Trava Security

You asked for it, so we’re back for another season of your favorite cybersecurity podcast, The Tea on Cybersecurity. In the last two seasons, host Jara Rowe covered everything from the basics – what is phishing? – to implementation – do I need cyber insurance? This season, we dive deep into compliance but, true to our word, simplify things and cover more basics – a must-listen boost your cybersecurity knowledge! Connect with the Host: Jara Rowe’s <a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">LinkedIn</a> Connect with Trava:Website -<a href="https://www.travasecurity.com/" rel="noopener noreferrer" target="_blank"> </a><a href="http://www.travasecurity.com" rel="noopener noreferrer" target="_blank">www.travasecurity.com</a>Blog -<a href="https://www.travasecurity.com/blog" rel="noopener noreferrer" target="_blank"> www.travasecurity.com/blog</a>LinkedIn -<a href="https://www.linkedin.com/company/travasecurity/" rel="noopener noreferrer" target="_blank">@TravaSecurity</a>YouTube -<a href="https://www.youtube.com/channel/UCBqqNS-TSnj2ClgeYdcTKQgrava" rel="noopener noreferrer" target="_blank"> </a><a href="https://www.youtube.com/@travasecurity" rel="noopener noreferrer" target="_blank">@TravaSecurity</a>&nbsp;

Introducing Season 3 of The Tea on Cybersecurity

“Keeping the inventory up to date, make sure that you have all possible points of entry covered and accounted for, similar to a building. When people try to put safeguards for a building, you're doing it, but just like on a network that you can't really physically see if you're missing an asset, that is a hole for an attacker to get into, and we do not want to give them easy access to things for sure.” - Marie Joseph This episode's conversation covers the basics of asset inventories and asset management with host Jara Rowe and guest Marie Joseph, Senior Security Solutions Engineer at Trava. We discuss the categories of assets and the challenges of establishing a comprehensive asset inventory.Hear how tracking and managing hardware and software within an organization is necessary for cybersecurity compliance. We dissect the impact of Bring Your Own Device (BYOD) policies on asset management, the concept of shadow IT, and the role of automated tools and technologies in asset management tasks. In this episode, you’ll learn:&nbsp; <ul><li>Why asset inventories are a crucial part of cybersecurity and compliance and the challenges of continuous upkeep.</li><li>How “Bring Your Own Device” (BYOD) policies help and hinder operations, including cybersecurity risk levels.</li><li>Why most compliance frameworks require companies to maintain different types of inventories to ensure that security and privacy measures are in place and monitored to meet regulatory requirements.&nbsp;</li></ul> Things to listen for: [00:00 - 00:18] Intro to The Tea on Cybersecurity[00:48 - 02:44] The definition of asset inventory and asset management[04:06 - 04:34] Maintaining an accurate software inventory for compliance with licensing agreements[04:34 - 05:51] Common challenges with establishing a complete asset inventory[07:42 - 09:27] Explanation of shadow IT, traditional asset management, and cybersecurity efforts[09:34 - 10:29] How asset management contributes to maintaining compliance.[12:04 - 13:30] Using automated tools in asset management tasks for continuous compliance[13:48 - 14:55] The importance of tracking all devices connected to a network[15:23 - 17:48] Jara’s receipts Connect with the Guest:<a href="https://www.linkedin.com/in/marie-joseph-a81394143/" rel="noopener noreferrer" target="_blank">Marie Joseph's LinkedIn</a> Connect with the host:<a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">Jara Rowe’s LinkedIn</a> Connect with Trava:Website <a href="http://www.travasecurity.com/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com&nbsp;</a>Blog <a href="https://travasecurity.com/learn-with-trava/blog?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com/blog</a>LinkedIn <a href="https://www.linkedin.com/company/travasecurity/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>YouTube <a href="https://www.youtube.com/@travasecurity?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>

Marie Joseph

Senior Security Solutions Engineer at Trava

Navigating Asset Management and Compliance with Marie Joseph, Trava

“Not only do we need to understand what risks might exist, but we need to understand what impact that might have. That goes into both the chance that they're going to happen and the chance that they're going to be successful in creating damage, and then also the likely damage that's going to happen from them.” - Michael MagyarOn this week’s episode, host Jara Rowe gets the tea on risk management with Trava’s vCISO consultant, Michael Magyar. Hear what risk management is, how it differs from crisis management, and what considerations fall under each to maintain compliance.&nbsp; This episode serves as a comprehensive guide for listeners looking to gain a better understanding of risk management, compliance, and general cybersecurity practices. Michael encourages a proactive approach to risk assessment and management to enhance organizational cybersecurity with actionable advice.&nbsp; What you’re learn:<ul><li>Why risk management is proactive and crisis management is reactive, and how to approach both from a preparation standpoint.</li><li>What components of risk management realistically fall under compliance, and why understanding this helps you mitigate potential risk.</li><li>How to start small with risk assessment to identify possible risks and how they might impact your business to build a foundation for effective risk management and cybersecurity practices.&nbsp;</li></ul> Things to listen for:[02:57 - 03:28] Explanation of risk as exposure to danger, harm, or loss[05:45 - 06:53] The importance of risk management for businesses[06:59 - 07:54] Comparison of risk management and crisis management[08:14 - 10:00] Key components of being proactive in cybersecurity[10:07 - 12:27] The role of risk management in compliance efforts[12:37 - 14:38] Challenges and tips in aligning risk management with compliance standards[15:17 - 17:47] Michael's advice for organizations and general cybersecurity[17:55 - 20:32] Jara’s receipts Connect with the host:<a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">Jara Rowe’s LinkedIn</a> Connect with Trava:Website <a href="http://www.travasecurity.com/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com&nbsp;</a>Blog <a href="https://travasecurity.com/learn-with-trava/blog?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com/blog</a>LinkedIn <a href="https://www.linkedin.com/company/travasecurity/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>YouTube <a href="https://www.youtube.com/@travasecurity?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>

Michael Magyar

Trava vCISO Consultant

Deciphering Risk Management and Compliance with Michael Magyar

“So the concept of vulnerability management in many ways is universal. And so if we think about it in a physical sense, try to keep our homes or our businesses secure from a physical sense. It's one of the vulnerabilities. Leaving your doors unlocked, leaving your windows unlocked, leaving a candle lit, and then leaving the house and going somewhere. Those are vulnerabilities.” - Jim Goldman Join our host, Jara Rowe, as she sits down with Trava CEO and Co-founder Jim Goldman to uncover the fundamental importance of vulnerability management in cybersecurity and compliance. In this episode, you'll learn why vulnerability management matters and why businesses can't afford to overlook it.This episode is your opportunity to gain practical insights and empower yourself with the knowledge needed to navigate the world of cybersecurity. Equip yourself to protect your business and stay ahead of the game. Here are the main insights you can expect to take away from this episode: <ul><li>How vulnerability management involves finding and fixing things that hackers could exploit, much like conducting a home inspection for your cybersecurity.</li><li>Why vulnerability management is fundamental for your business and crucial for all compliance frameworks and regulations.</li><li>Why conducting vulnerability management continuously is essential for the security of your business and your customers' data and how to tackle vulnerability management without feeling daunted.</li></ul> Things to listen for:[01:05 - 03:12] The concept of vulnerability management is universal[03:12 - 04:53] Where to begin with vulnerability management[04:54 - 06:14] How vulnerabilities in a system relate to compliance requirements[06:14 - 09:14] Audits as the critical last step to certification and compliance[13:04 - 14:07] When vulnerability management comes into play during the certification process[14:11 - 15:30] Essential components of a vulnerability management program[15:32 - 17:13] Using technology to identify, prioritize, and fix vulnerabilities[17:27 - 19:17] Common challenges organizations typically face in implementing vulnerability management[20:39 - 21:27] Jim’s final thoughts on vulnerability management[21:47 - 23:51] Jara’s receipts Connect with the Guest:<a href="https://www.linkedin.com/in/jigoldman/ " rel="noopener noreferrer" target="_blank">Jim Goldman's LinkedIn</a> Connect with the host:<a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">Jara Rowe’s LinkedIn</a> Connect with Trava:Website <a href="http://www.travasecurity.com/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com&nbsp;</a>Blog <a href="https://travasecurity.com/learn-with-trava/blog?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com/blog</a>LinkedIn <a href="https://www.linkedin.com/company/travasecurity/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>YouTube <a href="https://www.youtube.com/@travasecurity?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>

Jim Goldmnan

Cybersecurity expert, Trava

Why Vulnerability Management Matters for Cybersecurity Compliance

“Find a compliance platform, it'll make life a lot easier. Then I would develop the policies and procedures, if you don't already have those, and then collect evidence to justify, to prove everything you're doing that's in the framework. It's going to be important for audits and just internal or external audits.” - Scott Schlimmer In this episode, host Jara Rowe is once again joined by cyber risk specialist Scott Schlimmer with a deep dive into the world of compliance frameworks and certifications. Listen as we explain the challenges of compliance and non-compliance with certification programs in cybersecurity.&nbsp; Learn which regulated industries must follow specific frameworks and how noncompliance can affect business opportunities and your bottom line. We also unravel Fedramp, CMMC, CCPA, and CPRA, offering a clearer understanding of their cybersecurity roles.&nbsp; In this episode, you’ll learn:&nbsp;<ul><li>How to follow a compliance framework without having the certification, though having the certification can demonstrate to partners and customers that your organization has strong cybersecurity measures.</li><li>The significance of certifications and the value of the NIST framework as a reliable source for general cybersecurity best practices.</li><li>What the legal and financial consequences of noncompliance for different industries may be, such as failing to follow frameworks like Fedramp or CMMC when working with the government.&nbsp;</li></ul> Things to listen for:[00:47 - 01:27] The relationship between compliance frameworks and certification programs[01:27 - 02:54] The difference between regulated and non-regulated industries[02:54 - 04:40] Explanation of the NIST framework and insights into other compliance acronyms[04:40 - 08:59] Multiple compliance frameworks, compliance audits, and non-compliance issues[08:59 - 10:54] Improving cybersecurity posture, security assessment, and maturity models[10:54 - 13:56] Preparation for compliance audits and the importance of a compliance platform[13:56 - 14:31] How to become compliant or get certified and reasons for external assistance[14:38 - 17:20] Jara’s receipts Connect with the Guest:<a href="https://www.linkedin.com/in/scottschlimmer/" rel="noopener noreferrer" target="_blank">Scott Schlimmer's LinkedIn</a> Connect with the host:<a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">Jara Rowe’s LinkedIn</a> Connect with Trava:Website <a href="http://www.travasecurity.com/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com&nbsp;</a>Blog <a href="https://travasecurity.com/learn-with-trava/blog?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">www.travasecurity.com/blog</a>LinkedIn <a href="https://www.linkedin.com/company/travasecurity/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>YouTube <a href="https://www.youtube.com/@travasecurity?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank">@travasecurity</a>

Scott Schlimmer

Cyber risk specialist at Trava

Understanding Cybersecurity Frameworks and Certifications with Scott Schlimmer, Trava

“It's hard to have privacy without security and to have effective security that requires strong protection of personal identifiable information, or PII. So security, privacy, and compliance really must go hand in hand. If one is prioritized over the other, it can have an adverse effect.” - Christina Annechino On this episode, we welcome back both Christina Annechino and Marie Joseph to bring us back to a little more 101 on Cybersecurity. With host Jara Rowe, the team breaks down terms and buzzwords that you need to know to keep you and your company’s data safe.&nbsp;Find out the difference between a breach and an incident, the nuances of security, privacy, and compliance, and gain insights into the crucial importance of cyber hygiene. We'll also explore the key differences between data security and data protection, understanding acronyms like GDPR, CCPA, HIPAA, and PIPEDA, and grasping the significance of maintaining asset inventories. In this episode, you’ll learn:&nbsp;<ul><li>The difference between a breach, when a threat actor gains unauthorized access, and an incident, where data is compromised, is crucial for proactive security measures.</li><li>Understand frameworks vs. standards: Frameworks provide an overview of requirements for compliance and certification, while standards outline specific criteria that must be met, forming the foundation of cybersecurity best practices.</li><li>The importance of cyber hygiene or the tools, processes, and policies you need to maintain a strong security posture, enabling constant improvement in cybersecurity health within organizations.</li></ul> Things to listen for:[00:24 - 02:47] Introduction to episode and compliance series[02:57 - 04:25] The difference between security and privacy and compliance[04:28 - 06:08] The challenges in balancing security, privacy and compliance[06:26 - 07:24]&nbsp; The difference between risk and control[07:31 - 09:46] The difference between a breach and an incident[09:58 - 11:03] The difference between data security and protection[11:03 - 12:18] The most common data protection regulations[12:31 - 13:10] The difference between frameworks and standards[13:22 - 14:50] What is RBAC and how it relates to cybersecurity[14:50 - 16:45] The meaning of IoT and maintaining inventory assets[16:50 - 18:00] What does Cyber Hygiene mean[18:01 - 20:37] Jara’s receipts Connect with the Guest:<a href="https://www.linkedin.com/in/marie-joseph-a81394143/" rel="noopener noreferrer" target="_blank">Marie Joseph's LinkedIn</a><a href="https://www.linkedin.com/in/christina-annechino/" rel="noopener noreferrer" target="_blank">Christina Annechino's LinkedIn</a> Connect with the host:<a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">Jara Rowe’s LinkedIn</a> ﻿Connect with Trava:Website<a href="http://www.travasecurity.com/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> www.travasecurity.com&nbsp;</a>Blog<a href="https://travasecurity.com/learn-with-trava/blog?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> www.travasecurity.com/blog</a>LinkedIn<a href="https://www.linkedin.com/company/travasecurity/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> @travasecurity</a>YouTube<a href="https://www.youtube.com/@travasecurity?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> @travasecurity</a>

Currently, as a Senior Security Solutions Engineer at Trava, I work on different compliance projects which include both security and privacy-driven frameworks with clients. I have helped with conducting annual risk assessments on clients and used that knowledge to help organizations towards different compliance certifications and attestations: SOC2, ISO27001, CCPA, GDPR, etc. In August 2020, I graduated from Indiana University, where I received a graduate degree of Master of Science in Cybersecurity Risk Management through the Kelley School of Business, Maurer School of Law, and Luddy School of Informatics, Computing, and Engineering. Through this program, I gained experience working with incident response plans, cybersecurity best practices, and analysis work through clinics and capstones with IU Health and Eli Lilly. In my undergrad career, I studied Law and Public Policy in the O'Neill School of Public and Environmental Affairs, along with receiving a minor in Human Resource Management. In my undergrad, I traveled abroad in London to learn about UK and US National Security, along with learning from leaders in the MI5, MI6, and the New Scotland Yard. Along with this, I have taken heavy course loads regarding national security, homeland security, law, and policy. In my high school and college experiences, I have developed leadership skills through my work as a nanny, tutor, photographer, and media internships. I have developed leadership skills through my chair position on Indiana University Dance Marathon (IUDM), being Director of Chapter History for my sorority Alpha Gamma Delta, and being Photography Editor for my nationally ranked high school yearbook. I have won multiple awards for my work in photography and photoshop, and was given the prestigious opportunity to attend Media Day for the Indianapolis 500 in 2014 to interview and photograph all the drivers.

Sr. Security Solutions Engineer at Trava

In May 2022, I graduated with a MS degree in Cybersecurity. With this degree I have acquired skills that have enhanced my knowledge and experience in network security, vulnerability assessment, and threat analysis. I have had one technical internship in web development where I reviewed GitLab CI/CD pipelines of medical websites to understand the architecture of jobs in each stage building components such as repositories, libraries, modules, and dependencies to enter testing and deployment. I have also had leadership roles at my university such as working in Career Services and as a board member for Pace Computing Society and PoPTV. I thrive when challenged and thoroughly enjoy learning new things, improving upon myself and my skills. I believe my strong educational background in tech displayed by my undergraduate and graduate degrees demonstrates my knowledge and dedication to becoming a valuable employee in any tech position I attain. A common component that can be seen on any standard company website is their mission statement. If I had to summarize my mission statement, derived from my experience and skills, it would be to contribute revolutionary ideas to the brightest minds working towards the advancement of technology, bettering the world.

Christina Annechino 

Cybersecurity Analyst at Trava

Cybersecurity Compliance Buzzwords with Marie Joseph and Christina Annechino, Trava

“There's a converging of several forces or several trends going on right now that I think are going to potentially cause significant changes in 2024.” @Jim Goldman, CEO of Trava Security, knows a thing or two about cybersecurity. In this episode, Jim and host @Jara Rowe dive into the latest scoop on what's happening in the world of cybersecurity and compliance and what you need to know to keep your business safe and secure in 2024.&nbsp; They discuss how ransomware is alive and well, and federal governments worldwide are taking a stand, which is great news for us, bad news for the cyber terrorists. They also talk about the changes in the compliance landscape in 2024, with a big focus on changing breach disclosures and cybersecurity risk management. They also filled us in on a very helpful resource – CISA, Cybersecurity and Infrastructure Security Agency – available for all of us to stay up-to-date on compliance.&nbsp; In this episode, you’ll learn: <ul><li>Ransomware is a real and growing threat. Learn how federal governments are joining forces to tackle this issue, and discover proactive measures like multifactor authentication to keep your business safe.</li><li>Compliance equality through new regulations are ensuring that all companies, public and private alike, are held to the same standard for cybersecurity risk management and breach disclosures.</li><li>How to secure company laptops and contractor access to ensure remote work resilience</li></ul> Things to listen for: [01:51 -5:14] Overview of Cybersecurity and Compliance Landscape in 2024[5:14 - 6:38] Proactive Measures we can take to mitigate Ransomware attacks[8:34 - 9:58] Cyber Insurance&nbsp;[9:59 - 13:40] Changes in Compliance Frameworks in 2024[16:16 - 19:01] Other threats to be on the lookout in 2024 include work-from-home issues[21:53 - 23:28] How to stay agile and resilient[24:25 - 25:36] Final thoughts from Jim[25:48 - 28:54] Jara’s receipts Connect with the Guest:<a href="https://www.linkedin.com/in/jigoldman/" rel="noopener noreferrer" target="_blank">Jim Goldman's LinkedIn</a> Connect with the host:<a href="https://www.linkedin.com/in/jararowe/" rel="noopener noreferrer" target="_blank">Jara Rowe’s LinkedIn</a> ﻿Connect with Trava:Website<a href="http://www.travasecurity.com/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> www.travasecurity.com&nbsp;</a>Blog<a href="https://travasecurity.com/learn-with-trava/blog?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> www.travasecurity.com/blog</a>LinkedIn<a href="https://www.linkedin.com/company/travasecurity/?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> @travasecurity</a>YouTube<a href="https://www.youtube.com/@travasecurity?utm_source=casted&amp;utm_medium=podcast&amp;utm_campaign=podcast_share" rel="noopener noreferrer" target="_blank"> @travasecurity</a>

Jim Goldman

CEO of Trava Security

Cybersecurity in 2024: Trava’s CEO Jim Goldman on What to Expect

The Tea on Cybersecurity by Trava

Blog

Linkedin

Cybersecurity—a word we hear all the time. Show of hands for those who actually understand what it means.The Tea on Cybersecurity is here to help educate the newbs on what cybersecurity is, why it is important, and everything in between. The Tea on Cybersecurity is for everyone, but especially those small and medium-sized businesses that are starting their journey in building a cyber risk management program. Each show is about 15-30 minutes long to deliver you with the facts and less fluff.

Introducing Season 3 of The Tea on Cybersecurity

DESCRIPTION

Today's Host

Jara Rowe

Recent Episodes