Socializing Security

In this episode, Brian and Milou speak with Mark Kreitzman, a cybersecurity veteran and evangelist at Efani, about how a SIM swap attack took over his phone number and led him to build a mobile-security business. They unpack warning signs, the risks of SMS-based account recovery, practical ways to reduce exposure, and why Mark believes security now matters more than the increasingly elusive promise of privacy. Mark on LinkedIn: https://www.linkedin.com/in/kreitzman Learn more and get a $99 discount coupon here! http://efani.com/socializingsecurity Chapters 00:00 Introduction 04:03 A personal SIM-swap attack sparks a security startup 06:19 The warning signs: lost signal and sudden password resets 09:01 How carrier verification and social engineering failed 12:26 Who carries out SIM swaps, and how scam operations work 15:13 Bitcoin losses, arbitration, and the limits of recourse 17:10 Why carriers and banks accept weaker verification tradeoffs 20:26 Practical ways to reduce SIM-swap and phishing risk 24:12 Email aliases and separating financial accounts 28:20 AI, data breaches, and exposed business security gaps 32:04 Slow down: social engineering targets people, not just systems 34:23 Why Mark says security has overtaken privacy 38:04 Data poisoning and the future of personal information 39:23 Efani offer and closing reflections 41:20 Reflections 45:17 Outro

Cybersecurity Awareness Month is here, and this episode is your ultimate guide to transforming bland security training into engaging and effective programs. Join hosts Brian and Milou as they unravel the secrets behind building a culture of security awareness that goes beyond the checkbox mentality. They dive deep into the current landscape of cybersecurity training, exploring why traditional methods often fail. Brian shares personal anecdotes about repetitive training experiences and how organizations can innovate to keep employees engaged. Milou highlights the importance of creating a culture around security behaviors rather than treating training as a mere obligation.  Chapters 00:00 Celebrating Cybersecurity Awareness Month 03:09 Building a Culture of Security Training 05:50 The Effectiveness of Cybersecurity Training 08:46 Phishing Simulations: Testing or Trapping? 12:02 Metrics and Measurement in Cybersecurity Training 15:03 Creating a Security-Conscious Culture 18:06 Engaging Employees in Security Training 21:03 The Role of Leadership in Cybersecurity Training 24:09 Innovative Approaches to Cybersecurity Training 27:03 Conclusion and Future Directions

In this episode, Brian and Milou delve into the complexities of global privacy regulations, discussing GDPR, US state laws, and best practices for building a comprehensive privacy program. They explore how companies can operationalize privacy, manage cross-border data transfers, and ensure compliance across different jurisdictions. Chapters 00:00 Introduction and episode overview 02:27 Deep dive into GDPR and its global influence 03:44 Balancing regional differences in privacy requirements 04:42 The role of privacy banners and user consent 05:22 US privacy laws: states and federal regulations 06:28 California's privacy law and enforcement 07:13 Managing privacy across different jurisdictions 08:09 Simplifying privacy compliance with a global baseline 09:39 Key elements of a privacy notice and user rights 11:25 Commonalities and differences in privacy laws 12:15 California versus GDPR: Watering down or strengthening? 13:25 Enforcement and compliance challenges in privacy laws 14:49 Data sovereignty and localization laws 16:16 Cross-border data transfer mechanisms and adequacy decisions 17:49 Managing subprocessors and third-party data sharing 20:33 The complexity of subprocessors and AI in privacy 22:25 User interactions and implicit consent in privacy management 24:24 Transparency and communication in privacy updates 26:24 Organizational structure of privacy teams and reporting 29:44 Final thoughts and audience engagement

In this episode, Brian and Milou explore the complexities of managing personal and work devices in a security-conscious environment. They discuss the pros and cons of using separate phones, the implications of mobile device management, and strategies for balancing security with privacy and convenience. Chapters 00:00 Introduction to the topic of device management and security 01:47 Brian discusses his current device setup and security policies 04:01 The upcoming changes in company policies regarding device control 05:54 Milou shares her experience with separate phones for work and personal use 08:01 The challenges and benefits of managing multiple devices 10:11 Privacy concerns and employee rights in BYOD policies 12:02 How IT manages device updates and security patches 14:02 The importance of transparency and communication in device policies 15:50 Managing offboarding and device wipe procedures 17:48 Balancing security needs with employee privacy and convenience 19:53 The impact of policies on employee productivity and mental health 21:57 Best practices for IT departments managing multiple devices 24:08 The future of device management and security policies 26:03 Final thoughts and personal decisions about device management

In this episode, Brian and Milou discuss the critical aspects of crisis communication during security incidents, emphasizing legal considerations, internal and external communication strategies, and the importance of preparation and transparency. Chapters 00:00 Introduction to Crisis Communication in Security Incidents 01:15 People, Process, and Technology in Crisis Response 02:33 Media Training and Handling Public Questions 04:05 Legal Aspects of Incident Reporting 06:08 Involving External Counsel and Forensic Teams 10:42 PR and Media Strategies During Incidents 13:08 Customer Communication and Transparency 18:02 Internal Communication and Employee Awareness 22:15 Post-Incident Documentation and Trust Rebuilding 28:46 Final Thoughts and Best Practices for Crisis Communication