ByteWise

Putting Members First: A CXO's Perspective on Technology, Risk, and Experience

Guest: Bill Peters, Chief Experience Officer at TAPCO Credit Union
Episode Summary:
In this episode of ByteWise, we're joined by Bill Peters, Chief Experience Officer at TAPCO Credit Union. Bill shares his insights on how to effectively manage technology, risk, privacy, and security while prioritizing the member experience. He emphasizes the importance of:
Collaboration: Breaking down silos and partnering with stakeholders across the organization, including the board, IT, and risk management.
Early Evaluation: Incorporating privacy and security considerations from the very beginning when evaluating new technologies and vendors.
Member Focus: Using data to understand member behavior and needs, but always prioritizing member privacy and security.
Continuous Learning: Investing in board and staff education to stay ahead of emerging technologies and threats.
AI for Efficiency: Leveraging AI to increase efficiency and free up staff for more complex tasks and relationship building.
Bill also provides valuable advice for new CXOs, emphasizing the importance of asking questions, being curious, and building trust and vulnerability within teams.
Key Takeaways:
CXOs need to be well-versed in technology, risk, privacy, and security to effectively lead their organizations.
Collaboration is essential for successful technology implementation and risk management.
Data can be a powerful tool for understanding member needs, but privacy and security must be prioritized.
AI can be a game-changer for efficiency, but it's important to manage employee concerns and expectations.
Continuous learning and development are crucial for both board members and staff.
Connect:
Bill Peters
TAPCO Credit Union

S1E22 Unlocking Influence

Unlocking Influence
In this episode of ByteWise, Daniela and Glen dive into the often-overlooked importance of sales skills in risk management. They go beyond the spreadsheets and data analysis to reveal why understanding client needs, building trust, and nurturing long-term relationships are crucial for success in this field.
Daniela and Glen explore the dynamics of vendor relationships, the role of technology in business decisions, and the essential need for clear communication between internal teams and external consultants. This insightful conversation highlights the power of translating risk assessments into strategic benefits and fostering genuine resilience within organizations.
Key Takeaways:
Sales skills are not just for salespeople: Risk managers need to be persuasive communicators to effectively convey their message and influence decision-making.
Empathy is key: Understanding client pain points and perspectives is crucial for developing tailored risk solutions.
Trust is the foundation: Building strong relationships with stakeholders, both internal and external, requires trust and transparency.
Think long-term: Risk management is not a one-off activity; it requires a long-term perspective and ongoing relationship management.
Vendor engagement is crucial: Vendors need to engage with all stakeholders, not just the IT department, to understand the broader business context.
Empower your internal team: Equipping internal employees with sales skills and processes can improve communication and collaboration.
Leverage external expertise: External consultants can bring valuable credibility and insights to enhance risk management efforts.
Relationships matter: Cultivating and maintaining relationships is essential for long-term success in risk management.
Ask the right questions: Effective communication starts with asking insightful questions to truly understand client needs and concerns.
Translate assessments into action: Risk assessments should be translated into tangible strategic benefits to drive meaningful change within organizations.
What to do next:
Subscribe to Bytewise Podcast on your favorite platform.
Share this episode with colleagues and friends in the risk management and technology fields.
Leave a review and tell us what you think of the show!
We hope you enjoyed this episode of Bytewise! Tune in next time for more insightful discussions on the intersection of technology and risk management.

S1E21 Deadwood Decoded - Glen's Conference Chronicles

Join Daniela, Brian, and Glen as they dissect Glen's recent conference experiences. Glen shares insights from Secure World and Wild West Hackin' Fest, highlighting the ongoing struggle to effectively manage AI risks, the persistent gap between business leaders and cybersecurity professionals, and the need for better communication and collaboration across departments. They discuss the challenges of technical debt, the ransomware epidemic, and the importance of investing in detection and response mechanisms. 
Key Takeaways:
AI Governance Gap: While AI is a hot topic, there's a lack of focus on organizational governance and risk management.
Communication Breakdown: A chasm remains between business leaders and cybersecurity professionals, hindering effective risk communication and decision-making.
Tool Overload: An overreliance on tools and technology without proper strategy and communication is a common pitfall.
Ransomware Reality: Ransomware remains a significant threat, highlighting the need for stronger preventative measures and investment in detection and response.
Small and Medium Businesses: Smaller organizations often struggle to find cybersecurity solutions that fit their needs and budgets.
Shifting Focus: There's a growing recognition of the need to move beyond prevention and invest more in detection, response, and recovery.
Breaking Down Silos: Increased collaboration between security, legal, risk management, and other departments is crucial for effective cybersecurity.
Resources Mentioned:
https://www.secureworld.io
https://wildwesthackinfest.com
Call to Action:
Think beyond tools and technology. Focus on strategy, communication, and collaboration.
Invest in detection and response mechanisms to minimize the impact of cyberattacks.
Break down silos and foster communication between departments.
Consider attending cybersecurity conferences to stay informed and network with peers.
Connect with ByteWise:
https://bytewise.podbean.com/
https://www.linkedin.com/company/bytewise-podcast/
 
 

S1E20 Beyond Certifications - Hiring for Curiosity and Growth

In this episode of ByteWise, Glen and Brian discuss the nuances of hiring in the tech industry. They emphasize the importance of finding candidates who are a good cultural fit and have the potential to grow, even over those with perfect qualifications on paper. They delve into the limitations of relying solely on certifications and degrees, highlighting the value of real-world experience and problem-solving skills.
The hosts also encourage tech professionals to develop business acumen and bridge the communication gap with business leaders. Additionally, they discuss the benefits of remote work and the importance of trust and leadership in managing remote teams, while critiquing the trend of companies forcing employees back to the office full-time.
Key Takeaways:
Prioritize cultural fit and potential for growth when hiring.
Look for candidates with intellectual curiosity, problem-solving skills, and a willingness to learn.
Encourage tech professionals to develop business acumen.
Embrace remote work and trust employees.
Avoid rushing the hiring process and focus on finding the right fit.
What to do next:
Subscribe to ByteWise on your favorite podcast platform.
Share this episode with your colleagues and friends in the tech industry.
Leave a review and let us know what you think of the show!
We hope you enjoyed this episode of ByteWise. Tune in next time for more insights and discussions on the intersection of technology and business.

S1E19 Bridging the Gap - from InfoSec to Fraud Fighter

Guest: Mark Moore, VP Fraud Strategy and Prevention 
 
Episode Highlights:
The Fraud-Tech Fusion: Mark shares his unique journey from InfoSec to Fraud, highlighting the increasing overlap between cybersecurity and fraud prevention in today's digital landscape.
Outsmarting the Scammers: From the resurgence of check fraud on Telegram to sophisticated multi-layered attacks, Mark reveals the latest tactics fraudsters are using and how to stay one step ahead.
Building a Proactive Defense: It's not just about "whack-a-mole" anymore! Learn how Mark builds proactive fraud prevention strategies, emphasizing the importance of data analysis, collaboration with marketing and digital teams, and utilizing tools like LinkedIn and DefenseStorm's newsletter to stay informed.
The Ideal Fraud Fighter: Forget the stereotypes! Curiosity, humor, adaptability, and resilience are the key traits Mark looks for when building his team. He also shares insights on using the SFIA framework for effective hiring and training.
Navigating the Org Chart: Where does fraud prevention fit best within an organization? Mark discusses the pros and cons of embedding fraud teams within IT, risk management, or operations, emphasizing the need for flexibility and understanding each organization's unique strengths.
Key Takeaways:
The lines between fraud and cybersecurity are blurring, necessitating closer collaboration between these fields.
Data is key in both fraud and marketing, making cross-departmental partnerships essential.
Soft skills like curiosity, adaptability, and resilience are just as important as technical skills in fraud prevention.
Building a proactive fraud defense requires staying informed, utilizing the right tools, and understanding the evolving tactics of fraudsters.
The ideal organizational structure for fraud prevention varies depending on the company's strengths and culture.
Resources:
International Association of Financial Crimes Investigators
Northwest Fraud Investigators Association
Association of Certified Financial Crime Specialists
Center for Financial Professionals
DefenseStorm
Connect with Mark!
 
 
 

S1E18 Dungeons, Dragons, and... Don't Click that Link! Cybersecurity Awareness Month is almost here!

October is looming, and for many, that means the dreaded annual cybersecurity training. But on this week's ByteWise,we're here to tell you it doesn't have to be a snoozefest!
We kick off with Daniela's newfound obsession: the Darknet Diaries podcast. It's a thrilling deep dive into the underbelly of the internet, perfect for getting in the cybersecurity mindset. (Just maybe don't listen to it before bed!)
Then, we tackle the big question: How can we make cybersecurity awareness fun? Forget those click-through slideshows.We're talking:
The "Inside Man" - a binge-worthy series that had employees begging for more.
A treasure hunt that turned the office into a playful battleground.
A phishing contest that pitted departments against each other (with hilarious results).
Roundtable discussions that tapped into employee expertise and offered the chance to win prizes.
"Feature Friday" - a simple but effective way to put a human face on security.
And for the truly adventurous: tabletop exercises with a Dungeons & Dragons twist!
We also share a treasure trove of free resources to get you started. So, ditch the boring webinars and turn October into a month of cybersecurity excitement! Your employees (and your data) will thank you.
Links & Resources:
All the goodies mentioned in the episode:
CISA Cybersecurity Awareness Month (free)
National Cybersecurity Alliance (free)
KnowBe4 - Home of the "Inside Man"
Wizer (great alternative for training and phishing)
Hackback Gaming
Ready to level up your cybersecurity awareness? Subscribe to ByteWise today!
Subscribe!

S1E17 Beyond Gut Feeling - Let's talk about Risk Appetite!

In this episode of ByteWise Podcast, Daniela, Brian, and Glen chat with Jeff Owen, Chief Operating Officer at Rochdale, a credit union services organization (CUSO) specializing in enterprise risk management (ERM). They delve into the often misunderstood concepts of risk appetite and risk tolerance, emphasizing their importance in the information security and technology space. Jeff shares his insights on defining ERM, establishing risk appetite statements, and integrating them into strategic decision-making. He also discusses the challenges of gaining buy-in for risk management initiatives and provides actionable advice for incorporating risk appetite statements into cybersecurity strategies.
Key Takeaways:
Defining ERM: Jeff emphasizes the importance of understanding ERM's objectives before jumping into discussions, highlighting the need for a holistic approach that considers the biggest risks tied to organizational objectives.
Risk Appetite vs. Risk Tolerance: Jeff differentiates between risk appetite (broad, qualitative view of acceptable risk) and risk tolerance (detailed, quantitative boundaries on specific risks).
Establishing Risk Appetite Statements: Jeff outlines a step-by-step process involving dialogue between the board and executive team, incorporating risk categories and objectives, and creating hypothetical scenarios to gauge risk tolerance.
Communicating Risk Appetite Statements: Jeff stresses the importance of communicating risk appetite statements to decision-makers across the organization, ensuring they understand and can leverage them in their roles.
Cyber Risk Appetite: Jeff acknowledges the increased focus on cyber risk from regulators and boards and discusses incorporating cyber risk as a separate risk category in risk appetite statements.
Integrating Risk Appetite with Strategy: Jeff highlights the value of integrating risk appetite conversations into strategic planning to proactively address risks and opportunities.
Following Up on Risk Appetite Statements: Jeff suggests identifying measurable risk tolerances, tracking adherence to them, and establishing processes to address breaches.
Example Risk Appetite Statement: Jeff shares an example risk appetite statement that balances an aggressive strategic plan for partnering with innovative technology providers with the importance of protecting member data and maintaining member confidence.
Guest Information:
Jeff Owen, Chief Operating Officer at Rochdale
LinkedIn: Jeff Owen
Email: jowen@rochdaleparagon.com 

S1E16 Turning Lemons into Lemonade

Turning Lemons into Lemonade!
In this episode of ByteWise, Daniela, Brian, and Glen dive into the concept of "never letting a good crisis go to waste." They explore how organizations can leverage incidents, both big and small, to drive positive change and strengthen their security posture.
Topics Discussed:
The concept of "never letting a good crisis go to waste": Origin of the phrase, how it applies to risk management and incident response.
Optimism bias: The tendency to underestimate the likelihood of negative events. How it can hinder proactive risk management.
Learning from incidents: Whether they happen to your organization or someone else, every incident is a learning opportunity.
Practical ways to leverage crises:
Sharing news articles and translating them into actionable insights for decision makers.
Conducting tabletop exercises and simulations to identify weaknesses and test assumptions.
Conducting blameless retrospectives to learn from your own incidents and prevent them from happening again.
The importance of communication: Clearly communicating the potential impact of incidents to decision makers and translating technical jargon into understandable language.
Remember that everyone is vulnerable to cyber attacks: Don't underestimate the risk to your organization.
The importance of cyber resilience: Investing in cyber resilience is crucial, but it's also important to acknowledge that organizations can be victims of crimes.
The role of third-party risk: A significant percentage of incidents are caused by third-party vendors.
Key Takeaways:
Incidents, whether big or small, can be used to drive positive change and improve your organization's security posture.
Don't let optimism bias prevent you from taking proactive steps to mitigate risk.
Learn from the mistakes of others and use their experiences to strengthen your own defenses.
Communicate clearly and effectively with decision makers to ensure that your concerns are heard and addressed.
Share your thoughts on the episode and let us know how you've leveraged crises to drive positive change in your organization.

S1E15 The Eternal Tug of War - Convenience vs. Security

In this episode of ByteWise, Daniela, Brian, and Glenn discuss the ongoing tension between convenience and security in our personal and professional lives. They explore the risks associated with popular conveniences like one-click purchases, facial recognition, and smart home devices, emphasizing the importance of reading privacy policies and being mindful of our digital footprint.
The conversation shifts to the workplace, highlighting challenges like the use of personal devices, email autofill, and cloud-based tools. They stress the need for transparency between employees and IT/security teams, finding a balance between user experience and security, and providing employees with the right tools to do their jobs securely.
The hosts also touch on the benefits of password managers and single sign-on, the risks of using personal phones for work, and the role of mobile device management (MDM). They conclude by reminding listeners to question the cost of "free" apps and services, emphasizing that convenience should not come at the expense of privacy and security.
Key Takeaways:
Convenience vs. Security: The episode explores the constant tension between convenience and security in both personal and professional lives, highlighting the trade-offs we make for ease of use.
Digital Footprint & Privacy Concerns: The hosts discuss the risks of leaving a massive digital footprint, with our data being collected and potentially exploited by various entities.
Workplace Challenges: The conversation shifts to the workplace, focusing on the challenges of balancing convenience and security when using personal devices, email autofill, and cloud-based tools.
Transparency & Communication: The importance of open communication between employees and IT/security professionals is emphasized to ensure a secure and efficient work environment.
Tools for Security & Convenience: The hosts discuss tools like password managers and single sign-on that can enhance both security and convenience.
Personal Devices & Work: The risks associated with using personal phones for work, such as potential legal issues, are explored, along with the role of mobile device management (MDM) in mitigating these risks.
The Hidden Cost of Convenience: The episode concludes by reminding listeners to question the cost of "free" apps and services, emphasizing that convenience often comes at the price of privacy and security.
Enjoyed this episode on balancing convenience and security? Help us spread the word! Share this episode with your friends and colleagues, and don't forget to subscribe to ByteWise for more insightful discussions on how to connect the dots between risk management, technology, and information security. 

S1E14 Risk & Reward: The Innovation Equation

In this episode, Daniela, Brian, and Glen dive into the complex relationship between innovation and security with special guest Scott Daukas. They discuss common misconceptions between innovators and risk/security professionals, how to bridge the gap, and the importance of collaboration in building a secure and innovative future. The conversation also explores legacy systems, strategic planning, and the value of early involvement in the innovation process.Key Takeaways:Misconceptions: Innovators are often seen as mavericks disregarding risk, while risk/security professionals are sometimes perceived as roadblocks to progress.Bridging the Gap: Education, collaboration, and fostering a culture of shared goals are key to breaking down silos and building trust.Early Involvement: Bringing risk and security professionals into innovation discussions early on helps identify potential vulnerabilities and create more resilient products.Strategic Planning: Integrating risk management into strategic planning ensures that security considerations are part of the big picture and not just an afterthought.Legacy Systems: These pose challenges for innovation, but organizations can adapt by identifying systems of record, utilizing APIs, and strategically investing in upgrades.The How, Not the No: Risk and security teams can focus on finding solutions rather than just saying no to new technologies.Relationships Matter: Building strong relationships and understanding each other's perspectives leads to better communication and faster decision-making.Guest:Scott Daukas, Principal at One Washington Financial, brings over 25 years of experience in the credit union industry, specializing in innovation and strategy.To our listeners:Reach out to those who you might typically view as being in opposition to your goals. Engage in conversation, seek to understand their perspective, and discover common ground to drive innovation and security together.Remember: By fostering collaboration and understanding, we can create a more secure and innovative future.