Dennis Xu

#TechExecs #SevcoSecurity #CrowdStrike | Greater #Canada #CyberSecurity & #AssetIntelligence Forum (TODAY) Great Job Brian Contos Akiko Honda Sevco Security and Jennifer Tamasi CrowdStrike, with 80+ registrations and an incredible turnout! TOPIC: Closing Off Security Gaps with CrowdStrike & Sevco | How One Unprotected Device Leads to Exponential Risk The responsibilities of a security professional are immense—the environment you’re protecting is complex and dynamic and you’re facing an increasing number of threats looking for any possible security gap to exploit. All it takes is one unprotected device to put your entire enterprise at risk, yet the typical enterprise’s critical security controls are under-deployed by 20%. Sevco and CrowdStrike covered how security teams can benefit from a single, comprehensive IT asset inventory across existing tools to automatically expose and prioritize gaps in their environment. Thank you for leveraging #TechExecs Network (Leadership Forums)

20

2 Comments

🌐 Protecting Canada's Critical Infrastructure: New Cybersecurity Guidance from the CSE 🌐 Canada’s Communications Security Establishment (CSE) just released vital cybersecurity guidance to help critical infrastructure (CI) providers strengthen their defenses against evolving cyber threats. This new guidance offers an essential roadmap for CI organizations to navigate risks with greater resilience, offering frameworks and recommendations that address challenges specific to sectors like energy, finance, healthcare, and more. At Stratejm a Bell Canada company, safeguarding CI is a priority, and this guidance from CSE reinforces best practices we advocate in every cybersecurity engagement. With comprehensive recommendations on access management, network security, incident response, and system resilience, these insights are a crucial resource for any organization committed to protecting Canada’s infrastructure. 📌 Let's continue to fortify our security measures, foster cross-sector collaboration, and implement strong cyber defense frameworks. Together, we can build a more resilient digital Canada. #Cybersecurity #CriticalInfrastructure #Stratejm #CSE #Canada #teambell #bell https://lnkd.in/gufSNKqy

38

3 Comments

On June 5, I will share some red teaming tips during our webinar. We would love for you to join us and learn more about our tradecraft.

26

The Government of Canada released an Enterprise Cyber Security Strategy last month. Unfortunately, most media outlets overlooked or did not understand what enterprise cyber security means or is about. So, I decided to write an introduction to the first Canadian Enterprise Cyber Security Strategy. https://lnkd.in/gQ4nP7dc #Canada #defence #defenceindustrialbase #enterprise #cybersecurity #cyberdefence Canadian Cyber in Context #innovation #cyber #treasuryboard

24

8 Comments

Seeing more security breaches for big businesses in the news this year than any other. I have always included a snapshot of recent breaches to help set the landscape when training businesses in Security and Privacy Awareness. Eight years ago, I had to stretch to find 10 breaches within businesses that the audience would recognize. In a session I ran last month, I had to expand this to 20 breaches, all for well-known businesses, and I had to leave another half-dozen off the list. All of these in under a year's time. Cybercriminals grow more creative. They are not going to wait for you and your business to be ready. I urge everyone to start looking into the viability of Managed Detection and Response for your business. Learn more about the this valuable tool HERE: https://lnkd.in/gsKGzkVU

4

1 Comment

🎯Canadian law enforcement authorities have arrested an individual who is suspected to have conducted a series of hacks stemming from the breach of cloud data warehousing platform Snowflake earlier this year. The individual in question, Alexander "Connor" Moucka (aka Judische and Waifu), was apprehended on October 30, 2024, on the basis of a provisional arrest warrant, following a request by the U.S. The development was first reported by Bloomberg and corroborated by 404 Media. The exact nature of the charges against Moucka is currently not known. 🔔 Stay connected for industry’s latest content – Follow Dr. Anil Lamba, CISSP #linkedin #teamamex #JPMorganChase #cybersecurity #technologycontrols #infosec #informationsecurity #GenAi #linkedintopvoices #cybersecurityawareness #innovation #techindustry #cyber #birminghamtech #cybersecurity #fintech #careerintech #handsworth #communitysupport #womenintech #technology #security #cloud #infosec #riskassessment #informationsecurity #auditmanagement #informationprotection #securityaudit #cyberrisks #cybersecurity #security #cloudsecurity #trends #grc #leadership #socialmedia #digitization #cyberrisk #education #Hacking #privacy #datasecurity #passwordmanagement #identitytheft #phishingemails #holidayseason #bankfraud #personalinformation #creditfraud

2

This is it. Genuinely THE event of the year. Nothing has me more excited. Join Armis as a number of our executives - Nadir Izrael, Curtis Simpson, Michael F., Andrew Grealy, Juan Carlos B., and myself - collaborate and work with the Government of #Canada, Public & Private Sector organizations, as well as industry experts to help Defend The North against attacks on Critical Infrastructure. A multi-day, multi-module event happening from June 10-12, organized by the great Mahdi Raza and siberX, this event dives into a systematic method of detecting, assessing, and responding to a massive incident in a collaborative effort across Canada. Explore how Armis helps detect - and proactively protect - organizations in the following modules (and more!) : 1) Breach Identification and Initial Response 4) Impact on Financial Markets, Travel & Tourism, and Utilities 7) Cyber Threat Escalation & Secondary Attacks In the interest of having everyone prepared and cyber-ready - this event is FREE to register for. Join us in person and streamed live - siberx.org/defendthenorth/ #SiberX #Armis #CriticalInfrastructure #IoTSecurity #OTSecurity #IoMTSecurity #Cybersecurity #Cyberwarfare #DefendTheNorth #WeAreCyber

32

2 Comments

You hear about data breaches in the news repeatedly, and most of them are preventable. At Cloud9 (https://c9sec.com), we help save you money and your reputation. A security compliance audit can save companies money in several ways (#Cybersecurity #DataBreach #CloudSecurity #MFA #DataProtection #Snowflake #StaySafe): 1. Avoiding Fines and Penalties: Regulatory non-compliance can lead to hefty fines. By staying compliant with regulations like GDPR, HIPAA, or PCI-DSS, companies avoid these penalties, saving significant costs. 2. Reducing Risk of Data Breaches: Audits identify and mitigate vulnerabilities, helping to prevent costly data breaches. The costs associated with breaches—like incident response, legal fees, and loss of customer trust—can be substantial. An audit helps to address security gaps before they lead to breaches. 3. Lowering Insurance Premiums: Many insurers offer lower premiums to companies with strong compliance and security measures. Regular audits can help companies demonstrate a commitment to security, potentially lowering their insurance costs. 4. Improving Operational Efficiency: Audits often reveal inefficiencies or outdated processes. By addressing these, companies can streamline operations, reducing costs in areas like IT and cybersecurity management. 5. Protecting Brand Reputation: A strong compliance record builds trust with customers and partners. A single incident of non-compliance or a data breach can lead to lost customers, reduced sales, and diminished market value—far more costly in the long term than the upfront cost of regular audits. 6. Enabling Long-Term Cost Control: Ongoing audits help create a culture of proactive risk management. Identifying risks early on can prevent future costly remediation, making security spending more predictable and controllable over time.

4

Why should #CISOs and C-Level #Executives give a hoot about #election-related #security? Reboot Communications Ltd. is hosting the Vancouver International Security Summit #viss on November 25-26, 2024. The event will address #foreign threats and #ensure economic & #political resiliency. #Misinformation and #disinformation can significantly impact public perception and behaviour. It is crucial to combat these issues by promoting media literacy, fact-checking, and transparent communication. Organizations must prioritize accurate #information #dissemination to build #trust and maintain #credibility. Key speakers at the event include Calvin Chrustie from the Critical Risk Team, Peter W. Klein from UBC's School of Journalism, Writing, and Media, and Dr. Heidi Tworek from UBC's Centre for the Study of Democratic Institutions. Reboot Communications Ltd.Calvin Chrustie LLM Heidi Tworek For more details, visit https://lnkd.in/g7uRKfH. #SecuritySummit #Misinformation #Disinformation #SecurityChallenges #VancouverEvent

1

The Canadian Cybersecurity Network launched their #newsletter and I love it. It is exactly what we needed to centralize Canada’s #cybersecurity information. I will make sure research related articles are included. In this edition I described the crucial role of #academic research in cybersecurity and I also explain the difference between research and R&D. https://lnkd.in/dS6Y8G8x

16

🚨 Security Lessons from the Canada Revenue Agency Tax Fraud Incident 🚨 The Canada Revenue Agency (CRA) recently faced a massive fraud scheme, with hackers exploiting H&R Block credentials to siphon over $6 million via fraudulent tax returns. This incident highlights the importance of robust security measures for taxpayer data. 🔑 Key Takeaways: 1. Multi-layered Identity Verification: CRA’s “pay now, verify later” approach exposes vulnerabilities. Implementing stronger, preemptive verification steps can help reduce fraudulent claims. 2. Enhanced Coordination with Banks: Sharing real-time information about flagged accounts with financial institutions can help prevent unauthorized transfers. 3. Public Transparency: Disclosing breaches promptly builds trust and enables individuals to take protective actions, such as monitoring for fraud. Strengthening data protection for taxpayer accounts is essential to prevent financial fraud. #Cybersecurity #DataProtection #TaxFraud #CanadaRevenueAgency #FinancialSecurity https://lnkd.in/e4jeNrWR

1

🚨JOB SEARCH HACK:🚨 Lists!!!! ( Example Linked in post) Explore lists like "Top Companies in Cyber," "Top Companies in Tech," "Best Companies to Work For," and more. ( get creative, the internet is full of lists) These lists are compiled by various organizations and usually include company names and links to their websites. 🚀 Follow the links directly to the career sections of these websites. ✅ Saves time by providing a targeted list of reputable companies. ✅ Direct access to the company’s career page reduces time spent on searches. ✅ Efficiently narrows down your options to top-tier employers. Happy job hunting! Going through the company website also lets you see if it's a company you want to work for—check their mission, vision, values, and benefits before applying. #JobSearchHack #CareerTips #TimeSaver #DreamJob #Cyberjobs #cybersecurity https://lnkd.in/guYhsdHb

14

7 Comments

Canadian law enforcement authorities have arrested an individual who is suspected to have conducted a series of hacks stemming from the breach of cloud data warehousing platform Snowflake earlier this year. The individual in question, Alexander "Connor" Moucka (aka Judische and Waifu), was apprehended on October 30, 2024, on the basis of a provisional arrest warrant, following a request by the U.S. The development was first reported by Bloomberg and corroborated by 404 Media. The exact nature of the charges against Moucka is currently not known. In June 2024, Snowflake disclosed that a "limited number" of its customers were targeted as part of a targeted campaign. Later, Google-owned Mandiant attributed it to a financially motivated threat group called UNC5537. "UNC5537 comprises members based in North America, and collaborates with an additional member in Turkey," the company assessed with moderate confidence at the time, adding approximately 165 organizations were impacted. Some of the targeted companies included major corporations such as Advance Auto Parts, AT&T, LendingTree, Neiman Marcus, Santander, and Ticketmaster (Live Nation). In some of the incidents, the threat actor(s) attempted to extort the companies by threatening to sell the stolen data on criminal forums if they didn't pay up. AT&T reportedly paid the hackers $370,000 to delete the stolen data, according to WIRED. The attacks worked by leveraging stolen customer credentials obtained via prior stealer malware infections to obtain initial access. The investigation also found that the initial compromise of infostealer malware occurred on contractor systems that were used for downloading games and pirated software. #canada #snowflake #databreach #extortion #threatactor

I'm thrilled to announce that we're bringing Richard Seiersen, Chief Risk Officer and co-author of the book "How To Measure Anything In Cybersecurity Risk", to the Greater Toronto Area for an exclusive session on risk quantification !   If you're a Security Leader eager to dive deep into crucial metrics and learn how to leverage them for success, signup at the link below! 📩 Let’s unlock the power of risk together on December 5th. Don’t miss out on "How to Measure and Communicate What Matters in Cybersecurity Risk" —join our invite list today! Space is limited to 10-15 CISO and Security Executives. ➡ Signup Here: https://lnkd.in/eYghb9nn Why Attend? - It's Not Another Vendor Escape Room - Serious Risk Thought Leadership with Application - Peer To Peer Discussion - Lunch is Provided - Signed Copy of book "How To Measure Anything In Cybersecurity Risk" - Gratis #RiskManagement #CyberRisk #Qualys #RiskQuantification #GTA #Toronto #RichardSeiersen

50

4 Comments

A decade ago, a client faced a colossal breach. It was a wakeup call. They realized they needed strategic cybersecurity guidance but couldn't justify a fulltime CISO. That's where fractional CISO services come in. Fractional CISOs provide the expertise of a seasoned cybersecurity leader without the fulltime cost. They bring a wealth of experience and strategic insights to your organization on a parttime basis. It's like having a cybersecurity expert on demand. Here’s why more organizations are opting for fractional CISOs: → CostEffective: You get toptier talent without the overhead of a fulltime salary. → Expertise: Fractional CISOs bring years of experience from various industries. → Flexibility: They can adapt to your unique needs, offering scalable services. → Strategic Guidance: They help you navigate complex cybersecurity landscapes. But the real magic lies in their ability to integrate seamlessly with your team. They don't just offer advice; they become a part of your organization. They understand your business goals and align cybersecurity strategies accordingly. Imagine having a CISO who not only mitigates risks but also enhances your business operations. That's the power of a fractional CISO. They help you stay ahead of threats while you focus on growth. If you're an organization looking for strategic cybersecurity guidance, consider a fractional CISO. It's a costeffective, flexible, and powerful solution. Let's discuss how this can transform your cybersecurity approach. Comment below or send me a message. Your security is our commitment. Let’s make it stronger together.

1

Ontario’s Bill 194 introduces the Enhancing Digital Security and Trust Act (EDST), which focuses on strengthening cybersecurity, regulating AI use, and protecting personal information, especially for minors. The Bill places significant emphasis on public sector compliance with new AI and cybersecurity standards but leaves many specifics to forthcoming regulations. It also enables the Ontario government to regulate the collection and use of digital information, particularly for those under 18. Armour Cybersecurity  can help organizations comply with these new standards by implementing robust cybersecurity frameworks that meet the EDST’s requirements, ensuring both public sector entities and private organizations are well-protected against evolving cyber threats. #cyberresilience

6

2 Comments