BiL Castine

SoCal CISO Community, please join me in welcoming your newest Governing Body member, Julie Harris, CISO at PulteGroup! Tomorrow at 2pm PST, you can find Julie and many other CISOs from your community convening for the final CISO Townhall of 2024. Join virtually tomorrow to discuss: -Enhancing cloud security and cost-effectiveness across diverse cloud environments through managed security services -Leveraging AI innovations while addressing global regulatory and data privacy standards to strengthen security strategy -Sharing best practices for implementing effective cloud security operations across a global footprint to ensure resilience and compliance Register now at My.Evanta.com! #socalciso #evantaciso #aisecurity #cloudsecurity

24

1 Comment

In just one week, the SoCal CISO Community will assemble for their Evanta CISO Summit on May 21st! One of the many exciting sessions next week will be led by Todd Friedman, Sunil Agarwal, and Trina Ford, focused on "The CISO as a Savvy Board Communicator." Translating the organization's cybersecurity posture to the board can be a catalyst in improving organizational resilience and building strong rapport. How do you communicate security initiatives clearly when the stakes are high? Join this session to discuss: -Leveraging your expertise to build trust -Demystifying cybersecurity spending -Translating cybersecurity into actionable language Qualified InfoSec professionals, apply to join below! #socalciso #evantaciso #informationsecurity

19

2 Comments

Interesting discussion about the pros and cons of branding/naming vulnerabilities. In my experience, branding vulns like Heartbleed and Log4j, branding exploits like eternal blue and dejablue, and branding attacks like NotPetya helps when broad communication and expediency are needed. Non-security folks are much more likely to remember Heartbleed then CVE-2014-0160 and when these things are given names, it heightens awareness because regular people take notice. We do need to be careful that we don't overuse branding such that it degrades these benefits... there is a reason we only give hurricanes names when they reach a certain size. #cybersecurity

8

Hm. Microsoft seems to have come up with a new "security convenience" which I didn't want, and more importantly is far weaker security. Specifically when I log in it wants to send a "code" to my email account. Since September I have been getting these "codes" from people trying to log in from Turkey, China, Iran, the gang of usual idiots. Fine. However this account has (a) A strong password, (b) TOTP based MFA and (c) nothing of value. Normally it wouldn't be a problem as MS would TOTP anyone who managed to somehow guess the password.... But now apparently I can just type my email address and a "code" is sent to my personal email. Enter code, totally logged in. Bypasses password AND TOTP *and* makes it easy for random flunkies to drive me nuts with fake requests. Thanks Microsoft for continuing to waste my time and insisting on using an easily findable email address as my "username". Not sure when they started this, but it looks like it goes back to September. Edit: Hilarious update: You CANNOT REMOVE the email validation method as an appropriate auth. This basically turns Microsoft's accounts into a super weak system with a hole by default. *sigh*

14

1 Comment

The SoCal CISO Summit is only 3 weeks away! Don't miss this all-star lineup with Emily O'Carroll, Jonathan Chow, and Arthur Lessard, discussing "The Imperatives of PAM" on May 21st. Organizations have suffered relentlessly from cyberattacks, each week it seems there are new headlines highlighting ransomware attacks or data breaches. With the sensitivity of privileged accounts, unpatched vulnerabilities, and an extensive remote workforce, privileged access management (PAM) is essential to securing your most critical systems and data. Join this panel session to discuss: -Why PAM plays a crucial role in mitigating cyberattacks -Gaining executive buy-in on effective solutions -Having a proactive approach to implementation and configuration Qualified InfoSec leaders, register below! #evantaciso #socalciso #informationsecurity

57

4 Comments

One of the most common reasons IAM consultants are considering something new right now is that they were promised things that didn't/won't happen... Salary increases, 'we'll pay & give you time in work for your certifications', 'we have loads of projects in One Identity...' There's a demand for IAM consultants. Hiring is hard, but retention is also so important, and so is reputation. A few things to think about: 1. 🆔 Be honest in your interview process about what this person is coming in to Of course you want to share the 'best version', but make sure what you share is reality. 2. 🆔 Take the time to understand what the people you interview actually want Think beyond just skills & cultural fit, what do they care about, what will challenge them etc...) Welcome the 'right' people, encourage great people who might not be 'right' to explore other things 3. 🆔 Be aligned on expectations & think carefully about 'promises' you make 'We'll figure it out when they start' is probably not the best tactic - have some alignment BEFORE they start, only promise what you can actually deliver on, seek feedback/encourage feedback sharing... Happy IAM consultant hiring! ✌🏻😎 #iam #identityandaccessmanagement #recruitment #dontmakepromisesyoucantkeep

32

6 Comments

The Recall saga gets even worse. I guess Satya giving that interview and explaining Recall security as "lol trust me bro" isn't really holding up to testing. This company has a lot of trust rebuilding to do and it's doing the exact opposite by burning down what was left. "But let's put it this way: Microsoft is building a feature into Windows that is monitoring and logging a ton of data about you and the way you use your PC. Traditionally, we’d call this “spyware.” "Those who truly hate it will be able to turn it off, though the list of “at least you can uninstall it/turn it off!” things in Windows 11 is getting frustratingly long." "Even if Recall were locked down better, another problem is that Windows 11 has eroded its users' trust and patience over time by endlessly pushing Microsoft's other products and services and refusing to respect user choices once they've been made."

30

13 Comments

Next Wednesday, July 24th, the SoCal CISO Community is connecting for their final 'Summer Series' Townhall of 2024! Don't miss this interactive virtual session led by Discussion Leaders: -Julie Harris, CISO, PulteGroup -Sunil Agarwal, CISO, VP Information Security and Risk Management, OSI Systems -Desiree Wilson, CISO, Quantum M&A -Hugh Jones, Security Operations Transformation Leader, Palo Alto Networks -Roberta French, Vice President of IT, WD-40 Company -Mike Cushing, Head of Global Information Security, Patagonia For over a decade, security leaders and architects utilized a disparate best of breed point solution framework to solve their security challenges. This resulted in bloated security architectures, overlap in capabilities and significant security architecture and integration failures. These failures impacted organization’s ability to scale to meet business demands and reduced stability of the security architecture as environments and data volumes grew. The use of AI driven detections, automation, endpoint security, attack surface management and real-time threat intelligence application were the moonshot achievements for security solutions like SIEM, but were never achieved. Join this session to discuss: -Scaling to meet business demands and stabilizing your security architecture -Reimagining organizational security operations programs based on standardization -Achieving the impossible with security information and event management Community Members register on the mobile app or at My.Evanta.com! #evantaciso #socalciso #infosec

22

4 Comments

Microsoft has recognized the reputational, emotional, and other devastating impacts that arise when intimate imagery of a person is shared online without their consent. This has become more complex as a result of increasingly realistic synthetic or “deepfake” imagery. Whether real or synthetic, the release of such imagery has serious, real-world consequences. Our collective approach to this whole-of-society challenge therefore must be dynamic.  As a result, we are announcing that we are partnering with #StopNCII to pilot a victim-centered approach to detection in Bing, our search engine.  StopNCII is a platform run by SWGfL that enables adults from around the world to protect themselves from having their intimate images shared online without their consent. More info here: https://stopncii.org/ Microsoft has also donated a new #PhotoDNA capability to support StopNCII’s efforts. We have been piloting use of the StopNCII database to prevent this content from being returned in image search results in Bing Check out the blog for more information... https://lnkd.in/e552SDME

80

8 Comments

Oh dear Lord did my amazing boss just ruin my weekend... He has tasked me with making the risk register not "stupid, unwieldy and useless." I cannot think of a single time in my 30 year career that a CISO has said something like, "We just completed our monthly review of the risk register and due to the changing landscape, Project X is on hold for 3 months and Project Y will begin immediately." I cannot think of a single company, whether behemoths like Oracle or Salesforce or companies with more hard core security needs like fintech startups EVER have a direct relationship between the risk register and actual work. It has always been something that gets updated quarterly, shown to an auditor to check the box, and then mostly ignored until the next scheduled update and review. Does anyone have any cool ideas for making the risk register actually impactful on security operations and the broader engineering org?

2

3 Comments

Yeehaw, security buckaroos! Jasper here, ready to share some wisdom on what you need to wrangle before you saddle up for a Red Team Operation. Now, listen close 'cause this is important as a water trough in the desert. A Red Team Op ain't no afternoon rodeo - it's the real deal, like trying to catch a greased pig at the county fair! Before you holler for them Red Teamers, make sure you've got: 1. A mature security program: Your defenses should be tighter than a new pair of boots. We're talkin' solid policies, procedures, and controls. 2. Incident Response Team: Have your posse ready to ride at a moment's notice. They should be drilled harder than a prairie dog's tunnel. 3. Robust Monitoring: Your eyes should be peeled like an eagle watchin' for field mice. 24/7 monitoring is key, folks! 4. Clear Objectives: Know what you're aimin' to learn. Are you testing your crown jewels or the whole darn kingdom? 5. Management Buy-in: Make sure the big bosses are on board. You don't want them hollerin' like a startled rooster when things get hairy. 6. Scope and Rules of Engagement: Set clear boundaries. It's like fence lines for your digital ranch - keeps everyone playin' fair. 7. Recovery Plans: Be ready to pick up the pieces if them Red Teamers knock something over. It's like having a first aid kit for your systems. 8. Communication Plan: Know how you'll spread the word if things go south. Faster than gossip at the general store! Get all this sorted, and you'll be ready for them Red Teamers to give you a run for your money. Remember, preparation is key - you wouldn't enter a buckin' bronco contest without practicin' first, would ya? Stay safe out there on the digital range, partners! #infosecdonkey

11

1 Comment

Nicely done team! Looking to deploy copilot or get data governance under wraps? Let us Shoe you how with a complimentary copilot or Data Risk Assessment leveraging Varonis!

4

How Can Design Protect Users from Suffering Real-World Harm After Digital Interactions? This question has been resonating with me since the "Trust & Safety in the Majority World" workshop, hosted by the Institute for Rebooting Social Media at the Berkman Klein Center for Internet & Society at Harvard University and Integrity Institute. At this event, I had the privilege of engaging with over 60 experts in AI, Research, Policy, and Content Moderation. The insightful conversations about Design for Trust & Safety (T&S) were incredibly enriching, and I was grateful for the opportunity to share my perspective. Here are 3 Key Takeaways on the Design POV: 1️⃣ Positive Friction: Friction is not always the villain in user experience. Implementing positive friction can safeguard users by preventing impulsive actions that could lead to harm. 2️⃣ Context-Specific Safety Tools: Safety tools should be tailored to the specific context, as threats vary widely across different environments, supporting more effective protective measures. 3️⃣ Design from the Margins: Centralizing marginalized users in the design process is challenging but essential, promoting a safer and more inclusive experience for all users. For those interested in a deeper dive, I highly recommend reading the recent article by Tech Policy Press, which shares more details about our experiences. Kudos to Nadah Feteih, Diletta Milana, and Jenn Louie for their exceptional work in organizing the event and crafting the article. 🛟 What tools and practices do you currently use to incorporate T&S considerations into your designs? https://lnkd.in/dFFHgECg

12

Encode Justice Chapters all worked on a StateAI Legislative Project this past term. If you'd like to read the Oregon chapter's work, visit the link below!

4

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Let's recall Recall for a fun Friday post. Recall is like a drinking problem, it's getting worse. "Microsoft is fully aware that the concept of Windows Recall sounds creepy. I know that the company spent a lot of time internally figuring out how to communicate this feature to the world, but it turns out there's no good way to communicate something like this when your users don't trust you." "Here is a list of just some of the practices Microsoft has employed on Windows that users do not like: Requiring a Microsoft Account to setup Windows 11 Advertising in system-level interfaces like Start, Widgets, Settings, and File Explorer Refusing to acknowledge user app defaults like browsers Shoehorning MSN into Windows Replacing native Windows apps with slower, uglier web apps Full-screen prompts pushing you to setup OneDrive or Microsoft 365" The key here is Microsoft is losing trust faster than an Ozempic junkie loses weight. Can we really trust MS to not turn this feature on with an update? Can we trust MS not to start harvesting this data? Can we trust MS to fix how easily accessible this data is? I think the answer for a growing number of people is that No, we can't and it's time to part ways with Windows. https://lnkd.in/egS5CCRv

34

21 Comments

Copied: Are you a hiring manager in infosec? Can you spare 5 minutes to share your thoughts on the current state of cybersecurity talent with Minorities in Cybersecurity? Minorities in Cybersecurity operates workforce development programs to train, place, and mentor professionals from underrepresented groups throughout their career -- we don't Ding Dong Ditch (shout out to my fellow 90s kids!). To help ensure we're preparing new talent with the skills and experience you need for your teams, please fill out the survey below. ✍️ Survey: https://lnkd.in/gAaUsbzS

3

1 Comment

For the past week the world and the security community has been buzzing about the CrowdStrike patch failure. The word "RISK" has been mentioned multiple times...but, do you really understand "RISK?" Take a look at Chapter 2, "Risk and Risk Management" to better understand these concepts. One of my book reviewers (Mr Larry Hughes) mentioned it was one of the best summaries on the topic of RISK ever written. #risk #crowdstrike #riskassessment #criticalinfrastructure #rothstein

13

3 Comments

Southern California study finds high levels of airborne plasticizers

1