Podcast: 2022 Cybersecurity Trends CISO Anthony Leatherwood pt. 2

[Music] (00:47)

 

Right, being prepared is making sure you have the right investment, the right solution, the right platforms, and the right EDR solution in place to protect the organization and contain it, right, so.

 

I mean, you know, with Biden's executive order, right, he just succeeded not- not too long ago this year, cybersecurity is important right? And companies are starting to realize, right, from your universities, to your local state governments, to your state, to private entities that, you know, cyber security is important, right, and if you want to be viable in the supply chain you have to protect it, right. I think with this new focus, right, that's a long time coming, right, I- I call it a harbringer- harbringer, right. Did I say that right?

 

James (02:23)

No-brainer?

 

Anthony (02:23)

Harbringer. Right. I call it a massive, kind of brain, of-of activity.

 

James (02:28)

Sure.

 

Anthony (02:28)

Right, not just from the U.S government, but from the public and private sector. I think with all these things at tangent, you know, coming into play, I think the focus here right now is on cyber security. Folks are at the point where they're saying that 'Hey if I don't focus on this,' right, 'I won't- I will no longer be in business.' you know? I think folks realize that and that's why the focus is there.

So I- I- I hope you're not getting tired of hearing it but you know that we've been preaching that the four things you have to have to make sure that you're in good shape is a clean copy of your data, a proactive threat hunter, visibility in your security gaps, an incident response plan but if you could make one recommendation to the CEO's and the executive teams that are listening, what what would you tell them 'you need to make sure before end of year, you have at least looked at or shored up'?

 

You know, I- I'm a big ISO 27001 fan. I-

Explain what that is real quick.

I know- I know for certain that they were fully, like, removed from everything, but that- that- that's an area where I feel like a lot of our business leaders forget to consider that. Listen, who are they going to attack first? Your executive team, your CEO, your CFO? If that person's been in the company a long time, they've certainly been through some laptops.

I mean, you have- and SMB's struggle with this- but, enterprises as well, you know, running SAP, whatever major system they have, you know, CRM tools, right, Gmail, It's called joiners, movers, leavers, right. So, you know, join a new joiner to the organization, mover lateral, or promote it within the organization. Leave remedy, leaving the organizations, a lot of organizations have issues with keeping up with those type of movements, right. I think part of it, what you want to do, is make sure that you understand the JML [joiners movers leavers] process and make sure you can account for who's in your organizations, who's connected, and who's gone, right? Those state changes are important.

 

That's good, yeah. We have a- a personal wish too, to not be hacked. So I know that there was the- a giant push for identity theft protection. That was what, four or five years ago, it seems like everybody was buying something they could make sure their identity wouldn't get stolen.

 

Anthony (06:42)

Yeah.

 

James (06:43)

I know the credit card companies are doing their end of it, your- your applications you signed into now at MFA, but there's still a concern about our own personal data, and will it ever get hacked or picked up. What measures do you recommend people take and maybe, what's too far? 

 

I mean, you have some industry regulation, you know some products out there like the neat locks and things of that sort but, well, it was- I'm big on prevention, more than detection, right. I- I think you, you get smart on where your data is located. You get smart on leveraging encryption, you know across any of your sensitive data, especially PHI data or whatever data you may have and you get smart on, you know, one key work. Where I kind of advise SMB's is that, you know, you have accounting software that's probably web-based. Use a dedicated browser, right, you know, for that accounting software. Don't- you know, don't use the general browser, you know, your employees use to access the internet. Use that dedicated browser and it's only to be used for the accounting software. You limit your threat surface, as we call it, and you limit your exposure and your risk, right, because we all know one of the most important, you know, life is first- right you want to protect life but we all know that SMB's is important for the revenue, you know, liquidity to remain- remain intact.

 

Yeah, life is most important.

 

Where- where would you- what would- where would you procure- what would you make next that you haven't done yet?

 

 

I know the wife was wanting me to focus on that.

That's a- that's a great cut. I'd love to talk about that, yeah, that's a fun one.