Shows / CYBR.Signal
Episodes
- CYBR.Signal
Risk and Innovation with Michael Farnum
In this episode of CYBR.Signal, CYBR.SEC.Community CEO Michael Farnum reflects on a recent AI governance panel that challenged his perspective on…
- CYBR.Signal
Recognizing Burnout with Sam Van Ryder
In this episode of CYBR.Signal, CYBR.SEC.Community Co-Founder Sam Van Ryder sits down and has an honest conversation about burnout and recognizing it before it…
- CYBR.Signal
'Energized Cybersecurity Culture' Book Review with Michael Farnum
In this episode of CYBR.Signal, Michael Farnum reviews Bryan Perkola’s ‘Energized Cybersecurity Culture’ and explores its unique approach to building stronger…
- CYBR.Signal
Log Off with Sam Van Ryder
In this episode of CYBR.Signal, CYBR.SEC.Community Co-Founder Sam Van Ryder reflects on the importance of truly stepping away from work in an industry that…
- CYBR.Signal
A Grave Case of Confirmation Bias
In this episode of CYBR.Signal, Michael Farnum uses an unexpected discovery at a construction site in Tomball, Texas, to explore the dangers of confirmation…
- CYBR.Signal
Everything is Everyone's Responsibility
In this episode of CYBR.Signal, legendary CISO Andy Ellis draws inspiration from a visit to New England Patriots training camp to challenge the idea that…
- CYBR.Signal
Diversifying Supply Chains ‘Til the Cows Come Home
In this episode of CYBR.Signal, CYBR.SEC.Community Co-Founder Sam Van Rider reflects on the recent Fairlife cyberattack and what it reveals about the…
- CYBR.Signal
Art vs. Architecture
If your security dashboard looks impressive but fails to provide actionable metrics, it’s artwork - not infrastructure. In this episode of CYBR.Signal…
- CYBR.Signal
Cyber Sunday is now CYBR.Signal
After a 2-year hiatus, Cyber Sunday is back under a new name: CYBR.Signal. What started as quick, off-the-cuff thoughts from CYBR.SEC.Community CEO Michael…
- CYBR.Signal
CISOs and Data Access
CISOs are typically not the owner of their organization's most critical (or even non-critical) assets and data. There are usually business unit leaders…
- CYBR.Signal
EXEC.SEC.CON.
Security conferences and events are often built with a certain audience in mind. Some are for a a general audience, and others are focused on the CISO. But if…
- CYBR.Signal
Practicing Tabletop Exercises
Does practice make perfect? Probably not perfect, but it does make you better. That also applies when performing tabletop exercises. But is it feasible to…
- CYBR.Signal
Cybersecurity Mentorship
In mentorship, it's often thought that the mentor is doing the teaching and the mentee is doing the learning. But mentors should also be open to and seek out…
- CYBR.Signal
RSA Advice
The 2024 RSA Security Conference is here. While I am not going this year, I do want to give a few professional networking pointers for folks who are going…
- CYBR.Signal
Cyclical Attack Methods
Attack vectors and methods tend to by cyclical, meaning attackers will come back to see if old tricks will yield new results. I talk about one such attack…
- CYBR.Signal
SIEM Trends
SIEM (Security Incident and Event Management) has been a round a long time. But there are some recent trends and new vendors that are creating fresh ways to…
- CYBR.Signal
Cybersecurity Trends
How can you tell if a new #cybersecurity concept (think Zero Trust) in cybersecurity is a just a flash in the pan or a valuable idea that can be utilized in…
- CYBR.Signal
New Tools and Tech
There is a lot of fear of the security implications about AI and other new and/or improved technologies. And while some fear is healthy, we also can't let it…
- CYBR.Signal
Configuration Management
Michael talked about security control monitoring a few weeks ago. In this #CyberSunday, he is digging in a bit around an essential part of control monitoring…
- CYBR.Signal
Cyber Jobs
There is a lot of talk and advice on social media, blogs, etc. about the Cybersecurity job market. There's no doubt it's a tough market right now, but does…
- CYBR.Signal
Communication vs. Technology
An X/Twitter thread about technology vs communication in #cybersecurity inspired today's video. Which one do you think is more important or more difficult?…
- CYBR.Signal
Control Monitoring
Today's #CyberSunday is about monitoring controls regularly (as opposed to a point-in-time assessment). Michael gets into some methods of monitoring and what…
- CYBR.Signal
AT&T Outage
Many of us were affected by the cell carrier outage last week. Some initial explanations have come out, but are those explanations plausible? And is a…
- CYBR.Signal
FUD and Cyber
Indecision and apathy from alert fatigue are big issues in #cybersecurity. But have you thought about how FUD marketing can cause some of the same problems?…
- CYBR.Signal
The Big Game!
It's #cybersunday, and it's also time for the Big Game (can't use the real name because reasons). Michael is a big American Football fan, so he's getting into…
- CYBR.Signal
Coverage Analogy
Michael is in the snow in Michigan to record today's Cyber Sunday. The cold weather and road conditions inspire a cybersecurity analogy around making decisions…
- CYBR.Signal
Risk Wrap Up
Michael is wrapping up his Risk Management/Assessment series on today's #CyberSunday. His two points today are around risk assessment frameworks and a caution…
- CYBR.Signal
Risk Avoidance vs. Risk Mitigation
Michael tells a story from his professional past explaining some of the differences between Risk Mitigation and Risk Avoidance. The scenario on today's…
- CYBR.Signal
Last #CyberSunday of 2023!
2024 is almost here, and that means a special end-of-year CyberSunday to close out the year. Today, Michael is talking about three topics that warrant special…
- CYBR.Signal
Risk Communication
It is crucial to know what role the CISO/security leader plays when it comes to risk. In today's #CyberSunday Michael talks about working with asset…
- CYBR.Signal
Showing Value in Risk
Risk assessments have inherent value for the business if done correctly. But there can also be explicit value for the business in performing a risk assessment…
- CYBR.Signal
Risk Prioritization
Before you can figure out what risks to accept, you have to prioritize the risk. Before you can prioritize risk, you have to get visibility in your environment…
- CYBR.Signal
Fees for Cybersecurity Speaking Engagements
A CISO recently shared a LinkedIn post regarding speaking engagements. In this post he advised security leaders to ONLY accept paid engagements as their time…
- CYBR.Signal
Reviewing Accepted Risk
Reviewing accepted risks is a crucial part of a risk management program. In today's #cybersunday, Michael talks about some important best practices like…
- CYBR.Signal
Recent Social Engineering Attacks
Some recent notable #cybersecurity breaches have come from #socialengineering attacks. Humans are always going to fall for this, but we can help lessen the…
- CYBR.Signal
MDR is Not a Service
If you're looking for an MDR (Managed Detection and Response) vendor, the temptation is to think of them as a product company versus a services company. On…
- CYBR.Signal
Barracuda ESG Flaw Thoughts
The Barracuda ESG Vulnerability is still causing havoc, with the vendor telling their customers to replace the box. In this CyberSunday, Michael discusses some…
- CYBR.Signal
Is GRC Technical?
There are a few paths to getting into cybersecurity, and not all of them are considered “technical”. But what does that mean? In this #CyberSunday, Michael…
- CYBR.Signal
Security Champions: Secret Weapon Against Shadow IT
How do you work towards a solution for a problem like Shadow IT with people when everyone wants to try to throw tech at it? On today's #CyberSunday, I talk…
- CYBR.Signal
Shadow Security in a World of Shadow IT
We all know about Shadow IT, and we know it is a big issue (bigger these days with the ease of workload deployment in the cloud). But are we also aware that…
- CYBR.Signal
Wrong, Too Much, or Irrelevant Info: Know Your CyberSecurity Audience
Knowing your audience when you're giving information about your #cybersecurity program, efforts, etc. is extremely important. Are they technical? Are they even…
- CYBR.Signal
The Importance of OpSec: Keep it Secret, Keep it Safe!
Operational/Operations Security is the practice of making sure sensitive data/information about your operations doesn't leak out. in today's #CyberSunday, I…
- CYBR.Signal
A Couple of Post-Breach Lessons
A friend of mine recently experienced a #breach in his organization. There were two lessons that stood out to me as he was going through the post-mortem, and…
- CYBR.Signal
Sweating the Small Cyber Things
It's flooding a bit in Houston, and that made me... of course... think of #cybersecurity. On today's #CyberSunday, I am talking about making sure you pay…
- CYBR.Signal
Password Managers and Credential Stuffing: Not a Good Combo
Credential stuffing is an often-used attack. But for the love of all that is holy, your master password in your password manager should not be susceptible to…
- CYBR.Signal
CI/CD OWASP Top 10: What does it mean for you?
The CI/CD OWASP Top 10 came out last month (not sure how I missed that!). What does that mean? Well, that depends on what you're responsible for in the CI/CD…
- CYBR.Signal
Holidays: Using This Time to Measure Managed Security Effectiveness
The holidays should be a time to celebrate food, friends, and family (and football). Maybe this is also a good time to measure the effectiveness of your…
- CYBR.Signal
Setting Cybersecurity Priorities: Perspective Makes a Difference
How you set priorities around building a #cybersecurity program differs based on your perspective. On today's #cybersunday, I talk about how the perspective of…
- CYBR.Signal
Asset Management and Vulnerability Management: Pair Them or Not?
I was quoted in an article last week about the latest CISA directive on #assetmanagement and #vulnerabilitymanagement (link below). I was the cynical voice in…
- CYBR.Signal
Lift and Shift: Not Always Bad
In today's #CyberSunday, I go a little outside the normal #cybersecurity discussion and talk about how #liftandshift isn't always negative when it comes to…
- CYBR.Signal
Securing Digital Transformation: An Old Problem with Modern Concerns
Securing the digital transformation is not a new problem. It is actually an old problem with modern concerns. A lot of people are talking about how concerned…
- CYBR.Signal
IT and Cybersecurity: the Importance of Knowledge and Empathy
Dr. Gerald Auger and I gave a talk last week at the Houston Technology Summit titled "Building Cooperation and Understanding Between Security and IT". We…
- CYBR.Signal
Regulations vs Standards: a.k.a Necessity vs Fundamental
Is regulatory compliance fundamental to your #cybersecurity program? In this #CyberSunday, I compare regulations against standards and talk about which one…
- CYBR.Signal
Cybersecurity Products: Innovation vs Need vs Practicality
There have a been a few times in the history of #cybersecurity product development when a new solution has been truly innovative. But what is extremely rare is…
- CYBR.Signal
Discussions from BlackHat: People and Assets
There were two big themes from discussions with our customers at #BlackHat. One is a commonly discussed problem these days (lack of people). The other takes us…
- CYBR.Signal
Cybersecurity Conferences: Local vs National and Talks vs Vendors
I'm headed out to Vegas tomorrow for the #BlackHat #cybersecurity conference, and it made me think about a couple of questions that have been on my mind for a…
- CYBR.Signal
Low Code No Code Dev Tools
Low-Code/No-Code dev tools are fueling the rise of the "Citizen Developer", but there are real security implications around the tools that enable the…
- CYBR.Signal
Vendor Feature Business Alignment
While feature comparisons are important when choosing a #cybersecurity product, what do you do when two products are essentially the same? On this…
- CYBR.Signal
SASE vs SSE
On this #CyberSunday, I'm talking about how #SASE (Secure Access Service Edge) and #SSE (Security Service Edge) are not exactly the same. You need to know what…
- CYBR.Signal
Threat Intel - Choose Wisely!
On this #cybersunday, I am talking about #threatintel. Specifically, I am talking about how you need to know your use case when you're asking about threat…