How do phishing scams, AI-powered attacks, and strategic governance intersect? Together, they're redefining the future of cybersecurity. Organizations are navigating a mix of challenges and implementing innovative solutions to proactively address today's threats.

Today's guest is Kelly Hood. She is the EVP and cybersecurity engineer at Optics Cyber Solutions. She is a CISSP who specializes in implementing cybersecurity and privacy best practices to manage risks and to achieve compliance. She supports the NIST cybersecurity framework and serves as a CMMC registered practitioner, helping organizations strengthen their cybersecurity posture and develop effective risk management strategies.

Show Notes: * [01:06] - Kelly is a cyber security engineer at Optic Cyber Solutions. It's her job to help companies protect themselves. * [02:17] - Don't be embarrassed if you fall for a phishing scam. * [03:01] - These attempts are getting more realistic. Kelly shares how she was briefly fooled by a phishing scam that looks like an email from her mother. * [05:25] - The NIST Cybersecurity Framework is a voluntary framework for defining cybersecurity. An update was put out in February of 2024. They also added a new function. * [06:01] - The five functions that organize a cybersecurity program have been to identify, protect, detect, respond, and recover. They recently added the govern function. * [06:38] - The govern function is about defining your business objective and then putting protections in place that makes sense for those objectives. * [09:01] - The identify function is focused on knowing what we have. * [09:40] - Protect includes everything from identity management, authentication, training, data security, and platform security. * [10:12] - Detect is looking at what's happening around us. It's continuous monitoring and knowing what happens if something goes wrong. * [11:00] - Respond is knowing what the plan is when something does happen. * [12:01] - Recover is about getting back to normal after something happens. * [16:22] - Data centers want to make sure that they have redundant power supplies. * [17:33] - We discuss some of the things that people might forget when identifying cybersecurity assets. Data and people need to be thought about as well as systems and hardware. * [21:00] - We need to write things down and understand what systems and data connections we have. * [23:10] - We talk about the importance of being aware of the physical space and who is actually supposed to be there. * [24:46] - Data is one of the assets that often gets overlooked for protection. There are many new requirements that require data to be protected. * [27:54] - Monitoring to understand what traffic you should expect and what is and isn't normal activity is also important. * [31:10] - Transparency and communication are paramount for creating trust. * [33:51] - Sometimes recovery doesn't mean 100%. Get up and running and prioritize the systems that matter most. * [36:56] - With governance, you really want to look at what you're trying to do with the business and then translate cybersecurity to fit that objective. * [37:27] - Have guidance documentation in place and have oversight.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources: * Podcast Web Page * Facebook Page * whatismyipaddress.com * Easy Prey on Instagram * Easy Prey on Twitter * Easy Prey on LinkedIn * Easy Prey on YouTube * Easy Prey on Pinterest * Optic Cyber Solutions * (MaPT) Maturity and Progress Tracker * Optic Cyber Solutions on LinkedIn * Optic Cyber YouTube * NIST Cybersecurity Framework