Ajoy Kumar

🔐 Cybersecurity and Supply Chain: The Dynamic Duo! NIST CSF GV.SC-09 🔐 Ever think about how your favorite superhero gadgets come together? Behind every great tech product is a supply chain, and keeping that chain secure is just as important as locking down your own organization. That’s where NIST CSF Subcategory GV.SC-09 steps in, making sure supply chain security practices are baked right into your cybersecurity and risk management programs. What does that mean? It’s like making sure your superhero tools (aka tech products and services) are secure from day one—and you don’t just set it and forget it. You’re constantly monitoring how things perform throughout their life cycle, keeping a sharp eye on any weak links or hidden villains. For the newbies, the NIST Cybersecurity Framework is your go-to guide for reducing risks and protecting your organization. GV.SC-09 helps you integrate supply chain security into your big-picture strategy—ensuring that your partners, vendors, and suppliers are as secure as you are. 🌐 In the world of cybersecurity, a strong supply chain equals a stronger defense. So, why not make it a key part of your risk management strategy? Because after all, teamwork makes the dream work! #Cybersecurity #NISTCSF #SupplyChainHeroes #RiskManagement #Teamwork

10

Data Breach Alert: Fidelity Investments Reports Exposure of 77,000 Clients' Personal Information In today’s digital age, cybersecurity breaches are becoming a pressing concern across industries. Unfortunately, Fidelity has joined the growing list of financial institutions affected by such incidents. In a recent filing, the company revealed that the personal information of approximately 77,000 clients was exposed in a data breach that occurred between August 17 and August 19. While no direct access to client accounts was compromised, hackers leveraged two newly established customer accounts to gain access to personal details of a subset of clients. Fidelity responded swiftly to the breach, terminating unauthorized access on August 19 and launching an investigation with the help of external cybersecurity experts. To reassure affected customers, Fidelity has offered two years of credit monitoring and identity restoration services through Transunion. They also emphasized their commitment to safeguarding client information, stating, “Fidelity takes its responsibility to serve customers and safeguard information seriously.” For those affected, Fidelity encourages continuous monitoring of financial statements and credit reports. Taking proactive steps, such as enrolling in identity protection services, is critical to mitigating the risks associated with data breaches. #DataSecurity #Cybersecurity #FinancialServices #Fidelity #DataBreach #ProtectYourData #CustomerSafety #IdentityTheftPrevention #AdvisorDefense https://lnkd.in/eyZVTxDM

8

I recently received a copy of Packt Publishing’s Unveiling the NIST Risk Management Framework: A practical guide to implementing RMF and managing risks in your organization by Thomas M. This guide breaks down using and implementing a risk management framework within your organization. Understanding the risks at the organizational and technical level are the first steps in managing and monitoring the vulnerabilities and threats of your organization. This book breaks down the NIST RMF in a manner that allows you to go step by step through the process. These steps allow you to build a risk aware organization from top to bottom.  NIST makes documents available at no charge, including the NIST SP 800-37 v2, which this book is based. The book breaks down this document and is an excellent accompanying guide to the document. Chapter 9 and 10 are particularly helpful with guidance for the RMF for cloud implementation and use case scenarios, respectively. For anyone that wants to understand how to implement a risk management framework within your organization, I highly recommend this book. Pick up your copy here: https://packt.link/689vW Kamalpreet Sahni

17

1 Comment

Important for firms dealing with the outage but also to note criminals posing as Crowdstrike employees for further victimization. A good fraud scheme works because there is a kernel of fact within it. Never underestimate the creativity of the adversary and willingness to take advantage of any situation. That’s why diligence and preparedness is important and why good cyber security requires both process and technology.

39

🚨 October Surprise 🚨 Nope, it’s not a plot twist in your favorite TV show… the real surprise this October is that the CMMC Final Rule is officially here! 🎉 If you’re a #DoD contractor, you’ve got until Q1 2025 to start seeing CMMC requirements in your contracts, with full implementation rolling out through 2027. So, consider this your friendly reminder: It's time to start getting your ducks in a row (or, in this case, your controls in place)! 🦆💻 But don’t panic. Working with an experienced CMMC Readiness Provider like Concertium means you won’t be left scrambling. We’ll guide you from that nerve-wracking self-assessment all the way through to the final audit, and we’ll stick around to help manage the program post-audit too. Basically, we’ll be your security sidekick! 🦸‍♂️ Don't wait until the last minute or leave it to chance—reach out to us at www.concertium.com to ensure a smooth CMMC journey. #CMMCCompliance #DoDContractors #CMMCRollout #OctoberSurprise #CyberSecurity #Concertium #ComplianceJourney #StayAuditReady #ConcertiumCMMC

11

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

Interesting 🤔 DOJ Updates the Evaluation of Corporate Compliance Program Memorandum, Emphasizing Emerging Technologies, Data Analytics, and Whistleblower Protections. First, the Updated ECCP focuses extensively on technology risks. This reveals DOJ’s ongoing concern that companies use technology responsibly and effectively mitigate the risks of misuse of technology. In particular, DOJ expects companies to navigate the complex landscape of AI—both its potential risks and benefits—while also ensuring that compliance programs are robust enough to keep pace with cyber criminals. The revised guidance sets forth ten questions that companies should use when assessing and managing these risks. Lastly, DOJ has now made clear that it expects data analytics to be a key part of effective compliance. The Updated ECCP encourages companies to leverage data analytic tools to detect and prevent misconduct, including leveraging its data to gain insights into the effectiveness of its compliance program. To this end, the Updated ECCP also highlights a renewed and explicit focus on whether compliance programs are adequately and proportionately resourced when compared to resources utilized for commercial purposes. Stated differently, DOJ has suggested that it will look with disfavor upon a company where there is “an imbalance between the technology and resources used by the company to identify and capture market opportunities and the technology and resources used to detect and mitigate risks.” https://lnkd.in/gmKwr5a5

3

This speaks volumes to the importance of having a Board members who are versed in cybersecurity and a correctly constructed Board. Take note, and get ready, there will more callouts.

18

1 Comment

Understanding HITRUST: A Unified Approach to Information Security HITRUST, founded in 2007, stands out as a comprehensive framework that aligns with over 30 industry standards, including NIST CSF, ISO/IEC 27001, PCI-DSS, HIPAA, and more. By integrating these diverse frameworks into a single model, HITRUST simplifies compliance and security management, ensuring that organizations can address a wide range of regulatory requirements without the complexity of juggling multiple standards. In the healthcare sector, HITRUST is particularly beneficial. For example, EPIC Systems, a prominent electronic health record provider, utilizes HITRUST to manage sensitive patient data securely. The framework ensures adherence to HIPAA for safeguarding Protected Health Information (PHI) and Personal Identifiable Information (PII), addresses privacy compliance, and supports PCI-DSS requirements for secure billing and payment processing. HITRUST’s approach involves taking the more robust or stricter controls from these frameworks to prevent gaps or confusion, ensuring that all applicable security and compliance needs are met comprehensively. Beyond healthcare, HITRUST’s integration of various frameworks provides a scalable solution for organizations across different industries. This unified approach not only streamlines the compliance process but also enhances overall security posture by aligning with the most rigorous standards available. For businesses handling diverse data types and regulatory demands, HITRUST offers a structured path to manage risks effectively and achieve robust, consistent compliance. As such, it remains a crucial tool for organizations seeking to navigate the complex landscape of information security and regulatory requirements efficiently. HITRUST Official Website](https://lnkd.in/eZNa9ckN)

8

While SOC 2 compliance is not explicitly required for organizations handling sensitive customer data, it is highly valuable and increasingly seen as a minimum bar for providing reasonable care around sensitive data. SOC 2 Type 1 focuses on a snapshot of your controls at a specific point in time, highlighting their design and implementation. SOC 2 Type 2 examines the operational effectiveness of those controls over an extended period. This is a good (& brief) article that explains the differences and why an organization might choose one and or the other. It is also quite useful if you just want to understand more about them or why your company is pursuing and or maintaining a SOC 2 Type 2 certification. #GRC #ITAUDIT #SecurityControls #Cyber #InfoSec #InformationSecurity #CISO #SOC2type2 #Startup #IPO #Cybersecurity #DataSecurity #ControlsAudit #SOC2 #SOC2Compliance #DataPrivacy #TrustServices #ControlsFramework #RiskManagement #ContinuousMonitoring #ControlsMonitoring #DueDiligence #InvestorExpectations

5

In November 2023, CISA issued guidance on CVE-2023-4966, a vulnerability in Citrix NetScaler ADC and Gateway, also known as Citrix Bleed. This buffer overflow issue can lead to the disclosure of sensitive information and has been exploited by attackers, like the PLAY Ransomware group. Exploitation of this vulnerability could allow for the disclosure of sensitive information, including session authentication token information that may allow a threat actor to “hijack” a user’s session. Read more from Kroll Cyber Risk's deep dive on PLAY Ransomware: http://ms.spr.ly/6042lJrLu

1

While the SEC's broader Cyber Risk Management rules for RIAs remain unchanged (for now), the regulatory body is progressing with new incident response requirements under Regulation S-P. This written policy is crucial for RIAs as it aims to enhance their ability to detect, respond to, and recover from security incidents or breaches of customer information. For further information and a detailed outline of the requirements, visit our site. #RIAs #CyberSecurity #IncidentResponse #RegulationSP

7

🔐 Breaking Down NIST CSF Subcategory GV.SC-06 🔐 When it comes to cybersecurity, it’s not just about what happens inside your organization—it’s also about who you do business with. That’s where NIST CSF Subcategory GV.SC-06 comes into play. GV.SC-06 emphasizes the importance of performing thorough planning and due diligence to reduce risks before entering into formal relationships with suppliers or other third parties. Why is this important? Imagine partnering with a vendor who has weak security practices. That connection could become a gateway for cyber threats, putting your entire organization at risk. GV.SC-06 helps ensure that before you sign any contracts or agreements, you’ve carefully evaluated the potential risks and taken steps to mitigate them. For those unfamiliar with the NIST Cybersecurity Framework, it’s a set of guidelines designed to help organizations manage and reduce cybersecurity risks. It’s a widely respected tool used across various industries to build strong and resilient security strategies. 🌐 By conducting proper due diligence before partnering with third parties, you’re not just protecting your organization—you’re also building a stronger, more secure business network. #Cybersecurity #NISTCSF #RiskManagement #ThirdPartyRisk #DueDiligence

6

Most Organizations Not Prepared For Upcoming CISA Software Compliance Deadline A recent survey has revealed a concerning trend: a staggering 80% of organizations are not ready to meet the CISA's Secure Software Development Attestation Form deadline on June 11, 2024. This form, a critical component of Executive Order 14028, mandates software producers working with the U.S. government to confirm the deployment of key security practices. The implications of non-compliance are severe, ranging from legal and financial penalties to increased susceptibility to cyberattacks and reputational damage. Despite the urgency, 84% of companies have not implemented Software Bills of Materials (SBOMs) into their development process, a requirement made mandatory over three years ago. The survey, conducted at RSA Conference 2024, also highlights a lack of awareness, with 65% of security professionals admitting they have never heard of EO 14028. With software supply chain attacks impacting over 2,700 organizations in the U.S. last year alone, the need for immediate action has never been more critical. #Cybersecurity #CISA #Compliance #SoftwareDevelopment #RiskManagement

7

🚨 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗜𝗻𝘀𝗶𝗴𝗵𝘁: 𝗨𝗻𝗶𝘁𝗲𝗱𝗛𝗲𝗮𝗹𝘁𝗵 𝗖𝘆𝗯𝗲𝗿𝗮𝘁𝘁𝗮𝗰𝗸—𝗔 𝗖𝗮𝗹𝗹 𝗳𝗼𝗿 𝗘𝗻𝗵𝗮𝗻𝗰𝗲𝗱 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀 🚨 Fellow IT and risk management professionals, let's take a quick look into the UnitedHealth Group's cyberattack, which not only led to an $872 million operational disruption but also exposed the company to potential regulatory fees and penalties up to $1.6 billion😱. This incident underscores the dire need for rigorous privacy standards across the insurance industry. 🔍 𝗜𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗥𝗲𝗰𝗮𝗽: A ransomware attack on UnitedHealth compromised sensitive data, revealing significant security gaps within healthcare IT systems—a sector particularly vulnerable due to the critical nature of the data processed. 🔐 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗮𝗻𝗱 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗕𝗿𝗲𝗮𝗰𝗵𝗲𝘀: The breach potentially 𝙫𝙞𝙤𝙡𝙖𝙩𝙚𝙙 𝙢𝙪𝙡𝙩𝙞𝙥𝙡𝙚 𝙥𝙧𝙞𝙫𝙖𝙘𝙮 𝙡𝙖𝙬𝙨, 𝙞𝙣𝙘𝙡𝙪𝙙𝙞𝙣𝙜 𝙃𝙄𝙋𝘼𝘼 𝙞𝙣 𝙩𝙝𝙚 𝙐.𝙎., 𝙖𝙣𝙙 𝙥𝙤𝙨𝙨𝙞𝙗𝙡𝙮 𝙂𝘿𝙋𝙍 𝙞𝙛 𝙀𝙐 𝙘𝙞𝙩𝙞𝙯𝙚𝙣𝙨' 𝙙𝙖𝙩𝙖 𝙬𝙚𝙧𝙚 𝙞𝙣𝙫𝙤𝙡𝙫𝙚𝙙. This situation highlights the importance of adhering to stringent privacy laws aimed at protecting personal health information. 💸 𝗙𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝗮𝗻𝗱 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗖𝗼𝗻𝘀𝗲𝗾𝘂𝗲𝗻𝗰𝗲𝘀: Beyond the immediate financial impact, UnitedHealth could 𝗳𝗮𝗰𝗲 𝘂𝗽 𝘁𝗼 $𝟭.𝟲 𝗯𝗶𝗹𝗹𝗶𝗼𝗻 𝗶𝗻 𝗳𝗲𝗲𝘀, emphasizing the severe implications of failing to secure consumer data adequately. 🛡️ 𝗠𝗶𝘁𝗶𝗴𝗮𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝗕𝗲𝘀𝘁 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀: In their response, UnitedHealth is not only enhancing its cybersecurity measures but also aligning with industry best privacy practices such as [e.g., ISO/IEC 27701, NIST PF, AICPA PMF], which are not mandated by any particular state given the absence of a federal privacy regulation in the United States at this time. This proactive approach includes implementing advanced monitoring systems, enhancing threat detection capabilities, and ensuring continuous alignment with evolving privacy standards to rebuild trust and ensure compliance. 💡 𝗗𝗶𝘀𝗰𝘂𝘀𝘀𝗶𝗼𝗻 𝗣𝗼𝗶𝗻𝘁: Given the lack of a unified federal privacy regulation, 𝙝𝙤𝙬 𝙘𝙧𝙪𝙘𝙞𝙖𝙡 𝙙𝙤 𝙮𝙤𝙪 𝙩𝙝𝙞𝙣𝙠 𝙞𝙩 𝙞𝙨 𝙛𝙤𝙧 𝙤𝙧𝙜𝙖𝙣𝙞𝙯𝙖𝙩𝙞𝙤𝙣𝙨 𝙩𝙤 𝙫𝙤𝙡𝙪𝙣𝙩𝙖𝙧𝙞𝙡𝙮 𝙖𝙙𝙝𝙚𝙧𝙚 𝙩𝙤 𝙩𝙝𝙚 𝙝𝙞𝙜𝙝𝙚𝙨𝙩 𝙥𝙧𝙞𝙫𝙖𝙘𝙮 𝙨𝙩𝙖𝙣𝙙𝙖𝙧𝙙𝙨? 𝙒𝙝𝙖𝙩 𝙖𝙧𝙚 𝙩𝙝𝙚 𝙗𝙚𝙨𝙩 𝙥𝙧𝙖𝙘𝙩𝙞𝙘𝙚𝙨 𝙮𝙤𝙪𝙧 𝙤𝙧𝙜𝙖𝙣𝙞𝙯𝙖𝙩𝙞𝙤𝙣 𝙞𝙢𝙥𝙡𝙚𝙢𝙚𝙣𝙩𝙨 𝙩𝙤 𝙣𝙖𝙫𝙞𝙜𝙖𝙩𝙚 𝙩𝙝𝙞𝙨 𝙛𝙧𝙖𝙜𝙢𝙚𝙣𝙩𝙚𝙙 𝙧𝙚𝙜𝙪𝙡𝙖𝙩𝙤𝙧𝙮 𝙡𝙖𝙣𝙙𝙨𝙘𝙖𝙥𝙚? Interested in exchanging ideas and strengthen our privacy frameworks together. Your insights are invaluable! Engage in the discussion below! ⬇️ #Cybersecurity #DataProtection #PrivacyLaw #HealthcareTech #RiskManagement ISACA New York Metropolitan Chapter Tim Wei Teena Christina Eugene James Sam Thomas Alex Joseph Munish May Grant Branislav Maurice Larissa Jerry

18

3 Comments

CISA Warns Active Exploitation of Zimbra & Ivanti Endpoint Manager Vulnerability The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding the active exploitation of critical vulnerabilities in Synacor’s Zimbra Collaboration and Ivanti’s Endpoint Manager (EPM). Organizations using these products are urged to mitigate potential risks immediately. CVE-2024-45519: Synacor Zimbra Collaboration Command Execution Vulnerability A newly identified vulnerability, CVE-2024-45519, has been discovered in the Synacor Zimbra Collaboration platform. This flaw resides in the postjournal service and may allow unauthenticated users to execute commands remotely. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

1

Cybersecurity is no longer an option for NY Healthcare—it’s a mandate. New York’s new regulations are setting the stage for a more secure healthcare landscape. General hospitals must now comply with robust cybersecurity measures starting this year, but with the benefit of $650 million in funding to help hospitals meet the new cybersecurity requirements. This is the key: mandates are meaningless without the ability to execute! Patient data is at the heart of these changes. With ransomware attacks on the rise, this couldn’t have come at a better time. But here’s the question: Are hospitals ready to handle the complex maze of new compliance standards? It’s not just about tech upgrades—it’s a cultural shift in how hospitals approach cybersecurity. The cost of a breach isn’t just financial—it’s about trust. One cyberattack could jeopardize the lives of thousands of patients. The federal government is also in the process of introducing enhanced cybersecurity measures for hospitals. If you’re in healthcare, this is your wake-up call. Hospitals need dedicated CISOs, cybersecurity teams, regular audits, and advanced monitoring systems in place. The stakes have never been higher. Congratulations NY State for such a bold move in cybersecurity! https://lnkd.in/eM34xA6q

69

8 Comments

National Cyber Security Awareness Month is here! October marks a time to focus on enhancing online safety through education and empowerment. In our interconnected world, cyber threats are increasingly prevalent, from personal data breaches to corporate espionage. Key areas of focus include user education, multi-factor authentication, data backups, and system updates. Participating in Cyber Security Awareness Month is vital for everyone, not just IT professionals. Join in by attending webinars, sharing tips with your network, and conducting security audits of personal or business accounts. Remember, cyber security is essential for businesses and individuals alike. It's a shared responsibility to create a safer online environment. Looking to the future, cyber security remains a critical requirement, not an option. Let's take this month as a starting point to cultivate lasting habits for year-round safety. Stay informed, be proactive, and remember that cyber security is an ongoing journey. Together, we can make significant strides in safeguarding our online presence. CISA (Cybersecurity and Infrastructure Security Agency) Safe Link: https://lnkd.in/dUBHSW_P

11

2 Comments

This is a critical need for us all and one I fear we are once again speaking to without working toward a solution. But let me explain why this matters to me….. I am a college dropout teenage dad. I worked those odd jobs, ending up working in a printing plant for several years. I got lucky and an interest in gaming led to a skill in PC hardware salvage. That skill in PC salvage led to my own business and working IT support in a steel mill in the 90s. Eventually that skill led to much more. My story is any one of tens of millions of people with millions of background variations. My path was a very real path to technology in the 90s when the PC was newer to the corporate world. The method still exists, though the path has shifted to add cyber and artificial intelligence alongside technology. There are hundreds, really millions of people who are where I was, and they are unaware of their potential and where they can go if given the opportunity. Many of these people are limited because from their seat they do not see a path that leads them to success. The gap is further ahead than the suggested putting people together with jobs. https://lnkd.in/ejvFwyvE  The gap is in getting people to realize they have a natural skill and in that there is an educational path forward for those people. This is even more day-today to me as my adult soon to be son-in-law required financial support this past semester. He would love to have an affordable education path into any of these proposed initiatives. Adult education for people regardless of their state of diversity are much less available than we like to pretend. We need to focus on a program that begins with recruitment, training, education, and support that leads to the place education does, “recruiting, hiring, and engagement”. It isn’t that the talent isn’t out there. It is that the path appears impossible and unaffordable for the millions without support. I am more than excited about this excellent and absolutely needed initiative. We still need more. We need the offer of financial support to create that new talent. We need support from start to finish. 

10