The Cyber Rants Podcast

It's a wild market for cybersecurity services, often confusing buyers and selling companies less than ideal solutions. The question is, between MSSP, vCISO, and cybersecurity program development, what is the best fit for your organization's needs? This week, the guys discuss the pros and cons of the common services to help you understand the best fit. From Managed Security Services Providers (MSSP) and Virtual Chief Information Security Officers (vCISO), to remote security teams and tailored Cybersecurity Program Development solutions, this episode covers the critical considerations for selecting the right cybersecurity service partner.

It is important to know what you're getting into when you invest in services from a cybersecurity provider to help with security and compliance! There are critical considerations and points you must know in order to get the most from your cybersecurity firm and their services.

This week, the guys discuss how to properly engage your cybersecurity provider to make sure your initiatives are met. They also share insights about what a cybersecurity firm cannot do for you, plus how much time you or your team should expect to spend.

What do you think of when you hear "Red Team vs. Blue Team"? Board or video games, military exercises, or cybersecurity terms? This week the guys discuss Red Teaming as it relates to cybersecurity and penetration tests, when Red Team Cybersecurity Testing is an appropriate method and when other colors are better, plus the critical considerations you need to think through before engaging a cybersecurity firm to perform a Red Team Penetration Test.

The transition to a remote workforce has left many companies wondering how they'll achieve compliance with various requirements like CMMC, ISO 27001, and SOC 2. Meanwhile, remote workers have made it easier than ever for cyber criminals to attack. This week, the guys discuss cybersecurity for remote workers and meeting all compliance requirements, sharing principles that work across companies of all sizes.

This week, the guys discuss some of the bigger cybersecurity struggles for mid-market and emerging companies. Developing an effective cybersecurity incident response plan is a major challenge and when done incorrectly, can cause a lot of damage. The guys also share struggles SaaS companies face when they're inundated with cybersecurity questionnaires that are holding up the sales process.

Cyber insurance is a critical part of any risk management program and something that every company must have. Finding the right policy with the proper coverage can be tricky and the major insurance companies are not always the best fit. This week the guys talk with cyber insurance expert, Tony Robbins, about the fundamentals you must know to properly protect your organization. They cover how to identify a good insurer, what questions to ask when getting your policy, and how cyber insurance must correspond with your incident response plan. 

If your organization is growing and is getting ready to build its own InfoSec team, this week's episode is for you. The guys discuss the "Who's Who" of cybersecurity, explaining the cybersecurity job titles and key players that growing organizations need when maturing their cybersecurity programs. From Chief Information Security Officers to Architects, Engineers, and Project Managers, the guys share who's who in each position, plus the required skill sets, responsibilities, and proper staffing models.

Is being compliant the same as being secure? If you're meeting all the requirements, are you adequately protected? This week, the guys discuss the differences, nuances and overlaps between cybersecurity and compliance, plus how you can simplify alignment to multiple compliance requirements.  

Are your executives and board members struggling to understand cyber risk?  This week, the guys are joined by David Moon of Arx Nimbus, a company that turns cyber risk into the language that all business leaders understand. David shares how they translate cybersecurity into financial metrics that allow organizations to make better risk management decisions. The guys discuss how companies can create tremendous clarity around cyber risk, resulting in better support and resource allocation.