Podcast: Play in new window | Download (Duration: 14:18 — 13.1MB)

Subscribe: RSS

In this episode of CHATTINN CYBER, Marc Schein interviews Judith H. Germano, a nationally recognized thought leader on cybersecurity governance and privacy issues. She is a Senior Fellow at the NYU Center for Cybersecurity (CCS) and the Reiss Center on Law and Security and an Adjunct Professor of Law at NYU School of Law.

Judith was a federal prosecutor for 11 years, from 2002 to 2013. Today, she shares that her last role was as the Chief of economic crimes, which oversaw cybersecurity, securities fraud, and other complex fraud. She handled tremendous cases of international significance, some that were reported in the news and some that were not.

From an experience that spans over a decade, Judith learned the growing importance of cybersecurity for businesses. She realized that there were many questions regarding handling cybersecurity risks- when and whether to work with the government and protect yourself proactively from incidents. And though she loved her government job then, she wanted to help by advising companies proactively.

Judith currently leads the CCS cybersecurity task force and roundtable series of corporate executives and senior government officials addressing critical cybersecurity concerns. She is also the founder of GermanoLaw LLC, advising public and privately-held companies on cybersecurity and privacy matters and representing companies and individuals on securities fraud and other complex white-collar criminal and regulatory compliance issues. Judi counsels senior executives and corporations on cybersecurity, risk management, and strategy. Her publications include: “Cybersecurity Partnerships: A New Era of Collaboration” and “After the Breach: Cybersecurity Liability Risk.”

In today’s episode, she shares the role of boards in handling cybersecurity issues, the changes and advancements made in the industry today, and what challenges remain in the industry for cybersecurity experts to face. We also learn why boards need to proactively ensure that companies are compliant with security policies and address and document their cybersecurity effectively.

Highlights:

“Cyber security is a top priority for organizations and governments. And it is critically important that the board is well versed in cybersecurity.”

“We’ve also seen some cases outside of the cybersecurity context that show that boards have an obligation and fiduciary duty not just to ensure that policies are in place of the organization, but that they’re followed, and a responsibility to document in the minutes what the board is doing to address issues of key importance of the organization.”

“You want to make sure that the board is asking questions that have to do with basic cyber security hygiene.”

“There are some boards that have a specific risk management committee and cyber security and privacy risk may be housed there.”

“As smart as we get defending, the attackers get smart and new ways of attacks.”

“Over the years, many organizations, unfortunately, are still catching up on basic things like encryption and logging and updates and other best practices.”

Time-Stamps:

[02:58] – The role of a board in terms of cybersecurity or cyber maturity
[04:06] – What recent legal decisions helped face the developments of current board liability
[05:21] – How in depth should boards be getting within cybersecurity or cyber risk?
[07:48] – Some of the cybersecurity trends that boards are currently seeing
[10:32] – Engineering in the law school and the concerns of future leaders within cybersecurity

Connect with Judith:

LinkedIn: https://www.linkedin.com/in/judith-germano-b7a63310
Twitter: https://twitter.com/judigermano?lang=en
Website: https://germanolaw.com/

Podcast: Play in new window | Download (Duration: 18:00 — 16.5MB)

Subscribe: RSS

In this episode of CHATTINN CYBER, host Marc Schein is joined by Matthew Pachman, the Vice President, Chief Risk and Compliance Officer at FTI Consulting. Matthew has an extensive background in Compliance and Risk Management.

Originally hailing from New Jersey, Matthew Pachman has a degree in Law from the University of Virginia. He has been awarded Compliance Week’s Top Minds Award. He was named “Top Ethics and Compliance Officer” by the Ethisphere Institute for three consecutive years. He is a recognized and decorated professional speaker in the corporate compliance space.

Welcome Matthew Pachman! Matthew  kicks it off with an explanation of the differences between Compliance and Risk Management as they relate to cyber liability. Cyber risk is top priority. It is what every board member, executive and regulator worry about on a day-to-day basis. From the compliance side of cyber security, Matthew stresses that one can implement rules and systems to control these dangerous factors.

We then move into a discussion about the importance of cyber protection within a company and the approaches we can take to make sure the company has a culture of compliance and awareness. What role does Human Resources play in this? Matthew shares his take on cyber protection and employee awareness which rely on HR communication tactics. Anywhere we talk about communication and culture, HR is involved!

Next, we shift gears to the subject of cyber insurance. Matthew shares the qualities and tools he looks for in an insurance program as well as a corporate program. If you are in the risk business, you cannot underestimate the importance of cyber insurance! This especially applies to today’s work environment which is primarily remote due to Covid-19 and thus a higher need for cyber security.

Wrapping up our interview, Matthew leaves us with some of the pros and cons for those looking to start a career in cyber risk. He says “You have to like playing defense. You are trying to protect your goal.”

 

What You Will Learn

1. Compliance or Risk Management; which one is more difficult to approach?
2. What is required for better risk management?
3. What is HR’s role in cyber risk management?
4. What makes a good cyber program for controlling cyber risks?
5. Importance of having cyber insurance.
6. What are the pros and cons of taking cyber risk management as a career path?

 

 

 

Podcast: Play in new window | Download (Duration: 26:06 — 23.9MB)

Subscribe: RSS

In this episode of CHATTINN CYBER, Marc Schein interviews Jeff Cohen, Senior Vice President of Zywave and former President of Advisen. In November 2020, Zywave acquired Advisen, the leading provider of data, media, and technology solutions for casualty insurance markets. Jeff led Advisen’s strategies for Global Business Development and for the company’s Data and Media businesses and resources.

As a sales and marketing executive, Jeff Cohen has over thirty years of experience in data management, data analytics, media, and news business aimed towards insurance and financial sectors. Jeff joined Advisen in 2003 after spending over 15 years at Bloomberg in North American Sales.

Jeff currently serves as a board member for the Spencer Educational Foundation which funds scholarships, internships, and grants for undergraduate and graduate students who will be tomorrow’s risk management and insurance leaders. Additionally, he serves as a board member of the Center for Hearing and Communication, a non-profit agency that serves all people with hearing loss.

Most recently, Advisen was acquired by Zywave, an insurance agency software company used by over15,000 insurance agencies. Zywave offers Advisen a level of scale with coinciding talent, media capabilities, and supportive infrastructure benefiting the company and the service providers, brokers, and clients that Advisen serves. Jeff and many others believe that cyber is constantly moving at the speed of light making it a space that is always adapting and needing change.

Advisen’s Annual Cyber Risk Insights Conference is one of the major cyber conference series.  Advisen’s Cyber Risk Awards event has also become one of the most prestigious awards in the cyber risk community.

Time-Stamped Segments  

• Meet the Guest – Jeff Cohen [00:31]
• How did Advisen grow to become one of the leading organizations in the world? [01:02]
• What led to partnering Advisen with Zywave? [05:04]
• What is Advisen’s role within cyber? [06:57]
• Where Jeff Cohen feels that future of cyber will be? [06:57]
• How is cyber different from other lines of business? [10:34]
• How has Advisen’s Annual Advising Conference has become a major cyber event globally? [14:11]
• Is there anything I should Have Asked you Today That I Didn’t? [23:02]
• Closing Thoughts [25:37]

 

 

 

 

Podcast: Play in new window | Download (Duration: 37:00 — 33.9MB)

Subscribe: RSS

In part two of our Chattinn Cyber with with host Marc Schein, our guests, Sherri and Michael, continue talking about ransomware. They start with the question of whether or not you should actually pay the ransom. Sherri recommends making sure you have backups. Have a plan to resecure your data even if you have to engage with the hackers. From the legal side, Michael recommends contacting law enforcement—but not the local police. These days, the FBI works really hard to help. It also helps to have built a relationship with federal police ahead of time. Sherri suggests looking into community partnership programs that have sprung up recently.

Regarding police takedown, Sherri explains that some leading ransomware gangs have recently been taken down, including Emotet. Emotet was one of the leading technological threat distributors. With Emotet on your computer, all your information could be stolen within 15 minutes. And then they could simply nuke it all with the Ryuk ransomware. Members of that very gang have been arrested. Emotet will uninstall itself by April of this year.

A lot of repair software may actually be working as malware itself. It’s absolutely vital to have expert help at every step of the way.

Sherri finishes the episode by giving a few key things to watch out for to protect yourself from ransomware:

1. Exposed remote login credentials.
2. Email phishing.
3. Software vulnerabilities.

She recommends using two-factor authentication and a VPN. Be sure to train users to think before they click. Michael urges to do your due diligence assuming there is risk. Get ahead of the proliferation of ransomware attacks.

Key Takeaways:

• Ask for proof of life if you’re going to pay the ransom on your data.
• Knowing who to contact is important.
• An advisory can help to organize your response to hackers.
• There are downsides to getting your ransomware payments insured.
• You must treat any threat as a potential data breach.

Key Quotes:

• “There’s nothing new here from a legal perspective.” – Michael (13:00)
• “We actually have seen takedowns of ransomware-as-a-service gangs.” – Sherri (22:00)
• “You have to assume that there may have been data stolen.” – Sherri (24:50)
• “You cannot figure out what the breach is without the technology side.” – Michael (26:00)
• “The second you start a letter-writing campaign, you have to be mindful of the fact that you’re creating a record for court.” – Michael (33:10)

Podcast: Play in new window | Download (Duration: 31:27 — 28.8MB)

Subscribe: RSS

In this episode of Chattinn Cyber Marc Schein interviews guests; Sherri Davidoff, CEO of LMG Security and author of the recently released book, “Data Breaches.” And Michael A. Kleinman, Special Counsel, Fried Frank. Sherri started working in cyber security before that was even a term.  And Michael, on the other hand, comes from the legal world. A litigator, Michael started to see more and more clients needing counsel with regard to cyber and use privacy issues.

They begin their conversation digging into the issue of ransomware. Sherri explains what ransomware is and moves into how ransomware continues to evolve. She shares a story of a ransomware case that infiltrated a trucking company. This stranded the trucks and affected the retail industry at large.

They also discuss what kind of legal room the victims of a cyber attack actually have. It’s a complicated issue when business is disrupted—especially when they are contractually obligated to deliver. Sherri explains that businesses need to demand security reviews in their contracts, and the community as a whole needs to understand that transparency around security benefits everyone.

Michael talks briefly about notification laws and how they affect private data in contractual agreements. Sherri says that 75% of ransomware breaches take personal data. What you really need to do is figure out what they actually have before taking the next step of paying the ransomware.

Key Takeaways:

• There is now ransomware as a service.
• The hacker economy is demanding more and more specialized roles.
• A cyber attack can actually cause a breach of contract.
• 92% of breaches come from third parties.
• There really aren’t standards for suppliers notifying when there’s a hack.
• Think about which suppliers have important access to your data.

Key Quotes:

• “The operational impact of a ransomware case, sometimes by design, often has this huge ripple effect—especially when who’s targeted is a key supplier.” – Sherri (6:00)
• “Once you start getting into a ransomware case, you start to realize how dependent even little things are.” – Sherri (9:35)
• “This issue of incidents arising out of third parties is not new.” – Michael (15:30)
• “You need to understand what the contracts actually say.” – Michael (18:20)
• “If your data is up there, YOU need to do an investigation.” – Sherri (20:36)
• “Reduce your access, and you reduce your risk.” – Sherri (21:30)
• “Today, ransomware is typically the tip of the iceberg. It’s the last thing you see after a long-range attack.” – Sherri (22:25)

Podcast: Play in new window | Download (Duration: 16:52 — 15.4MB)

Subscribe: RSS

In this episode of CHATTINN CYBER, Marc Schein interviews Kristin Judge, a Leading Voice for Cybercrime Victims. Kristin educates small businesses, elected officials, and nontechnical individuals to use best practices to avoid cyber risks.

Small businesses and individuals are facing a huge risk with the rapid growth of cybercrime, people are losing their livelihood, homes, and mental health. Businesses, as well as communities, are suffering globally.

Kristin discusses the top 3 cyber risks that are impacting individuals and small businesses.

• Romance Scams on the internet
• Cyberbullying
• Ransomware attacks

Kristin started Securing our Community, a program that will help tackle the risk of cybercrimes. In this program, her team will train children and college students to assist less tech-savvy people in their environment. She says, trainees will be able to help individuals, businesses, and communities. Such as adding a malware program to individual’s systems, changing their privacy settings, etc.

Recently, Cyberspace Solarium Commission took a great step to protect individuals and small businesses from cybercrimes. Cyberspace Solarium Commission shared a transition document with the Biden administration that talks about leading a national call center for individuals and small businesses. They also call-out the need for victim services grants. Due to all these efforts of the Cyberspace Solarium and congressional leadership, we are finally seeing that the cyber victims are being served and their voice is being heard.

Topics Discussed in the Podcast

1. How Kristin Judge started her career in cybersecurity and was appointed to train government officials?
2. How cyber attacks are impacting small businesses and individuals?
3. What are the trends of cyber risks and what are the top 3 cyber risks?
4. What individuals and small businesses can do to protect themselves from cyber risks?
5. How Kristin’s ‘Securing our Community’ and ‘Cyber Secure My Business’ programs are helping individuals and businesses?
6. What services are available  for small businesses and individuals?
7. How an individual can report any cyber issue and can reinforce the security of his/her system?
8. Where individuals can get constant updates of new information on cybersecurity and cyber risks?
9. What Cybercrime Support Network (CSN) is doing for small businesses?
10. What are the benefits of engaging cybersecurity companies with small businesses?
11. What is the significance of cyber insurance in protecting small businesses?
12. What’s the importance of securing home networks?
13. What Cyberspace Solarium Commission recently did to protect individuals and small businesses from cybercrimes?

 

Podcast: Play in new window | Download (Duration: 19:04 — 17.5MB)

Subscribe: RSS

In this episode of CHATTINN CYBER, Marc Schein interviews Kilian Koepsell, CTO and Co-Founder of Caption Health. As Caption Health CTO and Co-Founder Kilian Koepsell leads the company’s efforts to use the latest in artificial intelligence and deep learning to bring the diagnostic power of ultrasound to more healthcare providers, democratizing access to healthcare and improving patient outcomes.

Prior to co-founding Caption Health, he worked on developing computer vision algorithms matched to the human visual processing system at the Redwood Neuroscience Institute and UC Berkeley — research he brought to Caption Health’s ultrasound guidance software. He also co-founded White Matter Technologies and was a founding team member at IQ Engines, which was acquired by Yahoo! for its Flickr group. He holds a PhD in physics from the University of Hamburg, as well as two master’s degrees in mathematics and physics from the same university.

Kilian was born and grew up in a family of physicians, in Germany, where he developed a keen interest in health care. Along with health care, he was also fascinated with computers and Artificial Intelligence (AI) since his childhood. Although Kilian was passionate about AI and health care, he studied mathematics and physics. Soon he realized that these two courses were based on theoretical knowledge, however he wanted to study something that he could apply to create an impact on the lives of other people. Then he decided to switch his field and pursue his childhood passion. He came to the United States and studied Neuroscience and Artificial Intelligence at UC Berkeley.  After completing his research at UC Berkeley he started his career in the field of medical imaging.

Access to quality diagnostic imaging leads to more timely and accurate diagnoses and treatment for patients, but the skills needed to perform an ultrasound exam take years of specialized training to master. Caption Health is bridging this gap through a simple but powerful concept: what if we could use technology to emulate the expertise of highly trained medical experts and put that ability into the hands of every care provider?

Caption Health’s breakthrough technology, Caption AI, empowers healthcare providers with new capabilities to acquire and interpret ultrasound exams by emulating the expertise of a sonographer. The AI software provides real-time probe guidance, automatically captures diagnostic-quality images, and automatically calculates ejection fraction (the most widely used measurement to assess cardiac function). It is the world’s first and only FDA cleared AI-guided ultrasound system.

Kilian talks about the significance of Caption AI for treating Covid-19 patients. He says that many Covid-19 patients are dying due to cardiac complications because the Covid-19 virus is attacking their hearts along with the lungs. As the Covid-19 virus is attacking the heart, it is very important to keep a regular check on the performance of the patient’s heart. But due to the isolation protocol, it becomes very difficult for the experts to do an ultrasound examination of the patient’s heart by personally visiting him/her. In this scenario, Caption AI provides an easy and quick solution by enabling any health care provider to easily get echo images and evaluate heart performance.

The company hopes to democratize healthcare by expanding clinicians’ ability to perform ultrasound at the point of care in order to improve patient outcomes and reduce costs. In 2020, they received three major FDA clearances, including an expedited clearance to support frontline healthcare workers in the fight against COVID-19; closed $53 million in Series B funding; announced their first commercial partnership with Northwestern Medicine; and received a $4.95M grant from the Bill & Melinda Gates Foundation to support the development of innovative AI technology for lung ultrasound.

Topics Discussed in the Podcast

1. What brought Kilian to Artificial Intelligence and medical imaging?
2. How Kilian’s AI-based medical imaging tool helps healthcare providers?
3. What is the significance of AI-based medical imaging tool in treating Covid-19 patients?
4. How Covid-19 impacted Kilian’s medical imaging business?
5. What are the concerns of people regarding Artificial Intelligence?
6. What are the benefits and risks of Artificial Intelligence?
7. How Artificial Intelligence can change the overall health care industry?
8. Why is it so important to decentralized health care?

 Contact detail of Kilian Koepsell

Website: https://captionhealth.com/

 

 

Podcast: Play in new window | Download (Duration: 31:51 — 29.2MB)

Subscribe: RSS

In this episode of CHATTINN CYBER, Marc Schein interviews Sean Hoar, of Lewis Brisbois and chair of the Data Privacy & Cybersecurity Practice. He has extensive experience managing responses to digital crises and effectively marshaling resources to contain and remediate information security incidents. He served as the lead cyber attorney for the U.S. Attorney’s Office in Oregon, and he worked closely with the Computer Crime & Intellectual Property Section in Washington D.C. He holds the Certified Information Systems Security Professional (CISSP), the Global Information Security Professional (GISP), and the Certified Information Privacy Professional/United States (CIPP/US.

Sean served in the US Attorney’s Office for many years where he handled career cases that exposed him to the digital world of electronic surveillance. He believes that cyber hackers have evolved fast and have become more sophisticated over the years, leveraging the systems and applications. Sean explains that as long as cybercriminals are able to monetize data; ransom and other exploits are going to continue, the most dangerous of which right now is extortion. Sean explains how he advises his clients to give information to the FBI who gather evidence across the country and attribute each case to malicious actors, they hold them accountable, and criminally charge them.

Sean explains why security starts with setting up foundational basics in an organization. He also describes the criteria they use to ensure advanced cybersecurity for their clients: they make sure the internal teams understand what they’re supposed to do, and the external teams stay in touch with their obligations. Companies need to put cyber procedures in place to avoid financial consequences in the long run if they are not proactive. “But for me, it’s a matter of helping them really visualize what it will look like, and until they understand that, it’s going to be hard to get them to take action.”

Companies that carry cyber insurance are well educated and have immediate attention and deployment of resources they need to go from one side to the other, which limits the expense and the impact of the attack. Companies without insurance, on the other hand, struggle on who they should call because they don’t have the education and systems in place to go from one side to the other. They contact the wrong people which results in more confusion and expenses.

What You Will Learn:

• The danger of cyber ransom exploits and extortion in risking data privacy online.
• Why cybercrimes are only going to increase in the future and become more dangerous
• How Sean helps his clients visualize their cyber exposure procedure as a long-term financial investment.
• The difference between companies that carry cyber insurance and those who don’t.
• The tools that Sean created to deal with information security control assessments and response planning for the private sector.
• The power of building a stable effective team with the right attitude.

Podcast: Play in new window | Download (Duration: 25:01 — 22.9MB)

Subscribe: RSS

In this episode of Chattinn Cyber, Marc Schein interviews retired Lieutenant General Vince Stewart. He is the Chief Innovation and Business Intelligence Officer at Ankura and Founder/CEO of Stewart Global Solutions. In previous roles, he has served as the Director of Intelligence at the USMC, Commanding General of the Marine Forces Cyberspace Command, Director of the Defense Intelligence Agency, and Deputy Commander of the US Cyber Command.

Born in Jamaica, Vince was determined to live the American dream. In 1971, he and his sister joined their mother in the US with nothing but hope and a vision — no titles, no special privileges, only the basics. He learned to play American football and started at Western Illinois University with a scholarship, eventually being recruited into the US Army ROTC program. He was determined to serve and give back to the country that gave him all these opportunities. 38 years later, Vince retired with many medals and distinctions, all of which he modestly credits to the individuals who served beside him.

Vince speaks deeply to his transition from public to private sector and how despite many years of experience, many challenges still emerged. While in the public sector he was executing the budgets, the private sector forced him to maneuver making the budget and consider the margins in order to facilitate it. The heavy reliance on litigation in the private sector was also a learning point for Vince.

Vince strongly advocates for “collective defense” – a collaboration between organizations and government agencies for sharing intelligence and solutions to win the fight against the very real threats in cyberspace.

Around 60% of large companies ($100 million +) never recover from a data breach. Vince explains the misconception that large companies are the only ones at risk – some criminals want $20 million, but some want just $5000! The mere fact that we all have data that we want to protect is a point of great interest to nation-states and criminals. As a company, around 70% of breaches are as a result of insider activity.

Vince talks about the evolution of phishing and how susceptible many people are to those types of schemes. About 5% of people are curious enough to open an email with the subject line “don’t open this email.” What about the other 95%? Smarter criminals are developing socially engineered phishing, in the form of ads tailored to a person’s interests – you see the ad and you click on the link.

To learn more about Vince’s incredible career, from landing in America with nothing but the basics, to climbing the ladder and becoming the Deputy Commander of the United States Cyber Command, listen to this episode of Chattinn Cyber with Marc Schein.