Category: Cybersecurity & Infosec

[November 18, 2024] Docent Institute hosted the 2024 Chicago Security Speakeasy with 60 guests for drinks and dinner at the oldest private club in Chicago. A wonderful venue for a formal pre-holiday party and charity fundraiser. Thanks to my friends for making it possible, as members of this exclusive club!

I was honored to be invited to give a presentation on November 14th in Rockford, IL for the Rock River Valley Section. The turnout was 30+ members and non-members. Click the image above for the PDF.

ABSTRACT Read More

CornCon “Quad Cities Cybersecurity Conference” is returning in person on September 30 & October 1, 2022. To be held at RiverCenter convention center in downtown Davenport, Iowa, this year’s conference will include a Thursday CISO summit (TBD), two days full of great speakers, tutorials, villages and expo, as well has K12 activities on both Friday and Saturday. More details can be found on the conference website: https://corncon.net. (note that early bird pricing has been extended to July 15th)

https://www.forbes.com/sites/bobzukis/2022/06/27/rsa-2022-solutions-to-systemic-cyber-risk-are-emerging-but-its-early/?sh=518b6fbe1c42

Systemic risk is about the risk that exists between the parts of any complex system. This includes third-party vulnerabilities. Being able to understand if any third party introduces critical levels of systemic risk to the entire system through concentration risk is also a critical systemic cyber risk challenge.

It was a great honor to be asked to keynote Bloomcon this morning! Wish I could have been there in person. Despite the issues we had getting sound to work with Zoom, I ended my presentation on time. I’ll have to go in person next year!Link to my slides: https://johndjohnson.com/…/BloomCon.2022.JJOHNSON…

I was fortunate to be on a panel to discuss the Software Supply Chain with Richard Rushing, Bryan Hurd and Richard Greenberg (moderator) for the ISSA Los Angeles chapter on Wednesday (1/19/21). Click here to view the recording, https://www.youtube.com/watch?v=y3wqCc34tME.

Supply chain security can refer to suppliers who provide services, staffing, support, or who develop software/hardware. The supply chain is varied and different across industry segments and organizations. If you consider the development of applications or electronics, there may be a long list of companies who contribute to the final product. The longer the supply chain and the less visibility you have into (or ability to assess) each supplier, the higher the overall complexity and resulting risk to your organization.

Let’s consider the software that we use in our own organizations. There is a lot of it. Do you have a complete inventory of the software you have running on your endpoints, or supporting business processes? Having a granular software inventory and an approved enterprise application catalog is a starting point. The granular information you need includes: “Who owns and makes decisions about the application?” “Who supports and patches it?” “Who budgets for and pays for licenses?” “What is the application architecture and how does it communicate?” Having a central trusted software inventory (this may differ between desktops and servers) is a starting point. Read More

How can programs aimed at K-12 students encourage more kids to consider cybersecurity as a career? Watch the webinar recording now!

This interactive webinar is designed for educators and professionals who want to learn from cybersecurity professionals who have developed engaging STEM events to get kids excited about cybersecurity as a possible career. The panelists will share examples of successful events and activities that they have led with K-12 students for over a decade, many of which you can duplicate in your own community. Read More