I think maybe I should check to see if we paid for cloud backup protection. Or maybe, we’re doing it. Who knows?
Thanks to this week’s podcast sponsor, Adaptive Shield
Got feedback? Join the conversation on LinkedIn.
On this week’s episode
Why is everybody talking about this now?
Is your cloud service provider backing up your data, or should you be doing that? Many users of OVHcloud realized they should have been doing it because they didn’t realize what they had bought. OVH suffered a fire that destroyed one of its data centers making some of the customer data unrecoverable. They had backup of some services, but no backups of other data. As of now, OVH is backing up all customer data for free, but this speaks to a big problem with trusting cloud providers, noted Enrico Signoretti of GigaOm in a post on LinkedIn. Did you pay for backups? How are they being provided? Where physically are they? And how often do you test restoring? Everyone knows they should do this, but how often is it actually being done?
Someone has a question on the AskNetSec subreddit
On the AskNetSec subreddit, the question was asked, “What’s the advantage of reporting bugs to official sources over brokers?” Some really good pro and con discussions of both ranged from brokers usually pay more, to going straight to the source seems “the right thing to do.” But there were so many variances that it wasn’t that cut and dry. As a bug bounty hunter, if you find a significant bug, where should you go first?
Rick Woodward from Gibbs & Cox asks, “Which kind of dishonesty is the worst?”
Hey you’re a CISO, what’s your take?
Another redditor on the AskNetSec subreddit asks, what kinds of questions should the interviewee ask about a company’s environment so they know they’re not walking into a giant mess? There were a ton of good suggested questions in the thread. If you could only ask three, which three would you ask that would give you the most information about both the stability and challenge of the security environment?
What would you advise?
Ross Young asked, I want to be a board advisor, how am I going to be paid? How much effort do I want to spend on this? What compensation should I expect? What do companies expect a CISO as an advisor to do? You both are advisors, so what’s your experience, advice, and what have you heard from others?