Pwned: The Information Security Podcast

Episode 200 - Reflections of Pwned...Until Next Time

Justin Fimlaid — Wed, 03 Apr 2024 11:30:00 -0400

In this episode of Pwned, Justin and Jack celebrate their milestone 200th episodes the best way they can…with some good old Ransomware Rye. Join the duo offsite at Mad River Distillers tasting room in Burlington, Vermont, as they review podcast excerpts from the last few years and respond with fresh takes, all while guessing who actually said it.

Check out the links below on people we reference in this episode:

Glen Bressner, Co-Founder and Managing Partner, Activate VP

Chris Metinko, Senior Reporter, Crunchbase News

Key moments:

00:00 – Title Sequence

00:20 – Introduction

05:30 – Café Press and Hot, Stinky Soup

10:17 – Punxsutawney Programmer

15:05 – Sometimes You Should Argue the Price of Champagne

21:36 – Parsing Through Cybersecurity Product TUD

26:30 – Meat Market March

31:13 – Beyond the Badness-Ometer

34:57 – Wrap Up

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharbor.com

LinkedIn: https://www.linkedin.com/company/nuharbor

Episode 199 - When a BlackCat Crosses Your Path...

Justin Fimlaid — Thu, 21 Mar 2024 13:39:38 -0400

In this episode of Pwned, BlackCat rises from the grave for another life full of ransomware attacks; this time targeting a healthcare organization, Change Healthcare, for a whopping $22 million. Join Justin and Jack as they look through the facts and speculate that BlackCat may not be who they say they are.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 198 - Heard it Through the Grapevine - Beyond the Beltway, 2024

Justin Fimlaid — Fri, 08 Mar 2024 07:00:00 -0500

It’s a first, with Jack going solo, and the subject is a set of 8 recent recommendations from senior IT and security leaders at the recent e.Republic/Center for Digital Democracy Beyond the Beltway show. Panels of executives described their experience with successful security and technology communications, and Jack interprets and applies these for our Pwned cybersecurity audience. It’s a rare view into the minds and reactions of the kind of leaders that we know are fundamental to the success of any security strategy.

Check out these links:

e.Republic: https://www.erepublic.com/

Beyond the Beltway: https://events.govtech.com/Beyond-the-Beltway-2024.html#/agenda

Center for Digital Government: https://www.govtech.com/cdg

Key takeaways:

00:00 - Title Sequence

00:25 – Introduction

02:48 – Know the Plan

03:58 – Bring Objective Data

05:02 – Speak to All

06:05 – Find the Baseline

07:45 – Upskill My Team

10:11 - Everything is Relative

11:50 - Bring the Value

13:10 - Prepare for Change

14:27 – Recap

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 197 - Curt Wood, CISA, and the Cavalry

Justin Fimlaid — Wed, 21 Feb 2024 12:34:49 -0500

Well-known public sector executive advisor, Curt Wood, joins the team to talk about the role of the Cybersecurity and Infrastructure Security Agency (CISA), statewide cybersecurity, and the complex responsibilities of leaders as they understand and integrate multiple communities in their cybersecurity planning. As former executive secretary and CIO for the Commonwealth of Massachusetts and the current executive director for the 2023/2024 SLED Cybersecurity Priorities Report (CPR), Curt is going broad and deep with Justin Fimlaid and Jack Danahy on the changing nature of threat intelligence, interagency communications, and establishing a leadership position for cybersecurity.

View the CISA website

Download the CPR

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 196 - The Recent MOAB Event -- Mother or Just Another?

Justin Fimlaid — Wed, 14 Feb 2024 13:08:52 -0500

Justin Fimlaid and Jack Danahy are talking about the recent 26.6B records found exposed. While the records are mainly old, the Pwned perspective is always new. Listen in for some history, some discussion of other expert views like Troy Hunt and others, and a perspective on whether this Mother of All Breaches may in fact be more of a news story and less of a new story.

View Troy's article: Troy Hunt: The Data Breach "Personal Stash" Ecosystem

View the original MOAB post: Mother of All Breaches: a Historic Data Leak Reveals 26 Billion Records | Cybernews

Key Takeaways:

00:00 – Title Sequence

00:45 – Introduction to topic: Mother of All Breaches

02:24 – Public Reaction

03:42 – Where Did the Records Come From?

05:28 – Mystery Leads to Uproar

08:25 – Biggest Takeaway From the Breach

10:53 – Making Improvements, But Still a Long Way to Go

13:13 – Complex Passwords and Password Vaults

15:40 – AI-Generated Code

18:00 – Summary

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 195 - Reflections on Election Security

Justin Fimlaid — Fri, 09 Feb 2024 16:26:10 -0500

In a discussion covering election issues from disinformation to voter access, Justin Fimlaid and Jack Danahy are both dispelling and reinforcing listener concerns about the impact of technology and cyber threats on the upcoming elections. Tune in for an in-depth discussion on disinformation, newly proposed government/social media contact restrictions, and a look into what may come (or that the team think should come) to deliver more secure elections in the future.

Key Takeaways:

00:00 – Title Sequence

00:22 – Introduction

04:16 – Social media and influencing elections

06:50 – Disinformation from the very beginning

10:33 – Can we ever go back to disconnected elections?

13:47 – Trusting election security technology

16:37 – Estonia’s voting technology

18:43 – Voting ID’s and intrusiveness

21:33 – Education and election awareness

24:30 – Wrapping up

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 194 - Pulling MXDR Out of the Pit of Despair

Justin Fimlaid — Wed, 31 Jan 2024 11:17:00 -0500

It’s been over two years since the team examined the overuse and increased malleability of the term “XDR” and were forced to sentence that term to the Pwned terminology dungeon, the “Pit of Despair”. Well, times change, and our intrepid topical explorers are seeing signs that a reexamination is deserved, as XDR is becoming more understood, and Managed XDR (MXDR) is now a reality. Join Justin Fimlaid and Jack Danahy in this episode of Pwned as they carefully pull MXDR out of the "Pit of Despair" by the suspenders. The guys explore and wade through the industry jargon that has complicated views of threat detection and response technology and services, and ultimately, make the rescue.

Check out the original episodes where they were placed into the Pit:

Pwned GigaByte - The pit of despair (nuharborsecurity.com)

Voldemort (XDR) Spawns New Death Eaters (mXDR) (nuharborsecurity.com)

Key Takeaways:

00:00 – Title Sequence

00:30 – Introduction

03:18 – Term reveal

05:28 – Notable changes in the last two years

08:45 – Has XDR manifested itself into reality?

13:49 – The history/origins of XDR

17:00 – Jack’s rebuttal

21:58 – Wrap up

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 193 - Nostra-BlameUs: The 2022 Predictions Revisited

Justin Fimlaid — Wed, 24 Jan 2024 13:46:43 -0500

In honor of releasing the 2023-2024 SLED CPR, Justin and Jack take a walk down memory lane and discuss their predictions from the 2022 CPR, and how they fared in 2023. Have all 5 predictions panned out the way the duo thought, or did some fall short? Tune in to find out.

Check out our annual SLED CPR.

Key Takeaways:

00:00 – Title sequence

00:27 – Introduction to topic

01:15 – Prediction 1: Back to basics

04:45 – Prediction 2: Teaming up

06:03 – Prediction 3: Staying on top

08:30 – Prediction 4: Election-driven urgency

10:27 – Prediction 5: States Will Lead Private industry to new models of security

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 192 - It's Back! Pwned Previews the 2023-2024 SLED CPR

Justin Fimlaid — Wed, 17 Jan 2024 10:59:35 -0500

In this episode, Justin and Jack are giving a sneak preview of this year’s SLED Cybersecurity Priorities Report. It’s all fresh off the presses and the team is giving a birds-eye view of the process, focus, and conclusions that the CPR is bringing to (and from) State, Local, and Higher Education leaders.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 191 - Leaving 2023: Time for Defense in Breadth

Justin Fimlaid — Wed, 10 Jan 2024 11:59:14 -0500

The Pwned podcast leaps into 2024 with Justin Fimlaid and Jack Danahy talking about what they've were seeing at the end of 2023, some ideas on improving for 2024, and some new ideas around understanding more about predicting breach impact and exposure. The guys are looking at some new ideas like improving attack simulation, increasing visibility, and the potential application of new approaches like synthetic malware and attack campaigns. One of the results of a new Pwned term of art, based in a need to focus on "Defense in Breadth" over the tradition of "Defense in Depth of days gone by. All of this drives a conversation ranging from cyber insurance to the value of the next cybersecurity dollar spent.

It's a great way to wrap up 2023 with Pwned and jump into the hopeful potential for 2024.

Key Takeaways:

00:00 – Title sequence

00:24 – Introduction

01:35 – Recommendations for starting out 2024

02:15 – One small gap can lead to catastrophe

03:56 – New year, new approaches

05:00 – Prediction: Synthetic Testing

08:35 – Potential for better insurability and dollar spend/investment

11:23 – Jack’s JIE: Justin Inspired Epiphany: Defense and Breadth

13:18 – Impacts against the business during and after an attack

16:25 - Summary

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Bonus: Top 3 of '23

Justin Fimlaid — Wed, 27 Dec 2023 08:00:00 -0500

To wrap up 2023, we would like to take the chance to reflect on what we’ve all seen this year, and what has headlined our coverage here at Pwned. Come on along and relive three of our past episodes that created the most activity, and join us in seeing how far we’ve all come.

Our top 3 episodes from this year are:

Episode 170 - Staying on Course When You've Got Headwinds - a mailbag episode dedicated to a listener who's feeling the pressure to justify continuing cybersecurity spend.
Episode 166 - Rethinking Cyber Insurance to Help it Survive, and Thrive - an episode discussing the well-publicized comments from Zurich Insurance CEO Mario Greco on the potential demise of cyber insurance.
Episode 167 - Cybersecurity Seat - Hall-full/Half-empty, Have Patience - another mailbag episode about successful paths forward when a CISO find themselves in a role that's a little larger than they expected.

Your continued support means the world to us. Thank you, and we'll catch you in the new year.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 189 - Shaky Plans - Pwned Takes on the President's Blueprint for an AI Bill of Rights

Justin Fimlaid — Wed, 20 Dec 2023 16:20:54 -0500

In the second part of our series on Federal AI proclamations, Justin and Jack make a point-by-point assessment of the Federal view on inalienable protections from AI misbehavior. If you’re concerned with AI’s incursions into everyday life or are interested in understanding whether our leaders have a grasp on the issues, this is an episode you can’t miss.

AI is complicated. Cybersecurity is complicated. Political language is complicated. Your Pwned team is here to make things understandable. Tune in and find out.

Check out the resources and references mentioned in this episode:

Blueprint for an AI Bill of Rights

Episode 188 - Safe, Secure, and Trustworthy. Pwned on the President's AI Executive Order

Episode 182 - The Next AI Episode - With Diana Kelley!

Key Takeaways:

00:00 – Title Sequence

00:22 – Introduction to the topic

01:47 – Safe and Effective Systems: What Exactly Does That Mean?

10:22 – Algorithmic Discrimination Protections: Put the Human in the Loop

14:29 – Data Privacy: Understanding the Cost of Using Services

20:05 – Notice and Explanation: Responsibility of Data Exposure

22:05 – Human Alternatives, Consideration, and Fallback: Why? Because the Algorithm Says So

24:23 – Closing Statements

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 188 - Safe, Secure, and Trustworthy. Pwned on the President's AI Executive Order

Justin Fimlaid — Tue, 05 Dec 2023 07:00:00 -0500

In this episode, Justin and Jack are reviewing the recent presidential executive order on AI. While there are plenty of good ideas in the mix, the team is taking some time to examine their feasibility, their value, and their likelihood of execution in our current, fast-paced, AI environment.

Stay tuned for part two on the Blueprint for an AI Bill of Rights!

Check out the resources we referenced in this episode:

FACT SHEET: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence

Episode 176 - Outcomes, Prescriptions, and Presidental Policy

Key Takeaways:

00:00 – Title Sequence

00:27 – Topic Introduction

01:16 – What is the Fact Sheet?

01:44 – Software Security

04:43 - New Standards for AI Safety and Security

14:46 – Protecting American’s Privacy

18:27 - Advancing Equity and Civil Rights

21:06 – Supporting Workers: Adapting to New Innovations in the Workplace

26:43 – Recap and Positive Note

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 187 - Pwned Making the Case for Judicial Security

Justin Fimlaid — Wed, 22 Nov 2023 06:30:00 -0500

Following Justin's work with members of the press on the recent Kansas City court system ransomware shutdown, he and Jack are talking about the potential impacts and repercussions of increasing cyberattacks against the judiciary. There are issues of timely judgements, sealed records, even courts paying criminals, as the Pwned team judges the situation and brings some new evidence to the discussion of causes and prevention.

See Justin in the press: https://www.wibw.com/2023/10/19/cybersecurity-expert-explains-issues-facing-kansas-courts-they-remain-offline/.

Key Takeaways:

00:00 – Title sequence

00:22 – Introduction

00:51 – Incident Details

01:42 – Courts shut down: back to basics

04:10 – Chain of custody in the event of a ransomware attack?

05:13 – Justin’s press presence: analogies

06:48 – Courts paying criminals?

07:18 – ETA for opening the courts

09:32 – Targets and motivation

11:23 – Are attackers getting all information, or are there barriers for information that should be protected?

14:04 – CJIS

16:15 – Digitizing paper files for security

17:20 -- Recap

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 186 - The Acquisition of Revelstoke

Justin Fimlaid — Wed, 01 Nov 2023 13:30:00 -0400

In this episode of Pwned, Justin and Jack discuss the recent acquisition of automation firm Revelstoke by managed security vendor Arctic Wolf. With a lot of cash on the line, is this deal a right swipe, or do they think Arctic Wolf will be left in the dark when the lights come up? Tune in for the details.

Key Takeaways:

00:00 – Title sequence

00:28 – Introduction to acquisition

02:04 – Financial details

04:53 – Analogy: A nickel for a dollar

06:53 – Convertible Note details

08:20 – Jack’s decision

10:00 – Justin’s response

11:29 – Justin’s decision

12:05 -- Recap

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 185 - An Unconventional Take on Cybersecurity Awareness

Justin Fimlaid — Thu, 26 Oct 2023 07:00:00 -0400

In this episode of Pwned, Justin and Jack tackle Cybersecurity Awareness Month 2023. Coming at you with three unconventional tips to keep in the back of your mind, the duo dive into the world of security for vendors, purchasers, and members of the public.

Key takeaways

00:00 – Title Sequence

00:34 – Introduction to Cybersecurity Awareness Month

01:36 – What does security awareness mean?

02:40 – More heightened cybersecurity awareness this year overall

05:12 – More informed public = more informed questions

06:34 – The market is demanding more secure software and services

07:11 – Tip #1: Be aware that it’s okay to ask for things to be secure enough

07:49 – Analogy: Cybersecurity awareness = healthcare/consumer medicine awareness

09:19 – What was it that made the provider think this service is good for you?

10:04 – Providers will try to sell you their product, not what you need

12:32 – Tip #2: Awareness = How can we all work to make things better both at work and at home?

14:31 – Blockbuster: People shouldn’t have to be so cybersecurity-aware

15:43 –Make security seamless, so people don’t have to worry about it in their day-to-day

16:55 – Give your network the ability to filter out malicious content so it’s not on the backs of your employees

17:58 – Tip #3: Vendors be aware of the vulnerabilities caused by too much functionality

19:13 – Recap

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 184 - 4 Steps to a Security Strategy

Justin Fimlaid — Wed, 04 Oct 2023 06:30:00 -0400

In this episode of Pwned, Justin and Jack are evaluating a four-step process for developing a cybersecurity strategy and end up creating one of their own. If you’re looking for some ideas or a blueprint for your own planning, it’s probably worth a listen. Stay tuned for our upcoming blog: 4 Steps to a Rock-Solid Cybersecurity Strategy for an in-depth look at what we came up with!

As a recap, here are our four steps to a cybersecurity strategy:

Step 1: Ask and Understand

The single most important component in every cybersecurity strategy is understanding your business thoroughly.

Step 2:

Apply Your Expertise With a deep understanding of your business in place, you are now ready to apply your knowledge to define the appropriate security controls and measures.

Step 3: Measure Progress

Now that you have your security controls in place, it's time to assess how well you're implementing them. This step involves measuring your progress and identifying any gaps. It's also an opportunity to involve key stakeholders and keep them informed.

Step 4: Create and Communicate

The final step involves formalizing your cybersecurity strategy and ensuring its ongoing relevance and effectiveness. It's about creating a living, breathing strategy that evolves with your organization's needs.

Key elements of this episode:

0:26 – Introduction to 4 steps to build a cybersecurity strategy

2:32 – Know your organization’s tolerance for risk mitigation 5:04 – Planning roadmaps for internal success

5:33 – These four steps are a great starting point, but they won’t get you all the way home

6:02 – Crucial missing piece: Your cybersecurity strategy should start with your business strategy

7:33 – Building a cybersecurity strategy = building a house

9:07 – Meet the organization where they're at

11:49 – Educate organizations on what they need to know for their security strategy

13:09 – NuHarbor’s 4 steps to creating a cybersecurity strategy

14:00 – Step 1 – Ask and Understand

18:08 – Step 2 – Apply Your Expertise

21:24 – Step 3 – Measure Progress

24:58 – Step 4 – Create and Communicate

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 183 – Making a New Cybersecurity Job Work

Justin Fimlaid — Wed, 06 Sep 2023 07:00:00 -0400

In this mailbag episode of Pwned, Justin and Jack respond to a listener question that has all the earmarks of a well-known security problem: a new leader starting in an organization with what feels like a random mix of products and problems. By talking through the different elements of the situation, the team offers proven and straightforward suggestions for making the transition more action-oriented, more measurable, and much less stressful.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 182 – The Next AI Episode – With Diana Kelley!

Justin Fimlaid — Wed, 23 Aug 2023 11:30:28 -0400

This week, Justin and Jack are talking AI with one of the security industry’s most well-known experts and influencers, Diana Kelley of Protect AI. The topics, like the growth of AI, are all over the place, from the impacts of AI on security teams to secure AI development, and even a quick mention of the rights of sentient AI. Come hear what’s new in ML SecOps and high-integrity AI, and some well-informed predictions for the future.

If you want to get in touch with Diana, you can find her LinkedIn here.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 181 – Breached Trust: Lazarus Making Friends

Justin Fimlaid — Wed, 16 Aug 2023 07:15:37 -0400

In this breach of the week episode, Justin and Jack look into the recent attacks targeting the GitHub developer community. Developers are increasingly being targeted by North Korean state-sponsored threat actors to use and execute poison code. Tune in to get the scoop.

The DarkReading article can be found here: North Korean Cyberspies Target GitHub Developers (darkreading.com)

CISA’s request for comment can be found here: Request for Comment on Secure Software Self-Attestation Common Form | CISA

Watch this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 180 – Thales Not Impervious to Imperva’s Charm

Justin Fimlaid — Wed, 02 Aug 2023 07:15:08 -0400

Multifaceted French security and defense firm, Thales, has acquired longtime application and availability cybersecurity pioneer, Imperva, in a major acquisition from U.S. cybersecurity private equity leader, Thoma Bravo. In this RightSwipes episode of Pwned, Justin and Jack review the histories of both Imperva and Thales, adding valuable context to the market analysis. There’s plenty to talk about and factor into this week’s thumbs-up/thumbs-down conclusion.

Check out the following links for resources mentioned in this episode:

Watch this week’s episode:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 179 – Collaboration Celebration

Justin Fimlaid — Thu, 20 Jul 2023 11:12:06 -0400

In Massachusetts, a group of communities are banding together to improve IT acquisition effectiveness. In this episode of Pwned, Justin and Jack explore the benefits of this alliance, ideas on the cybersecurity impact, and the relationship between this effort and other regional and whole-of-state strategies. It’s a feel-good episode of Pwned, and the team is bringing positive vibes.

Learn more about the North Shore IT Collaborative here: North Shore IT Collaborative | Danvers, MA (danversma.gov)

Watch this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 178 – SOC Talk

Justin Fimlaid — Thu, 13 Jul 2023 15:12:13 -0400

In this episode Justin and Jack are taking a question from the mailbag on choosing regional or private security operations centers (SOCs). The conversation quickly turns to finding the best SOC for your needs, the most beneficial preparation before engaging with vendors, and the right of any organization to demand answers in language they can understand and apply.

Watch this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 177 – The Obligatory AI Episode: Prevail or Fail? Can’t Spell Either Without AI

Justin Fimlaid — Thu, 06 Jul 2023 13:12:34 -0400

From ChatGPT to predictive analytics, AI techniques are changing all industries and knocking on the door of cybersecurity.  Justin and Jack are answering with an episode examining potential advancements and limitations that we’ll likely encounter over the next few years. If you’re interested in an experienced, optimistic, but grounded view on what AI can do for your security operation, this is an episode for you.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 176 – Outcomes, Prescriptions, and Presidential Policy

Justin Fimlaid — Wed, 28 Jun 2023 11:02:17 -0400

The White House has released another statement on their National Cybersecurity Strategy. This time Justin and Jack are supportive of the tone and some of the content. In this episode, hear about the new approach to improving cybersecurity with an emphasis on vendor responsibility, liability, opportunities, and outcomes.

Do you think the President’s directive is helpful, or do you think it lacks the specifics for these policies to succeed?

Resources mentioned in this episode:

Policy: FACT SHEET: Biden-Harris Administration Announces National Cybersecurity Strategy | The White House.

Dark Reading: The White House National Cybersecurity Strategy Has a Fatal Flaw (darkreading.com) by Eyal Mamo.

Request for Comment on Software Security Attestation: Request for Comment on Secure Software Self-Attestation Common Form | CISA by CISA.

For more insight on federal cybersecurity policy, listen to our 2022 White House Week series:

Presidential Prerogative – “Bulletproof Cybersecurity in One Week or Less”

Another Presidential Push – This Time It’s National

Washington Week 3 is Spelled SEC

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 175 – Acquisitions Defining a Changing Landscape for Deception

Justin Fimlaid — Wed, 21 Jun 2023 11:12:06 -0400

In this RightSwipes episode, the unexpected union of Proofpoint and Illusive creates an irresistible combination for Justin and Jack. They’re talking through the applicability of deception technology, market appetite, and Proofpoint’s move to deepen their bench with Illusive. The question remains whether Proofpoint was looking to strengthen identity-based defenses or if there’s a broader strategy in motion.

As referenced in this episode, you can check out Ericka Chickowski’s article on DarkReading here.

Watch this week’s video here:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 174 – Getting More Intelligence Out of Threat Intelligence

Justin Fimlaid — Tue, 13 Jun 2023 11:58:12 -0400

In this episode, Justin and Jack are talking about threat intelligence, from its ideal content mix to the audience, and ways to improve its usefulness and availability. Threat intel is about more than feeds. It’s about hunting, sharing, and enriching our understanding of threats whenever we can.

Check out our SLED Cybersecurity Priorities Report here to examine top cybersecurity priorities in SLED, what’s fueling them, and how you can implement them in your organization.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 173 – An Old Friend, Some Old Equipment, and New Challenges All Around: Part 2

Justin Fimlaid — Thu, 08 Jun 2023 17:12:40 -0400

In part two of “An Old Friend, Some Old Equipment, and New Challenges All Around,” we welcome back Zack Borst. Since his departure from NuHarbor Security, Zack has since embarked on a mission to enhance emergency management, including cyber preparedness, and now he’s talking with Justin and Jack about the state of cybersecurity systems and subsequent challenges. Join the trio for the second part of this eye-opening discussion about technology, threats, aging equipment, critical services, and the troubling mix of kinetic and cybersecurity emergencies.

Watch this week’s video here:

Check out EM Weekly at EM Weekly — The Readiness Lab or on your favorite podcast streaming service.

You can find Zack on Linked in here: https://www.linkedin.com/in/zborst/, or by email at zack.borst@dobermanemg.com.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 173 – An Old Friend, Some Old Equipment, and New Challenges All Around: Part 1

Justin Fimlaid — Fri, 02 Jun 2023 17:13:53 -0400

Our latest episode welcomes back Zack Borst, former co-host and co-contributor to Pwned in its earlier seasons. Zack has since embarked on a mission to enhance emergency management, including cyber preparedness, and he’s talking with Justin and Jack about the state of cybersecurity systems and subsequent challenges. It’s an eye-opening discussion that blends technology, threats, aging, equipment, critical services, and the troubling mix of kinetic and cybersecurity emergencies. Gain insight into an emerging arena and a heightened urgency for cybersecurity improvements.

Watch this week’s video here:

You can find Zack on Linked in here: https://www.linkedin.com/in/zborst/, or by email at zack.borst@dobermanemg.com.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 172 – Applications, Security, Supply Chain, and SBOMs

Justin Fimlaid — Tue, 25 Apr 2023 10:19:45 -0400

In an episode that is close to Jack’s heart and history, he and Justin explore a renewed interest in the security of applications. They discuss the new Application Security Center of Excellence (ASCOE) being built at the Commonwealth of Massachusetts, shifting far left of boom by prioritizing contract language, and the importance of championing the need for application security before implementing any program.

Listen in for practical ways to make progress in an area that will only get better by working on the applications you’ll see tomorrow.

Key moments:

1:51 – Introduction to application security.

8:26 – Application security surrounding AI/ChatGPT. Is open source insecure?

9:38 – Application security = restaurant?

10:39 – In a world where no one wants you to get in front of application security, how do you get in front of it?

18:15 – Strong application security requires healthy communication.

21:38 – Why is application security so important?

25:26 – Application security is not a one-and-done deal; it goes on forever. It’s a continuing cycle of Whac-A-Mole.

Watch this week’s episode here:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 171 – Balancing Security to the Left and Right of Boom

Justin Fimlaid — Tue, 18 Apr 2023 11:16:11 -0400

In this episode, Justin and Jack delve into the growing trend toward increased investment in detection and response. With the rise in successful attacks and public breaches, detection and response are getting plenty of love, sometimes at the expense of preventative measures. Tune in as our duo explore the current state of affairs, share their observations on various response tactics, and provide valuable insight for listeners who are considering investing in cybersecurity capabilities to reduce the likelihood or impact of inevitable threats.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Episode 170 – Staying on Course When You’ve Got Headwinds

Justin Fimlaid — Thu, 16 Mar 2023 09:00:40 -0400

In this mailbag edition of Pwned, Justin and Jack are presented with a question from a listener who’s feeling pressured to justify continuing cybersecurity tooling spend. They’ve seen this happen repeatedly and offer recommendations for responding with well-articulated tradeoffs and benefits and preparing for budget cuts during the proposal and acquisition process.

Ultimately, security leaders do their best when they can maximize value from their existing tooling, or garner support from non-security stakeholders that can translate the negative impacts of reduced security capabilities into business terms. Listen in for practical advice as security teams start to bear more scrutiny and field more requests for spending justification in tight economic times.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 169 – The Lesson Is in the Struggle

Justin Fimlaid — Thu, 09 Mar 2023 11:36:28 -0500

In this episode, Justin and Jack discuss a recent CISO dialogue around the difficulties in replacing staff that move on, and strategies for easing the impact of losing talented folks to competitors or lottery wins. From educating other team members, to succession planning and developing close relationships with vendors there are ways to prevent the unexpected loss of teammates from resulting in a corresponding loss of sleep.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 168 – Roadmaps and Socializing Support for Security

Justin Fimlaid — Wed, 22 Feb 2023 12:38:45 -0500

In this episode, Justin and Jack respond to a note from the mailbag. A listener inquires about successful approaches to recruiting support for security initiatives, and the team shares stories about educating stakeholders, developing champions, and encouraging security program collaborators, especially when planning a multiyear, multipronged strategy.

Check out this week’s video:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

For general information, you can reach us at info@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 167 – Cybersecurity Seat – Half-full/Half-empty, Have Patience

Justin Fimlaid — Tue, 07 Feb 2023 13:59:06 -0500

Following a listener request, Justin Fimlaid and Jack Danahy are talking about successful paths forward when a CISO finds themselves in a role that’s a little larger than they expected, or an organization has a well-meaning CISO that needs a little more time to get it right. This happens all the time, and it doesn’t have to end with burning out or throwing out an otherwise capable executive. If you find yourself in that oversized chair, sit back and give a listen.

Helpful links:

The Hunt for the Super CISO Part 1

The Hunt for the Super CISO Part 2

CISO Job Description Download

Check out this week’s video:

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 166 – Rethinking Cyber Insurance to Help it Survive, and Thrive

Justin Fimlaid — Thu, 26 Jan 2023 13:08:41 -0500

Following well-publicized comments from Zurich Insurance CEO Mario Greco on the potential demise of cyber insurance, Justin and Jack are digging deep. They describe the challenge to insurers, the potential for unlimited liability, and propose a new and more intentional model that benefits insurers, clients, and the CISOs involved. It’s a new take on a thorny problem, with lessons for all players.

Links:

Are Cyber Attacks Uninsurable?

World Economic Forum 2020 Grim Insurance Predictions

On a lighter note: Whisky Home – Old Forester | First Bottled Bourbon™

Check out this week’s video:

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust. Website: https://nuharborsecurity.com Facebook: https://www.facebook.com/nuharbor/ Twitter: https://twitter.com/NuHarbor@nuharbor LinkedIn: https://www.linkedin.com/company/nuharbor/ Instagram: https://www.instagram.com/nuharborsecurity/

Episode 165 - Atonement and Autonomous Aggrandizement

Justin Fimlaid — Fri, 06 Jan 2023 14:27:00 -0500

In this last episode of PWNED Season 3, Justin and Jack are paying off the year’s debts from infractions against the Pit of Despair, while analyzing a BlackHat announcement by a leader in the market. There are debts to be paid, and there’s a striking new example of the old security tendency to obscure, over-the-top messaging. The season is going out with a bang, and it looks like Season 4 will start with a blank slate but a full list of issues to watch for.

As mentioned in this episode, check out the Security Bullshit Generator!

Check out this week’s video:

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 164 - BREAKING NEWS: Annual SLED Cybersecurity Priorities Report is LIVE

Justin Fimlaid — Wed, 14 Dec 2022 15:39:00 -0500

After much work and a little fanfare, the 2022 SLED Cybersecurity Priorities Report has been publicly released. Justin and Jack are giving a quick overview of the findings, along with their usual, and unavoidable, take on some of the results. For those of you who have participated in the research or have been following the lead-up to this day, you’ll be glad to hear that the result does not disappoint.

Here’s the announcement: SLED Leaders Find Roadmap for 2023 Success in Groundbreaking Report From NuHarbor Security | Business Wire

And here’s the CPR: https://info.nuharborsecurity.com/2022-sled-cpr

Episode 163 - Are CISOs Dying on the Security Hill or Just Stumbling Over a Cliff?

Justin Fimlaid — Wed, 07 Dec 2022 10:42:00 -0500

In this episode of PWNED, Justin springs an unexpected topic, based on his deep affection for social media. Seeing a post from a security leader who feels he has been unfairly held accountable by his company, he’s bringing it to the podcast. We’ve got victimhood, CISO expectation setting, transparency, and disappointment, all in one episode as Jack and Justin take this common feeling apart.

As referenced in this episode, you can find the book, “Can’t Hurt Me”, by David Goggins here: Can’t Hurt Me, David Goggins

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 162- Previewing the Annual SLED Cybersecurity Priorities Report

Justin Fimlaid — Tue, 29 Nov 2022 18:52:00 -0500

In this episode, Justin and Jack are talking about the trends, common concerns, and research done to support the soon-to-be-released 2022 SLED Cybersecurity Priorities Report. Input from hundreds of sources has been combined with insights from major vendors and the NuHarbor team to deliver some surprising conclusions about the state of the SLED cybersecurity landscape and the leaders that are transforming protection of public services and public trust.

As referenced in this episode, check out this article by Wendy Nather (2011) on the The Security Poverty Line.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 161 - Checked Out

Justin Fimlaid — Tue, 22 Nov 2022 13:02:00 -0500

Following the news that Twitter, now owned by Elon Musk, is charging users for a “blue check” next to their name — an icon that once signaled a verified and authentic user, Justin and Jack discuss the cybersecurity implications behind this new phenomenon, and clear away the confusion and chaos that comes with it.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 160 - Is it time for CrowdSwipes?

Justin Fimlaid — Thu, 03 Nov 2022 16:30:00 -0400

In this RightSwipes episode of Pwned, Justin and Jack start with an analysis of the recent CrowdStrike acquisition of Reposify, and while they may not agree on the love match, it starts an interesting new debate on “Best-in-Breed” versus “Combined Value” players in cybersecurity. It’s an important point of inflexion for companies, and maybe for the cybersecurity market, so listen in.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 159 - The Pwned Public Chat with the Public Sector: Part 3

Justin Fimlaid — Mon, 31 Oct 2022 09:45:00 -0400

In this final episode with Justin and Jack speaking to a group of state security leaders, the PWNED team is talking about a series of topics from new, more successful awareness campaigns to the challenges of avoiding being a target in the first place. This entire session is driven by audience questions, and you may hear one that you’d have asked were you there.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 158 - The Pwned Public Chat with the Public Sector: Part 2

Justin Fimlaid — Thu, 06 Oct 2022 17:00:00 -0400

In their second episode in front of a group of public sector tech execs, Justin and Jack are talking about the challenge and risks of application security, including the cascading exposure from supply chain vulnerabilities like log4j. They also spend some time talking about the attack trend towards automation and the ubiquitous threats that indiscriminately target organizations regardless of size or specialty. It’s another episode driven by listener questions and current events, with a focus on the impact to mid-sized organizations and those who serve through the SLED community.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 157 - The Pwned Public Chat with the Public Sector: Part 1

Justin Fimlaid — Fri, 23 Sep 2022 17:00:00 -0400

In this first installment of a three-part series, Justin and Jack are speaking with public sector leaders about the unique challenges and successes of securing platforms and systems within the State, Local, and higher Ed (SLED) community. They’ve got plenty of experience and plenty to say as they answer questions about current threats, new approaches, and the patterns of success that NuHarbor has seen over the past few years.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 156 - School’s Out – Ransomware and K-12

Justin Fimlaid — Wed, 14 Sep 2022 09:13:00 -0400

Following another school system breach and some pretty dire reporting, Justin and Jack are reviewing current events and talking about the current environment of risk and impact to K-12. There is plenty to discuss, but the result is a much more balanced view and some thoughts on applying a reasonableness filter to the stories we’re hearing.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 155 - Last Words and LastPasses – A Breach of the Week Two-fer

Justin Fimlaid — Thu, 01 Sep 2022 18:21:00 -0400

In a new two-for-one Breach of the Week, Justin and Jack discuss a couple of controversial events from the news this week. First, the recent disclosures by Twitter’s Pieter (Mudge) Zatko and a follow-on article by long-time security icon Edward Amoroso, have our hosts sharing two different points of view on what the story means. Second, we get back to a harmonious Pwned cast as Justin and Jack discuss the recent LastPass source code breach, which was handled quickly and effectively by the LastPass team. It’s a two-fer, combining the role of the CISO and the hyperbole of breach reporting, all in one BOTW episode.

Helpful Links:

Edward Amoroso’s article

CNN Business article reporting on Mudge

LastPass blog post

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 154 - Rickhouse Swipes

Justin Fimlaid — Tue, 23 Aug 2022 17:20:00 -0400

Justin and Jack join John Egan, founder of Mad River Distillers, for a chat about his thoughts on cybersecurity acquisitions, and his own experience as a lawyer in the technology field. Special thank you to John, Mad River Distillers President Mimi Buttenheim, and General Manager/Head Distiller Alex Hilton for welcoming the team and giving their time. To view the Mad River crew, click here.

Justin and Jack took the time to write out reviews of some of the beverages from Mad River. Those can be found below:

Burnt Rock Bourbon
The Burnt Rock Bourbon has a long finish, combining a sweet undertone of vanilla and oak with a distinctive power at the front of the palate.
Revolution Rye
The Revolution Rye is a spicy entrant, capable of standing up to an ice cube, or even a little mixing, without losing its personality. That’s why we featured it in our Old Fashioned Madman cocktail.
PX Rum
All of the bourbons and even the featured special, a caramel-y rum called the Mad River PX Rum, have a custom feel to them. There is a sense that somebody specifically put that booze in that bottle with thought for who would be drinking it.

If you want to reach out to John Egan, you can email him at jegan@goodwinlaw.com, or find him on LinkedIn.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 153 - Mailbag – Deciding Your Future Based on the Past

Justin Fimlaid — Tue, 16 Aug 2022 07:00:00 -0400

We’ve got more mail! Thank you to Mike for sending in this intriguing question about how to decide what cybersecurity college program to attend to get the most for your future. Justin and Jack have an answer for you, and it’s a little more complicated than you would think; take a look at a program’s past and present successes to determine what you want your future to be.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 152 - Research, Report, Release, Repeat

Justin Fimlaid — Tue, 09 Aug 2022 17:09:00 -0400

With the release of the new Enterprise Strategy Group (ESG) report, by Jon Oltsik, in late July, Justin and Jack sit down and discuss their thoughts on the research and the importance of consolidating industry-wide terminology and technology. Will they deem the report to be spot-on, or are there just too many unrealistic expectations? Tune in to find out!

If you would like to read through the ESG report, please click here.

For information on the AWS conference, please click here.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 151 - Maslow’s Hierarchy of Cybersecurity Maturity

Justin Fimlaid — Wed, 03 Aug 2022 09:43:00 -0400

Jack is back at it this time at the National Association of Counties (NACo) conference in Aurora, Colorado. Justin attempts to remotely highjack the microphone to discuss Maslow’s Hierarchy of Needs for Cybersecurity with the audience. Justin checks in before and after the presentation to discuss talking points, maturity of an organization, and how the presentation went.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 150 - Almanna Cyber – Startups for Everyone

Justin Fimlaid — Tue, 26 Jul 2022 16:03:00 -0400

In this special Pwned episode, Justin and Jack discuss Almanna Cyber – their new cybersecurity accelerator fund. Almanna, derived from the Old Norse word for “everyone”, is just that: a cyber accelerator for everyone. The J’s are inviting new cyber startups and individuals with a great ideas to apply for membership in their first cohorts. Sharing over 50 years of experience in the industry, and having built multiple successful cybersecurity businesses, Justin and Jack will help cohort members to grow their own ideas and companies into a strong, successful, cyber business.

Pwned content will still be released weekly, but keep an eye out for their new podcast as well: Cyber Engine, which can be found on your favorite podcast streaming apps, or through the Almanna Cyber Website. To listen to the first episode, please click here.

For questions regarding Almanna Cyber, please visit www.almannacyber.com, or email Justin at justin@almannacyber.com or Jack at jack@almannacyber.com.

If you have any questions or suggestions regarding Pwned, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you on the next one.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 149 - Home Alone – A Swipeless RightSwipes

Justin Fimlaid — Tue, 12 Jul 2022 07:00:00 -0400

US birth rates are the lowest in 40 years, and we may be seeing a spread of that trend into our RightSwipes matchups. With no meaningful Swipes in sight, Jack and Justin are taking a look at the SwipeScene and drawing some conclusions (and predictions) about the Swipeless period we find ourselves in. Is it a return to the bright lights of fundamental analysis showing some of the real faces behind the carefully crafted cosmetics, or is everyone taking a “wait & see” attitude towards the end of the night? Hard to tell, but Justin and Jack are making some prognostications for the quarterly and yearly likely SwipeStats.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 148 - GOGO Breach of the Week – CafePress and Hot, Stinky Soup

Justin Fimlaid — Thu, 07 Jul 2022 15:57:00 -0400

In this GOGO (Give One, Get One) episode of Pwned, Justin and Jack discuss two recent breaches. The first, a breach of 23 million compromised accounts from CafePress that was disguised to users as a password policy update; and the other a recipe for a hot tub breach with a side of “hot, stinky soup”.

To access the articles we reference in this episode, check out these links below:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 147 - Heart-Stopping Finale for Ransomware Cardiologist

Justin Fimlaid — Tue, 28 Jun 2022 07:30:00 -0400

An overachieving heart surgeon in Venezuela has turned his hand to ransomware, and it looks like his heart was really in it. Sadly for him, but great for those us losing “patients” with this cottage economy, he was busted by the FBI, and it’s Code Blue for his highly-rated, 5-star reviewed, $10K+/month, custom ransomware platform and SDK. Justin and Jack break it down and talk through the details and the factors that are making this type of malpractice possible.

For more information on this topic, check out these links:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 146 - Valuable Shade From the Great Sequoia

Justin Fimlaid — Fri, 24 Jun 2022 09:35:00 -0400

As their portfolio companies (and everyone else) are facing a sea change in market and financing conditions, Sequoia Capital has shared their recommendations for surviving the storm. In this episode of Pwned, Justin and Jack provide a Pwned-style interpretation and application of the insights while taking a regretful victory lap over their earlier predictions that this market reset was also coming for cybersecurity.

For more information on references we make in this episode, check out the links below:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 145 - Beyond the Badness-ometer

Justin Fimlaid — Tue, 14 Jun 2022 07:00:00 -0400

Applications are the root of so many things we use on a day-to-day basis. In this episode, Justin and Jack discuss a way more pragmatic approach to application security than securing all data at once.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 144 - Jury’s Out on Jumping Around

Justin Fimlaid — Tue, 07 Jun 2022 07:00:00 -0400

Justin and Jack are joined by NuHarbor ace recruiter, Olive Robb, for an open discussion of cybersecurity recruiting, the job market, and an employer’s view of resumes that show lots of movement. It’s a candid conversation, as usual, with some recommendations about making the most out of your own positions and time in the cybersecurity market.

Olive is happy to connect directly over email or LinkedIn regarding opportunities here at NuHarbor. Looking for future opportunities or don’t see something exactly up your alley? We also have a general careers email if you wish to send along your resume.

Olive’s LinkedIn: Olive Robb | LinkedIn

Olive’s email address: orobb@nuharborsecurity.com

NuHarbor’s general careers email: careers@nuharborsecurity.com

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 143 - Mailbag – The Hunt for the Super CISO Part 2

Justin Fimlaid — Fri, 03 Jun 2022 17:10:00 -0400

In the second half of our CISO recruiting series, Justin and Jack are talking about the pressure, about incident handling, and about the importance of intellectual curiosity in this hire. There are tips for candidates, hiring teams, and even executive management in general, on what to expect, and how to look for it.

To view our CISO job description write up, click this link.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 142 - Mailbag – The Hunt for the Super CISO Part 1

Justin Fimlaid — Fri, 27 May 2022 19:10:00 -0400

The first of a two-part series, this episode highlights what qualities make a good Chief Information Security Officer (CISO), along with how to find the perfect candidate and what the right questions are to ensure they meet those capabilities. Make sure you tune in for part 2!

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 140 - Is it Crypto Crying Time?

Justin Fimlaid — Tue, 17 May 2022 15:03:00 -0400

In this Breach of the Week episode, Justin and Jack share the story of how 600 million USDC was stolen from Axie Infinity, as well as some other crypto catastrophes with the purpose of deciding whether cryptocurrency has the stability and safety to move from its current second-class status to a legitimate, recognized, form of practical currency.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 139 - Battle for the Future – Dwayne Williams and the NCCDC

Justin Fimlaid — Tue, 10 May 2022 11:25:00 -0400

Following the National Collegiate Cyber Defense Competition (NCCDC), Justin and Jack talk with their director, Dwayne Williams, about the competition, his own history, and some insights on the next generation of security leaders. We even get his well-honed view of the likely future of the cybersecurity space and threats within it.

A special thank you Dwayne for taking the time to bring his voice to Pwned, and for his continuing efforts to raise the caliber and quantity of college students moving into cybersecurity.

Congratulations to the University of Central Florida on their triumph, and to all the finalists for securing a place in the national competition.

If you wish to get in contact with Dwayne, you can email him at dwayne.williams@utsa.edu.

For information on the NCCDC, please visit this website.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 138 - Sometimes You Should Argue Over the Price of Champagne

Justin Fimlaid — Tue, 03 May 2022 17:04:00 -0400

Justin and Jack are digging into the pressures and practical realities of cybersecurity investing, both from investor and company perspectives. From a need to spend to the evanescence of some valuations, the two J’s are taking party hats off of ponies and providing some advice for companies that are currently feeling the pinch of an emerging and more realistic investor appetite.

To read the article we referenced in this episode, click here. The picture we reference can be found below.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 137 - RightSwipes – Meat Market March

Justin Fimlaid — Fri, 29 Apr 2022 16:00:00 -0400

In this episode of RightSwipes, Justin and Jack take a look at Security Week’s article of 40 cybersecurity company acquisitions that took place just in the month of March of 2022.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 136 - Voldemort (XDR) Spawns New Death Eaters (mXDR)

Justin Fimlaid — Tue, 26 Apr 2022 15:41:00 -0400

Following up on our January prognostications, Justin and Jack highlight the emergence of the foreshadowed “mXDR” vendors and the causes of the ongoing devolution of security language. All isn’t lost, though, as the team recognizes the potential for a beneficial new set of demands from Board-level security voices.

To listen to the XDR episode, Pwned GigaByte – The Pit of Despair, click here!

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 135 - Washington Week 3 is Spelled SEC

Justin Fimlaid — Fri, 22 Apr 2022 16:20:00 -0400

In a Washington Week series where the team has reviewed both private and public sector cybersecurity memoranda from the President, they’re now looking at an announcement that really matters; cybersecurity guidelines from the Securities and Exchange Commission. Will this be the catalyst of change? Will these requirements make cybersecurity better? Probably not.

If you want to read more about the subject, check out these links below:

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 134 - Another Presidential Push – This Time it’s National

Justin Fimlaid — Thu, 21 Apr 2022 08:41:00 -0400

In the second Pwned Washington Week episode, Justin and Jack are interpreting the President’s National Security Memorandum #8 and they’re finding more trees than forest. Add to that a call for a different style of advisor to the President, a metaphorical insertion of Harvey Dent, and it’s a full basket of Pwned insights.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 133 - Presidential Prerogative – “Bulletproof Cybersecurity in One Week or Less”

Justin Fimlaid — Tue, 19 Apr 2022 07:00:00 -0400

In the first episode of Pwned’s Washington Week series, Justin and Jack lay out the details of the Biden Administration’s announcement on protecting national security. Is it too little, too late, too optimistic, or just more political noise?

If you’re interested in reading the articles we mentioned in this episode, check the links below!

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 132 - Waves Crashing on the Breach

Justin Fimlaid — Fri, 15 Apr 2022 11:22:00 -0400

Justin and Jack surf on the recent Forrester Wave for Global Cybersecurity and end up hanging ten on some of the criteria, but wiping out on its usefulness.

Some links we referenced in this episode can be found here:

Bullsh*t Generator

Alinea Restaurant

Forrester Lead Analyst, Jeff Pollard

PWC Link to Forrester Report

McDonald’s in Paris

Top 10 Accounting Firms in the US

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 131 - $wipeOut – For Money, Not Love

Justin Fimlaid — Fri, 08 Apr 2022 16:01:00 -0400

With no security hookups in sight, Pwned is digging into the investment fever in the cybersecurity meat market, from the reasons behind the massive valuation to the impact of these investments on security vendors and customers. It may not be RightSwipes, but it is definitely part of that process.

In this episode, we referenced CrunchBase’s article “Cybersecurity Funding Remains High Even as Venture Cools Off”. You can find the article by clicking here.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 130 - Mailbag – Does Zscaler Have the X Factor?

Justin Fimlaid — Wed, 06 Apr 2022 16:32:00 -0400

In this mailbag episode, Justin and Jack are looking at security vendor Zscaler, answering an inbound from Alvin, a listener in Canada. His question and the topic is whether or not Zscaler is a good choice and a good investment, and the answer is clear.

If you’re interested in reading the article mentioned in this episode, you can find that here, and the previous episode of Pwned referenced can be found here.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 129 - Pwned Live – The Future of Cybersecurity

Justin Fimlaid — Thu, 31 Mar 2022 11:33:00 -0400

And we’re live!! On March 18th, Justin and Jack took to the stage at the Northeast Collegiate Cyber Defense Competition (NECCDC), hosted at Champlain College, where they presented an episode of PWNED in front of a live audience. The future of cybersecurity; one where we reduce the complexity and confusion of cybersecurity, starts with this new generation of security minds who will be entering the workforce over the next few years. Together we need to make cybersecurity easier.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 128 - Trustworthy or Trust-Worthless?

Justin Fimlaid — Tue, 29 Mar 2022 10:11:00 -0400

Justin and Jack turn up the heat by throwing a painfully over-used and under-accurate term, “Trusted Advisor”, into the depths of the Pit of Despair.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 127 - Is Attivo Sentinel’s One?

Justin Fimlaid — Fri, 25 Mar 2022 16:00:00 -0400

In this week’s RightSwipes, Justin and Jack talk about SentinelOne’s acquisition. Have they been subject to Attivo’s deceptive ways?

Some pieces of media we mentioned in this episode are:

SentinelOne’s Q4 Earnings Call Transcript

Mandiant’s Announcement of Partnership with SentinelOne

2019 PWNED Episode – The Best Security Technology You Probably Aren’t Using

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 126 - Parsing Through Cybersecurity Product TUD

Justin Fimlaid — Tue, 22 Mar 2022 10:12:00 -0400

Finally face-to-face, Justin and Jack discuss 3 ways to power through cybersecurity product technology, uncertainty, and doubt, to get to know a company before joining as an employee, purchasing as a consumer, or investing as an investor.

Huge thanks to Robby Dow (LinkedIn | Instagram | Article), our own Katy Feifs’ brother, for his stellar recommendation of Old Forrester 1920 Prohibition Style bourbon.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 125 - Mailbag – Grassroots Organizations: From BSides to Breaches & Beer

Justin Fimlaid — Thu, 17 Mar 2022 15:06:00 -0400

Another pull from the mailbag combined with some wisdom from BSides’ Jack Daniel prompt Justin and Jack to talk about the importance and authenticity of cyber grassroots groups.

“These types of organizations are exactly who we need in the community” – Justin Fimlaid

We would like to give a huge shoutout to the following individuals and groups:

Jack Daniel – LinkedIn Page
Steve Morgan & Cybersecurity Ventures – Cybersecurity Ventures LinkedIn ; Cybercrime Magazine Website ;
Diana Kelley – LinkedIn Page
Tenable – Website
Shoulders of Infosec – Tenable Article Written By Jack Daniel
Breaches and Beers – To reach out to the group, shoot an email to bb@squidanddagger.com

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 124 - Breach of the Week – Lapsus$ Dancing With NVIDIA

Justin Fimlaid — Tue, 15 Mar 2022 13:30:00 -0400

Recently, former ransomware group Lapsus$ threatens to expose the private information of NVIDIA if they don’t stop disabling crypto-mining. Justin and Jack break it down.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

The links we mentioned in this podcast can be found below:

Brett Callow Tweets

Ars Technica Article

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 123 - RightSwipes – Google Swipes Their Ideal Man-diant

Justin Fimlaid — Fri, 11 Mar 2022 13:00:00 -0500

In a security community match that tops a Kardashian hookup, Google and Mandiant have found each other and this time, Justin and Jack aren’t in sync on the love match. Come hear why.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

To view our Google and Siemplify episode mentioned, click here.

To view an archive of all of our podcast episodes, click here.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 122 - Meet the New NeynPhone

Justin Fimlaid — Tue, 08 Mar 2022 09:50:00 -0500

A new Breach of the Week episode highlights NSO, Pegasus, and iPhone breaches.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Resources Mentioned:

New York Times Article

Washington Post Article

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 121 - Butts as Biometrics

Justin Fimlaid — Tue, 01 Mar 2022 07:00:00 -0500

A rant on “Eyes on Glass” turns into a new entry into the Pit of Despair.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 120 - RightSwipes – Is Optiv Available for Swiping?

Justin Fimlaid — Fri, 25 Feb 2022 16:59:00 -0500

It looks like KKR and Optiv may be moving on. Was this a missed Swipe, or have they just grown apart? Justin and Jack have got the details.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 119 - Mailbag Mission: Certifiable Interest

Justin Fimlaid — Tue, 22 Feb 2022 20:56:00 -0500

Jesse wants to go from Down Under to tops in cybersecurity, and is looking to Justin and Jack for some advice.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 118 - Does Security Have to be Painful to be Good?

Justin Fimlaid — Fri, 18 Feb 2022 16:38:00 -0500

Cybersecurity has evolved over the years. The increased accessibility of features and functionality requires less understanding of the cybersecurity practice and discipline to be successful. Is the “art of cybersecurity” lost, or does a shift in consumption bring more people to the fight?

At the 3:08 minute mark, we reference episode 8: “We’ve Got Mail – The Science of Security Spend”. Make sure you give it a listen!

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 117 - We’ve Got Mail – The Science of Security Spend

Justin Fimlaid — Tue, 15 Feb 2022 09:49:00 -0500

You ask, we answer. Thank you to investor Ryan for your insightful question into market share, security vendors, and what it means for the security marketplace.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 116 - Zero-Sum Breach of the Week

Justin Fimlaid — Tue, 08 Feb 2022 13:17:00 -0500

This week’s Pwned episode comes with a zero-sum Breach of the Week! Jack and Justin talk one publicly disclosed breach, and one publicly disclosed breach that could have been, but wasn’t.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 115 - Right Swipe – Google Takes Siemplify Home

Justin Fimlaid — Fri, 04 Feb 2022 17:00:00 -0500

Google recently acquired Siemplify to integrate it into Google Cloud Chronicle. Jack and Justin give the run down of the pair and decide if the match has chemistry and will thrive in their relationship, or if Google should have just gone home alone.

If you have any questions or suggestions, send us an email at pwned@nuharborsecurity.com.

If you like our content, please like, share, and subscribe! We’ll catch you next time.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 114 - Punxsutawney Programmer

Justin Fimlaid — Wed, 02 Feb 2022 13:55:00 -0500

We’re back – like Groundhog Day! Wait, it is Groundhog Day! The debate of supporting open source software and software supply chain security keeps repeating. Learn what one programmer does to get peoples attention and put an explanation point on the power that open source software developers have.

Earmuff your whistle pigs and open the bottle of WhistlePig while you listen to the story of the Punxsutawney Programmer. Holiday notes can be sent to pwned@nuharborsecurity.com

(Justin writing – do me a solid! Please like, share, subscribe)

VIL (Very Important Links):

JavaScript developer screws over own popular npm packages • The Register

Dev corrupts NPM libs ‘colors’ and ‘faker’ breaking thousands of apps (bleepingcomputer.com)

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 113 - Zero Trust, No Trust

Justin Fimlaid — Tue, 01 Feb 2022 09:18:00 -0500

Zero Trust is a highly attractive term that conjures beneficial impacts, but is inconsistently defined (hint: it means “Don’t Trust Anything”). Its history of overuse means Justin and Jack have to spend some time making it clear.

Beware the Pit of Despair!

If you have any suggestions on what might fall into the pit next, send us an email at pwned@nuharborsecurity.com.

Content referenced in this episode can be found in the links below:

Microsoft’s approach to advocating for a Zero Trust business plan.

John Kindervag’s Zero Trust Network Architecture video.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 112 - Two Old Friends Together – TrelliXDR

Justin Fimlaid — Tue, 25 Jan 2022 12:38:00 -0500

Episode 3 of the Pwned podcast is here and a new victim, Trellix, joins its old friend XDR in the Pit of Despair. Join Justin and Jack through their deep dive into the pit. If you have any suggestions on who might fall into the pit next, send us an email at pwned@nuharborsecurity.com.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 111 - Breach of The Week — Log4j Vulnerability

Justin Fimlaid — Tue, 18 Jan 2022 10:51:00 -0500

Welcome back to season 3 of Pwned! In this Breach of The Week episode, Justin and Jack cover the base and the wind up of the log4j vulnerability exposed in December, and the impact it has on the world’s supply chain. Tune in to learn more about the vulnerability, and how NuHarbor Security can help you secure your network.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 110 - Pwned GigaByte – The Pit of Despair

Justin Fimlaid — Tue, 11 Jan 2022 10:51:00 -0500

Aaaaaaand…. We’re back! Justin and Jack kick off season 3 of Pwned by introducing the Pit of Despair, where marketing terms end up when they have a strong start and a promising future, but derail from the path of meaning and end up in the ditches. What will the first victim of the Pit of Despair be?

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://www.nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 109 - Pwned Season 3 – WE’RE BACK!

Justin Fimlaid — Thu, 23 Dec 2021 15:30:00 -0500

Pwned Season 3! WE’RE BACK! Time to rub the haze out your eyes and earmuff the kids. Gloves are off this time. I’ve had too long with my personal thoughts and the cybersecurity industry still can’t figure this thing out. Season 3 kicks off in January! Catch you later!

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 108 - Breach of the Week: Farewell Zack

Justin Fimlaid — Tue, 23 Feb 2021 03:00:00 -0500

Breach of the Week: Farewell Zack

Episode 107 - Breach of the Week: Pfizer Rain Clouds

Justin Fimlaid — Tue, 09 Feb 2021 03:00:00 -0500

Pfizer falls victim to cloud misconfiguration. Clouds can be complex.

Episode 106 - Partner Spotlight: CyberArk Talks Evolution of PAM – Part 2

Justin Fimlaid — Thu, 04 Feb 2021 03:00:00 -0500

This week we’re surveying identity as a mechanism of compromise in a first-of-its-kind “Partner Spotlight” series. In Part 2, we chat with Brandon Traffanstedt, Global Director, Solutions Engineering at CyberArk. He digs into the complications of super powerful access, and reminds us exactly why we don’t write our passwords on sticky notes.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 105 - Partner Spotlight: CyberArk Talks Evolution of PAM – Part 1

Justin Fimlaid — Tue, 02 Feb 2021 03:00:00 -0500

This week we’re surveying identity as a mechanism of compromise in a first-of-its-kind “Partner Spotlight” series. In Part 1, Justin talks shop with CyberArk’s Scott Whitehouse, VP Channels and Alliances for the Americas. Get the scoop on how NuHarbor partner and global leader in privileged access management continues to innovate in the name of helping folks become consistently more secure.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 104 - Breach of the Week: Frago-Rock?

Justin Fimlaid — Wed, 20 Jan 2021 03:00:00 -0500

Every company operating in the United States is required to maintain a Form I-9 file on every employee to ensure that they are legally allowed to work and not subject to more restrictive immigration rules. But Form I-9 files can contain a ton of sensitive information making a good target for identity thieves.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Reputable places to read more about this BOTW:

https://www.law.com/therecorder/2020/10/27/fragomen-reports-data-breach-impacting-some-google-employees

https://www.reuters.com/article/dataprivacy-fragomen-googlebreach/fragomen-says-breach-exposed-google-employees-information-but-client-data-systems-safe-idUSL1N2HJ020

https://techcrunch.com/2020/10/26/fragomen-data-breach-google-employees/

Episode 103 - Breach of the Week: Stop looking at my Vastaamo

Justin Fimlaid — Tue, 05 Jan 2021 05:00:00 -0500

Geez, I guess nothing is off limits. Vastaamo was first breached in 2018, but this…just…keeps…going. Vastaamo has been requested by attackers to pay half a million USD in Bitcoin. But to make it worse employees and patients are also targets of extortion.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Other places to grab information on this BOTW:

https://blog.malwarebytes.com/cybercrime/2020/10/vastaamo-psychotherapy-data-breach-sees-the-most-vulnerable-victims-extorted/

https://www.scmagazine.com/home/security-news/data-breach/vastaamo-breach-is-blackmailing-individual-customers-the-next-extortion-trend/

https://threatpost.com/vastaamo-hackers-blackmailing-therapy-patients/160536/

Episode 102 - Breach of the Week: You Reap What You Sow

Justin Fimlaid — Tue, 17 Nov 2020 05:00:00 -0500

Long story short, somebody hacked Harvest Finance and by manipulating asset values, stole tens of millions of dollars. Soon there was a bounty on the black hat, and the relationship is still complicated – Harvest is offering the hacker $1M for their $23M back.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 101 - Breach of the Week: Not Yo Nitro

Justin Fimlaid — Tue, 10 Nov 2020 05:00:00 -0500

So Nitro PDF got hit. The popular PDF software had an undisclosed number of accounts and files released into the wild. Contracts, agreements, love letters, etc. were up for sale on the dark web within hours. Hear what Justin hates to say about it.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 100 - Breach of the Week: There’s a Crook in Your Nook

Justin Fimlaid — Tue, 03 Nov 2020 05:00:00 -0500

In this week’s episode, we look into a big hack at one of the last bookstore giants. Barnes and Noble got whacked in both their brick and mortar and their cyber stores preventing purchases and virtual book reading. Justin discusses why he picked the Nook over the Kindle and Zack laments that the last big bookstore is getting picked on.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 99 - Social Engineering with Jeff

Justin Fimlaid — Thu, 29 Oct 2020 05:00:00 -0400

We are joined by Jeff to talk social engineering both in the real world and the digital world. Jeff talks about how the movie Sneakers sparked his interest, how he got paid to sneak into people’s buildings, and why we see so many people getting duped today.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 98 - We’re Literally A Week Away

Justin Fimlaid — Tue, 27 Oct 2020 05:00:00 -0400

I know, another election security episode with Zack? Yes! Well this week we’re looking at strategies to stop you from getting duped because we’re about to cross the finish line and this year more than ever, cybersecurity is playing a big role in our election and each of us has a role to play. We have some more details on a recent email campaign out of Iran and will talk about why actual data breaches aren’t necessary when you can just make it seem like you’ve stolen data. The good news is that Justin is back again Thursday with a new Breach of the Week and we have some really great episodes with our partners coming up that are going to be awesome!

CISA has put together an excellent resource page for election security that I highly recommend: CISA.gov/protect2020

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 97 - Breach of the Week: You’re So Busted!

Justin Fimlaid — Thu, 22 Oct 2020 05:00:00 -0400

It’s another solo episode and we’re digging deep into the recent indictment of six Russian GRU agents belonging to Sandstorm. What did they do? What happens now? Is this going to stop future attacks? Listen in and find out!

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 96 - Election Security Follow Up

Justin Fimlaid — Mon, 19 Oct 2020 05:00:00 -0400

It’s a solo episode as Zack follows up on some of the previous discussions and updates you on some of the latest issues around election security. Russia still wants to ruin our democracy, botnets are great at spreading garbage news, and the feds are feeling pretty good so far about the overall threat to election infrastructure.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 95 - Breach of the Week: Even the Feds Aren’t Immune

Justin Fimlaid — Thu, 15 Oct 2020 05:00:00 -0400

On this week’s breach, we’re talking about an unnamed federal agency that was compromised by a fairly easy backdoor into the agency’s network. While we can only speculate about which agency was hit or what the intent was of the bad actors, we can all agree that the feds getting whacked is not a good thing.

For more info: https://www.infosecurity-magazine.com/news/us-federal-agency-compromised-by/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 94 - Betrayed by the Coffee Maker

Justin Fimlaid — Tue, 13 Oct 2020 05:00:00 -0400

In what may be the most upsetting episode of Pwned yet, Justin and Zack discuss the implications of a coffee maker going rogue and the possibilities of our IoT appliances turning on us. Are the machines rising against us? Was the coffee maker made by Cyberdyne Systems? Pour yourself a fresh cup of java and listen in as we figure out which appliances have it in for us.

Read the story here: https://decoded.avast.io/martinhron/the-fresh-smell-of-ransomed-coffee/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 93 - Breach of the Week: Run Over By The Chowbus

Justin Fimlaid — Thu, 08 Oct 2020 05:00:00 -0400

This week we’re talking about breach at a food delivery service that appears to be the result of a disgruntled insider. Justin and Zack talk about how easy it was to get the data and how the perpetrator sent out notification of the breach themselves.

You can read the article here: https://www.infosecurity-magazine.com/news/delivery-service-chowbus-breach/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 92 - Medical System Networks Need Life Support

Justin Fimlaid — Tue, 06 Oct 2020 05:00:00 -0400

Justin is back for another episode and we’re again talking about a medical system that’s been hit by ransomware. In what may be the largest attack on a US healthcare network, Universal Health Services had their entire US system impacted by a ransomware attack forcing staff to shut down computers and resort to pen and paper documentation. Justin and Zack talk about the implications of these attacks and then go off the rails discussing the vulnerabilities of US infrastructure and the possibility of an EMP destroying everything.

You can read the article here: https://www.nbcnews.com/tech/security/cyberattack-hits-major-u-s-hospital-system-n1241254

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 91 - Breach of the Week: QR Code Quagmire

Justin Fimlaid — Thu, 01 Oct 2020 05:00:00 -0400

We’re talking QR codes this week and no, it is not 2010. QR codes are back and they’re doing more than ever. QR codes have returned to help us do contactless payments, authentication, and all the other fun stuff they could do before, however, like everything digital, the bad guys are trying to ruin everything for us.

You can read the article here:https://www.forbes.com/sites/louiscolumbus/2020/09/20/the-cybersecurity-threat-no-one-talks-about-is-a-simple-code/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 90 - Reading the Tea Leaves

Justin Fimlaid — Tue, 29 Sep 2020 05:00:00 -0400

What’s the future hold for information technology in a post-COVID world? Justin is back on the podcast to talk about a recent list Microsoft put together speculating what cyber security will look when we start to get back to a new normal. Spoiler, it’s a lot of stuff cybersecurity teams have been pushing for that are finally starting to become commonplace and will likely stick around when things settle.

Here’s the article about Microsoft’s predictions: https://www.techrepublic.com/article/microsoft-says-the-pandemic-has-changed-the-future-of-cybersecurity-in-these-five-ways/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 89 - Breach of the Week: The First Death by Ransomware

Justin Fimlaid — Thu, 24 Sep 2020 05:00:00 -0400

Justin has returned to the podcast and this week we’re covering what could be the first death to be directly linked to a ransomware attack. We talk about why hospitals are targets, how this could become far more complicated if it’s found to be a nation state, and how the legal system will address this and whether this will result in a homicide charge.

You can read the article here: https://www.theverge.com/2020/9/17/21443851/death-ransomware-attack-hospital-germany-cybersecurity

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 88 - The Secret Sauce Part 3

Justin Fimlaid — Tue, 22 Sep 2020 05:00:00 -0400

Kathie is one of the early members of NuHarbor and has been directly responsible for finding and curating the team that has grown into the company NuHarbor is today. Kathie joined the podcast today to talk about how NuHarbor has built a successful work culture, how it’s surviving the pandemic, and what’s next. Kathie has served as the NuHarbor gatekeeper and evangelist and is often one of the first people you speak to when you submit your application and if you’d like to talk to her yourself, you can apply to NuHarbor here: https://nuharborsecurity.com/careers.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 87 - Breach of the Week: Cyber Virus Meets Real Virus

Justin Fimlaid — Thu, 17 Sep 2020 05:00:00 -0400

We’re continuing our exploration of the intersection of cyber and real world disasters and this week we have a report from Cynet about unrelenting attacks that have occurred since the beginning of the COVID-19 crisis and how criminals are using this real world disaster to exploit people in the digital world. You can read the original story here https://thehackernews.com/2020/09/covid-cybersecurity-report.html and you can read our two most recent posts on Threat Intelligence and Threat Hunting, both of which will help you close the gap on the new and novel threats you may face.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 86 - Cybersecurity During Disasters

Justin Fimlaid — Tue, 15 Sep 2020 05:00:00 -0400

It’s National Preparedness Month! Zack is going to tap into his previous life as an emergency manager to discuss the increasing intersection of disasters and cybersecurity. From identity theft and fraud to the increasing reliance on cybersecurity to how cybersecurity professionals can increase their knowledge and skills to respond, we’re exploring a lot on today’s episode. We will likely take some deeper looks at these issues in the coming weeks because a large swath of the US is currently being impacted by significant natural disasters.

National Incident Management and Incident Command System Courses: https://training.fema.gov/nims/

TEEX online courses: https://teex.org/program/online/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 85 - Breach of the Week: Election Security and Protecting Our Increasingly Digital Democracy Part II

Justin Fimlaid — Thu, 10 Sep 2020 05:00:00 -0400

We’re back with the second half of our discussion on election security with Davis. This week we’re talking about strategies and concepts that must be considered as part of a comprehensive security plan from physical security to ensuring people don’t share bad information. If you like this episode, check out last week’s episode discussing all of the threats and vulnerabilities that elections face.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 84 - The Secret Sauce – Part 2

Justin Fimlaid — Tue, 08 Sep 2020 05:00:00 -0400

We are back with our second episode exploring how NuHarbor Security began and what sets us apart from our peers. This week we’re joined by Scott, NuHarbor’s VP and guru of marketing and sales. Scott is another one of the OG crowd and has been with NuHarbor since the very early days. We’ll talk to Scott about how he has embraced content creation, like this podcast, over using traditional methods of marketing and why he and Justin are willing to give away things that other companies may feel people should be charged for.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 83 - Breach of the Week: Election Security and Protecting Our Increasingly Digital Democracy Part I

Justin Fimlaid — Thu, 03 Sep 2020 05:00:00 -0400

We are just a couple of months away from the 2020 election and like many voters, we are discussing election security. This week we are joined again by Davis and we’re talking about the threats to our election and how most people focus on the wrong thing when it comes to securing elections. From voting machines to hanging chads to social engineering, how much of a threat do we face and what can we do about it? This was a big episode, so big we actually split it into two, so this week we talk about the threats, and next week we will cover philosophical and strategic approaches to election security.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 82 - The Secret Sauce – Part 1

Justin Fimlaid — Tue, 01 Sep 2020 05:00:00 -0400

The original group, or OG’s as they’re referred to around the office, have seen NuHarbor grow from a scrappy little company trying to break the mold to a quickly expanding cybersecurity firm punching above their numbers. What is it that motivated the original members to take the leap and join Justin in his pursuit of building an infosec company in his own image? What is it that is driving the company growth despite the challenging economy? We’re starting this discussion with Kyle, the company Swiss Army knife, and leader of REDSEC offensive security operations. Kyle has been with NuHarbor since the early days and shares his thoughts on starts-ups, entrepreneurs, and why he’s still here.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 81 - Breach of the Week: How Much Is This Going To Cost Me?

Justin Fimlaid — Thu, 27 Aug 2020 05:00:00 -0400

This week Zack is solo and is discussing a new report out from IBM Security on the costs of data breaches. To put it bluntly, it’s not cheap. However, the report shows that all is not lost and that organizations that have strong cybersecurity plans, software, and personnel, will save millions of dollars post-breach compared to those who have nothing. The lesson here is to hire us because every dollar you spend before an incident will return a lot more should something occur.

We highly recommend you review the report which you can find here: https://www.ibm.com/security/digital-assets/cost-data-breach-report/Cost%20of%20a%20Data%20Breach%20Report%202020.pdf

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 80 - Taking Care of The Team Part II

Justin Fimlaid — Tue, 25 Aug 2020 05:00:00 -0400

We are back with Part II of our taking care of the team series. In this episode, Zack and Justin will address some of the challenges in keeping staff and what leaders can do to support their staff as well as how to build up team members so that someday they can take over. Justin also discusses how taking care of your team is taking care of your customers. Listen in and let us know what you think! Contact us at pwned@nuharborsecurity.com if you have topics you’d like discussed or if you’re interested in being a guest.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 79 - Breach of the Week: One Person’s Trash Is Another’s Treasure

Justin Fimlaid — Thu, 20 Aug 2020 05:00:00 -0400

On this week’s breach, we’re talking about a breach that took years to come to fruition. How many of us have sold, recycled, or tossed a used computer with the hard drive still in it? It happens countless times a day and we likely don’t even think about the amount of data that remains, even after you “wipe” it. That’s right, your secret list of coworkers with the worst taste in music could be out in the wild as we speak! Listen in to learn what you should do to secure these old drives as well as what not to do when you get rid of a computer.

For info on this weeks breach, check out: https://www.recyclingtoday.com/article/lessons-electronics-recyclers-itad-companies-learn-morgan-stanley-data-breach/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 78 - Taking Care of The Team Part I

Justin Fimlaid — Tue, 18 Aug 2020 05:00:00 -0400

We’re talking team care this week with Zack and Justin. They’ll cover the challenges of leading a team in crisis (like a pandemic), how to keep up enough on the lives of your team members without being creepy, and why leaders fail to lead. This was a very long recording session so we’re breaking it up into two separate episodes. If you take care of your team, they’ll take care of you.

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 77 - Breach of the Week: Twitter Gets Owned by A Kid

Justin Fimlaid — Thu, 13 Aug 2020 05:00:00 -0400

Justin is back on the podcast and for this week’s breach, we’re talking about the big Twitter breach that opened up some of the biggest users on the system to a bitcoin scam. We were shocked at how incredibly easy it was to get into the system, access important accounts, and then waste the opportunity for a second rate bitcoin scam. We’ll talk about how this type of vulnerability is far more common than you think and why businesses continue to fail at the most basic security practices.

To learn more about the recent arrest of the perpetrator: https://www.wfla.com/news/hillsborough-county/tampa-teen-accused-of-being-mastermind-behind-twitter-hack-that-targeted-high-profile-accounts/

Check out NuHarbor Security for complete cybersecurity protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 76 - Catching Up With Travis

Justin Fimlaid — Tue, 11 Aug 2020 05:00:00 -0400

We brought Travis back to give us an update on what he’s seeing for trends and issues. We talk about the biggest things on the horizon including securing remote workers, the shift away from offices, securing education from k-12 through higher ed, and even election security and the threat to democracy. We’re in a dynamic world and Travis talks about how companies are managing everything and moving forward.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 75 - Pwned: Cybersecurity Maturity Model Certification with Kristof

Justin Fimlaid — Tue, 04 Aug 2020 05:00:00 -0400

We’re joined by Kristof to dig into another compliance frontier, the Cybersecurity Maturity Model Certification (CMMC). Kristof will give us a primer on who CMMC affects, what they need to do get compliant, how you get certified, and when this certification goes live. If you fall into the Defense Industrial Base (DIB) or work with the Dept of Defense or contractors who are connected to the DoD, you better ready for CMMC. Kristof also discusses how this will replace NIST with the DoD and the potential alignment of CMMC with other federal agencies.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 74 - Breach of the Week: Shedding Some Light On The Dark Web

Justin Fimlaid — Thu, 30 Jul 2020 05:00:00 -0400

We’re joined by two NuHarbor staffers this week to explore the dark web. We posted a poll on Twitter yesterday and the people have spoken, they wanted dark web content and we are delivering. We’ll discuss what the dark web is, how it is used, and whether or not it is a good idea to visit it on your home computer. We’ll also learn what happens to your stolen credentials post hack and what they may be used for. So if you’re a dark web noob, tune in and get educated.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 73 - Lock It Down – Application Security Authentication Requirements

Justin Fimlaid — Tue, 28 Jul 2020 05:00:00 -0400

We are back with another throwback episode, this time on Application Security Authentication Requirements. You probably would not be surprised to realize that there are still organizations out there that are not using best practices when it comes to authentication requirements and their lack of understanding often results in security headaches for their organization and potential data leaks for users. Justin shares 10 requirements from OWASP and how they can help you in your quest for compliance with various security standards.

You can read Justin’s in depth post here: https://nuharborsecurity.com/10-application-security-authentication-requirements/

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 72 - Blue Streak the Hack, Not the Movie

Justin Fimlaid — Thu, 23 Jul 2020 05:00:00 -0400

Today we’re talking Blue Leaks, the massive data leak impacting law enforcement agencies at all levels, not to be confused with the classic Martin Lawrence movie Blue Streak, a comedy from 1999. We talk about the impacts of the breach, how and why it happened, and the continued risk to government agencies as they expand their online presence.

More info on the breach from Wired: https://www.wired.com/story/blueleaks-anonymous-law-enforcement-hack/

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 71 - In Search of ISO with Kristof

Justin Fimlaid — Tue, 21 Jul 2020 05:00:00 -0400

On this week’s episode we’re talking to Kristof about ISO 27001. We cover the who, what, when, why, and how of ISO and discuss how the process works from initial discussion through certification. Kristof points out some of the pitfalls and shares his thoughts on why ISO is often a better choice than some of the other standards that exist (NIST, we are looking at you.) If you’re a organization interested in ISO, be sure to listen!

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 70 - Breach of the Week: Amtrak Has Gone Off The Rails

Justin Fimlaid — Thu, 16 Jul 2020 05:00:00 -0400

This week Justin and Zack realize with terror, that their favorite form of transportation has betrayed them. The NuHarbor train system of choice, Amtrak, found itself on the receiving end of a data breach and unfortunately the train has left the station. The breach appears to have originated within the app used to access your Amtrak guest points system, sharing all the weird things you purchased using your points and your PII like social security number, names, and addresses. At the same time, travel by train is the best and both Justin and Zack said they’re Amtrakers for life.

To read more about the breach, check out https://cyware.com/news/critical-vulnerabilities-spotted-in-the-amtrak-mobile-application-1474d637

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 69 - Breach of the Week: Gigabyte Edition: Nation States Want Your Data

Justin Fimlaid — Tue, 14 Jul 2020 05:00:00 -0400

You shouldn’t be shocked by this, but North Korea is trying to break into your data. Seriously, check your logs. If you do not see the telltale signs, it’s only a matter of when, not if, a nation state takes a shot at you. This was originally set to be a Breach of the Week, but we got chatty and we decided to launch this as a regular full episode. Justin and Zack discuss how cyber-attacks are leveling the playing field between nations. Specifically, they discuss how North Korea has built a 7,000 person cyber security division that’s only purpose to damage, destroy, and steal data. Are you ready to take on an adversarial nation?

To learn more about North Korea’s Cyber Army, check out: https://www.businessinsider.com/north-korea-kim-jong-un-cyber-army-cyberattacks-nuclear-weapons-2020-6

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 68 - Breach of the Week: Maker of Chips Gets Clipped

Justin Fimlaid — Thu, 09 Jul 2020 05:00:00 -0400

For this week’s Breach of the Week, we’re talking about a software on a chip maker that got hit by our old friend, Maze Ransomware. Justin talks about the persistence of viruses after you’ve been hit and how companies can try to prevent this from happening. We also are beginning to discuss 5G. What is 5G? Well, if you believe the hype, it is literally everything. Stay tuned for more 5G coverage in the future as we begin to explore the benefits and challenges of this new tech.

To learn more about this breach: https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 67 - From the Archives: Exim Server Vulnerabilities

Justin Fimlaid — Tue, 07 Jul 2020 05:00:00 -0400

What is up everyone! For this week’s episode we’re digging into the archives and we picked one of the most popular episodes from Season 1 of Pwned, Exim Server Vulnerabilities. What’s fascinating about Exim is that it first launched 25 years ago and still supports a lot of email systems around the globe. The software’s longevity and proliferation mean that hackers have had a long time to learn the vulnerabilities of the platform and unpatched servers seems to be the target that get picked off the most. Give the episode a listen and let us know what you think!

To learn more about Exim Server Vulnerabilities:

https://nuharborsecurity.com/exim-server-vulnerabilities/

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 66 - Pwned Gigabytes – Nuharbor Is Literally the Best Place to Work

Justin Fimlaid — Tue, 30 Jun 2020 05:00:00 -0400

We have a very special episode this week! NuHarbor Security is literally the best place to work. Seriously, NuHarbor was selected as a “Best Places to Work in Vermont” for the second time! Justin and Zack discuss why they think NuHarbor was selected and why NuHarbor staff members make the difference. Justin also talks about how having a strong corporate philosophy that emphasizes staff wellness above all else can help any company succeed and how he prioritizes building a company of people who work well together. You can read more about the award and Justin’s remarks as we received the award here: https://nuharborsecurity.com/best-place-to-work-2020

You can join NuHarbor and find out why we’re a best place to work by visiting our career page at https://nuharborsecurity.com/careers

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 65 - Breach of the Week – Spy Versus Spy

Justin Fimlaid — Thu, 25 Jun 2020 05:00:00 -0400

On this week’s Breach of the Week, we’re talking CIA and a pretty epic dump of highly sensitive and classified materials including some of the most dangerous hacking tools they’ve created. Was it a nation state looking to seek revenge? Was it a hacking group that perpetrated the deepest depths of the government’s networks? Listen and find out (hint: It wasn’t either of those things). Justin gives his thoughts on how this went down, the lack of good policies and procedures, and we talk about the risk of the insider threat.

Link to the story: https://www.washingtonpost.com/national-security/elite-cia-unit-that-developed-hacking-tools-failed-to-secure-its-own-systems-allowing-massive-leak-an-internal-report-found/2020/06/15/502e3456-ae9d-11ea-8f56-63f38c990077_story.html

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 64 - Your Cyber Threat Intelligence Should Probably Be Smart

Justin Fimlaid — Tue, 23 Jun 2020 05:00:00 -0400

On this week’s episode Justin’s discussing cyber threat intelligence and why it takes a combination of good systems, smart people, and solid processes to stay ahead of the bad guys. Justin also shared some sources you can use to find intel and some thoughts on how to effectively use that intel including building your platform to manage all the data. You’re going to be drinking from a fire hose once you start ingesting intel, so Justin also provides his thoughts on how to make sense of everything and how hiring someone, perhaps NuHarbor Security, can help to take that raw intel and use it to create a robust security posture that isn’t constantly feeding you false positives.

If you like this episode, you should check our episode with Davis, one of our Cyber Threat Analysts https://nuharborsecurity.com/pwned-gigabytes-davis-finds-threats-before-they-find-you/

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 63 - Breach of the Week – Shocked and Amazed

Justin Fimlaid — Thu, 18 Jun 2020 05:00:00 -0400

On this week’s episode we are digging into a specific Maze Ransomware attack that hit one of the biggest security firms on the planet. What does it mean when a security company gets hit, how they’ll probably be just fine with their billions of dollars, and whether or not we should cut them some slack. While we don’t know how much they ultimately paid the hackers, we know that they estimate the impact to their company to be in the tens of millions of dollars, which for a company of this size is probably not something they wanted to deal with but have the resources to handle.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 62 - Pwned Gigabytes – Navigating the Maze

Justin Fimlaid — Tue, 16 Jun 2020 05:00:00 -0400

Maze Ransomware has been in the headlines quite a bit recently and the way things look, we’re probably going to see it more in the future. Justin and Zack take a deep dive into what Maze is, how it works, and why businesses impacted should probably not mess around with getting it sorted out. They’ll also cover the unfortunate reality that once your hit, it’s very likely you’ll be targeted again and what you can do to prevent getting impacted in the first place. As is often the case, human error is the most common vector for attack but there are some tools and technology you can use to make it a bit harder for the people trying to break into your systems.

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 61 - Breach of the Week – ShinyHunter People

Justin Fimlaid — Thu, 11 Jun 2020 05:00:00 -0400

Despite the mediocre R.E.M. pun, this is a good episode. We’re covering ShinyHunters and how they got busy in May dumping millions of accounts into the dark web. Zack learns that hacked data doesn’t necessarily arrive ready to start using and Justin laments at the fact that hackers only need to be right once and business need to be right 100% of the time. We also talk about the return of Anonymous and who their targeting during their resurgence. Once again, we suggest you let REDSEC, our offensive security team, hack you before someone else does.

hbspt.cta.load(9212203, 'fb57af26-98aa-434b-93de-f33cfde6f331', {"region":"na1"});

Check out the full Wired story here: https://www.wired.com/story/shinyhunters-hacking-group-data-breach-spree/

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 60 - Pwned Gigabytes – Davis Finds Threats Before They Find You

Justin Fimlaid — Tue, 09 Jun 2020 05:00:00 -0400

On this week’s episode we’re talking to Davis about threat analysis and how he sifts through the noise to help keep organizations safer from security threats. We are covering everything from the alphabet soup of infosec acronyms to why having some human eyes on intel can strengthen information security to what the future holds in threat analysis. Davis sits in the purple side of the house between the REDSEC offensive security team and the groups defending against attacks. Justin also gets another opportunity to take a shot at AI and again we are reminded that even with the best technology, you gotta make sure the people that work for you are not downloading sketchy files.

hbspt.cta.load(9212203, 'fb57af26-98aa-434b-93de-f33cfde6f331', {"region":"na1"});

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 59 - Breach of the Week – How About You Nintendon’t Do That

Justin Fimlaid — Thu, 04 Jun 2020 05:00:00 -0400

In this week’s Breach of the Week episode we talk about a big breach at Nintendo that revealed NNID, Nintendo’s ID system, which is linked to other private and payment info. Justin and Zack then discuss everything from the cost of video games to video game streaming. Also, we discuss video game currencies and how big streaming video games is. Like, share, subscribe!

Link to story: https://www.cshub.com/attacks/articles/incident-of-the-week-nintendo-investigating-160000-account-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 58 - Pwned Gigabyte – Say Hello to REDSEC with Kyle

Justin Fimlaid — Tue, 02 Jun 2020 05:00:00 -0400

This week we are welcoming Kyle to the podcast to tell us all about REDSEC. We’ll learn who they are and how they help clients find vulnerabilities before the bad guys do. Kyle will talk about why we have updated and centralized the offensive testing side of the house at NuHarbor and what sets it apart from other offensive security organizations. From snooping Wi-Fi to phishing for credentials to hacking webapps, nothing is safe from the skilled operators. We also talk about R.A.V.E.N., the remote testing tool used by the team, and the benefits and flexibility it adds to the security assessment process. Long story short, they can keep you out of the news and off of our Breach of the Week episodes. For more content related to offensive security, check out our previous Gigabyte and Breach of the Week episodes with Eric and Randy.

hbspt.cta.load(9212203, 'fb57af26-98aa-434b-93de-f33cfde6f331', {"region":"na1"});

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 57 - Breach of the Week – Marriott Meltdown

Justin Fimlaid — Thu, 28 May 2020 05:00:00 -0400

In this weeks Breach of the Week, Justin and Zack discuss not one, but two, separate breaches at Marriott hotels, one releasing nearly enough data for every person in the United States! Will this stop Justin and Zack from ever staying at a Marriott again or will they cash in those reward points for a future room upgrade? Tune in to find out!

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 56 - Attracting and Keeping Your Cyber Security Talent

Justin Fimlaid — Tue, 26 May 2020 05:00:00 -0400

It’s graduation season and despite the very strange and challenging times we live in, a lot of awesome and talented students are about to be unleashed into the world and if you’re a cyber security company that’s trying to attract them, Justin has some thoughts. Maybe you already have a full roster but for some reason you just cannot seem to figure out why your best folks keep leaving, well, Justin has some thoughts on that as well. Attracting and keeping your talent is difficult and expensive. Yes, you gotta spend money to make money and that also goes with your people as well. Finally, Justin has a few thoughts on how you can build your skill set by building your own lab and putting in the work on your own time to make you a better candidate. A little something for everyone. Like, share, rate, and review! Let us know what you think!

We’re also including an in depth blog post to allow you to dig deeper into this episode and find ways to recruit and retain cyber talent: https://nuharborsecurity.com/attracting-keeping-cybersecurity-talent

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 55 - Breach of the Week: War Stories With Eric

Justin Fimlaid — Thu, 21 May 2020 05:00:00 -0400

On this week’s episode, we’re testing how far a breach can go and what happens when a customer is 100% positive they’re system is bullet proof. Can Eric drop ship a very expensive item to prove a point? Can Randy print himself a badge so that he doesn’t have to wait for one? Did Justin really want a tractor for the office? Our dynamic duo of Eric and Randy are back and it’s Eric’s turn to share some of his penetration testing highlights. Here’s another chance to get a peek behind the curtain and see how our offensive testing team does their work.

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 54 - Why Government Is the Ultimate Ransomware Target

Justin Fimlaid — Tue, 19 May 2020 05:00:00 -0400

Why are government agencies constantly a target for ransomware? Not a day goes without a story about a city or government agency that is found itself on the losing end of a ransomware attack. Adversaries can create relentless attacks on networks looking for any vulnerabilities to exploit and get unlimited tries while an agency only needs one person to make a mistake and compromise an entire system. Justin will share his thoughts on why governments are such attractive targets and why preventing these attacks is so difficult. He will also go over why ransomware is a symptom of a larger problem of under investment, limited funds, and constant poaching of cyber talent into the private sector.

If you are looking for even more info about the risk ransomware and why this is such a pervasive challenge, check out our blog for a in depth analysis of this problem: https://nuharborsecurity.com/government-ransomware-target

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 53 - Pwned Breach of the Week – War Stories with Randy

Justin Fimlaid — Thu, 14 May 2020 05:00:00 -0400

This week we’re again joined by Eric and Randy to hear some war stories. Randy takes us through the time that he immediately accessed a bunch of very critical files while he was hanging out waiting for an engagement to begin. He also discusses how Justin tried to talk him into making a very large statement to let the customer know that they’d been had and how Randy had to talk Justin out of it. Randy also sheds some light on how something as simple as opening up the system to allow for some maintenance can be the thing that takes down your company. Learn from the pros so you don’t find yourself on our next Breach of the Week!

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 52 - Pwned GigaBytes – Hiring and Recruiting with Emi and Allie

Justin Fimlaid — Tue, 12 May 2020 05:00:00 -0400

Whether you recently graduated or are looking to break into cyber security, you need to check out our hiring and recruiting episode with two of our Talent Acquisition Specialists, Emi and Allie. Should you write a 20-page resume? How important are cover letters? What are companies like NuHarbor looking for? Should you include a recipe for your world-famous spaghetti recipe? We are going to learn what happens behind the scenes after you upload your resume and hit submit and with any luck, help you get hired for your next cyber security job. A lot of tech companies are hiring and most of us probably have an idea of what we think sets us apart but Emi and Allie are going to set us straight on what catches a recruiters eye and how to stand out without being obnoxious. If you think you are a cyber security rock star and want to work for a company that values your skills as much as your work/life balance, check out the latest job postings and reach out to Emi and Alli on our career page: https://nuharborsecurity.com/careers

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 51 - Breach of the Week – Catch of the Day

Justin Fimlaid — Thu, 07 May 2020 05:00:00 -0400

We live in a world where everything is connected to the internet, even fish tanks, and as we learn in today’s episode, that internet connected fish tanks can cause you some real headaches. Justin found a story about a fish tank in a casino that was used to access a lot of sensitive data and Zack reveals why he is no longer welcome at PetSmart. We also explore the potentially lucrative market of protecting internet connected fish tanks. We are just beginning to see how difficult securing your data is when everything we own has an IP address and is ready for exploitation. For all this and more, check out this weeks, Breach of the Week!

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: https://twitter.com/NuHarbor@nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 50 - Pwned GigaByte – Eric and Randy Get Paid to Break Into Other Peoples Stuff

Justin Fimlaid — Tue, 05 May 2020 05:00:00 -0400

On this week’s episode of Pwned, Justin and Zack are joined by Eric and Randy, two operators from our penetration testing team. This is another long episode and we are spending that time to learn everything about how our team uses white hat techniques to poke, prod, and punch into various systems. They will be discussing the tactics, techniques, and procedures used by adversaries how they simulate attacks, from creating code that will give them credentials to walking in a building and plugging in a device. You will also learn the difference is between penetration testing and vulnerability scans and how Eric and Randy do their best to find vulnerability scan reports to prove the value of a true penetration test. Sidenote, yes, I said Petaflop and I meant Petabyte and I’ll forever live with this mistake – Zack

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 49 - Pwned Breach of The Week: Your Online Dating Data Is Ready to Mingle

Justin Fimlaid — Thu, 30 Apr 2020 05:00:00 -0400

On this week’s episode of Pwned Breach of the Week, we are checking out dating data that found itself on the market, unfortunately it was not interested in starting a new relationship. The data breach resulted in numerous online dating services finding their client information on the dark web for sale to the highest bidder. In an age of increasing online dating, this type of breach can be expensive, revealing, and in some cases, quite embarrassing. Justin provides some helpful tips in how services can test systems prior to a breach to protect them and Zack professes his love for coffee and bagels. As always, we’d love to hear your feedback and hear your breach stories.

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 48 - The Vulnerability of Artificial Intelligence

Justin Fimlaid — Tue, 28 Apr 2020 05:00:00 -0400

You would be hard pressed to find a cyber security company that isn’t marketing its artificial intelligence capabilities. If you believe the hype, you probably think that AI can block zero day attacks, find the bad guys, and bring them to justice. The reality of what AI can and can’t do, is quite different from what you may be seeing in advertisements. While it’s not a silver bullet, AI does have a role in cyber security. Can it catch things that the good ol’ fashioned human being would otherwise miss? Can it actually stop attacks before they happen? On this weeks episodes Justin is laying out what artificial intelligence is, what it can do, and why you should be cautious when you are looking to employ AI systems to protect your organization.

We’re also including an in depth blog post to allow you to dig deeper into episode and learn more about artificial intelligence: https://nuharborsecurity.com/vulnerability-ai

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 47 - Pwned Breach of the Week: Measure Twice, Cut Once, and Check Your Email Attachments

Justin Fimlaid — Thu, 23 Apr 2020 05:00:00 -0400

On this week’s Breach of the Week, we learn the importance of measure twice, cut once. Why are we sharing this timeless carpentry advice? Well, for one, it is great advice to ensure you don’t waste construction materials but for our purposes, the breach this week is about an email sent out with the best of intentions and instead releasing significant PII data. As if you need another reason to check your email, we also talk about an email involving Nicholas Cage and yet another email that revealed who was pulling their weight at a big corporation. We highlight these mistakes because it is so easy that anyone could mistakenly do this, proving yet again human error is a significant vulnerability. So, check that email twice before sending, measure that board twice before cutting, and stay off our Breach of the Week!

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: https://nuharborsecurity.com

Facebook: https://www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: https://www.linkedin.com/company/nuharbor/

Instagram: https://www.instagram.com/nuharborsecurity/

Episode 46 - Pwned GigaByte – Chad and Travis Discuss Industry Trends, the Impacts of COVID-19, and the Future of Remote Working

Justin Fimlaid — Tue, 21 Apr 2020 05:00:00 -0400

Welcome to our first GigaByte episode! In this long episode, we are taking a big dive into information and cyber security industry trends with two of our Trusted Security Advisors, Chad, and Travis. They share what they have seen over the last few months, what changed with COVID-19 and what the future holds for the information security industry. As the industry has adapted, so has NuHarbor (in fact, this entire podcast was recorded remotely) and Chad and Travis explain how they have had to use their expertise to help information security professionals protect their organizations in a landscape that changes by the day. Chad and Travis also provide their thoughts on what changes are going to stick around, including significant increases in people working remotely and the challenges of using company devices, on personal networks, to log into company networks. How can companies prepare for this security challenge? Does the future of work involve more opportunities to stay in your pajamas? And will we ever have to go into a grocery store again? Tune in and find out!

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: www.nuharborsecurity.com

Facebook: www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: www.linkedin.com/company/nuharbor/

Instagram: www.instagram.com/nuharborsecurity/

Episode 45 - Pwned Breach of the Week: The Case of the Missing CD-ROM

Justin Fimlaid — Thu, 16 Apr 2020 06:00:00 -0400

This week we’re mixing it up with our Breach of the Week: The Case of the Missing CD-ROM. Yes, CD-ROM. Zack and Justin discuss the theft of a CDROM with PII and ponder why anyone would want to steal a CD-ROM and if they would even have a drive to get the data off in the first place. A real whodunit. Was it the Smithsonian, a confused child, or a Pintrest fail? Tune in to find out. Also, we’ve already hit 1000 listens for the new season! Thank you to everyone that listens to and enjoys our podcast! Unfortunately, we’re not satisfied with a mere 1000 listens and are challenging you to subscribe, like, share, rate, and review and get your fellow infosec and cyber security friends to listen. Next week we’ve got our first long episode where we talk to two of our Trusted Security Advisors about trends in the cyber security industry and how COVID-19 has flipped everything on its head.

You can find more breaches at the privacy rights clearing house: https://privacyrights.org/data-breaches

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: www.nuharborsecurity.com

Facebook: www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: www.linkedin.com/company/nuharbor/

Instagram: www.instagram.com/nuharborsecurity/

Episode 44 - TTPs for COVID-19 Threats

Justin Fimlaid — Tue, 14 Apr 2020 06:00:00 -0400

This week we’re exploring Tactics, Techniques and Procedures (TTP) related to COVID-19 threats. As with many disasters, cyber criminals are hoping to exploit people who are trying to find helpful information online and may be more likely to open sketchy links or email attachments. Therefore, the best ways to protect your organization is to understand what these threats look like, how they work, and who may be behind them, all of which requires that you understand the TTPs being used. So, check out this episode to learn about TTPs for COVID-19 threats. If you are enjoying these episodes, have ideas around topics, or would like to be on a future episode, contact us at pwned @ nuharborsecurity.com

Episode Transcript: PWNED Transcripts – S2E4 – TTPs for COVID-19 Threats

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: www.nuharborsecurity.com

Facebook: www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: www.linkedin.com/company/nuharbor/

Instagram: www.instagram.com/nuharborsecurity/

Covid-19 related TTPs:

Malware / Attack Phishing Geography / Industry Japan Lure Coronavirus Info Microsoft Word with malicaious VBA macro. Installs Emotet via Powershell. Malware / Attack Phishing Geography / Industry United States Lure “COVID-19 — Now Airborne, Increased Community Transmission”, appears to be from the CDC.gov (headers manipulated) Info Originally identified by Cofense, When victims click on the embedded link, they are redirected to a Microsoft Outlook login page, and upon entering their legitimate credentials, are further redirected to a legitimate website of the CDC. Malware / Attack Phishing Geography / Industry Italy Lure “Coronavirus: informazioni importanti su precauzioni”, appears to be from “Dr. Penelope Marchetti,” an employee of the WHO in Italy. Info Emails contain Microsoft Office Documents with VBA macros that installs Trickbot Malware that steals personal information or installs additional malware. Malware / Attack Phishing Geography / Industry South Korea Lure Varying subject lines that claim to information about South Korea’s response to COVID-19. Info Emails contain Microsoft Word documentation that installs the North Korea’s BabyShark Malware. Malware / Attack Phishing Geography / Industry United States Lure Email claiming to provide victims with information on global FedEx operations while the COVID-19 outbreak continues. Info Emails contained an attachment titled “Customer Advisory.PDF. exe” that, when opened, infected the victim with the Lokibot malware Malware / Attack Phishing Geography / Industry United States Lure Email claiming to provide victims with information on global FedEx operations while the COVID-19 outbreak continues. Info Emails contained an attachment titled “Customer Advisory.PDF. exe” that, when opened, infected the victim with the Lokibot malware Malware / Attack Phishing Geography / Industry United States Lure COVID-19 type content Info Originally identified by Proofpoint, These attacks involved emails that contained Microsoft Office document attachments designed to lure victims and exploit a Microsoft Office vulnerability, tracked as CVE-2017-11882, which allows attackers to run arbitrary code in the context of the current user ultimately installing AZORult malware. Malware / Attack Phishing Geography / Industry United States Lure COVID-19 emails from CDC.gov Info URL contained within a phishing email led to a fake Microsoft Outlook login page, designed to convince victims to input their credentials. In another instance, victims were asked to donate Bitcoin to the CDC to aid in the pursuit of a vaccine.

Episode 43 - Pwned Byte Sized – Continuity of Operations Planning

Justin Fimlaid — Fri, 10 Apr 2020 06:00:00 -0400

On today’s episode we’re talking COOP, or Continuity of Operations Planning. It’s estimated that as many as 50 percent of businesses impacted by a disaster will fail and that number is even higher for small businesses. You’re likely operating some form of a COOP plan due to COVID-19 and you may not have even realized it and hopefully you had a plan before everything hit the fan. Unfortunately, we’re seeing business close up shop because they were not prepared.

COOP at it’s most basic level is planning for how you’ll maintain your businesses critical functions before, during, and after a major disruption. What exactly does it cover? Some basic things to plan for include how you’ll communicate and access data, how staff will work, what systems must remain operational, how long you can function in a contingency mode, organizing your teams, delegating authority, and how you’ll get back to normal operations.

What can you do to prepare? FEMA has developed two online courses specific to COOP planning during a pandemic.

IS 520: Introduction to Continuity of Operations Planning for Pandemic Influenzas and IS 522: Exercising Continuity Plans for Pandemic Course.

These courses provide a great intro to the COOP process and can help build a solid foundation of training and experience.

There are a number of different standards to help assess and guide your COOP planning efforts and many organizations that can assist you from federal agencies to private sector consultants. Continuity of Operations Planning is a critical process that will help to ensure that your organization can survive any disaster. If you need assistance with your cyber COOP planning, contact us at NuHarbor Security today.

As always, thank you to our sponsor, Nuharbor security your end to end provider of security services and solutions If your looking for smart security solutions for your business and a security partner that actually gives a *BEEP*, visit us at www.nuharborsecurity.com

Episode 42 - SOAR for MSSPs

Justin Fimlaid — Tue, 07 Apr 2020 06:00:00 -0400

This week we explore security orchestration, automation and response (SOAR) and how managed security service providers (MSSP) can leverage SOAR to better secure your organization. We’ll discuss the challenges of traditional security monitoring and the benefits of working with an MSSP that integrates SOAR in its practice to be better prepared to respond to real events and understand how traditional methods of monitoring cyber security events can create complacency and miss real world incidents. We’ll also talk about the different providers of security services and why it’s important that you pick a provider that specializes in protecting organizations from cyber attacks.

In this episode, we’ll cover:

Understanding SOAR technology and how it can boost your security presence
The challenges of alert fatigue and complacency
Understanding the limitation of SOAR and how MSSP providers can optimize its use
Ensuring that your organization understand the difference in security resources available and how some may conflict
Picking the tools that will best protect you

Episode Transcript: Pwned Transcripts – S2 E3 -SOAR FOR MSSP Transcript

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: www.nuharborsecurity.com

Facebook: www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: www.linkedin.com/company/nuharbor/

Instagram: www.instagram.com/nuharborsecurity/

Episode 41 - Pwned Byte Sized – Keeping Your Web Conferences Secure!

Justin Fimlaid — Thu, 02 Apr 2020 15:37:00 -0400

Without question, we’ve entered a new era of web-based meetings. This has become how most companies are conducting business with the current pandemic. And I suspect this is going to remain even active after we’re all back at our offices. One thing that’s come up with the proliferation of web meetings is the failure to secure those meetings. It’s gotten bad enough that the FBI field office in Boston actually sent out an advisory today talking about the risks of meetings being infiltrated. So, what are those risks? First, as many of us have experienced over the last two weeks, people jumping into meetings that don’t belong in there, and in worst case, scenarios yelling obscene and noxious things that’s obnoxious for everyone listening in, and it also makes you, the host, look like you don’t know what you’re doing. Another important risk to consider is that if you have people inside those meetings that don’t belong there, they’re listening in on your business and other activities. You wouldn’t allow strangers to hang out in your conference room in real life, don’t let it happen online. So, what can you do? First, try to avoid open URL meetings. Don’t send them out to mass emails, don’t post them on social media. If you’re gonna have a meeting, make sure you invite who’s supposed to be there and provide them specific tokens or other information to login you can password protect your meetings which add an additional layer of protection. If you are having an open meeting for the love of God, mute everyone. No one wants to hear people eating food or commenting on the discussion, unless of course it is entertaining. Finally, pay attention to who’s logged in. Most meeting systems have a waiting room before you enter and that’s an opportunity to take a look around and see who doesn’t belong. You can also take actual attendance and boot people who don’t answer you. That’s today’s Pwned Byte Sized episode. Remember, keep your meetings safe and secure.

Website: www.nuharborsecurity.com

Facebook: www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: www.linkedin.com/company/nuharbor/

Instagram: www.instagram.com/nuharborsecurity/

Episode 40 - Securing Your Remote Workforce

Justin Fimlaid — Tue, 31 Mar 2020 10:03:00 -0400

Many organizations are finding themselves scrambling to secure their remote workforce due to COVID-19. On this episode, we’re talking remote workforce security best practices and what you can do to keep your team running out of the office. Best case scenario, you planned and exercised for just this situation and your team was ready to make the switch to off site, your staff were trained on how to securely work away from the office, and your system was built to keep your network and data safe both on and off premises. Unfortunately, the reality for many organizations was that they hadn’t considered remote workforce security, or at least to the scale of this crisis,and had to figure it out live. Wherever in that spectrum of readiness you find yourself, we’ve got tips, techniques, and strategies to help you keep you and your team secure and operational.

In this episode, we’ll cover:

Email security and phishing threats
Training and educating your employees to be safe and secure while working remotely
Preparing your enterprise security for remote work
Knowing what to look for and how to respond to threats
Encrypt, encrypt, encrypt
Utilizing cloud apps
Policies and procedures to help guide workers and keep your data safe

Episode Transcript

Check out NuHarbor Security for complete cyber security protection for your business and a security partner you can trust.

Website: www.nuharborsecurity.com

Facebook: www.facebook.com/nuharbor/

Twitter: @nuharbor

LinkedIn: www.linkedin.com/company/nuharbor/

Instagram: www.instagram.com/nuharborsecurity/

Episode 39 - The Pwned Podcast is Back!

Justin Fimlaid — Tue, 24 Mar 2020 11:27:00 -0400

NuHarbor Security announces the relaunch of PWNED – The Information Security Podcast with Justin Fimlaid. Stay tuned for episodes about staying secure while working from home, artificial intelligence, and emerging threats in 5G.

Episode 38 - Exim Server Vulnerabilities and Exploits

Justin Fimlaid — Mon, 24 Jun 2019 04:00:00 -0400

Exim Server Vulnerabilities and Exploits

Episode 37 - Winnti Malware for Linux

Justin Fimlaid — Mon, 10 Jun 2019 03:00:00 -0400

Winnti Malware for Linux

Episode 36 - APT10 Update

Justin Fimlaid — Mon, 03 Jun 2019 03:00:00 -0400

APT10 Update

Episode 35 - Ohio’s Data Protection Act

Justin Fimlaid — Mon, 27 May 2019 23:16:00 -0400

Ohio’s Data Protection Act

Episode 34 - SHA-1 Collision Attacks Explained

Justin Fimlaid — Mon, 20 May 2019 03:00:00 -0400

SHA-1 Collision Attacks Explained

Episode 33 - Vulnerability Management and Patching

Justin Fimlaid — Mon, 13 May 2019 23:02:00 -0400

Vulnerability Management and Patching

Episode 32 - Getting started with NIST Cybersecurity Framework

Justin Fimlaid — Mon, 06 May 2019 03:00:00 -0400

Getting started with NIST Cybersecurity Framework

Episode 31 - Penetration Testing or Red Teaming?

Justin Fimlaid — Mon, 29 Apr 2019 02:55:00 -0400

Penetration Testing or Red Teaming?

Episode 30 - As Facts Change So Does My Opinion

Justin Fimlaid — Mon, 22 Apr 2019 02:33:00 -0400

As Facts Change So Does My Opinion

Episode 29 - The Open Banking Directive and Application Security

Justin Fimlaid — Mon, 15 Apr 2019 23:00:00 -0400

The Open Banking Directive and Application Security

Episode 28 - Election Security and Estonia’s e-Voting System

Justin Fimlaid — Mon, 08 Apr 2019 03:00:00 -0400

Election Security and Estonia’s e-Voting System

Episode 27 - Why People, Process, Technology is Not Enough

Justin Fimlaid — Mon, 25 Mar 2019 03:00:00 -0400

Why People, Process, Technology is Not Enough

Episode 26 - Quick Brief on PCI-DSS 4.0

Justin Fimlaid — Mon, 18 Mar 2019 03:00:00 -0400

Quick Brief on PCI-DSS 4.0

Episode 25 - Application Security Authentication Requirements

Justin Fimlaid — Mon, 11 Mar 2019 03:00:00 -0400

Application Security Authentication Requirements

Episode 24 - The Cavalry is NOT Coming

Justin Fimlaid — Mon, 04 Mar 2019 21:38:00 -0500

The Cavalry is NOT Coming

Episode 23 - SOC2 Report Quickstart

Justin Fimlaid — Mon, 25 Feb 2019 03:00:00 -0500

SOC2 Report Quickstart

Episode 22 - Not Invented Here Bias for Security

Justin Fimlaid — Mon, 18 Feb 2019 18:00:00 -0500

Not Invented Here Bias for Security

Episode 21 - The Difference Between Red Teaming and Penetration Testing

Justin Fimlaid — Mon, 11 Feb 2019 01:28:00 -0500

The Difference Between Red Teaming and Penetration Testing

Episode 20- Without Wax: The Quest for Perfection

Justin Fimlaid — Mon, 04 Feb 2019 03:00:00 -0500

Without Wax: The Quest for Perfection

Episode 19 - Quickstart – Building a Security Program with the NIST Cybersecurity Framework

Justin Fimlaid — Mon, 28 Jan 2019 03:00:00 -0500

Quickstart – Building a Security Program with the NIST Cybersecurity Framework

Episode 18 - The Best Security Technology You Probably Aren’t Using

Justin Fimlaid — Mon, 21 Jan 2019 03:00:00 -0500

The Best Security Technology You Probably Aren’t Using

Episode 17 - Benefits of a Security Certification & Equifax Security Breach

Justin Fimlaid — Mon, 14 Jan 2019 03:00:00 -0500

Benefits of a Security Certification & Equifax Security Breach

Episode 16 - 5 Security Predictions for 2019

Justin Fimlaid — Mon, 07 Jan 2019 03:00:00 -0500

5 Security Predictions for 2019

Episode 15 - Implementing an ISO 27001 ISMS

Justin Fimlaid — Mon, 31 Dec 2018 03:00:00 -0500

Implementing an ISO 27001 ISMS

Episode 14 - 4 Questions to Determine Which PCI SAQ is Right for Your Organization

Justin Fimlaid — Mon, 24 Dec 2018 03:00:00 -0500

4 Questions to Determine Which PCI SAQ is Right for Your Organization

Episode 13 - 9 Considerations to Make When Selecting a Cybersecurity Insurance Policy

Justin Fimlaid — Mon, 17 Dec 2018 03:00:00 -0500

9 Considerations to Make When Selecting a Cybersecurity Insurance Policy

Episode 12 - 1 Thing I’ve Learned About Successful Security Leaders

Justin Fimlaid — Mon, 10 Dec 2018 03:00:00 -0500

1 Thing I've Learned About Successful Security Leaders

Episode 11 - 5 Considerations When Outsourcing Security

Justin Fimlaid — Mon, 03 Dec 2018 04:31:00 -0500

5 Considerations When Outsourcing Security

Episode 10 - What is Doxxing?

Justin Fimlaid — Mon, 26 Nov 2018 03:00:00 -0500

What is Doxxing?

Episode 9 - A Lannister Always Pays His Security Tech Debts

Justin Fimlaid — Mon, 19 Nov 2018 03:00:00 -0500

A Lannister Always Pays His Security Tech Debts

Episode 8 - The Regular Type of Security Vendor

Justin Fimlaid — Mon, 12 Nov 2018 03:00:00 -0500

The regular type of security vendor

Episode 7 - 3 Parts of your Vendor Security Assessment Program

Justin Fimlaid — Mon, 05 Nov 2018 03:00:00 -0500

3 parts of your vendor security assessment program

Episode 6 - The Election Security Deception

Justin Fimlaid — Mon, 29 Oct 2018 03:00:00 -0400

The election security deception

Episode 5 - Security Awareness – Make it Personal!

Justin Fimlaid — Mon, 22 Oct 2018 03:00:00 -0400

Security Awareness – Make it Personal!

Episode 4 - Do you ISO 27001?

Justin Fimlaid — Mon, 15 Oct 2018 03:00:00 -0400

ISO 27001 isn't a security benchmark.

Show Notes: https://justinfimlaid.com/do-you-iso-27001/

Sponsor: https://nuharborsecurity.com and https://iso27001certifications.com

Contact Me: https://justinfimlaid.com/contact-me/

Twitter: @justinfimlaid

LinkedIn: https://www.linkedin.com/in/jfimlaid/

ISO 27001 Background

ISO 27001 is increasing in popularity mostly stemming from the exposure created by assessing the security posture of vendors and vendors trying to prove they are good data custodians. The problem, at least in the US, is most people confuse ISO 27001 as a compliance standard when in fact it's a mechanism to build your security program.

I met with a my buddy Todd last week whom is a security analyst at mid-size manufacturing company. While none of their information is considered “regulated” or “industry sensitive”, it would still suck if they lost it. So his organization choose ISO 27001 as their security framework. We chatted about why he's struggling with ISO 27001 adoption within their organization. Here's his deal - he was trying to use the ISO 27001 Annex A controls and trying to implement all the ISO 27002 controls and was getting frustrated with the process.

Here’s the deal ISO 27001 is not intended to be a compliance framework like PCI or HIPAA, rather it’s an information security management system - hence why ISO 27001 is commonly referred to as an ISMS. In the simplistic terms ISO 27001 is a management framework that guides you through designing a custom built security program with custom security controls right sized for your organization.

So here’s how ISO 27001 breaks down, ISO 27001 has 10 clauses, plus an Annex -- Annex A. Annex A holds the core ISO 27001 security controls. The 10 clauses include the body of ISO 27001 mechanics, mostly how to construct the ISMS.

ISO/IEC 27001:2013 has ten short clauses, plus a long annex, which cover:

1. Scope of the standard

2. How the document is referenced

3. Reuse of the terms and definitions in ISO/IEC 27000

4. Organizational context and stakeholders

5. Information security leadership and high-level support for policy

6. Planning an information security management system; risk assessment; risk treatment

7. Supporting an information security management system

8. Making an information security management system operational

9. Reviewing the system's performance

10. Corrective action

Annex A: List of controls and their objectives

Within those 10 Clauses - there is mandatory things that need to be completed:

From Advisera, Dejan Kosutic seems to do a nice job with ISO 27001. Here are the documents you need to produce if you want to be compliant with ISO 27001. Annex A documents are only required if there's a risk that requires their implementation.

Scope of the ISMS (clause 4.3)

Information security policy and objectives (clauses 5.2 and 6.2)

Risk assessment and risk treatment methodology (clause 6.1.2)

Statement of Applicability (clause 6.1.3 d)

Risk treatment plan (clauses 6.1.3 e and 6.2)

Risk assessment report (clause 8.2)

Definition of security roles and responsibilities (clauses A.7.1.2 and A.13.2.4)

Inventory of assets (clause A.8.1.1)

Acceptable use of assets (clause A.8.1.3)

Access control policy (clause A.9.1.1)

Operating procedures for IT management (clause A.12.1.1)

Secure system engineering principles (clause A.14.2.5)

Supplier security policy (clause A.15.1.1)

Incident management procedure (clause A.16.1.5)

Business continuity procedures (clause A.17.1.2)

Statutory, regulatory, and contractual requirements (clause A.18.1.1)

And here are the mandatory records:

Records of training, skills, experience and qualifications (clause 7.2)

Monitoring and measurement results (clause 9.1)

Internal audit program (clause 9.2)

Results of internal audits (clause 9.2)

Results of the management review (clause 9.3)

Episode 3 - What a pain in the GDPR!

Justin Fimlaid — Tue, 09 Oct 2018 08:37:00 -0400

This episode is sponsored by NuHarbor Security.

What is GDPR?

The General Data Protection Regulation was passed in 2016 and went into affect as of May 2018. I saw many organizations scrambling to achieve compliance the months preceding and following this past May. This new regulation Brought some additional changes Beyond the 1995 EU data protection directive. This regulation flipped a lot of organizations on their head, and for some security professionals inherited GDPR compliance obligations.

GDPR specifically focuses on reinforcing individual's rights, strengthening the EU internal market, ensuring stronger enforcement rules, and streamlining international transfers of personal data and setting global data protection standards.

The changes will give people more control over their personal data making it easier to access their information. GDPR is also designed to make sure that people's personal information is protected no matter where it is sent process for stored even outside of the EU As may be the case On the Internet.

This regulation flipped a lot of organization on their head and for some security professionals they inherited GDPR compliance obligations.

I've seen more security leaders pulling the short straw for GDPR responsibilities and are struggling to wade through the legal obligations. So what exactly is the security obligation with GDPR?

How is GDPR different than the 95 EU Data Protection Directive?

First off - what's the changes? It builds on the 95 EU directive. Some background on the directive.

In 1980, in an effort to create a comprehensive data protection system throughout Europe, the Organization for Economic Cooperation and Development (OECD) issued its "Recommendations of the Council Concerning Guidelines Governing the Protection of Privacy and Trans-Border Flows of Personal Data".[2] The seven principles governing the OECD’s recommendations for protection of personal data were:

Notice—data subjects should be given notice when their data is being collected;

Purpose—data should only be used for the purpose stated and not for any other purposes;

Consent—data should not be disclosed without the data subject’s consent;

Security—collected data should be kept secure from any potential abuses;

Disclosure—data subjects should be informed as to who is collecting their data;

Access—data subjects should be allowed to access their data and make corrections to any inaccurate data

Accountability—data subjects should have a method available to them to hold data collectors accountable for not following the above principles.[3]

However - there was no enforcement to the directive.

What's the Difference between Privacy and Security

Data privacy in data security Are 2 very different disciplines What data privacy Primarily focuses on the governance of the data It ensures that an organization is doing what they say there doing with that information. A core privacy Tenant Is that you will only Use the data in a way that you say you're going to use the data The intersection with security Comes when You have lost the data Or data was manipulated Through A security weakness or security breach. At that point you have Use the data in a way that You have not informed the consumer as part of your purpose obligations. In otherwords, because of a security weakness or breach you've done something with the data you didn't disclose such as sharing it with people you didn't intend to and allowed use of the data you didn't receive permission for.

GDPR brings a lot of benefits for consumers including a right to be forgotten. It allows for easier access to one's data And gives a right to data portability. It gives a right to know when one's data has been hacked. In that data protection has been implemented by design and by default.

Security Hasn't Changed

The core Security Tenant HAS NOT changed from the EU directive to GDPR. It only provides more guidance, structure,

Episode 2 - Your MSSP is Dead! Long Live your MSSP!

Justin Fimlaid — Mon, 08 Oct 2018 11:08:00 -0400

MSSP is dead. Long live MSSP! There was once a time when we had to go to an arcade to play video games. However, technologies like the Xbox and PlayStation have made it possible to access those same video games from the comfort of our own home. The managed security service provider industry referred to as an MSSP, is experiencing a similar technology shift today.

I spent some time last week visiting with a large organization in New York City. The question is, how many organizations do you see building their own Security monitoring capability and MSSP? This conversation started on the 17th floor In the conference room And ended up In a Starbucks in midtown on 42nd street. When it’s not raining, we’ve had some great fall temperatures so why not play a little Frogger in New York traffic while chatting MSSP on the way to Starbucks.

What is an MSSP?

Let's start by what we mean by an MSSP. The definition is a Managed Security Service provider.

What's the history of MSSPs?

Roots of an MSSP Originally started By Internet service providers in the late 1990s. Those ISPs would sell customers a firewall appliance and for an additional fee would manage the customer owned firewall over Internet connection. Today in 2018 the idea of an MSSP has become a lot of different things and an MSSP is encompassing of log monitoring, end point monitoring, firewall management…I would go out on a limb to say there's an MSSP offering for almost any major security technology in the market today. There are many different categories of MSSPs including the 5 common ones on site, perimeter management, Managed security monitoring, and penetration testing and vulnerability assessments, and compliance monitoring. For the purposes of the conversation in NY we focused on security monitoring category.

To understand where we are today it would help to understand where we’ve been. In the legacy model, which is still widely used today, a company sends their log files off premise to an MSSP in a blackbox arrangement. By black box I mean once you send you log files you don’t see those files anymore unless you’ve made a copy locally. With the historical technology MSSPs are limited to the types of log files that could be monitored due to the format of the log file. For example common log files such as Cisco and Juniper are very common, are often seen, and subsequently easier to enrich with threat Intel data or advanced correlations. Other less common log file formats can be a little more challenging to correlate or enrich if they have a non standard log format.

So from a legacy MSSPs standpoint it really makes a strong business sense to invest into common log types and only support those log types only. Most often times MSSP's will support a non common log file format but often results in a custom development effort.

Pain points of the legacy MSSP model:

As a former customer of a legacy MSSP I can honestly say one of my more significant pain points of the legacy model was the black box model where that I would forward my logs off premise and never see them again. If I was alerted to an issue and needed to do an investigation I did not have the tools or platforms in order to do a proper investigation and rarely could see the data points, correlations, or threat intel enrichment that validated the security event. The black box model was truly black box.

So where are we today?

In the late 2000 the security industry so rise of new security technologies that allowed organizations are to ingest their own log streams in data sources for the purposes of performing their own in-house security analysis. Over the last 10 years those security technology providers have only improved on that technology making it better faster and easier to perform security investigations in house. These technologies have made it possible to create a white box MSSP in house for any organization. In other words, if an organization wanted to build an in-house MSSP or security ope...

Episode 1 - Origin

Justin Fimlaid — Mon, 08 Oct 2018 02:55:00 -0400

This is the Origin of Pwned. My background includes many different security positions over the years working for a variety of different organizations. I have held a variety different security positions from security auditor, to a security engineer, all the way to being the chief information security officer for a fortune 750 company.

Today I spend a large part of my day talking with security professionals from all over the country in many different industries. Over the years I have talked to folks at hundreds of different companies and a little over 1000 security professionals at those organizations.

In order to be the best advisor to those companies and those security professionals I have become a voracious consumer of content. Some of the most common ways that I consume content is through audio. With the biggest audio collection being podcasts and audiobooks. However, I had almost no Information Security podcasts in my subscription list.

So true to my entrepreneurial form I decided to produce my own weekly information security podcast. The podcast is intended to be short in duration and try to right size the security information that I provide to fit within your busy schedule. Each week I will share questions and conversations that I have with companies and security professionals from all over the country in many different industries. Some questions and comments are related to security framework and best practices, some are related to security technologies available to us today, and some are discussion of general industry challenges.