Feras Batainah

The convergence of OT, IoT, and IT amplifies #cisa Director Easterly's sobering comments: Volt Typhoon activity has targeted a range of critical infrastructure sectors and is “likely just the tip of the iceberg,” Easterly said. “And there is, we believe, much we are not seeing.” There is no reason to be in the blind, especially for OT/ICS. Don't take my word for it, reference the Department of Energy, NREL/CECA report recently released. #zerotrust #cmmc #cybersecurity https://lnkd.in/e3eCqjZV A couple highlights: CECA concluded that runZero's discovery methods significantly improve visibility into utility infrastructure with detection of all IP-addressable devices in the test environment. This was accomplished without impacting the performance of industrial control systems (ICS) assets or interfering with ongoing SCADA processes and communications. CECA’s findings could be transformational for the energy industry since active scanning provides more comprehensive data about connected devices compared to passive discovery, giving security teams improved visibility to better secure ICS environments.

5

I'm working with a large enterprise client ($4BN) that needs a new GRC solution. It's funded, high priority and needs to get done A$AP Rocky. 😁 Who should be on deck for consideration? Also looking for data security provider recommendations and DLP as well. I'm aware of the major players of course but am curious to see what the comments section will recommend. Also, any introductions to their corresponding CEO's would be great so we can get these all moving fast. #ciso #riskmanagement #informationsecurity #digitalmarketing

157

258 Comments

The MSSP market is badly broken. This has been unfolding for some time now, increasing cost pressures combined with the lack of any meaningful performance measures have created a worrying 'race to the bottom' situation. The key warning sign is a strong focus on reactive security. There are now a multitude of low-end EDR/XDR solutions that can be paired with a very low cost SOC. The level of real-world protection provided by these solutions tends to be massively oversold, in reality they often just create a single fragile layer of defence. At Secmatics we put a strong focus on proactive threat-driven risk reduction, I see far too many organisations that believe they are safe because they have '24x7 security monitoring', and yet have easily discoverable actively exploited vulnerabilities in their infrastructure. Good security starts at home. You need a cohesive threat-informed technical strategy along with the right combination of proactive and reactive defences. If your security parter is not actively working with you to identify and proactively mitigate threats and vulnerabilities then it is probably time to look elsewhere. Caveat Emptor.

1

🚨 Cybersecurity Concerns at Sellafield Ltd: A Critical Lesson for All Industries 🚨 Sellafield Ltd, the UK’s nuclear waste processing firm, has been fined £332,500 ($440,795) by the Office for Nuclear Regulation (ONR) following a four-year investigation into significant cybersecurity shortcomings. The ONR found that Sellafield repeatedly failed to follow its own approved security protocols, leaving its IT systems—and potentially sensitive nuclear information—vulnerable to cyber threats. This incident serves as a critical reminder of the importance of robust cybersecurity measures, especially for industries managing highly sensitive data. As technology evolves, so must our commitment to protecting vital infrastructure from cyber threats. In the UK, several key local security vendors and frameworks are in place to protect nuclear infrastructure.😩 They need other vendors or at least few more . 💥 #Cybersecurity #NuclearSafety #DataProtection #Infosec #ONR #RiskManagement

18

Still wanting to learn more about Forcepoint ONE Data Security? Check out this extended demo where Forcepoint's Toby Dixon demonstrates the key features of our complete DLP SaaS solution:

7

𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞 𝐓𝐡𝐫𝐞𝐚𝐭 𝐋𝐚𝐧𝐝𝐬𝐜𝐚𝐩𝐞: 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬 𝐟𝐫𝐨𝐦 𝐭𝐡𝐞 𝐍𝐂𝐒𝐂 𝐚𝐧𝐝 𝐓𝐡𝐫𝐞𝐚𝐭 𝐭𝐨 𝐑𝐢𝐬𝐤 𝐂𝐨𝐦𝐩𝐚𝐬𝐬 The UK's National Cyber Security Centre (NCSC) offers a comprehensive approach to threat modelling that enhances an organisation's ability to identify and mitigate risks. Alongside this, Elemendar's Threat to Risk Compass provides an innovative solution to manage cyber threats effectively. https://lnkd.in/edzUcfc6 𝐍𝐂𝐒𝐂'𝐬 𝐀𝐩𝐩𝐫𝐨𝐚𝐜𝐡 𝐭𝐨 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐨𝐝𝐞𝐥𝐥𝐢𝐧𝐠 The NCSC emphasises a structured process to identify potential threats, assess risks, and implement appropriate controls. Their guidance involves several key steps: • 𝐈𝐝𝐞𝐧𝐭𝐢𝐟𝐲 𝐀𝐬𝐬𝐞𝐭𝐬: List critical assets, including data, systems, and infrastructure. • 𝐈𝐝𝐞𝐧𝐭𝐢𝐟𝐲 𝐓𝐡𝐫𝐞𝐚𝐭𝐬: Determine potential attackers and their motivations. • 𝐀𝐬𝐬𝐞𝐬𝐬 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬: Identify system weaknesses through scanning and testing. • 𝐃𝐞𝐭𝐞𝐫𝐦𝐢𝐧𝐞 𝐭𝐡𝐞 𝐈𝐦𝐩𝐚𝐜𝐭: Assess potential financial and reputational damage. • 𝐈𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬: Deploy security measures to mitigate identified risks. Regular updates and reviews are crucial to maintain relevance as new threats emerge. 𝐇𝐨𝐰 𝐓𝐡𝐫𝐞𝐚𝐭 𝐭𝐨 𝐑𝐢𝐬𝐤 (𝐓𝐓𝐑) 𝐂𝐨𝐦𝐩𝐚𝐬𝐬 𝐂𝐚𝐧 𝐇𝐞𝐥𝐩 𝐎𝐫𝐠𝐚𝐧𝐢𝐬𝐚𝐭𝐢𝐨𝐧𝐬 Threat to Risk Compass enhances threat management with comprehensive insights and strategic decision-making, addressing challenges highlighted by the NCSC: • 𝐄𝐱𝐞𝐜𝐮𝐭𝐢𝐯𝐞 𝐂𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐂𝐲𝐛𝐞𝐫 𝐑𝐢𝐬𝐤𝐬 𝐚𝐧𝐝 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬: TTR Compass translates complex threat scenarios into risk management insights, facilitating communication between cybersecurity teams and non-technical executives. • 𝐏𝐫𝐢𝐨𝐫𝐢𝐭𝐢𝐬𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬 𝐚𝐧𝐝 𝐆𝐫𝐨𝐮𝐩𝐢𝐧𝐠 𝐔𝐧𝐝𝐞𝐫 𝐑𝐞𝐥𝐞𝐯𝐚𝐧𝐭 𝐑𝐢𝐬𝐤𝐬: The tool aligns with frameworks like NIST or ISO, allowing organisations to group controls by risk type, aiding in effective organisation and communication of efforts. • 𝐃𝐲𝐧𝐚𝐦𝐢𝐜 𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐟𝐨𝐫 𝐈𝐦𝐩𝐚𝐜𝐭 𝐚𝐧𝐝 𝐋𝐢𝐤𝐞𝐥𝐢𝐡𝐨𝐨𝐝 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭: TTR Compass integrates updated threat intelligence to provide dynamic risk assessment updates, ensuring accurate and relevant impact scoring. • 𝐂𝐮𝐬𝐭𝐨𝐦𝐢𝐬𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲-𝐑𝐞𝐥𝐞𝐯𝐚𝐧𝐭 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬: TTR Compass offers customisable insights prioritising threats and controls relevant to specific sectors and geographical locations. By combining the NCSC's structured threat modelling approach with the innovative features of Threat to Risk Compass, organisations can enhance their ability to anticipate, prepare for, and respond to potential cyber threats, safeguarding their critical assets and maintaining stakeholder confidence. https://elemendar.ai #NCSC #Elemendar #CTI #AI #Innovation #RiskManagement #threatmodelling

12

As a C-suite executive or board member, your role is to be an enabler of Enterprise Cyber Risk Management (ECRM), not an expert. We achieve this by championing strong governance principles and understanding that cyber risk management is a business issue, not just an “IT problem.” After all, a proactive ECRM program can be a significant business enabler, aligning with your organization’s vision, mission, strategy, values, and services. This integration should feed into your overall Enterprise Risk Management (ERM) framework and shape your cybersecurity strategy. By embedding ECRM into your business operations, you safeguard your organization while driving growth and resilience. Discover more in my book: https://lnkd.in/e2muN5eZ #ECRM #CSuiteLeadership #CyberRiskManagement #ERM

6

🚨 Changes are coming to the DSPT! 🚨 From September 2024, NHS Trusts, ALBs, CSUs, and ICBs will see the DSPT shift to a new cyber security and IG assurance model based on the Cyber Assessment Framework (CAF). This new approach focuses on CAF-aligned ‘Objectives, Principles and Outcomes’, encouraging better decision-making. At Sapphire, we’re here to help you adapt. We recommend starting with a CAF Gap Analysis – a thorough review of your current cyber security posture against CAF standards, identifying any gaps, and providing a clear roadmap to compliance. And if improvements are needed, Sapphire offers tailored services to boost your security and resilience. Learn more at: https://lnkd.in/dYAzMfsQ #CyberSecurity #CAF #DSPT #NHS #Compliance

7

🌟 Excited to announce that I’ll be joining this year's conference of IoT Security Foundation themed "Past, Present & Future"! We’ll delve into important ongoing discussions, ensuring we uphold our “best practice, next practice” mantra. I’m particularly looking forward to discuss the impact of AI on IoT, supply chain risks, new attack types and discussing the evolving threat landscape. Let’s connect and collaborate on shaping a secure #IoT future! 🔐💡 #iotsecurity #ondevicesecurity #secureiotecosystem #iotspartan #smartdevices #internetofthings #connecteddevices #xiot #ciot #iomt #iiot #criticalinfrastructures #cni #compliance #iotautomation

9

Double James Todd's, what else can one ask for!! - James Todd, CTO of Adarma Security, and James Todd, EMEA Technical Director at Cribl on hand to discuss effective data managment and how data pipelining is revoluionising #SecurityOperations. Not to be missed! 👇 #WeAreAdarma #SecurityOperations #Cybersecurity

11

1 Comment

Information classification can be difficult. Often low-hanging fruit for some Information Security auditors if you make it complicated. How many classifications are too many? Here are some I have seen recently Public Private Controlled Restricted Internal Restricted Public Restricted (yes, this one confused me too) Confidential Highly Confidential Secret Top Secret Official Sensitive Unclassified Classified Make it simple, effective and consistent. Please!

11

In this exclusive webinar, we'll dive into the findings of the 2024 Voice of the CISO report, where we surveyed 1,600 CISOs from around the world and spoke to organisations with over 1,000 employees. We’ll also be joined by a panel of EMEA cybersecurity leaders from across industry who will share their experiences from the past 12 months and insights for the year ahead. https://bit.ly/3X6gURS #CISO #cybersecurity #proofpoint

1

🚨 Did you know 40% of employees send misdirected email? This small mistake can cause big problems – exposing your organisation to data loss, regulatory fines and brand damage. Proofpoint Adaptive Email DLP Blocks misdirected emails in real time, prevents costly mistakes and safeguards your business. Don't wait until it's too late. Secure your email communications today. #DefendData #EmailSecurity #Proofpoint #DLP #ProtectPeople #CyberSecurity #DefendData 🔗 Find out how https://lnkd.in/dwkn3qcK

2

Investigation Scenario 🔎 You've discovered that a Windows file server on your network has RDP enabled. It should not have RDP enabled. What do you look for to determine if a compromise has occurred? #InvestigationPath #DFIR #SOC

74

25 Comments

Turns out good #SecurityComms needs both comms & security subject matter expertise. This response is utter nonsense. 1) Rabbit got hacked, but claimed they didn't. Then finally admitted they did. 2) Their investigation found exploited API keys were contained in source code leaked by an employee 3) But they claimed it wasn't a security breach (Narrator: it's definitely a security breach) & they blamed journalists for reporting about it 4) Tried to downplay it by saying a fix was in the works already (the thing they originally claimed never happened) 5) Would like everyone to believe a new pen test is proof that things are fine now

9

1 Comment

🔑 The #PKI landscape is rapidly changing - is your organization keeping up? With #NIST releasing the first set of post-quantum cryptography encryption standards and shorter certificate validity on the way, it's time to assess your approach to Certificate Lifecycle Management (CLM) 💡 📥 Download The CISO’s Guide to CLM and get insights into streamlining #CLM, adapting to new PKI industry changes, and achieving crypto-agility: https://lnkd.in/e84Ceput

1

Another week, another #DORA gap analysis delivered to a happy customer! The market is definitely shifting in the right direction now that summer is going with more companies committing renewed investment into critical #cybersecurity projects and considerations. The #CISO position remains a challenging role, highlighting the continued need for security consultancies to support critical programs such as DORA compliance where internal SME resource is either scarce or only required for a finite amount of time. Positive and exciting times... #cybersolved

30

1 Comment

News from a vendor that I'm a HUGE fan of - Oligo Security Andrew Joseph "A new #criticalvulnerability (#CVE20246387) was announced yesterday, impacting a large number of #OpenSSH servers worldwide. LinkedIn hates links now so just google it or DM me for the blog link. The vulnerability, named RegreSSHion, allows full system compromise and remote code execution. Our latest blog post provides a full rundown of how to know if you’re impacted, remediation and mitigation steps (including what to do if you can’t upgrade to OpenSSH 9.8 right now), and how the #OligoPlatform makes it easier to detect #RegreSSHion. Oligo policies can help you detect and locate against RegreSSHion:"

11

2 Comments