress. It’s important that we keep our eye on the ball and not compound our problems with an information security lapse.

OK, switching gears now. Some people are struggling right now. Struggling with making sense of things, struggling with employment, struggling with anxiety, or struggling with any number of things. We started this thing called the Daily inSANITY Check-in last week. Evan, tell the listeners about this thing.

Daily inSANITY Check-in Discussion

The purpose of the Daily inSANITY Check-in is to provide a safe place for people to discuss current events, information security things, challenges we’re facing, or whatever else comes to mind. The check-ins are short (30- to- 60-minute) daily meetings with discussion. People are always free to come and go as they please.

[Brad] The Daily inSANITY Check-in is just one place to get support out of many within our community. The point is to find help when you need it and to help people where you can. It’s cool to see so many people rally and help.

FRSecure CISSP Mentor Program Update

[Brad] Real quick, we made an announcement last week about the FRSecure CISSP Mentor Program. We’re happy to say that we are still going through with this year’s class! The only change is that we have cancelled the in-person portion of the program. As of last Monday, the 23rd, we have 1,007 registered students! That’s crazy! Oh, and I should mention, if you haven’t registered yet, registration is still open.

Wrapping Up

[Brad] No news this week because we had so many other things to talk about. Two last things to mention:

  • Our pal Ryan Cloutier, aka “Cola” just wrapped up the second episode of his K12 Cybersecurity Podcast. It’s a great podcast and you should give it a listen!
  • A shout out to one of our regular listeners, Olga Hoogendoorn – Startseva. Evan promised to give her a shout out because she’s pretty awesome!

Well, that’s it for this week. Plenty going on and lots to do.

Thank you for listening. We’re a couple of guys who really care about you. We’re hoping you all stay healthy and sane! We love hearing from you, so if you’ve got something to say, email us at unsecurity@protonmail.com. If you would rather do the whole social thing, we tweet like that. I’m @BradNigh, and this other guy is @evanfrancen. Also, don’t forget to check out @studiosecurity and @FRSecure. They post some good things! Let us know how we can help you!

That’s it. Talk to you all again next week!

The UNSECURITY Podcast – Episode 65 Show Notes – Money Grab

Another week down. Damn, a whole month is down! January is already in the books.

While I’ve got you here, help us out with our mission. We’re busting our tails off doing our part to fix the broken information security industry. We’re striving and doing these things:

  • Setting a common information security language that can be spoken by everyone; the S2Score.
  • Developing and delivering simple (but effective and credible) information security risk assessments for the under-served (SMBs, state and local government, K-12, etc.):
  • Developing and delivering simple (but effective and credible) tools to help the under-served do information security better.
  • Teaching and mentoring others for free. The FRSecure CISSP Mentor Program is in it’s 11th year! We started with six students in 2010, last year we had 532, and this year we had more than 540 enrollments within the first 24 hours! Check it out and enroll here.

What can you do to help? Simple. You can help in (at least) three ways:

  • Do your own S2Org and S2Me assessments.
  • Contribute your opinions and feedback (after all, we’re all in this together).
  • Spread the word. Tell others. Tell them about the S2Org and S2Me assessments and tell them about the FREE FRSecure CISSP Mentor Program!

OK, on to the show…

February is already upon us, and RSA is just around the corner. Speaking of RSA, let’s talk about our industry’s money grab in this week’s episode. Let’s also discuss tips for talking to the board of directors about information security stuff .

This will be fun!

Alright, on to the show notes. This is my (Evan) show to lead and these (below) are my notes.


SHOW NOTES – Episode 65

Date: Monday, February 2nd, 2020

Show Topics:

Our topics this week:

  • Opening
    • Normal Stuff
    • Got Mail?
  • The Money Grab
    • It’s alive and well – everybody wants your $$$.
    • The Bad Guys Of Course
    • The “Good Guys” Too?
  • Talking to the Board
    • Tips
    • Recent Experiences
  • News
Opening

[Evan] Alright, welcome! This is Evan Francen, this is episode 65 of the UNSECURITY Podcast, and the date is February 3rd, 2020. In studio with me is none other than Mr. Brad Nigh. Howdy Brad.

[Brad] We’ll see how awake he is on an early Monday morning.

[Evan] I’m curious, are you a morning person or a night person?

[Brad] I don’t know what he’ll say here…

[Evan] We’ve got a great show planned for you today. Lots to talk about, for sure! We’re going to talk about this industry’s money grab and we’ll cover some tips for speaking to the board of directors. Before we dig in, Brad, how you doing?

Quick Catch-up Talk

[Evan] Alright. Well, let’s get to it. Let’s talk about the money grab in this industry. In case you didn’t know, I’m referring to the information security industry. You have the something that everybody wants. The bad guys, the good guys, and everyone in between. They all want your money. Collectively, I call this the “money grab” and we’re going to discuss this. I want to discuss this because I don’t want you losing your hard earned money to some crook and I don’t want you to piss it away on something that doesn’t do what you thought.

Discussion about the Money Grab

The money grab is alive and well. Everybody wants your $$$. Everybody.

  • The Bad Guys Of Course
    • The 2018 cybercrime industry was worth at least $1.5 trillion
    • There is no low that’s too low.

This slideshow requires JavaScript.

  • The “Good Guys” Too?
    • Gartner estimated that 2019 industry spending was $124 billion in 2019, and by some estimated it’s expected to grow to more than $170 billion by 2022. NOTE: this is for context only and not to imply that this is wasted spending.
    • FUD (scare the sh*t out of you) and Sex Sell (buzzwords, new blinky lights, etc.)
    • Seems like everybody is fighting for your money.
      • Conferences (RSA, Black Hat, etc.)
      • Companies (borderline extortion, crappy advise, etc.)
    • We’re (FRSecure and SecurityStudio) human too. Mission over money, does it keep us honest?

[Evan] It’s a dangerous world and people (non-information security people are confused). I wonder how much of this is on purpose. The enterprise organizations can afford to make mistakes, but the smaller players are left in the cold and they’re suffering because they often miss the basics, the fundamentals. I feel bad for the under-served markets, especially SMBs. This is our primary focus. OK, on that note…

Discussion about talking boards of directors and executive management

[Evan] Brad, you and I have had the privilege on many occasions to talk to boards and executives. What tips do we have?

Some good back and forth discussion I’m sure…

After a while, let’s do some news.

News

[Evan] I’ve only got two stories to discuss today, but I think they’re interesting ones:

Closing

[Evan] OK, that’s it. Episode 65 is in the bag. Brad, you’ve got any ideas for next week’s show yet?

[Brad] Maybe he does, maybe he doesn’t…

[Evan] Thank you to our listeners, we love hearing from you. If you’ve got something to say, email us at unsecurity@protonmail.com. If you would rather do the whole social thing, we tweet sometimes. I’m @evanfrancen and Brad’s @BradNigh. If you like company stuff, we work for SecurityStudio (@studiosecurity) and FRSecure (@FRSecure). The company people post good things from time to time too!

That’s it. Talk to you all again next week!

The UNSECURITY Podcast – Episode 64 Show Notes – 3rd Party Risk

Here we are, already into the 4th week of January and this is the last show for the month.

Quick recap of last week because it was awesome!

On Saturday (1/18), we held our holiday party at Punch Bowl Social. FRSecure and SecurityStudio employees flocked in from all over the country (Nevada, Kentucky, Missouri, Florida, etc.) to celebrate together. We sort of took over the joint with 120+ people eating, drinking, singing karaoke, bowling, playing pool, and hanging out.

One of our core values is “work hard/play hard”, and Lord knows we are experts at both these things! The teams did incredible things in 2019 and every single person played a critical part in our success. It was so awesome to spend time with each other, celebrating (a great 2019) and looking forward to an even better year ahead (2020)! It was a great night!

We gathered everyone together on Monday (1/20) morning for our quarter end/year end meeting. There are no words to describe what these people did in 2019. There isn’t an adequate adjective. By every account, 2019 was a huge success. Not only in terms of dollars and cents, but more importantly in the impact we made on our industry and in people’s lives.

This slideshow requires JavaScript.

Just a few highlights:

  • FRSecure has helped more than 1,000 organizations build and maintain better information security programs.
  • The CISSP Mentor Program helped 532 people learn better information security, secure better career options, and/or successfully pass their CISSP exam. UPDATE: We exceeded the entire 2019 enrollment within 24 hours of opening this year’s registration!
  • We gave more than 100 talks at conferences all over the United States.
  • SecurityStudio made great strides in helping organizations and people speak the same (information security language), including the release of the S2Me.
  • The companies grew at more than 40% again (top line), for the 10th consecutive year.

I could write an entire book about what was accomplished in 2019, and I’m speechless when I think about what we’ll do together this year (2020)!

The Minnetonka HQ office was full and buzzing on Monday! The rest of the week was filled with meetings, conversations, and security stuff. All icing on the cake.

Alright, on to the show notes. This is Brad’s show to lead and these (below) are his notes.


SHOW NOTES – Episode 64

Date: Monday, January 27th, 2020

Show Topics:

Our topics this week:

  • Opening
    • Catching Up
    • FRSecure Year End
    • SecurityStudio Year End
  • 3rd-Party/Vendor Risk Management
    • Let’s get literal.
    • A deep dive.
    • Seven “must haves”.
    • A warning (or two)
  • Next Week
    • Tips for talking to boards
    • I’m going to RSA this year and I already regret it
  • News
Opening

[Brad] Welcome back! This is episode 64 of the UNSECURITY Podcast, and I’m your host this week, Brad Nigh. Today is  January 27th, and joining me is my co-host, Evan Francen. Good morning Evan.

[Evan] Something energetic and uplifting I’m sure.

[Brad] We’ve got another great show planned for you this week, and we’ve already got some good topics to talk about next week. This week we’re going to cover a deep dive into 3rd-party (or vendor) risk management. Next week we’re going to cover tips for talking to boards and have a conversation about the RSA money grab. Don’t miss it! I’m guessing it could get controversial.

Before we get started, let’s recap last week quick.

  • Brad’s update(s)
  • Evan’s update(s)

[Brad] I wanted to take some time today talking about Vendor Risk Management and the difference between an audit based certification (SOC2, ISO, HITRUST) vs a risk assessment (S2Org or similar).

[Evan] Yeah man! Let’s do it!

3rd-Party/Vendor Risk Management

[Brad] You added stuff to my show notes! What gives man?

[Evan] Yeah, I couldn’t help myself. Hope you’re OK with it.

[Brad] What’s with “let’s get literal”?

Discussion…

[Brad] Let’s talk about the differences between audit based certification (SOC2, ISO, HITRUST, etc.) versus a risk assessment (S2Org or similar).

  • The fundamental differences
  • The positives and negatives to both approaches
  • At the end of the day, what should an organization be trying to accomplish with their Vendor Risk Management program
  • What should the vendor share/not share, how do they handle requests for more than they are comfortable sharing

Be sure to mention the new article (not yet posted), “Seven must-haves for effective third-party information security risk management”. You can get the free preview download by emailing us.

[Brad] Hopefully that was helpful to people working on both sides of Vendor Risk Management. Let’s do some news.

News

[Brad]

Always plenty of things to talk about in the news, and here’s a few stories that caught my eye this week:

Closing

[Brad] That’s it. Episode 64 is a wrap. Thank you to our listeners! Keep the questions and feedback coming. Send things to us by email at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @BradNigh and Evan is @evanfrancen. Lastly, be sure to follow SecurityStudio (@studiosecurity) and FRSecure (@FRSecure) for more goodies!

That’s it. Talk to you all again next week!

The UNSECURITY Podcast – Episode 63 Show Notes – Mission

I’m grateful to be back home. Two weeks in Cancun, Mexico where the sun was shining and the temperature was in the 80s. Now, I’m back in Minnesota where there’s a foot of snow on the ground and the temperature is in the single digits. I’m grateful to be back home because I’m with my family again. My FRSecure and SecurityStudio family!

THANK YOU to Brad and Ryan for doing holding down the fort!

OK, I was in Cancun to begin writing our next book. It’s “our” next book because Brad’s going to write his part and Ryan’s going to add a little flair too. The book is unofficially titled “Securing America” and will start to come together over the next couple of months. The (rough) outline looks like this so far:

  • Introduction
  • Information Security Operating System (ISOS)
    • Components
    • The Cycle
  • Securing America
    • Small Business
    • Local Government
    • Education
    • Home
  • The People Component
  • The Asset Component
  • The Control Component
  • The Process Component
  • The Measurement Component
  • The Journey – All Working Together
  • Starting NOW

If this book is anything like the first one (UNSECURITY), there’s likely to be some changes to the outline, but this is what we’ve got so far.

Alright. On to the show. This is episode 63 of the UNSECURITY Podcast. I’ll be hosting and these are my notes. Joining me in studio will be my co-host Brad Nigh and SecurityStudio’s very own Ryan Cloutier.

Let’s do this!

-Evan


SHOW NOTES – Episode 63

Date: Monday, January 20th, 2020

Show Topics:

Our topics this week:

  • Opening
    • Back Home
    • Book (Securing America) Status
    • What did I miss?
  • U.S. and Iran
    • Finishing the discussion from last week.
    • We’re not out of the woods.
  •  The “Mission” and CISSP Mentor Program
    • What is it?
    • Why do we care?
    • How can you join us?
  • News
Opening

[Evan] Hey UNSECURITY Podcast listeners! This is episode 62 and the date is January 20th, 2020. I’m Evan Francen, and it’s good to be back! I’m hosting today’s show, and joining me in studio is my friendly co-host Brad Nigh and my left-hand man Ryan Cloutier. Hey guys.

[Brad & Ryan] They’ll say “hi” or something.

[Evan] Did you guys catch that? I called Ryan my “left-hand man”. Of course you did, you guys read the show notes! You know why I called Ryan my “left-hand man”?

[Brad & Ryan] Stumped. Maybe.

[Evan] Well, I’ll tell you…

[Evan] Alright, I’m back home. It feels good to be back, and it couldn’t have been any better to come back to a bunch of smiling faces at our holiday party on Saturday! What did you guys think?

[Brad & Ryan] Sharing thoughts and such.

[Evan] We have a ton to cover today! Let’s catch-up quick. You guys cool with that?

Catching Up Discussion
  • Back home
    • Holiday Party
    • Q1/2020, Expectations
  • Book (Securing America) things
  • Did I miss anything?

[Evan] Like always, many good things to look forward too. Love you guys and love being back. Last week I had to run halfway through the show. We were talking about tensions between the United States and Iran and how it affects us all. There’s this talk of a cyberwar between us, and I just want to close the loop a little on the topic.

U.S. and Iran Discussion

[Evan] OK, the world’s not likely to end today, but we need to stay vigilant. Complacency and ignorance come with consequences. Switching gears now…

We talk about this mission at FRSecure and SecurityStudio. Brad, you have your take. Ryan, you have yours. I’ve certainly got mine too, but what is this “mission” and why is it important for our listeners to know about it?

Discussion about The “Mission” and CISSP Mentor Program

An open and honest discussion about our mission.

  • What is it?
  • Why do we care so much about it?
  • Are there ways for people to join us? If so, how?

The CISSP Mentor Program Registration is Open!

[Evan] Yes, it’s all about the mission! The theory is if you focus on the mission you’ll make money, but if you focus on the money, you’re certain to miss the mission. Love it! Alright, good talk. Let’s cover a few news stories, and wrap this thing up.

News

There’s always plenty of news in the information security industry. Here are a few stories that caught my eye recently:

Closing

[Evan] Wow. Lot’s going on and plenty of news to stay up on. I guess this is why they pay us the big buck, right?

This is the end of our show, and we close these things out pretty much the same way every week. Keep sending us your feedback, tips, of whatever else you’d like us to know at unsecurity@protonmail.com. If you have a suggested guest for us to reach out to, let us know that too.

If you’re the social type, socialize with us on Twitter, I’m Evan and you can find me @evanfrancen. Brad’s a cool cat, and you can find him @BradNigh. Ryan’s not to shabby himself, follow him at @CLOUTIERSEC.

That’s it! Talk to you all again next week!