How do phishing scams, AI-powered attacks, and strategic governance intersect? Together, they're redefining the future of cybersecurity. Organizations are navigating a mix of challenges and implementing innovative solutions to proactively address today's threats.
Today's guest is Kelly Hood. She is the EVP and cybersecurity engineer at Optics Cyber Solutions. She is a CISSP who specializes in implementing cybersecurity and privacy best practices to manage risks and to achieve compliance. She supports the NIST cybersecurity framework and serves as a CMMC registered practitioner, helping organizations strengthen their cybersecurity posture and develop effective risk management strategies.
Show Notes:
- [01:06] - Kelly is a cyber security engineer at Optic Cyber Solutions. It's her job to help companies protect themselves.
- [02:17] - Don't be embarrassed if you fall for a phishing scam.
- [03:01] - These attempts are getting more realistic. Kelly shares how she was briefly fooled by a phishing scam that looks like an email from her mother.
- [05:25] - The NIST Cybersecurity Framework is a voluntary framework for defining cybersecurity. An update was put out in February of 2024. They also added a new function.
- [06:01] - The five functions that organize a cybersecurity program have been to identify, protect, detect, respond, and recover. They recently added the govern function.
- [06:38] - The govern function is about defining your business objective and then putting protections in place that makes sense for those objectives.
- [09:01] - The identify function is focused on knowing what we have.
- [09:40] - Protect includes everything from identity management, authentication, training, data security, and platform security.
- [10:12] - Detect is looking at what's happening around us. It's continuous monitoring and knowing what happens if something goes wrong.
- [11:00] - Respond is knowing what the plan is when something does happen.
- [12:01] - Recover is about getting back to normal after something happens.
- [16:22] - Data centers want to make sure that they have redundant power supplies.
- [17:33] - We discuss some of the things that people might forget when identifying cybersecurity assets. Data and people need to be thought about as well as systems and hardware.
- [21:00] - We need to write things down and understand what systems and data connections we have.
- [23:10] - We talk about the importance of being aware of the physical space and who is actually supposed to be there.
- [24:46] - Data is one of the assets that often gets overlooked for protection. There are many new requirements that require data to be protected.
- [27:54] - Monitoring to understand what traffic you should expect and what is and isn't normal activity is also important.
- [31:10] - Transparency and communication are paramount for creating trust.
- [33:51] - Sometimes recovery doesn't mean 100%. Get up and running and prioritize the systems that matter most.
- [36:56] - With governance, you really want to look at what you're trying to do with the business and then translate cybersecurity to fit that objective.
- [37:27] - Have guidance documentation in place and have oversight.
Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.
Links and Resources:
