Business of Cyber

About this podcast

The Business of Cyber helps security, digital technology, and business leaders learn the best ways to manage and communicate about cybersecurity from the point of view of the business. Now that cyber is a top concern for business leadership and Board members, cyber needs to be viewed as a business risk. In this podcast, we'll interview business and security leaders to learn how they communicate effectively with one another and how security is impacting digital transformation initiatives.

Business of Cyber

Episodes

2021
BoC 26: Getting a Seat at the Table, Establishing Street Cred, & Building Trust with Al Ghous
Al Ghous is the Global Chief Information Security Officer at Envision Digital, a global AIoT technology organization. Prior to Envision Digital, Al served as Chief Security Officer at ServiceMax and was previously responsible for Cloud Platform, Product, and IoT security at GE Digital. Al has been in the Cyber Security industry for over 20 years contributing in different capacities from Product Security and Risk Management to Privacy and Security Architecture. Al has held other leadership roles in organizations such as Ernst and Young, Oracle, Kaiser Permanente, and Informatica to name a few. Al is active in the Cyber Security industry and part of several industry organizations and consortiums, as well as a member of several advisory boards. As an Advisor, Al takes pride in helping Founders focus on product development while maturing their Security posture to attract customers and investors alike.
February 9, 2021
24 min
BoC 25: Taking a Risk Led Approach to Security Leadership with Monica Verma
In this episode with Monica Verma, we discuss how a tour of an airplane's cockpit started a lifelong quest for a career in technology. She's now the CISO at the Norwegian Directorate of Health, is on the Board of the Cloud Security Alliance, and has held a number of security leadership roles at firms like PwC, Siemens, & Norges Bank, the Central Bank of Norway. She talks about her career in security leadership has identified a huge focus on risk management, specifically, an importance in discussing cyber risk in a way peers in the business can understand. She shares some tips for security leaders looking to manage the evolution of the CISO to more of a business-focused role: 1. Be okay with delegating. Despite her technical background and passion for hacking & technology, she knows her energy is better spent elsewhere 2. Embracing that those you need to communicate with, don't think about cyber all the time. Therefore, you need to be open, have compassion and patience when you're in these discussions. You can hear more from Monica and check out her podcast at MonicaTalksCyber.com
January 19, 2021
21 min
BoC #24: Ransomware is the Largest Security Awareness Exercise Ever w/ John Bambenek
John Bambenek is the President of Bambenek Labs, a security agency focused on providing cyber services in forensics, incident response, and managed services. John's spoken at conferences like ISC, BlackHat, SANS, and a number of other well known conferences. Additionally, he's huge contributor to the info sec community. During our conversation we explore how he's focused on communication, persuation, education as key skills for a security professional. Given John is a prolific speaker, he's well versed in articulating cybersecurity to a non-technical audiences. He boils it down to the 3 things any business will care about: Making money, spending less money, or mitigating risk. Additionally, we discussed how he viewed security's role as: Enabling risk based decision making CISO's becoming focused on how can they get business decisions made securely The long term implications of technical advancements (AI, ML, etc.) for security
January 12, 2021
19 min
2020
BoC #23: CEO of Aspis, Jeff Wagner on his Leadership Development, Transitioning from a Practitioner to Leader, Managing ReOrg's, & Aligning with the Business
Jeff Wagner is the CEO of Aspis, a cyber & administrative services company serving both government and commercial clients. Prior to founding Aspis, Jeff was the CISO at the Farm Production & Conservation, one of the largest Department's within the US Department of Agriculture. During today's show we cover, What did Jeff have to focus on during his transition from a security practitioner to a security leader? Why does he encourage those with technical experience to seek our leadership and management opportunities? What have been some of the most important leadership lesson Jeff's learned as a CISO as well as through his experience with his CISO customers? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
December 16, 2020
25 min
BoC 22: Paul Love on Cyber RIsk Story Telling, Presenting to the Board of Directors, and Simplifying Security for Execs
Paul Love is the CISO and Privacy Officer at CO-OP Financial Services, an interbank network connecting credit union ATM's nationwide. Prior to CO-OP, Paul held security leadership roles at Freddie Mac, Ally Financial, Microsft, and Cetera Financial Group. On today's show, Paul and I spent time exploring: How security leaders can become phenomenal story tellers How does Paul prepare when he's presenting cybersecurity to the Board of Directors Why does he focus on risk management as the critical piece of security decision making Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
November 25, 2020
19 min
BoC #21: A Focus on Building Internal Relationships with the CISO of MINDBODY
Jason Loomis is the CISO at MINDBODY, the SaaS solution provider serving the health, wellness, and beauty space. If you've recently booked a fitness class. there's a pretty good chance you scheduled the class through their platform. Jason shares he thinks most security professionals are too focused on the technical and not enough focus on telling the story. Jason credits his MBA for helping to refine his ability to sell his story & presentation skill, what he calls an often overlooked portion of the CISO role. Furthermore, we dig into: Building internal relationships as a part of his CISO role Prepping for and messaging his leadership presentations Story telling as a CISO skill
November 9, 2020
19 min
BoC #20: The Pendulum Between Enabling Business Innovation & Security w/ Ross Young, CISO @ Caterpillar Financial Services
Ross Young is currently the CISO at Caterpillar Financial Services, the bank behind the massive construction manufacturer. Prior to Caterpillar, Ross spent 2 years as a Divisional CISO at Capital One as well as over 10 years with the US government at organizations like the CIA, NSA, and Federal Reserve Board. On today's show, Ross and I explore his early desire to be a CISO and discuss how his career in the government and more recent shift to the private sector has enabled him to be an effective security leader. More specifically, Ross and I discuss one of the primary roles of the CISO which is maintaining the appropriate balance of security with enabling developers and the business to innovate. Ross and I dig into this and talk about strategies he's used to find a healthy balance throughout his career. Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
October 26, 2020
18 min
BoC #19: Why Does this 4x CISO Describe Himself as Being in Information Security Sales?
Roger Hale is currently the CSO at BigID, a startup that uses Machine Learning and Identity Intelligence to help organizations find, track and govern their Critical Data. Prior to that, Roger was the CISO at Informatica & Brocade, and held security leadership roles at Symantec, Lending Club, & inkling. On today's show, Roger and I discuss how he's viewed his job as a CISO pivot from an IT role to more of an evangelist role focused both internally and externally within a business. More specifically, we dig into: Why he views himself as being in information security sales? How can CISO's get a 'seat at the table?' Why should every security decision consider risk vs. reward? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
October 19, 2020
20 min
BoC #18: Practicing Communication with the Business w/ Rick Howard
Rick Howard is a legend in the security industry, having most recently served as the CSO at Palo Alto Networks. Rick's currently the CSO, Senior Fellow, and Chief Analyst at the CyberWire, one of the leading cybersecurity media & publishing companies. Rick is a self described "old army guy" having spent nearly 30 years in the US Army prior to transitioning to a commercial career with companies like Engility, Verisign, and Counterpane. On the interview, Rick and I dig into the changes he needed to make as a first time CISO in the commercial space as well as the primary differences between government & commercial sector. He describes one of his top skills as translating complex technical documents and concepts into a language that business professionals can understand. Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
October 14, 2020
21 min
BoC# 17: The Evolution of the Security Industry and Origins of the FAIR Model w/ Jack Jones
Jack Jones is one of the most well respected thought leaders in risk management and information security. During his 30 years in the industry he has garnered a decade of experience as a CISO, including five years for a Fortune 100 financial services company. His work has also been recognized by his peers and the industry, earning him the 2006 ISSA Excellence in the Field of Security Practices award, and the 2012 CSO Compass Award for Leadership in Risk Management. Jack is the originator of the now industry standard risk measurement model known as Factor Analysis of Information Risk (FAIR). FAIR has seen adoption globally, within organizations of all sizes, and is now regularly included in graduate-level university courses on information security and referenced by other industry standards. He also recently co-authored a book on FAIR entitled "Measuring and Managing Information Risk - A FAIR Approach", which has been inducted into the Cybersecurity Canon as a "must read" for professionals in the industry. Jack was also on the ISACA task force that developed the RiskIT framework, and he led the ISACA group that developed the CRISC certification. Today, Jack is in charge of Research at RiskLens, Inc. and is a sought after speaker at national conferences and universities like Carnegie Mellon and Ohio State University. He is also the Chairman of The FAIR Institute (http://www.fairinstitute.org/), a non-profit organization led by information risk officers, CISOs and business executives to develop standard information risk management practices based on FAIR.
October 14, 2020
27 min
BoC #16: How to answer the questions "Are we secure?" and "Are we good?"
Daniel Hooper is currently the CISO at Varo Money, one of the leading mobile first digital banks in the US. Prior to Varo, Daniel was the CISO at PIMCO, the global investment firm with nearly $2trillion USD in assets under management. Daniel and I connected via LinkedIn following a viral post of his regarding how CISO's should respond to the questions, "Are we good?" & "Are we secure?" These all too common questions highlight the need for CISO's to translate the complex technological problems they face into meaningful talking points to explore with their business peers. On the show, Daniel and I dig into his suggestions for responding to these questions as well as: What did Daniel need to work on most during his first CISO jobs? How does Daniel go out of his way to continually understand his business peers and his clients? What's the worst piece of security advice he's ever gotten? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
September 22, 2020
17 min
BoC #15: Should you quantify cyber risk?
Heath Renfrow is the Director & CISO at The Crypsis Group, an incident response and CISO advisory consulting firm. Prior to Crypsis, Heath has held CISO roles at the DoD, Army Healthcare, & the US Army Corp of Engineers. During the conversation, Heath and I cover: How has a career in the military prepared him for experience in the commercial security sector? How has he developed skill set's that enable him to communicate effectively with executive groups who lack cyber experience? Why does he chose to quantify risk and what has it done for him? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
September 16, 2020
18 min
BoC #14: Focusing on Business Context Rather than Control Frameworks
Vic Bhatia is the Head of Security GRC at Novi, a subsidiary of Facebook. Vic's experience spans across all sectors and a wide range of both consulting and security leadership roles. During the conversation we explore: What is the Facebook Novi project and how is Vic helping to operate their program? Why does Vic believe the most important area of focus for a security professional should be business context? How does Vic feel about control frameworks? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
September 14, 2020
21 min
BoC #13: Activating the Appropriate Mindset for Security to Help Pursue New Business Opportunities
Sian John is the EMEA Director of Cybersecurity Strategy for Microsoft, leading a team of Chief Security Advisors who provides expert guidance and consulting services to some of Microsoft's largest customers throughout the region. Prior to Microsoft, Sian held a similar leadership roles at Symantec where she focused on helping customers build cyber strategy and refine the vision for their programs. On the episode today we discuss: How does Sian recommend aligning with the business if you’ve historically struggled to do so? What role does security play in digital transformation? How can security teams position themselves to positively impact business initiatives? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
August 31, 2020
16 min
BoC #12: Soft Skills for a Security Leader to Become a Business Aligned Corporate Executive
Dan Blum is the Managing Director at Security Architects Partners, a consulting firm focused on cybersecurity leadership, architecture, and risk management. Prior to starting the firm, Dan was a research analyst at the Burton Group, which was subsequently acquired by Gartner in 2010. Additionally, he has security leadership experience at organizations like Respect Network and KuppingerCole. Most recently, Dan authored a book called Rational Cybersecurity for Business: The Security Leader's Guide to Business Alignment. Be sure to check out the book via the link below. On today's show, we cover: What are some specific examples of clients Dan's worked with who have done a good job aligning themselves with their business peers? How have those organizations gone about justifying increase budget? Why are some people better at this than others? Dan's Book: https://www.amazon.com/Rational-Cybersecurity-Business-Security-Alignment/dp/1484259513 Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
August 25, 2020
20 min
BoC #11: Positioning Security to Help Drive New Business and Meet Business KPI's w/ Peter Liebert
Peter Liebert is currently the CISO at Cerner Government Services, the leading EHR provider for the public sector. Prior to joining Cerner, Peter was chosen by his peers to be the 2019 Chief Security Officer of the Year by SC Magazine. Additionally, he's the former CISO for the State of California and is a security visionary with over 19 years of leadership experience in private, Federal (including the Military), and State Government organizations. On today's show we discuss: How have you justified an increase in cyber spend? How do you align with business KPIs? What have been the cultural differences you've noticed in working with both private and public sectors? Get in touch with the show: Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck
August 10, 2020
23 min
BoC #10: Actively Listen to Ensure Alignment with the Business (w/ Bill Bonney)
Bill Bonney is a well known figure in the security community having co-authored the CISO Desk Reference Guide with Matt Stamper & Gary Hayslip. Their book series is a meant to be a practical guide to help modern CISO's take on many challenges including executive leadership, communication, and business savvy. So of course, right in our wheelhouse. The books recently been published into the Cybersecurity Canon, the leading authority of cybersecurity content and books managed by Palo Alto Networks and The Ohio State University. During today's discussion, Bill and I discuss: How security leaders can conduct 'walk-about's' to position themselves as business enablers with the intent to listen and learn rather than describe how you support them CISO's forming a mentor relationship with a seasoned business leader within your organization The role digital transformation has played and will continue to play for security teams Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck OFFER FOR FIRST TEN EPISODES In order to enter for a chance to win each book discussed in the first 10 episodes, please rate & leave a review wherever you listen to podcasts and reach out to Joe via Email, LinkedIn, or Twitter with your username to let us know you've rated. Winners will be announced after Episode 10
August 3, 2020
21 min
BoC #9: Strategies for Business & Security Alignment with the Cybersecurity Field CTO at Microsoft, Diana Kelley
Diana Kelley is the Cybersecurity Field CTO at Microsoft, where she leads the Microsoft Cybersecurity Thought Leadership team and advises CIO's, CISO's, and CTO's on cyber strategy and approach. In addition to her work at Microsoft, Diana also serves on the Board of the non-profit, Women in CyberSecurity, on the Program Committee for the RSA Conference, hosts the MyCyberWhy podcast, and regularly appears on media platforms like CNBC, CBS, NY Times, and WSJ. During the interview, Diana and I discuss: How did Diana find herself in cybersecurity and ultimately in her current role at Microsoft? How does she envision the continued move to the Cloud and security's role in this industry migration? How does she encourage her customers to approach conversations with their business peers? Why should security teams take a leadership role in helping their business peers better understand cybersecurity? Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck OFFER FOR FIRST TEN EPISODES In order to enter for a chance to win each book discussed in the first 10 episodes, please rate & leave a review wherever you listen to podcasts and reach out to Joe via Email, LinkedIn, or Twitter with your username to let us know you've rated. Winners will be announced after Episode 10
July 27, 2020
24 min
BoC #8: Building a Security Culture That Enables Strategic Business Initiatives
Michel Romanino is the Deputy CISO at Cambia Health Solutions a member of the Blue Cross Blue Shield Association HQ’d in Portland. Prior to Cambia, Michel held security and software engineering roles at companies like CoreLogic, Intuit, Sharp Healthcare, & Teradata. During the interview, Michel talks about how he’s helped establish a strong security culture embedded in the organization's decision making process as well as some of the business opportunities they’re pursuing in light of the COVID19 pandemic. Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck OFFER FOR FIRST TEN EPISODES In order to enter for a chance to win each book discussed in the first 10 episodes, please rate & leave a review wherever you listen to podcasts and reach out to Joe via Email, LinkedIn, or Twitter with your username to let us know you've rated. Winners will be announced after Episode 10
July 20, 2020
24 min
BoC #7: Why is digital transformation the largest opportunity for security teams to modernize?
Mark Simos is the Lead architect for Microsoft Enterprise Cybersecurity Group where he is part of a group of cybersecurity experts who create and deliver unique cybersecurity services and solutions to Microsoft’s customers. Having spent the majority of his career there, Mark's been with Microsoft for over 20 years. We talk about: How can security stay out of the way of the business? How does Mark envision zero trust as a solution, improvement, or emerging trend? What vs how of being a business partner and integrating well with their business? Why is digital transformation the biggest opportunity for security teams to modernize? Website: businessofcyber.com LinkedIn: Joe Vinck & Business of Cyber Twitter: @joey_vinck OFFER FOR FIRST TEN EPISODES In order to enter for a chance to win each book discussed in the first 10 episodes, please rate & leave a review wherever you listen to podcasts and reach out to Joe via Email, LinkedIn, or Twitter with your username to let us know you've rated. Winners will be announced after Episode 10
July 15, 2020
20 min

Business of Cyber

About this podcast

Categories

About this podcast

Categories

Business of Cyber

Episodes

BoC 26: Getting a Seat at the Table, Establishing Street Cred, & Building Trust with Al Ghous

BoC 25: Taking a Risk Led Approach to Security Leadership with Monica Verma

BoC #24: Ransomware is the Largest Security Awareness Exercise Ever w/ John Bambenek

BoC #23: CEO of Aspis, Jeff Wagner on his Leadership Development, Transitioning from a Practitioner to Leader, Managing ReOrg's, & Aligning with the Business

BoC 22: Paul Love on Cyber RIsk Story Telling, Presenting to the Board of Directors, and Simplifying Security for Execs

BoC #21: A Focus on Building Internal Relationships with the CISO of MINDBODY

BoC #20: The Pendulum Between Enabling Business Innovation & Security w/ Ross Young, CISO @ Caterpillar Financial Services

BoC #19: Why Does this 4x CISO Describe Himself as Being in Information Security Sales?

BoC #18: Practicing Communication with the Business w/ Rick Howard

BoC# 17: The Evolution of the Security Industry and Origins of the FAIR Model w/ Jack Jones

BoC #16: How to answer the questions "Are we secure?" and "Are we good?"

BoC #15: Should you quantify cyber risk?

BoC #14: Focusing on Business Context Rather than Control Frameworks

BoC #13: Activating the Appropriate Mindset for Security to Help Pursue New Business Opportunities

BoC #12: Soft Skills for a Security Leader to Become a Business Aligned Corporate Executive

BoC #11: Positioning Security to Help Drive New Business and Meet Business KPI's w/ Peter Liebert

BoC #10: Actively Listen to Ensure Alignment with the Business (w/ Bill Bonney)

BoC #9: Strategies for Business & Security Alignment with the Cybersecurity Field CTO at Microsoft, Diana Kelley

BoC #8: Building a Security Culture That Enables Strategic Business Initiatives

BoC #7: Why is digital transformation the largest opportunity for security teams to modernize?