CvCISO Podcast

Summary In this episode, the hosts discuss various topics related to information security, including the recent controversy surrounding the CISA chief, the importance of leadership in security, and the launch of a new training course aimed at improving risk assessment skills. They emphasize the need for accountability in government and the significance of effective risk management in the security industry. The conversation also highlights the mission behind their new course and the importance of creating a supportive learning environment for aspiring security professionals. Takeaways The transition to a new job can be a significant growth opportunity. Leadership in security requires accountability and transparency. Understanding the context of decisions is crucial in security management. Information security fundamentally revolves around risk management. Creating a safe learning environment fosters better education. The new Certified Security Studio Risk Assessor course aims to standardize risk assessments. Effective risk assessments are foundational to a successful security program. Good leaders prioritize the mission over personal ego. Wisdom in leadership can be gained through experience and mentorship. The security industry needs to focus on fixing its broken aspects.Chapters 00:00 Introduction and Program Updates 02:42 Transitioning Careers and Personal Growth 04:57 CISA Chief's Controversial Actions 09:53 Leadership Accountability and Transparency 14:37 Implications of Data Exposure and Security Risks 19:18 The Role of Ego in Leadership 21:53 Leadership and Accountability 25:40 Introduction to the New Course 27:52 The Mission Behind the Course 31:32 Addressing Industry Gaps 35:57 The Importance of Objective Assessments 41:20 Creating a Safe Learning Environment

Summary In this episode of the CBC So podcast, host Andy welcomes a diverse panel including Evan Francen, Dave Tuckman, and Walter Anderson, who share their insights on cybersecurity and personal experiences. The conversation begins with a light-hearted introduction, where the hosts joke about their roles and backgrounds. Walter Anderson, the founder and CEO of PortSecure Cybersecurity, shares his journey from a curious child dismantling toys to a seasoned professional in the cybersecurity field. He recounts his early experiences with computers, his university hacking escapades, and how these shaped his career path. The discussion then shifts to the importance of mentorship and community in cybersecurity, emphasizing the need for sharing knowledge and supporting the next generation of professionals in the field. As the conversation progresses, Walter shares anecdotes from his travels, including his time in New Zealand and his unique experiences with locals. The hosts delve into the significance of building relationships in business, particularly in cybersecurity, where trust is paramount. Walter discusses his transition into the VCISO role and the challenges he faced, highlighting the importance of continuous learning and adaptation in a rapidly evolving industry. The episode wraps up with reflections on the value of personal stories and the impact they can have on others, encouraging listeners to embrace their unique journeys and contribute positively to their communities. Keywords cybersecurity, VCISO, mentorship, PortSecure, community, personal stories, risk management, technology, podcast Takeaways Curiosity drives innovation and learning. Building relationships is key in cybersecurity. Sharing knowledge can empower the next generation. Trust is essential in cybersecurity roles. Personal experiences shape professional journeys.

Summary In this episode, the hosts discuss various aspects of cybersecurity, focusing on the evolution of Secure Shield, the role of Managed Service Providers (MSPs), and the importance of risk management. They explore the challenges of insider threats, differences in cybersecurity standards between Canada and the US, and significant cybersecurity incidents from 2025. The conversation also touches on the impact of AI on cybersecurity and predictions for the future, emphasizing the need for education and awareness in the field. Takeaways The CBCSO program offers valuable education opportunities for professionals. Secure Shield has evolved from an MSP to a cybersecurity consultancy. Understanding risk management is crucial for client relationships. MSPs must be held accountable for their services and client security. Insider threats pose significant risks to organizations. There are notable differences in cybersecurity standards between Canada and the US. Cybersecurity incidents in 2025 highlight the need for vigilance. AI is changing the landscape of cybersecurity threats. Organizations must prepare for potential insider threats and their implications. The future of cybersecurity will require enhanced detection and risk management strategies.

Summary This podcast episode discusses essential cybersecurity tips for the holiday season, emphasizing the importance of situational awareness, identifying scams, and protecting personal information. The hosts share insights on how to navigate online shopping safely, the risks associated with social media sharing, and the significance of educating family members about cybersecurity. They also highlight the need for trust and verification in all communications, especially during the holiday season when scams are prevalent. Takeaways Situational awareness is crucial during the holiday season. Don't rush your online purchases; take your time. Be cautious of fake shipping notices and charities. Generosity should be exercised through trusted channels only. Avoid sharing too much personal information on social media. Protect your home by being mindful of what you share online. Be vigilant with ATMs and card readers to avoid skimmers. Use the five-second test to evaluate online shopping sites. Educate family members, especially older relatives, about cybersecurity. Trust should be built slowly and verified always.

SummaryIn this episode of CBC So Podcast, the hosts discuss various aspects of cybersecurity, particularly focusing on the upcoming holiday season and the associated risks. They introduce their guests, including Dan Ovick, who shares his journey in cybersecurity and the importance of community networking. The conversation shifts to holiday cybersecurity awareness, discussing the increase in scams and cyber threats during this time. The hosts emphasize the need for best practices in online safety, incident response planning, and the importance of educating youth about social media and cybersecurity. They conclude with final thoughts and advice for listeners to stay safe during the holiday season. TakeawaysThe CBCSO program offers valuable opportunities for skill development.Networking within the cybersecurity community is crucial for growth.Holiday shopping increases the risk of cyber threats and scams.Retailers must ensure their systems are secure during peak shopping times.Consumers should verify any suspicious messages by logging into official websites.Incident response planning is essential for personal and family safety.Social media can pose risks for youth; education is key.Families should discuss cybersecurity awareness regularly.Scammers often exploit the holiday season for financial gain.Using public Wi-Fi for transactions is highly discouraged.

Summary In this episode of the CVC So Podcast, host Andy welcomes a diverse group of cybersecurity professionals, including Joe Moldenhauer, who shares her inspiring journey from the casino industry to becoming a cybersecurity analyst. The conversation emphasizes the importance of community, support, and purpose in the cybersecurity field, as well as the value of learning from experiences and the need for diverse perspectives. The guests discuss overcoming challenges, the significance of self-discipline, and the role of purpose in career development, ultimately encouraging listeners to pursue their passions and make a positive impact in the industry. takeawaysFridays are a highlight for me.You can do it better than me.You have to find what your purpose is.You can't let the world tell you what your purpose is.You have to go through the scars.You need more women in this industry.You can learn things you never thought you could learn.You have to have self-discipline.You need to focus on the mission.You can do it too!

Takeaways Incident response plans are essential for effective cybersecurity management. Situational awareness is crucial for identifying potential threats. Communication during an incident is key to effective management. Training new employees quickly can reduce vulnerabilities. Creating a positive culture around cybersecurity encourages reporting of incidents. Personal incident response plans can help individuals prepare for potential threats. Lessons learned from incidents can improve future responses. Defining roles in incident response can streamline communication and actions. Understanding the adversary's tactics can enhance preparedness. Not every incident needs to be a disaster; proactive planning can lead to positive outcomes. Summary In this episode, the hosts discuss the importance of incident response in cybersecurity, sharing insights from a recent incident experienced by one of the guests. They emphasize the need for situational awareness, effective communication, and a positive culture around cybersecurity. The conversation highlights the lessons learned from the incident, the role of training and awareness, and the significance of personal incident response plans. The episode concludes with reflections on the importance of proactive planning and the need to celebrate successes in cybersecurity.

Summary In this episode, the hosts discuss the anxiety that VCSOs face in their roles, exploring coping mechanisms, the importance of transparency, and how to handle mistakes. They delve into the phenomenon of the Sunday blues, share personal experiences, and emphasize the value of community support and learning from scenarios. The conversation highlights the need for self-awareness and the significance of building confidence through experience in managing anxiety effectively. Takeaways Anxiety is a common experience for VCSOs.Coping mechanisms can include open communication and self-care.The Sunday blues can affect many professionals, not just VCSOs.Transparency in communication can reduce anxiety in the workplace.Handling mistakes openly can build trust and credibility.Scenario-based learning helps prepare for anxiety-inducing situations.Incident response can be a significant source of anxiety.Experience can help reduce anxiety in high-pressure situations.Self-awareness is crucial for managing stress and anxiety.Community support is vital for VCSOs facing challenges.

Summary In this episode, the hosts engage in a lively discussion with guest Jumpin Slick Nick about the importance of building relationships in the cybersecurity field. They explore the challenges of networking, overcoming imposter syndrome, and the role of vulnerability in professional growth. The conversation emphasizes the significance of effective communication, kindness, and genuine interest in fostering connections. The hosts share personal experiences and insights, highlighting that building trust and credibility is essential for success in any professional environment. TakeawaysBuilding relationships is crucial for success in cybersecurity.Trust, credibility, and likability are key components of relationships.Imposter syndrome can hinder professional growth and networking.Vulnerability can lead to better communication and understanding.Being kind and genuine can significantly impact relationship building.It's important to be your own advocate in your career. Effective communication involves meeting people where they are. Networking should feel natural, not forced. Self-reflection is essential for personal and professional development.You can impact others positively without realizing it.

Summary In this episode, the hosts discuss the Salt Typhoon hacking group, their recent attacks on US companies, and the broader implications of cybersecurity threats. They explore the reasons behind the naming of hacker groups, the importance of risk management, and the need for situational awareness in organizations. The conversation delves into the role of the Chinese government in cyber attacks, the techniques used by hackers, and notable breaches that have occurred. The episode emphasizes the need for better cybersecurity practices and the potential consequences of neglecting fundamental security measures. In this conversation, the speakers delve into the complexities of cybersecurity, focusing on the challenges of incident response, the long-term strategies employed by adversaries like China, and the implications for national security. They discuss the economic costs of remediation, the accountability of CISOs, and the importance of collaboration in the industry. The conversation emphasizes the need for mission-driven security practices and effective regulatory responses to cyber threats, while also outlining essential defensive strategies for organizations. Takeaways The Salt Typhoon group has been active for years, targeting major US companies. Risk management is more important than risk elimination in cybersecurity. Many organizations fail to address their most significant risks despite having large security budgets. Situational awareness is crucial for effective cybersecurity. Chinese government involvement in cyber attacks is a significant concern. Basic cybersecurity practices like patch management are often overlooked. Salt Typhoon has targeted critical infrastructure and telecommunications. The impact of cyber attacks extends beyond immediate breaches. Organizations often treat breaches as a cost of doing business. Understanding the threat landscape is essential for effective defense strategies. Incident response has been haphazard and often driven by self-preservation. China's cyber strategy is long-term, contrasting with the short-term focus of many organizations. National security is at risk due to significant data breaches. Economic costs of cybersecurity failures can be substantial and long-lasting. CISOs often lack the necessary training and accountability for their roles. Collaboration among cybersecurity professionals is essential for effective defense. Mission-driven approaches can lead to better security outcomes and financial success. Compliance certifications often create a false sense of security. Effective patch management and network segmentation are critical defensive strategies. Egress filtering can prevent many attacks by blocking command and control communications.

In this episode, the hosts discuss the recent cybersecurity attack on St. Paul, Minnesota, exploring the nature of the attack, the implications for city services, and the importance of effective communication and incident response planning. They emphasize the need for transparency and accountability in handling such incidents, as well as the role of cyber insurance in mitigating risks. The conversation highlights the frustrations surrounding the lack of information and preparedness in the face of cyber threats. In this conversation, the speakers discuss the critical aspects of incident response in cybersecurity, emphasizing the importance of controlling the narrative, maintaining effective communication, and engaging external teams for complex threats. They evaluate the effectiveness of the incident response and highlight the need for transparency and accountability in public communication during crises.The St. Paul cybersecurity attack was a deliberate and coordinated digital attack. Effective communication is crucial during a cybersecurity incident. Transparency in sharing information can help build trust with the public. Incident response plans are essential for managing cyber threats effectively. Cyber insurance does not replace the need for a solid incident response plan. Public organizations must prioritize the safety and security of their citizens. The lack of transparency can lead to speculation and mistrust. Risk management is more important than risk elimination in cybersecurity. Preparedness can save time, money, and resources during a cyber incident. Accountability is key in ensuring that public servants fulfill their responsibilities. You have a window of opportunity to control the narrative in an incident response. Timelines and investigations are crucial for understanding incidents. Engaging external teams can be necessary for complex cyber threats. Public communication is essential during a crisis to maintain trust. Data security concerns should prioritize protecting people over data. The effectiveness of incident response can be critically evaluated. Leadership decisions impact the effectiveness of incident response. Public perception can be manipulated through strategic communication. Cybersecurity incidents are often more common than perceived. Transparency in communication is vital for community trust.

SummaryIn this episode of the CvcISO So Podcast, hosts Evan Francen, Dave, and Jordon explore the humorous side of cybersecurity by identifying various red flags in VC engagements. The conversation is filled with laughter as they share funny anecdotes and insights about what to look out for in cybersecurity practices, emphasizing the importance of awareness and vigilance in the field. The hosts also touch on legal and ethical concerns, making the discussion both entertaining and informative. In this engaging conversation, the speakers explore the intersection of humor and seriousness in cybersecurity, discussing various red flags that can indicate poor practices in both personal relationships and professional environments. They emphasize the importance of communication, planning, and integrity in navigating these challenges, while also sharing lighthearted anecdotes and insights into the cybersecurity landscape.TakeawaysRed flags in cybersecurity can often be humorous yet insightful.Understanding the implications of cybersecurity practices is crucial.The importance of prioritizing cybersecurity in budget discussions.Humor can be an effective tool in discussing serious topics.Misconceptions about cybersecurity can lead to significant risks.Legal and ethical considerations are vital in cybersecurity engagements.Awareness of red flags can help prevent potential issues.Engaging discussions can lead to better understanding of cybersecurity.The role of humor in making cybersecurity relatable.Cybersecurity practices should be taken seriously, even when discussed lightheartedly. If their love language is sending you a 47 page NIST compliant PDF.You may be in the presence of a red flag if the security team has more turnover than the help desk.If their idea of incident response is emailing the entire C-suite, whoops, we're hacked with the shrug emoji.If their business continuity plan is to post, we're looking into it on Twitter, that might be a red flag.If the last time your anti-virus was updated, Blockbuster was still open, that's a concern.If their quarterly risk assessment is a whiteboard with hackers equals bad in red marker, that's a red flag.If your sock gets alerts but calls them suggestions, that's a problem.If your Amazon S3 bucket is more open than a 24 hour diner, that's a security issue.If your CISO's penetration test is asking the intern to guess the CEO's password, that's a major red flag.Apathy in leadership can lead to significant risks in cybersecurity.