Peter Bookman

🚨 Colorado has passed an AI consumer protection bill (SB24-205). If signed by the Govenor, consumers would gain new AI rights (starting in 2026). The bill requires developers and deployers of high-risk systems to take reasonable care to avoid algorithmic discrimination. The bill sets up a "rebuttable presumption" that reasonable care was taken by a developer and deployer if they take certain actions, including performing impact assessments, providing notices, performing regular reviews of the system, and providing data subject rights (like the right to correct incorrect information) (amongst other requirements). https://lnkd.in/gYWwAHYc

11

"An extraordinary or unusual thing, person, or event; an exceptional example or instance..." THATS what a "Palooza" is. And we're about to have a POLICYpalooza. A plethora of amazing revelations of whats possible with policy, when you're a StrongDM user. First up? How can you add an MFA prompt to every single resource in your environment. Stop begging your resource vendors to support MFA - just use StrongDM to enforce an MFA prompt whenever anyone accesses that resource, or when they access that resource at a certain time, or when they access that resource from a certain region or.. or...or.. Get in on this people... It's going to be amazing.

11

1 Comment

Are you ready to navigate the future of digital resilience? Splunk's 2025 Predictions offer critical insights that could shape your organization's strategy. Here’s a glimpse of what to expect: AI's ROI Takes Center Stage ✅ AI will supercharge productivity, delivering major dividends. ✅ Expect AI tools to become part of everyday workflows. ✅ SLMs (likely Small Language Models) will boost accuracy and slash operating costs. Resilience as a Collaborative Effort ✅ Organizations and vendors will team up to prevent large-scale disruptions. ✅ The public sector will tap into student talent to address security skill gaps. ✅ Observability data will guide application roadmaps and feature optimization. Navigating the Regulatory Landscape ✅ CISOs and CIOs will proactively tackle new compliance challenges. ✅ Cybersecurity materiality will be defined by recovery time. ✅ Global data laws will fragment due to geopolitical shifts. These predictions provide valuable insights for anyone in #tech, #security, or #business #strategy. Here is Splunk's full report for more details: https://splk.it/3VhPC9u  #SplunkPredicts #2025Predictions #CISO #CIOs #CEOs #BoardDirector Want more insights on #Tech and #Innovation? 👉 Subscribe to the #CXOSpice newsletter https://lnkd.in/gy2RJ9xg or YouTube channel https://lnkd.in/gnMc-Vpj.

298

70 Comments

Excited to share that we are entering into a partnership with Sandfly Security. Sandfly is an agentless, instantly deployable, and safe Linux security monitoring platform. Sandfly protects virtually any Linux system, from modern cloud deployments to decade-old devices, regardless of distribution or CPU architecture. Sandfly's deep understanding of Linux intruder tactics offers unparalleled threat coverage and proactive protection. Known and unknown attacks are detected with safety and performance. #Linuxsecurity #Agentless #SuperiorCompatibility #quickdeployment #driftdetection #Incidentresponse #Criticalinfrastructure Below is a recent customer testimonial. “Sandfly is the first product I’ve seen that accurately and quickly detects thousands of signs of compromise on the Linux platform. Its unique method automates tasks which would be manually impossible. Automation is key with detection, and Sandfly completely fits this and other requirements. If your organization is using Linux, this should be part of your cybersecurity toolset.”

7

If you are in the #insiderrisk #insiderthreat space or you find it interesting, this is indeed the conference you MUST attend! Please find registration information below and stop by our booth! #cybersecurity #zerotrust #dtexsystems #insiderrisk #insiderthreat

2

We'll be on the ground for BSides SF and #RSAC. Look for the devici booths! (At #RSAC, we're at the Early Stage Expo.) Hit me up to talk all things #threatmodeling! Also, catch me in a workshop or a main stage talk at #RSAC: Speaking: Secure and Privacy by Design Converge with Threat Modeling (May 8, 14:25 Pacific) Learning Lab: Threat Modeling Championship: Breaker vs. Builder (May 8, 08:30 Pacific)

12

1 Comment

🚨 Episode 29 with Ron Ross is out now! In this episode, we discuss NIST SP 800-172r3 ipd and their goal with this draft. There are roughly 3x MORE REQUIREMENTS. He emphasized that the goal is not to make your work harder, but rather give you more choices. Here are some of the significant changes listed: 🔸 Added new enhanced security requirements based on (1) the latest threat intelligence, (2) empirical data from cyber attacks, and (3) the expansion of security objectives to include integrity and availability 🔸 Added new requirement families for consistency with SP 800-171r3: Planning (PL), System and Services Acquisition (SA), and Supply Chain Risk Management (SR) 🔸 Increased the specificity of the enhanced security requirements to remove ambiguity, improve the effectiveness of implementation, and clarify the scope of assessments 🔸 Revised the enhanced security requirements for consistency with the source security control language in SP 800-53 Thank you to Dr. Ross, Victoria Yan Pillitteri, and everyone at National Institute of Standards and Technology (NIST) for always striving for what's best for the evolving infrastructure. They are accepting comments now until January 2025 and we promise that they don't just go into a black hole. Watch the full episode at the link in the comments below! ⤵

8

1 Comment

#RSA2024 starts in 2 weeks. I'll see 150+ booths with marketing slogans prominently displayed... and yet I'll walk past, not knowing what the company does or what problem they solve. I say this because RSA booth space is expensive at $50k-$200k+ for showfloor rental (booth design, build, travel, entertainment and extras can easily 3-5x that) Marketing has value. My challenge is too many marketers don't speak customer, they speak marketing. Customers are simply looking to understand "how can you make their lives easier, by solving a pressing concern or help with a 2024 project."

21

4 Comments

Join Philip Kwan, Senior Principal Product Manager at Palo Alto Networks, and Marisol Cruz Cain, Director at the Government Accountability Office, on Dec 4 at 2 PM ET to gain insights on quantum-resistant encryption and the roadmap to post-quantum readiness. Tune in to hear the experts speak about some of the latest advancements in quantum-resistant technologies, including VPNs and algorithm discovery tools, as well as the importance of interoperability and crypto-agility in PQC solutions. #quantumcomputing #quantumresistantencryption #cybersecurityencryption Secure your spot: https://bit.ly/413eN2X

9

They say that for a concept to be portable, it must be memorable. In that spirit, I wanted to offer a few suggestions for connecting to the intent of each of the ISO High-Level Structure (#HLS) elements. For those of you building your management system(s), or simply integrating a new MS (like #ISO42001) into your existing management system(s), please keep these quotes in mind. ➡️ Clause 4: Context of the Organization Understanding internal and external dynamics affecting goals and systems. 🖊️ “To know thyself is the beginning of wisdom.” – Socrates This speaks to the importance of self-awareness—an apt metaphor for understanding your organizational context. ➡️ Clause 5: Leadership Demonstrating commitment and setting direction for the management system. 🖊️“A leader is best when people barely know he exists, when his work is done, his aim fulfilled, they will say: we did it ourselves.” – Lao Tzu This captures the essence of leadership that inspires action and responsibility as a cultural norm. ➡️ Clause 6: Planning Determining risks, opportunities, and objectives for continual improvement. 🖊️“In preparing for battle I have always found that plans are useless, but planning is indispensable.” – Dwight D. Eisenhower It underscores the importance of the planning process, even (or especially) when conditions change. ➡️Clause 7: Support Providing resources, competence, awareness, and communication. 🖊️“Give me six hours to chop down a tree, and I will spend the first four sharpening the axe.” – Abraham Lincoln Your focus on preparation and equipping your resources aligns perfectly with this clause. ➡️Clause 8: Operation Executing and controlling processes to meet objectives. 🖊️“Well done is better than well said.” – Benjamin Franklin It emphasizes the importance of action and implementation over mere promises. People believe the behavior, not the words. ➡️Clause 9: Performance Evaluation Monitoring, measurement, analysis, and evaluation of performance. 🖊️“What gets measured gets managed.” – Peter Drucker This highlights the significance of consistent evaluation and feedback, both balancing and reinforcing. ➡️Clause 10: Improvement Continual improvement of the system and corrective action for nonconformance. 🖊️“The greatest glory in living lies not in never falling, but in rising every time we fall.” – Nelson Mandela This resonates with the spirit of continuous improvement and learning from mistakes. Failure isn't fatal unless we choose for it to be. I would genuinely love your feedback…what quote or quotes resonate most with you as you think about architecting your governance and management systems? A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

10

2 Comments

Getting the band back together for the next era in SecOps shifting left! It's an honor to be part of this. Let's chat about making the magic happen together!!! If you'll be at Black Hat, let's meet up. #shiftleft #prediction #prevention #SecOps #blackhat #GenAIsecurity

7

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

In a world where cybercriminals are leveraging AI to breach defenses, it’s time we turn the tables. Let’s empower your cybersecurity with cutting-edge AI solutions. Together, we can outsmart the threats and safeguard your digital realm.

1

I am a regular on the Razorthorn Security #Razorwire podcast, and one of the recurring fun topics we frequently revisit it #AI. For example, we've discovered that there are different AI tribes.  I am a biochauvinist, Richard Cassidy is a singularitarian, and James Rees is a transhumanist. Which AI tribe do you belong to? Don't forget to subscribe to the Curious AI Newsletter - the best source of AI news for techno-realists https://lnkd.in/eXiZ2NAa

8

3 Comments

ICYMI - Michael Vizard interviewed Umaimah Khan reported on Opal Security's newest least privilege posture management features launched on July 31. "Ultimately, cybersecurity teams need to have a long overdue conversation with business leaders about how privileges are granted and, just as importantly, revoked. In the meantime, however, machine learning algorithms can provide cybersecurity teams with some insights into the scope of an issue that in the wake of a cybersecurity breach is quickly identified as one of the root causes of the cybersecurity ills that plague organizations today." Check out the article on Security Boulevard powered by Techstrong Group! https://lnkd.in/eHJG_XkM #IdentitySecurity #LeastPrivilege

24

2 Comments

We are pleased to announce that TXOne has just completed a round of financing, raising a total of $51 million in this extension round of Series B, bringing the total Series B funding to $131.4 million. We are grateful for the investors' recognition of TXOne's vision and execution capabilities. TXOne believes that to excel in OT cybersecurity, it is crucial to protect the mission-critical assets there. Only by truly understanding and adapting to the unique constraints and requirements of OT operations in different vertical industries can we effectively address the pain points of users. Our strategy is to collaborate with industry leaders from various sectors to identify and formulate the best practices for OT cybersecurity, ensuring the success of our customers. In addition to serving manufacturing industries such as semiconductor, automotive, pharmaceuticals, and food and beverage, which we have been operating for several years, we have also successfully expanded into critical infrastructure sectors such as railway transportation, oil and gas, power utility, and shipping. OT cybersecurity is a vast and challenging field. There is no shortcut to lowering the difficulty level; it requires understanding the nature of the challenges, developing effective solutions for customers, and continuously refining them. Only through constant practice can we reduce the difficulty, replicate, and scale the industry. We will continue our efforts and hope to receive your support. https://lnkd.in/gqBrAXa8

433

51 Comments

Data-centric security is crucial in digital transformation as it focuses on protecting the most valuable asset—data—separately from network infrastructure. This approach is especially vital for industries like utilities, where data breaches can lead to significant financial loss, reputation damage, and operational disruptions. By implementing data-centric solutions like DPRM, organisations can ensure operational continuity and safeguard against sophisticated cyber threats, thereby enabling seamless digital transformation without compromising data security.

10

Utilities, pharmacies, other core components of the life we live are under attack daily and sustained predictable #MDR essential to keeping us safe and secure. CyberMaxx helping out clients here every day

4

In 2023, the manufacturing industry was the third-most represented industry in Arctic Wolf® Incident Response (IR) ransomware engagements, and fourth-most represented in IR business email compromise (BEC) engagements. (Link in comments) The median cost of a manufacturing ransomware attack responded to by Arctic Wolf Incident Response is now $500,000 USD. Can you ( Mr or Ms. Manufacturer) sustain downtime, interruptions, reputational damage, client data loss and more? We help many of the top local manufacturers in the area protect and defend their business from cyber threats by "making them a hard target" - putting in the defenses that will keep most of the "bad guys" moving on the next victim who hasn't locked their doors and windows.

5

1 Comment