Travis DeForge

Cross training and assigning multiple highly capable team mates to any project is critical prior to an unexpected departure. By the time a two week notice is tendered, it is far too late to recover the project process and ensure timelines are maintained if that is not a contingency plan at the onset. When two are assigned, and one leaves it changes the problem statement from "who can take this on?" to "who can provide support?". That nuance is a critical difference in an organization running many concurrent high-profile projects.

There are many aspects to ensuring data security in remote working environments; like most aspects of security a defense in depth model is ideal. Start by ensuring that all devices allowed to access corporate data are managed and compliant with baseline security policies. This should include updated operatint systems, encryption at rest, and the deployment of a corporate VPN and endpoint security solution at a minimum. Next ensure that MFA (ideally phishing resistant MFA) is enforced across all users where ever possible. An additional best practice is making sure there is robust data classification and data loss prevention (DLP) controls in place.

Cloud security is the hot topic of the time, and there is no shortage of content being made on it. Not only do each of the major cloud vendors have a plethora of documentation and learning content that is typically free, but there are extremely talented content creators who also put free content into the community. I'm of the mindset that there is absolutely a place for paid course content, guided labs, and expensive certification exams. But, before getting to that point, you should exhaust the free options available to you. For example, John Savil has an incredible YouTube channel which deep dives into Azure. I always encourage folks to build the foundation with high quality community content before evaluating premium options.

People love to talk about and review the courses and certifications that they take. If you are engaging with the community there are endless opportunities to discuss different resources with folks and find out what is helpful and what is snake oil. I find asking people directly about the course they just took to be significantly more valuable and insightful than reading reviews which tend to paint either a overly positive or overly negative picture (nobody leaves an honest average review)

Understanding that you're not an expert in all regards is really important. As much as you know about a specific topic in infosec, there is always more to know. Nobody is equipped to speak and advise on every aspect of such a wide and complex field. Use this self awareness as motivation to guide your continuous studying and self development. Each day you should be learning something in an area you are strong in, and something in a weak area. This will help you continuously grow.

Communication tools are certainly important but so too are communication guidelines. Is everybody in the company on the same page if "thumbs upping" a MS Teams message means "I acknowledge seeing this" or does it mean "I agree with this" ? Something so simple can lead to miscommunication easily in remote teams. Making sure everybody is on the same page with expectations for communications helps to ensure the team can collaborate effectively.