Episode #26
Episode 26: How to Run a Conference, Why Most Pen Tests Fail, and HIPAA's Ransomware Reckoning
In this episode, we're joined by Jon Buhagiar, Director of Information Technology at RareMed Solutions; a published Sybex/Wiley author of Cisco and Microsoft certification guides; and a longtime amateur radio enthusiast. We get into what it actually takes to run a security conference from the ground up, why so many penetration tests end up wasting everyone's money, and how compliance and cyber insurance keep reshaping the way organizations work. Plus, as always, a bourbon. 🎤 Jon's world — rare-disease specialty pharmacy, patient assistance programs, book writing, and ham radio 🏗️ Running BSides Pittsburgh: revenue, expenses, marketing, volunteers, speakers, and sponsors 🎟️ The real economics of ticket pricing, free tickets, and the venue/affordability squeeze 🧑🤝🧑 Dividing responsibilities and appointing workstream leads as an event grows 🎯 Scoping as the make-or-break of a good pen test — and the human element that tooling misses 🔗 Chaining vulnerabilities and what separates a checkbox test from a real one 💸 Why pen testing so often becomes an ineffective use of resources 📋 Compliance and contractual drivers vs. genuine risk reduction 🛡️ A risk-based, scenario-driven approach focused on resilience and continuous improvement 🤝 Engaging pen testers as partners and maturing the process over time 🔄 Security as a constant state of change — compliance, cyber insurance, and government scoring 🏥 HIPAA compliance, risk analysis, and the ransomware reckoning facing healthcare 🥃 Bourbon tasting and discussion ⏱️ Timestamps 00:00 Intro 01:26 Guest introduction & background 02:18 RareMed Solutions & patient assistance programs 05:01 Book writing & amateur radio 08:11 BSides Pittsburgh overview 15:04 Running a conference: planning & organization 22:05 Marketing & audience engagement 25:07 Dividing responsibilities as you grow 27:59 The value of ticket pricing 31:50 BSides & the conference model 46:11 Penetration testing & scoping 57:28 The purpose of pen testing 58:23 When pen testing goes wrong 01:00:16 Reasons for pen testing & compliance drivers 01:03:04 Continuous monitoring, testing & detection 01:06:19 Is your company ready for a pen test? 01:07:07 A risk-based approach 01:13:58 Scenario-based testing & resilience 01:17:31 Evaluating the value of pen testing 01:29:01 The constant state of change 01:31:01 Compliance & cyber insurance 01:32:19 Bourbon tasting 01:36:32 Government scoring & risk analysis 01:50:36 HIPAA compliance & ransomware 01:55:01 Wrap-up & call to action 🎧 Distilled Security Podcast Cybersecurity, GRC, and leadership, one pour at a time. 🎙️ Hosts Justin Leapline – @justinleapline Joe Wynn – @wynnjoe Rick Yocum – @rickyocum 🎤 Guest Jon Buhagiar linkedin.com/in/jonbuhagiar 📬 Send Us Your Questions! ask@distilledsecuritypodcast.com 🌐 Connect with Us Website: distilledsecuritypodcast.com X: @DisSecPod YouTube: @distilledsecurity Email: hello@distilledsecuritypodcast.com 👍 Like, comment, and subscribe for monthly security and compliance insights.
