OK, late again. Show notes before the show recording though, so it’s not terrible.

Lately, Brad and I haven’t seen each other much (or at all). I’ve been on the SecurityStudio Roadshow (#S2Roadshow) and Brad’s been swamped running his part of the FRSecure business (solutions development, sales support, innovation, IR support, and Analyst team support, etc.). Brad’s got a lot of stuff!

FRSecure won another award last week, which is super cool! The company was ranked #22 of the 50 fastest growing companies in the Twin Cities! In addition to being the 22nd fastest growing company, FRSecure was also the highest ranked information security consulting company on the list. This is the 3rd consecutive year that FRSecure has made the Fast 50 list, and I AM SUPER PROUD of this team! HUGE CONGRATULATIONS on a great accomplishment! They are all amazing, top to bottom!

When you get out of the way, incredible people to do amazing things. This is how FRSecure works.

Let’s get to some show notes, shall we?

---

SHOW NOTES – Episode 49

Date: Monday, October 14th, 2019

Show Topics:

Our topics this week:

• Quick Catch-up/Roadshow Week #2
• IT Security, Information Security, Cyber Security, and Physical Security
• Cybersecurity Maturity Model Certification (or “CMMC”)
• What it takes to do this job

Opening

[Brad] – Hi UNSECURITY Podcast listeners! It’s me, Brad Nigh. This is episode 49 and the date is October 14th. Evan’s here too. Say “hi” Evan.

[Evan] I oblige. I’m nice.

[Brad] It’s been a couple weeks since you and I have been in studio together. Last week, you and John Harmon hosted episode 48 while I was traveling. This week I’m back!

[Evan] It’s good to have you back man! I’m excited to catch-up and record this episode with you!

[Brad] Holy cow, we’ve got a jam-packed show today. Is this what I get for letting you write the show notes?

[Evan] 😉

[Brad] OK, let’s catch-up quick. Let’s chat about the stuff I’ve been up to, and some of the stuff you’ve been up to.

Quick Catch-up/Roadshow Week #2 Discussion

• Brad’s stuff.
• Evan’s stuff.
• The SecurityStudio Roadshow Week #2.

[Brad] Good things. We receive good questions from our listeners each week, and this past week is no exception. There was one question in particular that I wanted to cover with you. It was nice to here that the listener  has adopted our definition of information security in his policies, but he struggling with the term “IT Security”. He’s not alone I guess, because he also provided a link to a CompTIA article titled “What Is the Difference Between IT Security and Cybersecurity?“.

[Evan] Yeah, this can be confusing for some people. Words really do matter, especially when we struggle with using them correctly.

[Brad] The CompTIA article is sort of confusing, as the author covers different approaches to the definitions of IT Security, Information Security, Cyber Security, and Physical Security.

In one diagram, he arranges information security, cyber security, and physical security inside of IT security. In another diagram he drops IT security altogether and puts cyber security and physical security inside of information security. 

He then poses the question “So, which is best? Who is right?”. His answer leaves us hanging and then he a attempts to address whether terminology even matters. Let’s discuss this and address our listener’s question.

IT Security, Information Security, Cyber Security, and Physical Security Discussion

[Brad] Glad we settled it. Maybe we should make a diagram too. Later.

[Evan] Pretty sure we’ve got one or two of these somewhere.

[Brad] Alright. Another listener emailed us this week and asked us about the new(ish) Cybersecurity Maturity Model Certification (“CMMC”). Should we talk about this quick?

[Evan] I’ll agree because I agree.

Quick Cybersecurity Maturity Model Certification Discussion

• All companies conducting business with the DoD must be certified, regardless of the use/presence of Controlled Unclassified Information (CUI)
• Initial implementation of the CMMC will only be within the DoD
• The intent of the CMMC is to combine various cybersecurity control standards such as NIST SP 800-171, NIST SP 800-53, ISO 27001, ISO 27032, AIA NAS9933 and others into one unified standard for cybersecurity.
• CMMC is intended to serve as a verification mechanism.
• CMMC will implement multiple levels of cybersecurity. In addition to assessing the maturity of a company’s implementation of cybersecurity controls, the CMMC will also assess the company’s maturity/institutionalization of cybersecurity practices and processes.
• accredited and independent third party commercial certification organization to request and schedule your CMMC assessment
• Some of the higher level assessments may be performed by organic DoD assessors within the Services, the Defense Contract Management Agency (DCMA) or the Defense Counterintelligence and Security Agency (DCSA).
• Your certification level will be made public
• The government will determine the appropriate tier, contained in sections L & M of future Request for Proposals
• On October 3rd, the DoD posted the RFI for the CMMC Accreditation Body.
• The draft CMMC v0.4 is posted.
• The draft CMMC v0.6 is expected for public review in November, 2019.
• Finalization of CMMC v1.0 is expected by January, 2020.

[Brad] Lots to say about that. Last week, you mentioned me in a Twitter conversation you were engaged in. The tweet that started the conversation was “Lol lots of people whining about empathy in infosec this morning… what, are you all on the same sensitive mailing list or something?”

[Evan] Yeah. The author had a point and I thought it could be a good conversation about what it takes to be good at what we do from a slightly different perspective.

Discussion about what it takes to do this job

The Twitter thread:

Continues…

Good stuff to discuss, and shoutout to @c0Bchik for engaging in a discussion.

[Brad] Alright, let’s wrap this up with a few news stories.

News

[Brad] I’ve got three news stories to discuss this week:

• Alabama Hospital chain paid ransom to resume operations after ransomware attack – https://securityaffairs.co/wordpress/92450/cyber-crime/alabama-hospital-ransomware.html
• 18 International Hackers who Steal Tens of Millions of Dollars Arrested For ATM Skimming Attack – https://gbhackers.com/atm-skimming-attack-2/
• Consumers concerned about connected home privacy, still few implement safety practices – https://www.helpnetsecurity.com/2019/10/14/connected-home-consumer-attitudes/

Closing

[Brad] There you go, episode 49 is a wrap! Like many of you listening, we’ve got another busy week ahead.

Thank you to our loyal listeners! Thank you for your tips and feedback. Send us your wisdom, questions, advice, whatever, by email to unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @BradNigh and Evan’s @evanfrancen. Also, follow SecurityStudio (@studiosecurity) and the #S2Roadshow hashtag.

That’s it! Talk to you all again next week!