Episode 26: How to Run a Conference, Why Most Pen Tests Fail, and HIPAA's Ransomware Reckoning

<p>In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon. </p><p></p><p>🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio<br />🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors<br />🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze<br />🧑‍🤝‍🧑 Dividing responsibilities and appointing workstream leads as an event grows<br />🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses<br />🔗 Chaining vulnerabilities and what separates a checkbox test from a real one<br />💸 Why pen testing so often becomes an ineffective use of resources<br />📋 Compliance and contractual drivers vs. genuine risk reduction<br />🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement<br />🤝 Engaging pen testers as partners and maturing the process over time<br />🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring<br />🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare<br />🥃 Bourbon tasting and discussion</p><p></p><p>⏱️ Timestamps<br />00:00 Intro<br />01:26 Guest introduction &amp; background<br />02:18 RareMed Solutions &amp; patient assistance programs<br />05:01 Book writing &amp; amateur radio<br />08:11 BSides Pittsburgh overview<br />15:04 Running a conference: planning &amp; organization<br />22:05 Marketing &amp; audience engagement<br />25:07 Dividing responsibilities as you grow<br />27:59 The value of ticket pricing<br />31:50 BSides &amp; the conference model<br />46:11 Penetration testing &amp; scoping<br />57:28 The purpose of pen testing<br />58:23 When pen testing goes wrong<br />01:00:16 Reasons for pen testing &amp; compliance drivers<br />01:03:04 Continuous monitoring, testing &amp; detection<br />01:06:19 Is your company ready for a pen test?<br />01:07:07 A risk-based approach<br />01:13:58 Scenario-based testing &amp; resilience<br />01:17:31 Evaluating the value of pen testing<br />01:29:01 The constant state of change<br />01:31:01 Compliance &amp; cyber insurance<br />01:32:19 Bourbon tasting<br />01:36:32 Government scoring &amp; risk analysis<br />01:50:36 HIPAA compliance &amp; ransomware<br />01:55:01 Wrap-up &amp; call to action</p><p></p><p>🎧 Distilled Security Podcast</p><p>Cybersecurity, GRC, and leadership, one pour at a time.</p><p></p><p>🎙️ Hosts</p><ul><li><b>Justin Leapline</b> – @justinleapline</li><li><b>Joe Wynn</b> – @wynnjoe</li><li><b>Rick Yocum</b> – @rickyocum<p></p></li></ul><p>🎤 Guest</p><ul><li><b>Jon Buhagiar </b><a rel="noopener noreferrer nofollow" href="http://linkedin.com/in/jonbuhagiar" target="_blank">linkedin.com/in/jonbuhagiar</a></li></ul><p></p><p>📬 Send Us Your Questions!</p><p><a rel="noopener noreferrer nofollow" href="mailto:ask@distilledsecuritypodcast.com" target="_blank">ask@distilledsecuritypodcast.com</a></p><p></p><p>🌐 Connect with Us</p><p></p><p><b>Website:</b> <a rel="noopener noreferrer nofollow" href="http://distilledsecuritypodcast.com" target="_blank">distilledsecuritypodcast.com</a></p><p><b>X:</b> @DisSecPod</p><p><b>YouTube:</b> @distilledsecurity</p><p><b>Email:</b> <a rel="noopener noreferrer nofollow" href="mailto:hello@distilledsecuritypodcast.com" target="_blank">hello@distilledsecuritypodcast.com</a></p><p></p><p>👍 Like, comment, and subscribe for monthly</p><p>security and compliance insights.</p>