More Open Source Security episodes

Building a plan for disaster with David Bernstein thumbnail

Building a plan for disaster with David Bernstein

Published 20 Apr 2026

Duration: 39:19

Adaptive emergency management and disaster recovery demand dynamic strategies, structured frameworks like ISO 22301/NIST, cyclical preparedness, stress testing, stakeholder alignment, and resilience through collaboration and continuous learning to tackle evolving digital and physical risks.

Episode Description

Josh welcomes back David Bernstein to talk about creating a disaster recover plan. It's a very timely topic given all the current events. There are mo...

Overview

The podcast emphasizes the critical role of emergency management, disaster recovery, and business continuity planning in both digital and physical environments, highlighting the need for adaptable frameworks that evolve with emerging risks. It underscores the cyclical nature of emergency preparedness, stressing the importance of ongoing risk assessments, stakeholder engagement, and iterative updates to plans. Formal frameworks like ISO 22301 and NIST are presented as tools to structure planning processes, though the discussion critiques overly rigid approaches, advocating instead for flexible, context-specific adaptations. Challenges in initiating emergency programs include aligning organizational assumptions and ensuring stakeholder awareness, while validation through stress testingrather than superficial demonstrationsis framed as essential to identify plan gaps and prepare for unpredictable scenarios.

A significant focus is placed on the digital landscape, linking recent vulnerabilities in open-source software to the necessity of proactive risk mitigation and robust emergency planning in digital ecosystems. The conversation stresses the importance of continuous improvement cycles, such as the Plan-Do-Check-Act model, to refine plans dynamically and align them with evolving threats. It distinguishes between reactive, impulsive responses and deliberate, pre-established strategies, arguing that structured plans reduce reliance on last-minute improvisation. Practical considerations include avoiding overcomplication by prioritizing identified hazards, establishing clear decision-making authority, and fostering stakeholder collaboration through communication tools and clear role definitions.

Key themes also address the balance between preparedness and organizational resilience, emphasizing the need for realistic, adaptable plans that avoid burnout by cycling team members through tasks and managing workload effectively. The discussion advocates for simplified incident response processes, formal issue-raising mechanisms, and tailoring strategies to organizational size and complexity. Highlighting the importance of stakeholder involvement, including executives and operational leaders, the podcast underscores that effective planning requires balancing foresight with flexibility, ensuring that plans remain dynamic tools rather than static solutions. Ultimately, the content promotes a culture of continuous learning and iterative refinement in emergency management practices.

Recent Episodes of Open Source Security

1 Jun 2026 Open source verification with Sal Kimmich

Cybersecurity challenges include complex application ecosystems, overlooked kernel vulnerabilities, supply chain risks, and systemic risks from under-resourced organizations prioritizing surface-level controls, alongside calls for regulatory reforms, proactive threat modeling, secure development practices, and addressing tribal nations' unique legal and sovereignty concerns.

25 May 2026 Vulnerability disclosure with Casey Ellis

The evolution of vulnerability disclosure highlights challenges in prioritizing critical issues, outdated legal frameworks, and the role of initiatives like Disclosed.io in standardizing policies, alongside AI's impact on detection, open-source risks, triage complexities, and the need for collaboration and transparency to address systemic security barriers.

18 May 2026 F-Driod the open app store with Hans

F-Droid, an open-source Android app store modeled on Linux distributions, emphasizes security and transparency through source-code verification, contrasting with fragmented alternatives and corporate control, while addressing Android's ecosystem challenges and efforts to preserve open-source principles.

11 May 2026 Open source is critical infrastructure with Kat Cosgrove

Maintaining open source infrastructure is critical to prevent security risks from neglected projects, highlighting the need for sustainable funding, corporate collaboration beyond financial support, and systemic reforms to address coordination challenges, dependency fragility, and vulnerabilities.

4 May 2026 How to actually test a disaster plan with David Bernstein

A three-part disaster recovery framework emphasizing simplicity, clear roles, and collaboration, utilizing structured testing via HSEEP, real-world validation, and continuous improvement through exercises, while addressing pitfalls and balancing realism with psychological safety.

More Open Source Security episodes