Adam Wright, CISSP

#Cybersecurity is a top 5 enterprise-wide risk, and is a key priority for industry executives, Board members and regulators. My colleagues, Brian Levine and Megan Turner, are taking part in the The Institute of Internal Auditors Inc. 2024 Cybersecurity Virtual Conference on Oct. 30 where they'll discuss the risks and implications associated with cybersecurity. Register here:

27

1 Comment

A strong, comprehensive #compliance program can be leveraged to protect the value and integrity of your organization, supporting growth along the way. Learn how to start or optimize your compliance journey by reading RSM US LLP’s latest guide today! https://rsm.buzz/3xzkhX6

13

Learned a lot from this webinar featuring our audit readiness expert, Tony Myers-Burton along with other government audit leaders!

15

Just out: KPMG's Mid-year Look Forward on the "Ten Key Regulatory Challenges of 2024." Regulatory intensity has led to record financial remedies, with $5B marking the 2nd highest amount in SEC history. KPMG Regulatory Insights helps provide a clear understanding of the evolving regulatory landscape. https://bit.ly/4bXFLfc #KPMG #RegulatoryInsights #RiskManagement

4

Protiviti and The Institute of Internal Auditors' survey highlights how AI is reshaping the perception of existing risks, with 59% of IT audit leaders identifying AI as a significant threat over the next two to three years. Learn more in CPA Practice Advisor. https://bit.ly/4gWYgTX

1

CISA and FBI release draft guidance on Product Security Bad Practices for software manufacturers The CISA-FBI guidance outlines software manufacturers to avoid these product security bad practices. By following the recommendations in this guidance, manufacturers will signal to customers that they are taking ownership of customer security outcomes, a key Secure by Design principle. https://lnkd.in/gb3DgATY

4

🌟Change is coming! Read KPMG’s Defining Issues to learn about the #FASB’s proposal to modernize the internal-use software guidance for agile software development – plus the enhancement of guidance around when software development cost capitalization should begin. #kpmgfrv #audit https://bit.ly/4f57LiB

1

Who attended our threat briefing with KPMG covering Scattered Spider's cloud and on-premise TTPs?? What did you think? If you weren't able to join us for the briefing, ping me and I can share the recording! Crucial for the community to know the TTPs we have identified to hunt for in your IaaS, SaaS, CI-CD, IDP environments. TTPs are increasingly being copied and used by other threat actors. DM me to see our Scattered Spider battle-tested Cloud Detection and Response (CDR) platform live in action or for details on our no-cost CloudSec Health Check (will uncover activity other solutions like CSPMs and SIEMs consistently miss)

1

Compliance will often be positioned as adversarial to cybersecurity, but often it plays an important role in defining the reasonable and appropriate controls for risk reduction that should be implemented by cybersecurity teams. Thanks to Derrick Kean Auxtero for the great graphic to illustrate this point!

7

1 Comment

Semper Sec thank you for having me and A-LIGN as a guest on your webinar series. We discussed the importance of finding the right #AuditorPartner and how to prepare for an audit. Cybersecurity Compliance Assessments are critical these days and more stakeholders are focusing on #QualityReports and #Efficiency.

36

2 Comments

Fellow #CISSP holders, I need you to weigh in. I was recently having a discussion with a colleague where the conversation led to an important consideration. Having a CISSP comes with a hefty burden of upholding a code of ethics that can, in nearly every case, risk a cert holders livelihood. Given that ISC² has no jurisdiction or ability to offer protections for CISSP holders who uphold these ethical standards, how do you navigate scenarios where you witness unethical, illegal, or risky behaviors that could put an enterprise and the public at risk? There are some serious considerations I think every #CyberSecurity #Practioner needs to consider before they align to ANY certification body. 1. Ethical Dilemma: CISSP's are expected to uphold high ethical standards, including reporting security issues, but may face personal consequences for doing so. 2. Enforcement Limitations: ISC²'s ability to enforce ethics is largely limited to the certification itself, not extending to workplace protections. 3. Credibility Issue: This situation could potentially undermine the integrity of the certification if holders feel they can't act on their ethical obligations without risking their livelihoods. 4. Practical Challenges: Providing actionable protections across various global jurisdictions and employment situations is extremely complex. So, with that being said, how do you navigate the conflicts of interest that exist with these certifications? Let me know in the comments. I want to hear your thoughts! #CleverGirl ♛ Gina King ♛ Derrick Knox, Jr. WellSecured IT The Ovation Point LLC Diverse IT ISC2

21

33 Comments

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

The #KPMGGFRVC hosted an insightful session on governance and compliance, delving into the evolution of the internal control environment, risks associated with new technology, and best practices for cyber security and data retention. These key takeaways are vital for CAOs striving to maintain robust governance and compliance frameworks. Equip yourself with the knowledge needed to navigate these complexities effectively. https://bit.ly/4gjOZUS

1

Join BPM's Fred Rica and Josh Schmidt for a #webinar to explore critical strategies for defending against #cyberattacks and effective response methods. 🛡️ Don’t wait for a breach — act now! #Cybersecurity #CybersecurityWebinar #CyberAwarenessMonth

1

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: This week, Apple released security updates for two zero-day vulnerabilities, tracked as CVE-2024-44309 and CVE-2024-44308, in iOS, iPadOS, macOS, visionOS, and Safari web browser, which are actively exploited in the wild. The vulnerability CVE-2024-44309 is a cookie management issue in WebKit that could lead to a cross-site scripting (XSS) attack when processing malicious web content. “Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.” reads the advisory. https://lnkd.in/eHWvAmtG

1

Explore the cautionary tale of delayed breach reporting and its impact on compliance in cybersecurity. This must-read, featuring BPM Partner Fred Rica, is an essential resource for board members and cybersecurity professionals alike! #CybersecurityCompliance #BreachReporting

1

Explore the cautionary tale of delayed breach reporting and its impact on compliance in cybersecurity. This must-read, featuring BPM Partner Fred Rica, is an essential resource for board members and cybersecurity professionals alike! #CybersecurityCompliance #BreachReporting

1