How EDR Is Different from Traditional Anti-Malware/Anti-Virus Software
In today’s cybersecurity landscape, threats are more complex, persistent, and evasive than ever before. Traditional anti-virus (AV) and anti-malware solutions, once the gold standard for endpoint protection, are no longer enough. That’s where Endpoint Detection and Response (EDR) comes in—a next-generation solution designed to detect, investigate, and respond to threats in real time. But what…Read…
How Information Security Shapes the Future of AI and Machine Learning
Artificial Intelligence (AI) and Machine Learning (ML) are transforming industries, from healthcare to finance to transportation. But as these technologies become more powerful, they also become more vulnerable. One of the biggest and often under-discussed influences on AI/ML development is information security. Just as AI and ML are being used to bolster cybersecurity, the reverse…Read…
What is the Minimum Necessary Cybersecurity Program?
In today’s increasingly digital financial landscape, cyber threats are not a question of if, but when. For financial institutions like yours, the stakes are exceptionally high—customer trust, financial stability, and regulatory reputation hang in the balance. It has been found time and time again that it is less costly to protect your institution from devastating…Read…
Why ISACs Are Essential for Effective Threat Intelligence
As cyber threats become more frequent and more advanced, no organization, no matter how large or well-funded, can effectively stand alone. Threat actors are collaborating, sharing tools, and constantly evolving their tactics. The best way to fight back? With a united front. Information Sharing and Analysis Centers (ISACs) offer a powerful way for organizations to…Read…
Strengthening Cyber Defenses Through Cybersecurity Program Performance Management
Organizations face a constant barrage of cyber threats, from phishing attacks and ransomware to insider threats and zero-day vulnerabilities. To stay ahead, businesses need more than just reactive security measures. They need a proactive, strategic approach. That’s where Cybersecurity Program Performance Management (CPPM) comes in. What is Cybersecurity Program Performance Management? Cybersecurity Program Performance Management…Read…
Why Using a Search Firm is Critical for Filling Cybersecurity Roles
With the increasing frequency and sophistication of cyber threats, companies are scrambling to build strong cybersecurity teams. But here’s the problem: skilled cybersecurity professionals are in high demand and short supply. That’s where the value of a specialized search firm becomes clear. The Challenge of Hiring Cybersecurity Resources Filling cybersecurity roles is unlike hiring for…Read…
Why Your Organization Needs an Annual Third-Party Information Security Assessment
Information security has evolved from a purely technical issue to a core business concern. As cyberattacks become more frequent, sophisticated, and damaging, organizations of every size and industry face growing pressure to protect sensitive data, maintain regulatory compliance, and ensure operational continuity. Unfortunately, many organizations still operate with a false sense of security, trusting internal…Read…
Why Information Security Should Be Baked In From Day One, Not Bolted On Later
In the fast-paced world of startups and growing businesses, it’s easy to prioritize product development, customer acquisition, and scaling operations over backend functions like information security. After all, if no one’s hacking you yet, why invest in something that doesn’t directly generate revenue? This mindset is not only outdated, it’s dangerous. The Cost of Retrofitting…Read…
The Importance of Third-Party Risk Management in the Cloud: Navigating the Shared Responsibility Model
In today’s hyper-connected digital landscape, cloud computing has revolutionized the way organizations operate. From increased scalability to operational efficiency, the benefits are undeniable. However, with this shift comes a new array of cybersecurity challenges, particularly when it comes to managing third-party risks and understanding the shared responsibility model. What Is the Shared Responsibility Model? Cloud…Read…
The Value Proposition of Zero Trust: Reducing Cybersecurity Risk Through Smarter Architecture
In today’s digital landscape, the traditional perimeter-based approach to cybersecurity is no longer sufficient. As organizations increasingly adopt cloud services, support remote work, and manage a growing number of endpoints and users, the attack surface expands exponentially. In this environment, the question is not if a breach will happen, but when and whether your security model is prepared…Read…
Why the Human Element is the Most Important Part of Cybersecurity
Yesterday, I spoke at the Durant Chamber Coffee highlighting the importance of the human in cybersecurity. I would argue the human is the most important. Why? In the ever-evolving world of cybersecurity, we have a tendency to focus heavily on technology—firewalls, intrusion detection systems, encryption protocols, AI-powered threat analysis. And while these tools are essential,…Read…
The Importance of Cybersecurity Performance Management: A Key to Protecting Your Organization
In today’s fast-paced digital world, businesses of all sizes are at constant risk of cyberattacks. The frequency, sophistication, and severity of these attacks continue to rise, causing organizations to spend increasing amounts of time, money, and resources trying to protect themselves. However, many businesses overlook one crucial component that can make or break their cybersecurity…Read…
Defining “Reasonable” Security: Insights from the 2016 California Data Breach Report
In today’s rapidly evolving digital landscape, organizations face increasing pressure to secure sensitive information while complying with an ever-growing number of laws and regulations. Central to this challenge is defining what constitutes “reasonable” security—an elusive yet essential standard for safeguarding personal and business data. One of the most significant sources that sheds light on this…Read…
Understanding the Difference Between Vulnerability Scans and Vulnerability Assessments
In today’s rapidly evolving digital landscape, cybersecurity is more critical than ever. With businesses relying on technology to drive growth, safeguard data, and maintain operations, securing systems and networks from potential threats has become paramount. Two terms that often come up in cybersecurity discussions are “vulnerability scan” and “vulnerability assessment.” Though these terms may sound…Read…
Understanding the Difference Between a Security Event, Incident and Breach
I was on a call the other day discussing security incident and breach response. One of the things that we both highlighted is the difference between an event, incident and breach. Confusing these three could land you in a lot of trouble. What is an Event? According to NIST, an event is any observable occurrence…Read…
The Importance and Advantages of Creating Documentation for SOC 2 Compliance
In today’s increasingly digital world, data security and privacy are more critical than ever. As businesses handle sensitive customer data, they must ensure that proper safeguards are in place to protect this information. One of the most widely recognized frameworks for achieving this is the SOC 2 (System and Organization Controls 2) standard, which assesses…Read…
Keeping Your Business Secure
Small businesses are not exempt from cybersecurity threats. Here are some key facts about cybersecurity and small businesses: Laws both from the federal government and the state call for reasonable security. Relevant Federal Cybersecurity Law Relevant Oklahoma Cybersecurity Law Tips to Remain Secure:
The Importance of Security Certifications: CISSP, CISM, and CRISC
In the ever-evolving field of cybersecurity, organizations are increasingly relying on certified professionals to protect their digital assets and maintain robust security systems. As cyber threats continue to grow in sophistication and frequency, having a highly skilled and knowledgeable security team has become paramount. One of the most effective ways to demonstrate this expertise is…Read…
Understanding the Function of Information Security Operations vs. Information Security Engineering
In today’s digital landscape, where cyber threats are constantly evolving, organizations must develop robust strategies to protect their sensitive data, systems, and networks. Two essential areas within this strategy are Information Security Operations (SecOps) and Information Security Engineering. While both play pivotal roles in maintaining a secure environment, they focus on different aspects of information…Read…
The Importance of KPIs and KRIs in an Information Security Program
In today’s increasingly complex digital landscape, organizations face constant cyber threats that can impact their data, reputation, and bottom line. As businesses work to defend against these threats, it’s not just enough to have robust security systems in place. To ensure effective cybersecurity, it’s crucial to measure, monitor, and continuously improve security performance. This is…Read…
The Importance of Using Contractors for Staff Augmentation in Information Security
In today’s fast-paced and ever-evolving world of cybersecurity, businesses are constantly facing new threats and challenges. As organizations strive to protect their sensitive data and maintain the integrity of their digital infrastructure, having a skilled and flexible information security team is crucial. While traditional full-time employees have long been the cornerstone of many IT departments,…Read…
Why have Enterprise Security Architecture?
In today’s rapidly evolving digital landscape, organizations face an increasing number of cybersecurity threats that can compromise sensitive data, disrupt operations, and damage their reputation. Whether it’s ransomware attacks, phishing scams, or insider threats, the need for a robust and proactive cybersecurity strategy has never been more critical. One of the most effective ways to…Read…
The Importance of an Information Security GRC Program
In today’s interconnected world, businesses face an ever-growing array of cyber threats, from sophisticated attacks to regulatory pressures. With the stakes higher than ever, securing sensitive data, protecting assets, and ensuring compliance with legal and industry requirements are essential components of any successful business strategy. This is where a comprehensive Governance, Risk, and Compliance (GRC)…Read…
Launch of vCISO Services with Gilliam Security
I am excited to announce the launch of our new vCISO services — a game-changing solution designed to elevate your organization’s cybersecurity posture without the need for an in-house, full-time executive. In today’s increasingly digital world, cybersecurity is more critical than ever. Small to mid-sized businesses often face the challenge of securing their data and…Read…
Adoption of Compliance Requirements through Continuous Compliance
Many times several different assessments are required to understand adherence to a policy, regulatory framework, industry requirement, or some other regulation. While none of this difficult, it can result in asking the same question multiple times or fatigue of your auditee. To reduce fatigue and be able to view compliance across the board, as well…Read…
Third Party Security Risk Management
From acquisitions to mergers to software having integrations with systems outside of your organization’s span of control, third party security risk management has never been more important. One of the most famous examples where third party risk management failed was the acquisition of the Starwood brand by Marriott in 2016. Impact of Third Party Risk…Read…
Cyber Insurance: To Get Paid or Not Be Paid
So you have bought cyber insurance. Let’s take a deep breath knowing that you can be assured that you will not be out millions of dollars should your legal team announce your organization has been breached. Or maybe your organization will hear the words, “we are unable to cover your expenses.” Unfortunately, the latter is…Read…
Where to Start When Starting with Security
Security can be intimidating at first. The words “I feel like the sky is falling, just tell me where we need to start” are often said. One of the goals of the security program should be to have a positive employee experience that makes an impact on the organization to disrupt your industry with using…Read…
Security through Cloud or On-Premise?
One of the most common techniques of vendors is to immediately up sell going to the cloud; however, is the cloud always the best choice? To understand the true benefits of the cloud, one must first understand what the cloud is. Often this is alluded to a mega-structure with Fort Knox style security as well…Read…
What is Reasonable Security?
The words “Reasonable Security” often come up in executive meetings to help understand “what do we need to do?” As a security professional, our goal is to make things as secure based on a risk-based approach but risk can be defined differently based on where one is. In 2019, a big scramble was made by…Read…
SOC 2: Why Should I Care?
Often times an organization is asked “Do you have a SOC 2?” when one wants to find out about an organization’s information security state; however, do we know what benefit that really provides? A SOC 2 Report is a report that helps prospective customers, current and future auditors, investors, and company stakeholders understand the controls…Read…
Avoid Being a Cyber-Statistic
Did you know 6 in 10 small businesses go out of business within six months that fall victim to a cyber attack? Do not let that be you. Read more here to learn how to avoid becoming a cyber-statistic. Read the white paper Avoid Being a Cyber-Statistic to learn more.
