Dive into the latest PCI news in our July PCI Update. This episode covers key PCI developments, an in-depth exploration of Requirement 4, and a helpful QSA Q&amp;A. We kick off this episode by previewing the upcoming PCI Community Meeting in Portland and discuss our hosts' presentation on "Generative AI: Your New Secret Weapon or an Insider Threat?" We also talk about the INFI worksheet and the importance of Continuous Compliance. In the Requirement 4 segment, we focus on strong cryptography, robust security protocols, and the need to secure PAN during transmission over public networks. We highlight industry best practices for wireless networks transmitting PAN and the necessity to secure PAN when using end-user messaging technologies. A QSA Q&amp;A session wraps up our episode and tackles the issue of responsibility for PCI compliance when using third-party payment services. Whether you're an industry veteran or new to PCI, this episode offers a concise, informative roundup of the month's most significant PCI topics.

Dive into the latest PCI news in our July PCI Update. This episode covers key PCI developments, an in-depth exploration of Requirement 4, and a helpful QSA Q&amp;A. We kick off this episode by previewing the upcoming PCI Community Meeting in Portland and discuss our hosts' presentation on "Generative AI: Your New Secret Weapon or an Insider Threat?" We also talk about the INFI worksheet and the importance of Continuous Compliance. In the Requirement 4 segment, we focus on strong cryptography, robust security protocols, and the need to secure PAN during transmission over public networks. We highlight industry best practices for wireless networks transmitting PAN and the necessity to secure PAN when using end-user messaging technologies. A QSA Q&amp;A session wraps up our episode and tackles the issue of responsibility for PCI compliance when using third-party payment services. Whether you're an industry veteran or new to PCI, this episode offers a concise, informative roundup of the month's most significant PCI topics.

PCI Monthly Update: July Insights & Innovations

Do you know the average payout organizations are hit with for every attack? William Parks and Bill Dean discuss a service dedicated to helping your organization (big or small) withstand a ransomware attack. Bill and his team are ready to help you and your organization obtain peace of mind when it comes to these advanced threats.  Questions for Bill? Find him here: bill.dean@lbmc.com

Do you know the average payout organizations are hit with for every attack? William Parks and Bill Dean discuss a service dedicated to helping your organization (big or small) withstand a ransomware attack. Bill and his team are ready to help you and your organization obtain peace of mind when it comes to these advanced threats.  Questions for Bill? Find him here: <a href="mailto:bill.dean@lbmc.com">bill.dean@lbmc.com</a>

Worried about Ransomware?

LBMC Shareholder Bill Dean and William Parks spend today’s episode discussing Advance Guard, a new service offering from LBMC's Security Technical Team. Learn how Advance Guard may help protect your organization's most valuable assets, save time on compliance audits, and give peace of mind about your current security stance.  Want to see Bill’s “Prescription”? Check out the link below: https://www.lbmc.com/wp-content/uploads/2023/01/AdvanceGuard-Sample-Schedule.pdf Questions for Bill? Find him here: bill.dean@lbmc.com

LBMC Shareholder Bill Dean and William Parks spend today’s episode discussing Advance Guard, a new service offering from LBMC's Security Technical Team. Learn how Advance Guard may help protect your organization's most valuable assets, save time on compliance audits, and give peace of mind about your current security stance.  Want to see Bill’s “Prescription”? Check out the link below: <a href="https://www.lbmc.com/wp-content/uploads/2023/01/AdvanceGuard-Sample-Schedule.pdf" rel="noopener nofollow" target="_blank">https://www.lbmc.com/wp-content/uploads/2023/01/AdvanceGuard-Sample-Schedule.pdf</a> Questions for Bill? Find him here: <a href="mailto:bill.dean@lbmc.com">bill.dean@lbmc.com</a>

Advance Guard Could Save You

 Stay up to date with the latest in PCI compliance. In this episode, William Parks, Andy Kerr, and Kyle Hinterberg discuss the latest in PCI news, new restrictions around PAN data, and how to master Requirement 3 while preparing for PCI 4.0. Don't miss our upcoming webinar: "How to Reduce Your PCI Scope: Tips &amp; Technology Your Organization Needs to Know" on Thursday, April 13 at 11am CT.  Register Now!   For any questions, feel free to reach out to us here:   Kyle Hinterberg: kyle.hinterberg@lbmc.com  Andy Kerr: andy.kerr@lbmc.com William Parks: william.parks@lbmc.com

Stay up to date with the latest in PCI compliance. In this episode, William Parks, Andy Kerr, and Kyle Hinterberg discuss the latest in PCI news, new restrictions around PAN data, and how to master Requirement 3 while preparing for PCI 4.0. Don't miss our upcoming webinar: "How to Reduce Your PCI Scope: Tips &amp; Technology Your Organization Needs to Know" on Thursday, April 13 at 11am CT. <a href="https://lbmc.zoom.us/webinar/register/5016800089192/WN_usKlIzvnTnWy_LHpZkiO_A" rel="nofollow" target="_blank"> Register Now!</a> For any questions, feel free to reach out to us here: Kyle Hinterberg: <a href="mailto:kyle.hinterberg@lbmc.com">kyle.hinterberg@lbmc.com</a> Andy Kerr: <a href="mailto:andy.kerr@lbmc.com">andy.kerr@lbmc.com</a> William Parks: <a href="mailto:william.parks@lbmc.com">william.parks@lbmc.com</a>

PCI Monthly Update: March News & Requirement 3

ChatGPT is making headlines worldwide and its impact is making a lot of business owners uncomfortable. What is ChatGPT? How will this tool change how you do business? Is ChatGPT a security risk? What to expect from ChatGPT4? William Parks interviews LBMC's Data Insights team members to discuss this controversial topic, dive into facts your organization needs to know, and explore probable scenarios that could happen with this level of Artificial Intelligence. Want more insights? Contact LBMC's Data Insights team: Jon Hilton, Shareholder (jon.hilton@lbmc.com) Will Son, Senior Manager (will.son@lbmc.com)

ChatGPT is making headlines worldwide and its impact is making a lot of business owners uncomfortable. What is ChatGPT? How will this tool change how you do business? Is ChatGPT a security risk? What to expect from ChatGPT4? William Parks interviews <a href="https://www.lbmc.com/services/advisory/data-insights/" rel="noopener nofollow" target="_blank">LBMC's Data Insights</a> team members to discuss this controversial topic, dive into facts your organization needs to know, and explore probable scenarios that could happen with this level of Artificial Intelligence. Want more insights? Contact LBMC's Data Insights team: Jon Hilton, Shareholder (<a href="mailto:jon.hilton@lbmc.com">jon.hilton@lbmc.com</a>) Will Son, Senior Manager (<a href="mailto:will.son@lbmc.com">will.son@lbmc.com</a>)

ChatGPT: What You Need to Know

William Parks takes this podcast to introduce a key member of LBMC Information Security’s Technical Services team, Daniel Nguyen. Daniel is a manager on the team with quite the insightful background. William and Daniel spend time discussing current steps to keep your organization successful in their journey to a healthier security posture. Questions for Daniel? Find him here: daniel.nguyen@lbmc.com

William Parks takes this podcast to introduce a key member of LBMC Information Security’s Technical Services team, Daniel Nguyen. Daniel is a manager on the team with quite the insightful background. William and Daniel spend time discussing current steps to keep your organization successful in their journey to a healthier security posture. Questions for Daniel? Find him here: <a href="mailto:daniel.nguyen@lbmc.com">daniel.nguyen@lbmc.com</a>

Interviewing a Real Hacker

Stay up to date with the latest in PCI compliance. In this episode, William Parks, Andy Kerr, and Kyle Hinterberg discuss the latest in PCI news and how to master Requirement 1 while preparing for PCI 4.0. For any questions, feel free to reach out to us here: Kyle Hinterberg: kyle.hinterberg@lbmc.com Andy Kerr: andy.kerr@lbmc.com William Parks: william.parks@lbmc.com

Stay up to date with the latest in PCI compliance. In this episode, William Parks, Andy Kerr, and Kyle Hinterberg discuss the latest in PCI news and how to master Requirement 1 while preparing for PCI 4.0. For any questions, feel free to reach out to us here: Kyle Hinterberg: <a href="mailto:kyle.hinterberg@lbmc.com">kyle.hinterberg@lbmc.com</a> Andy Kerr: <a href="mailto:andy.kerr@lbmc.com">andy.kerr@lbmc.com</a> William Parks: <a href="mailto:william.parks@lbmc.com">william.parks@lbmc.com</a>

PCI Monthly Update: January News & Requirement 1

William Parks, Andy Kerr, and Kyle Hinterberg discuss the latest PCI news, share how to create and what should be covered in an executive summary for a PCI assessment, and answer a few questions from our listeners. If you’d like us to answer and address questions on our next episode, reach out to us here: Andy Kerr – andy.kerr@lbmc.com Kyle Hinterberg – kyle.hinterberg@lbmc.com William Parks – William.parks@lbmc.com

William Parks, Andy Kerr, and Kyle Hinterberg discuss the latest PCI news, share how to create and what should be covered in an executive summary for a PCI assessment, and answer a few questions from our listeners. If you’d like us to answer and address questions on our next episode, reach out to us here: Andy Kerr – <a href="mailto:andy.kerr@lbmc.com">andy.kerr@lbmc.com</a> Kyle Hinterberg – <a href="mailto:kyle.hinterberg@lbmc.com">kyle.hinterberg@lbmc.com</a> William Parks – <a href="mailto:William.parks@lbmc.com">William.parks@lbmc.com</a>

PCI Monthly Update: December News & FAQs

In this podcast, Host William Parks discusses with LBMC Information Security Senior Managers Andy Kerr and Kyle Hinterberg some of the top takeaways at this year’s PCI SSC Community Meeting. Topics discussed during this episode include changes to the “In-Place with Remediation” reporting option which was added in PCI DSS v4.0, what to do if you miss an ASV Scan, new ways to interact with the PCI Council, SAQ updates, and much more!

In this podcast, Host William Parks discusses with LBMC Information Security Senior Managers Andy Kerr and Kyle Hinterberg some of the top takeaways at this year’s PCI SSC Community Meeting. Topics discussed during this episode include changes to the “In-Place with Remediation” reporting option which was added in PCI DSS v4.0, what to do if you miss an ASV Scan, new ways to interact with the PCI Council, SAQ updates, and much more!

PCI SSC Community Meeting Top Takeaways

The Internet provides access to lots of good data, useful websites, social media options, and entertainment, but unfortunately, it also poses some risks to the security and privacy of individuals. In this episode, William Parks and Mark Burnette will share some practical tips for how you can keep yourself and your family safe and secure online. You will learn how to keep your kids safe on social media, how to avoid having to remember hundreds of online passwords (and how to avoid having them hacked), and how to protect your privacy while surfing the Internet. Episode Bonus: LBMC's free interactive resource, "Keeping Your Digital Identity Secure." Download Now!

The Internet provides access to lots of good data, useful websites, social media options, and entertainment, but unfortunately, it also poses some risks to the security and privacy of individuals. In this episode, William Parks and Mark Burnette will share some practical tips for how you can keep yourself and your family safe and secure online. You will learn how to keep your kids safe on social media, how to avoid having to remember hundreds of online passwords (and how to avoid having them hacked), and how to protect your privacy while surfing the Internet. Episode Bonus: LBMC's free interactive resource, "Keeping Your Digital Identity Secure." <a href="https://www.lbmc.com/blog/digital-identity/" rel="noopener nofollow" target="_blank">Download Now!</a>

Keeping Your Digital Identity Secure with Mark Burnette

CyberSecurity Sense is LBMC Information Security's podcast that provides insight and updates on such information security topics as: IPS Monitoring and Managed IDS Services, Security Information Event Management, Digital Forensic Analysis, Electronic Discovery and Litigation Support, Computer Security Incident Response, Penetration Testing, Risk Assessments, Security Program Planning, Web Application Security Assessments, ACAB LADMF Certification Assessments, CMS Information Security, FedRAMP, FISMA Compliance, HIPAA Compliance, HITRUST CSF Certifications, NIST 800-171 Certifications, PCI Data Security Standards, SOC Reporting and SOX Compliance.

Cybersecurity Sense

Incident response consultants are often contacted by clients who are in complete shock that their systems or networks have been compromised. Many times, these clients are hoping our analysis will ultimately prove that the incident was just a “flesh wound” to their systems and that they didn’t experience an actual data breach. It’s quite common for organizations to assume that data breaches won’t happen to them, and consequently, they typically don’t have an incident response plan. Not only do organizations need an incident response plan, but they also need to test it via  incident response tabletop exercises. In this podcast, LBMC Information Security’s Bill Dean shares five key reasons why organizations don’t detect cyber breaches, as well as some helpful tips for being prepared in the event of a cyber-attack. Listen, and discover these key takeaways:  Reasons why organizations need to plan for a data breach and test the plan Understanding why it’s important for organizations to know where its sensitive data lives The importance of enlisting the assistance of skilled information security professionals The case in support of quality penetration testing 

Incident response consultants are often contacted by clients who are in complete shock that their systems or networks have been compromised. Many times, these clients are hoping our analysis will ultimately prove that the incident was just a “flesh wound” to their systems and that they didn’t experience an actual data breach. It’s quite common for organizations to assume that data breaches won’t happen to them, and consequently, they typically don’t have an incident response plan. Not only do organizations need an incident response plan, but they also need to test it via <a href="https://www.lbmcinformationsecurity.com/resources/podcast-the-value-of-incident-response-tabletop-exercises" rel="nofollow" target="_blank"> incident response tabletop exercises</a>. In this podcast, LBMC Information Security’s Bill Dean shares five key reasons why organizations don’t detect cyber breaches, as well as some helpful tips for being prepared in the event of a cyber-attack. Listen, and discover these key takeaways: <ul> <li>Reasons why organizations need to plan for a data breach and test the plan</li> <li>Understanding why it’s important for organizations to know where its sensitive data lives</li> <li>The importance of enlisting the assistance of skilled information security professionals</li> <li>The case in support of quality penetration testing</li> </ul>

5 Reasons Why Organizations Don’t Detect a Cyber Breach

Since business leaders and board members are not often technically-inclined, they tend to have many questions about cybersecurity. Because of this, the AICPA recently recognized the need for a new type of cybersecurity examination report and put together a task force to bring to life what’s now known as SOC (System and Organization Control) for Cybersecurity. These reports will be beneficial in giving business leaders and board members an independent assurance and solid understanding of risk management and working with third-party cybersecurity professionals. In this podcast, LBMC Information Security’s Mark Burnette and Drew Hendrickson discuss SOC for Cybersecurity reports and what organizations and IT professionals should know about this new report and how it could help their organizations. Listen, and discover these key takeaways:  Why SOC for Cybersecurity reports were created Key elements found within an SOC for Cybersecurity report Differences in SOC 2 and SOC for Cybersecurity reports Ways organizations benefit from SOC for Cybersecurity reports Differences in SOC for Cybersecurity and Risk Assessments 

Since business leaders and board members are not often technically-inclined, they tend to have many questions about cybersecurity. Because of this, the AICPA recently recognized the need for a new type of cybersecurity examination report and put together a task force to bring to life what’s now known as SOC (System and Organization Control) for Cybersecurity. These reports will be beneficial in giving business leaders and board members an independent assurance and solid understanding of risk management and working with third-party cybersecurity professionals. In this podcast, LBMC Information Security’s Mark Burnette and Drew Hendrickson discuss SOC for Cybersecurity reports and what organizations and IT professionals should know about this new report and how it could help their organizations. Listen, and discover these key takeaways: <ul> <li>Why SOC for Cybersecurity reports were created</li> <li>Key elements found within an SOC for Cybersecurity report</li> <li>Differences in SOC 2 and SOC for Cybersecurity reports</li> <li>Ways organizations benefit from SOC for Cybersecurity reports</li> <li>Differences in SOC for Cybersecurity and Risk Assessments</li> </ul>

SOC for Cybersecurity

In a recent  report from Wombat Security Technologies based on data from millions of simulated phishing attacks, it was found that 76% of organizations said they experienced phishing attacks in 2017, and nearly half of information security professionals said that the rate of attacks increased from 2016 to 2017. F-Secure also recently released  research data indicating that over one-third of security incidents start with phishing emails or malicious attachments sent to company employees. In this podcast, LBMC Information Security’s Bill Dean digs into these research findings and shares some reasons why training employees to spot phishing emails, messages, and pre-texting calls can’t be done just once or once a year. Listen, and discover these key takeaways:  Fascinating new research findings about phishing attacks Reasons for training employees about phishing attacks on an ongoing basis Why it only takes one user to follow the link in a phishing email for your network to be compromised New approaches that may be implemented into our menu of phishing schemes 

In a recent <a href="https://www.wombatsecurity.com/blog/2018-state-of-the-phish-phishing-data-insights-and-advice" rel="nofollow" target="_blank"> report</a> from Wombat Security Technologies based on data from millions of simulated phishing attacks, it was found that 76% of organizations said they experienced phishing attacks in 2017, and nearly half of information security professionals said that the rate of attacks increased from 2016 to 2017. F-Secure also recently released <a href="https://www.helpnetsecurity.com/2018/02/23/weakest-link-security-perimeters/" rel="nofollow" target="_blank"> research data</a> indicating that over one-third of security incidents start with phishing emails or malicious attachments sent to company employees. In this podcast, LBMC Information Security’s Bill Dean digs into these research findings and shares some reasons why training employees to spot phishing emails, messages, and pre-texting calls can’t be done just once or once a year. Listen, and discover these key takeaways: <ul> <li>Fascinating new research findings about phishing attacks</li> <li>Reasons for training employees about phishing attacks on an ongoing basis</li> <li>Why it only takes one user to follow the link in a phishing email for your network to be compromised</li> <li>New approaches that may be implemented into our menu of phishing schemes</li> </ul>

Phishing Emails with 100% Click Rate

Zoom is soaring in popularity as a large population of remote workers are using it for video conferencing. With it's surging popularity, the platform's loose security protocols made it an easy target for hackers to take advantage and disrupt calls. "Zoombombing" allowed anyone to login to unprotected links to intrude on the calls often sharing lewd photos and videos. Listen to our most recent podcast to hear what you can do to use Zoom securely. 

Zoom is soaring in popularity as a large population of remote workers are using it for video conferencing. With it's surging popularity, the platform's loose security protocols made it an easy target for hackers to take advantage and disrupt calls. "Zoombombing" allowed anyone to login to unprotected links to intrude on the calls often sharing lewd photos and videos. Listen to our most recent podcast to hear what you can do to use Zoom securely.

Using Zoom Securely

The LBMC Information Security team recaps the 2019 HITRUST conference that was held in Texas in May. The team talks about the latest news on third-party assurance, HITRUST CSF adoption and controls implementation, SOC 2 + HITRUST, and the latest initiatives in the quality sub committee.

The LBMC Information Security team recaps the 2019 HITRUST conference that was held in Texas in May. The team talks about the latest news on third-party assurance, HITRUST CSF adoption and controls implementation, SOC 2 + HITRUST, and the latest initiatives in the quality sub committee.

HITRUST Conference Overview

The question is not, “Will your employees will get your company hacked?” but rather “When will your employees get your company hacked?” A recent article from HITECH Answers highlights this sad reality of human-error being the most common reason for a cyber intrusion and data compromise. So, while employee actions can circumvent most every security control you have invested in, security awareness training is critical to prevent your employees from being your number one risk. Users are often the last line in your cyber-defense efforts, and there is no patch for people wanting to be helpful or wanting to do the right thing. In this podcast, LBMC Information Security’s Bill Dean explains why ongoing employee security training is crucial to ensuring employees know how to spot a hacking attempt, ultimately protecting your organization from a potential cyber-attack. Listen, and discover these key takeaways:   Reasons why employees often do not realize how important they are to the process How not enabling multi-factor authentication on remote access to email allows hackers to easily access employee email accounts Why 91% of cyberattacks begin with a spear phishing email The importance of having strong passwords for employees Why backing up data is a must for protecting against cyber-attacks 

The question is not, “Will your employees will get your company hacked?” but rather “When will your employees get your company hacked?” A <a href="https://www.hitechanswers.net/will-employees-get-hacked/" rel="nofollow" target="_blank">recent article </a>from HITECH Answers highlights this sad reality of human-error being the most common reason for a cyber intrusion and data compromise. So, while employee actions can circumvent most every security control you have invested in, security awareness training is critical to prevent your employees from being your number one risk. Users are often the last line in your cyber-defense efforts, and there is no patch for people wanting to be helpful or wanting to do the right thing. In this podcast, LBMC Information Security’s Bill Dean explains why ongoing employee security training is crucial to ensuring employees know how to spot a hacking attempt, ultimately protecting your organization from a potential cyber-attack. Listen, and discover these key takeaways:  <ul> <li>Reasons why employees often do not realize how important they are to the process</li> <li>How not enabling multi-factor authentication on remote access to email allows hackers to easily access employee email accounts</li> <li>Why 91% of cyberattacks begin with a spear phishing email</li> <li>The importance of having strong passwords for employees</li> <li>Why backing up data is a must for protecting against cyber-attacks</li> </ul>

Why Employees Are Your Number One Risk

In this podcast, LBMC Information Security’s Mark Burnette offers a summary and perspective on the council’s insights—specifically addressing the three likely changes for the next version of the PCI DSS.

In this podcast, LBMC Information Security’s Mark Burnette offers a summary and perspective on the council’s insights—specifically addressing the three likely changes for the next version of the PCI DSS.

Key Insights on PCI DSS Version 4.0

Since incident response issues are no longer just an IT issue and can often involve legal issues, it is important for organizations to develop an incident response team, seek outside expertise, and have an overall action plan in the event of an incident. In this podcast, LBMC Information Security’s Bill Dean discusses how a complex situation like incident response can be purely based on common sense.

Since incident response issues are no longer just an IT issue and can often involve legal issues, it is important for organizations to develop an incident response team, seek outside expertise, and have an overall action plan in the event of an incident. In this podcast, LBMC Information Security’s Bill Dean discusses how a complex situation like incident response can be purely based on common sense.

Incident Response Should Be Common Sense

The AICPA Cybersecurity Working Group brought to life a new type of cybersecurity examination report in 2017 known as SOC (System and Organization Control) for Cybersecurity. These reports are intended to provide a consistent approach for evaluating and reporting on an entity’s cybersecurity risk management program and give management the ability to consistently describe its cybersecurity risk management program. Additionally, the flexibility of the reports allows management to use any recognized security framework as a baseline while enabling a CPA to provide independent assurance on the effectiveness of the program’s design. In this podcast from the Institute of Internal Audit meeting in Knoxville, LBMC Information Security’s Bill Dean and Drew Hendrickson discuss SOC for Cybersecurity reports and what organizations and IT professionals should know about this new report and how it could help their organizations. Listen, and discover these key takeaways:  A brief introduction to SOC for Cybersecurity Elements found within an SOC for Cybersecurity report The role of CPA firms in cybersecurity Differences in SOC 2 versus SOC for Cybersecurity An explanation of who needs SOC for Cybersecurity 

The AICPA Cybersecurity Working Group brought to life a new type of cybersecurity examination report in 2017 known as SOC (System and Organization Control) for Cybersecurity. These reports are intended to provide a consistent approach for evaluating and reporting on an entity’s cybersecurity risk management program and give management the ability to consistently describe its cybersecurity risk management program. Additionally, the flexibility of the reports allows management to use any recognized security framework as a baseline while enabling a CPA to provide independent assurance on the effectiveness of the program’s design. In this podcast from the Institute of Internal Audit meeting in Knoxville, LBMC Information Security’s Bill Dean and Drew Hendrickson discuss SOC for Cybersecurity reports and what organizations and IT professionals should know about this new report and how it could help their organizations. Listen, and discover these key takeaways: <ul> <li>A brief introduction to SOC for Cybersecurity</li> <li>Elements found within an SOC for Cybersecurity report</li> <li>The role of CPA firms in cybersecurity</li> <li>Differences in SOC 2 versus SOC for Cybersecurity</li> <li>An explanation of who needs SOC for Cybersecurity</li> </ul>

IIA Knoxville—SOC for Cybersecurity

In a previous podcast, we discussed purple-teaming as it compares to a conventional penetration test. Let’s now build on that approach, starting with the differences between attack simulation and conventional penetration tests. The methodology of attack simulation is the assumption that the network or a system will become compromised and the current controls will not prevent the infection. So, how does attack simulation differ from purple-teaming? With purple-teaming, everyone know what controls are being tested and when. The attack simulation is a bit different, asthe focus is the emulation of a specific attacker group and their methods of obtaining sensitive data. In this podcast, LBMC Information Security’s Bill Dean discusses attack simulation, or what some people label adversary simulation.

In a previous podcast, we discussed purple-teaming as it compares to a conventional penetration test. Let’s now build on that approach, starting with the differences between attack simulation and conventional penetration tests. The methodology of attack simulation is the assumption that the network or a system will become compromised and the current controls will not prevent the infection. So, how does attack simulation differ from purple-teaming? With purple-teaming, everyone know what controls are being tested and when. The attack simulation is a bit different, asthe focus is the emulation of a specific attacker group and their methods of obtaining sensitive data. In this podcast, LBMC Information Security’s Bill Dean discusses attack simulation, or what some people label adversary simulation.

Attack Simulation

Often in the information security industry, professionals can be accused of spreading fear, uncertainty, and doubt with cybersecurity concerns. However, considering the implications of integrity attacks, it is essential to pay close attention to them. As more organizations move to cloud storage, user authentication compromises are increasing. If an organization has sensitive information that can be accessed from anywhere online by simply using a username and password, that information is at risk, and organizations should make an effort to make their networks more secure.   In this podcast, LBMC Information Security’s Jason Riddle and Mark Fulford discuss the growing concerns with data integrity and how to avoid being a victim of attacks.   Listen, and discover these key takeaways:  Feedback heard from the cybersecurity field The need for two-factor or multi-factor authentication The ability for integrity attacks to impact financial markets How integrity attacks could be more effective than availability attacks and confidentiality attacks The need to increase cybersecurity efforts to prevent integrity risks and attacks 

Often in the information security industry, professionals can be accused of spreading fear, uncertainty, and doubt with cybersecurity concerns. However, considering the implications of integrity attacks, it is essential to pay close attention to them. As more organizations move to cloud storage, user authentication compromises are increasing. If an organization has sensitive information that can be accessed from anywhere online by simply using a username and password, that information is at risk, and organizations should make an effort to make their networks more secure.   In this podcast, LBMC Information Security’s Jason Riddle and Mark Fulford discuss the growing concerns with data integrity and how to avoid being a victim of attacks.   Listen, and discover these key takeaways: <ul> <li>Feedback heard from the cybersecurity field</li> <li>The need for two-factor or multi-factor authentication</li> <li>The ability for integrity attacks to impact financial markets</li> <li>How integrity attacks could be more effective than availability attacks and confidentiality attacks</li> <li>The need to increase cybersecurity efforts to prevent integrity risks and attacks</li> </ul>

Cloud Storage and User Authentication Compromises: Managing the Integrity of Your Data  

In comparison to previous years, 2017 was a good year as the number of healthcare records compromised was significantly down. As of December 30, there had been 341 breaches reported, affecting a little less than 5 million individuals. This compares to 327 breach reports in 2016 but with 16.6 million individuals affected. When this information is contrasted with 2015 statistics, fewer breaches (268) were reported, however more than 113 million patients were affected. So, why the significant drop in affected individuals? In this podcast, LBMC Information Security’s Mark Fulford offers some leading theories for these statistics, as well as a quick rundown of the top five healthcare data breaches from 2017. Listen, and discover these key takeaways:  Out of the top five healthcare data breaches, the largest one was a result of insider activity—specifically, unauthorized access through stolen media by a now-former employee, while the remaining four were all related to ransomware. Health providers were responsible for most of 2017’s data breach reports. As compared to Payers and Business Associates, far more records were compromised at provider organizations in 2017. 

In comparison to previous years, 2017 was a good year as the number of healthcare records compromised was significantly down. As of December 30, there had been 341 breaches reported, affecting a little less than 5 million individuals. This compares to 327 breach reports in 2016 but with 16.6 million individuals affected. When this information is contrasted with 2015 statistics, fewer breaches (268) were reported, however more than 113 million patients were affected. So, why the significant drop in affected individuals? In this podcast, LBMC Information Security’s Mark Fulford offers some leading theories for these statistics, as well as a quick rundown of the top five healthcare data breaches from 2017. Listen, and discover these key takeaways: <ul> <li>Out of the top five healthcare data breaches, the largest one was a result of insider activity—specifically, unauthorized access through stolen media by a now-former employee, while the remaining four were all related to ransomware.</li> <li>Health providers were responsible for most of 2017’s data breach reports.</li> <li>As compared to Payers and Business Associates, far more records were compromised at provider organizations in 2017.</li> </ul>

2017 Year-End Healthcare Breach Review

No matter the industry—government, healthcare, financial, or even smaller, mom-and-pop businesses—each deal with some type of sensitive customer information, and each has decisions to make when it comes to managing risk. Most security and audit frameworks (HIPAA, ISO, PCI, NIST, SOC 2, etc.) have requirements for risk assessment, making them one of the first things auditors or regulators ask for. Many companies are still using spreadsheets when it comes to performing risk assessments, which can be ineffective and insecure. Such a lack of functionality can keep a company from moving beyond assessment and into true risk management. In this podcast from the Institute of Internal Audit meeting in Knoxville, LBMC Information Security’s Bill Dean and Mark Fulford discuss the importance of risk management, including the effectiveness of risk assessments and how BALLAST can help organizations automate the risk assessment process. Listen, and discover these key takeaways:  Understanding what’s important to your organization when it comes to managing risks Reasons to consider more targeted risk assessments Why you shouldn’t just do gap assessments How to automate the risk assessment process Why not to stop at the assessment phase 

No matter the industry—government, healthcare, financial, or even smaller, mom-and-pop businesses—each deal with some type of sensitive customer information, and each has decisions to make when it comes to managing risk. Most security and audit frameworks (HIPAA, ISO, PCI, NIST, SOC 2, etc.) have requirements for risk assessment, making them one of the first things auditors or regulators ask for. Many companies are still using spreadsheets when it comes to performing risk assessments, which can be ineffective and insecure. Such a lack of functionality can keep a company from moving beyond assessment and into true risk management. In this podcast from the Institute of Internal Audit meeting in Knoxville, LBMC Information Security’s Bill Dean and Mark Fulford discuss the importance of risk management, including the effectiveness of risk assessments and how BALLAST can help organizations automate the risk assessment process. Listen, and discover these key takeaways: <ul> <li>Understanding what’s important to your organization when it comes to managing risks</li> <li>Reasons to consider more targeted risk assessments</li> <li>Why you shouldn’t just do gap assessments</li> <li>How to automate the risk assessment process</li> <li>Why not to stop at the assessment phase</li> </ul>

IIA Knoxville—Risky Business

All companies are subject to opportunistic attacks, but do you know if you are subject to a targeted attack based on the data you generate or maintain? In this podcast, LBMC Information Security’s Bill Dean addresses this question while diving deeper into the key differences between targeted attacks and opportunistic attacks.

All companies are subject to opportunistic attacks, but do you know if you are subject to a targeted attack based on the data you generate or maintain? In this podcast, LBMC Information Security’s Bill Dean addresses this question while diving deeper into the key differences between targeted attacks and opportunistic attacks.

Targeted Attacks Compared to Opportunistic Attacks

Remote

In this episode, Chelsea Smith talks with Bill Dean about the impact of remote work on IT audits during the COVID-19 pandemic. 

In this episode, Chelsea Smith talks with Bill Dean about the impact of remote work on IT audits during the COVID-19 pandemic.

The Impact of Remote Work on IT Audits

Most penetration testers are considered “red team,” while most defenders are considered “blue team.” Thus, the irony of a conventional penetration test is that these two groups are typically pitted against each other. When the red teams and blue teams are working together, you have what’s called a “purple team.” While purple-teaming has not always been a thing, it can be a win for both groups. Purple-teaming has now become somewhat of a buzzword. However, the effort behind it has great merit and value. In this podcast, LBMC Information Security’s Bill Dean helps purple-teaming, as well some of the benefits involved with the practice.

Most penetration testers are considered “red team,” while most defenders are considered “blue team.” Thus, the irony of a conventional penetration test is that these two groups are typically pitted against each other. When the red teams and blue teams are working together, you have what’s called a “purple team.” While purple-teaming has not always been a thing, it can be a win for both groups. Purple-teaming has now become somewhat of a buzzword. However, the effort behind it has great merit and value. In this podcast, LBMC Information Security’s Bill Dean helps purple-teaming, as well some of the benefits involved with the practice.

Purple-Teaming

2018 was one of the biggest years for data breaches to date, with more than 6,500 data breaches reported throughout the year. In this podcast, LBMC Information Security’s Bill Dean dives deeper into these recent data breach statistics and why it’s important to keep investing in the hard work involved with combating cyber-attacks to prevent data breaches in the days to come.

2018 was one of the biggest years for data breaches to date, with more than 6,500 data breaches reported throughout the year. In this podcast, LBMC Information Security’s Bill Dean dives deeper into these recent data breach statistics and why it’s important to keep investing in the hard work involved with combating cyber-attacks to prevent data breaches in the days to come.

2018 Was Second-Most Active Year for Data Breaches

The EU’s General Data Protection Regulation (GDPR) permits users certain rights (referred to as “data subject access rights” or “DSARs” in the documentation) that organizations will need to be prepared to accommodate if they must comply with GDPR. For organizations to be prepared to respond, it’s important to have a clear  understanding of DSARs before you risk consuming too much time, money, and resources in efforts to remain compliant. In this podcast, LBMC Information Security’s Drew Hendrickson shares some considerations for how to prepare and respond when a customer chooses to request action on one of their new rights under GDPR.

The EU’s <a href="https://www.eugdpr.org/" rel="noopener nofollow" target="_blank">General Data Protection Regulation (GDPR)</a> permits users certain rights (referred to as “data subject access rights” or “DSARs” in the documentation) that organizations will need to be prepared to accommodate <a href="https://www.lbmcinformationsecurity.com/blog/how-to-determine-gdpr-applicability-and-future-enforcement" rel="nofollow" target="_blank">if they must comply with GDPR</a>. For organizations to be prepared to respond, it’s important to have a clear <a href="https://www.lbmcinformationsecurity.com/blog/6-considerations-when-preparing-for-data-subject-requests" rel="nofollow" target="_blank"> understanding of DSARs</a> before you risk consuming too much time, money, and resources in efforts to remain compliant. In this podcast, LBMC Information Security’s Drew Hendrickson shares some considerations for how to prepare and respond when a customer chooses to request action on one of their new rights under GDPR.

GDPR and Preparing for DSARs

In this podcast, LBMC Information Security’s Bill Dean and John Dorling discuss some of the new tools available to help merchants who are trying to achieve PCI compliance.

In this podcast, LBMC Information Security’s Bill Dean and John Dorling discuss some of the new tools available to help merchants who are trying to achieve PCI compliance.

New Tools for PCI Compliance

When cloud-managed security was first introduced, there was some concern about the levels of security as compared to the security of data on an organization’s premises. Today, security professionals have implemented the appropriate controls to help could-based data management be safe and effective. As many organizations are now embracing and migrating to the cloud, it is important to know the risks and proper controls associated with the movement. In this podcast from the Institute of Internal Audit meeting in Knoxville, LBMC Information Security’s Bill Dean and Sese Bennett discuss the effectiveness and concerns surrounding migrating to cloud-managed security measures and what organizations today should know. Listen, and discover these key takeaways:  Why you should evaluate your current security frameworks and compare with cloud-managed controls A brief explanation of FedRAMP and FISMA Reasons to consider moving to cloud-managed security The potential risks associated with cloud frameworks if not implemented properly Why not to stop at the assessment phase 

When cloud-managed security was first introduced, there was some concern about the levels of security as compared to the security of data on an organization’s premises. Today, security professionals have implemented the appropriate controls to help could-based data management be safe and effective. As many organizations are now embracing and migrating to the cloud, it is important to know the risks and proper controls associated with the movement. In this podcast from the Institute of Internal Audit meeting in Knoxville, LBMC Information Security’s Bill Dean and Sese Bennett discuss the effectiveness and concerns surrounding migrating to cloud-managed security measures and what organizations today should know. Listen, and discover these key takeaways: <ul> <li>Why you should evaluate your current security frameworks and compare with cloud-managed controls</li> <li>A brief explanation of FedRAMP and FISMA</li> <li>Reasons to consider moving to cloud-managed security</li> <li>The potential risks associated with cloud frameworks if not implemented properly</li> <li>Why not to stop at the assessment phase</li> </ul>

IIA Knoxville—Implementing Cloud-Managed Security

The best podcast episodes of the most interesting stories and things. From skyping someone while they're in space, to tracking down and meeting a telephone scammer in person, to the story of a Galapagos. These episodes will keep you and all your friends entertained and captivated for hours. Learn something new in every episode! Add episodes you're interested into your queue below!

Best Episodes: Interesting Stories & Things

The best podcast episodes on Startups. For anyone working in a startup, or anyone interested in the incredible stories behind how people built companies like Instagram, and Facebook. Offering both practical advice and insights, as well as the stories for how many of the biggest startups got to where they are today. Add episodes you're interested into your queue below!