Brian Grayek

Delayed revocation events by the numbers: An epidemic of delayed revocations has infected the public CA community. Jason Soroko and I track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes. #pki #security #CABF #ssl #revocation https://lnkd.in/g6APX-Fx

21

I've done some research and some surveys on this, and a significant number of people see these "vanity" awards as a red flag - both for individuals and businesses. In the survey I did back in 2019, people said they're 39% less likely to engage with companies who promote their own awards. I think some companies view them like certifications - as a way to show competence before they have the experience/customers/case studies to show it. These awards are rarely based on anything substantive, however, so they don't tell customers anything - just that this company/individual loves awards.

14

2 Comments

Tip and Tricks Thursday: How to make sure your cyber program gets traction in an organization. Got a question on this recently in the PowerGRYD... "How do I get traction in the organization with the vCISO program - it feels like pushing a rope." I find this is typically because there is no executive sponsor or mandate for the program. How do we solve this? A business risk workshop with the executive team. Call it whatever you want - Crown Jewels, Critical Systems, Line-of-Business applications... But you need investment from leadership. And one of the best ways to do that is let them "decide" how the cyber program and risk program protects their business. You've also just: • Built rapport • Showed your value • Drawn a clear line that... • The business owns the risk. This is part of the standard vCISO onboarding methodology we learn in the PowerGRYD. Come join us. Link in comments 👇

13

5 Comments

🇺🇸 Washington Courts detected unauthorized network activity on November 4, which caused a network outage that disrupted operations in county courts across Washington State. So far, at least 29 county courts have reported limited availability of public services. While the exact cause is still unconfirmed, we believe ransomware may be involved based on initial reports—though this is just an assumption at this stage. Check out our full analysis here 👉 https://app.venarix.com

4

It’s hard to protect something when you don’t know what you have… I was privileged to attend the Scottsdale Institute Chief Information Security Officer’s Summit last week and was impressed with the ingenuity, diligence and commitment of the CISOs in attendance. Throughout the sessions, there was a return to the challenge of third-party vendor and asset management – common themes in my work with supply chain leaders, too. Healthcare providers rely on these partnerships to deliver top notch patient care, but the sheer breadth and depth of these relationships can certainly keep one up at night wondering if everything is as secure as it should be. Many are making progress, and they understand the importance of tracking all the assets they must manage and the necessity of controlling potential access points via their third-party relationships. Top strategies include: 🎆 Adopt and manage an enterprise-wide asset tracking system 🎆 Ensure contracts include appropriate data and access management protections 🎆 Deepen business unit partnerships enabling them to take ownership in their role in security via the assets and systems that are essential to their business 🎆 Create awareness of 2nd level partnerships with your key vendors to monitor potential risks that could impact you I’d love to hear from my network on unique partnerships between CISOs and SC leaders as well as tech companies who are advancing offerings in this space. What’s working or not working for you? #cybersecurity #medicaldevice #thirdpartyvendors #riskmanagement #assetmanagement #CISO #supplychain

13

A Data Breach at LA County Health Services 🏥 , shows that Phishing continues to be a huge threat should businesses stop using email internally? 2023 Was the Worst Year for Phishing on Record, we need to think of future solutions and this breach highlights very publically the risks Hackers gained access to LA County Health Services employee emails through a phishing campaign, potentially compromising patients' personal and health information.  23 employees had their credentials stolen in a February attack. Documents and e-mails in the compromised mailboxes included patients' personal and health information, including a combination of: • first and last name, date of birth, home address, phone number(s), e-mail address, medical record number, client identification number, dates of service • medical information (e.g., diagnosis/condition, treatment, test results, medications), • and/or health plan information. After discovering the breach, L.A. County Health Services disabled the impacted e-mail accounts, reset and re-imaged the compromised employees' devices, and quarantined all suspicious incoming e-mails. It also circulated awareness notifications to all employees, reminding them to always be vigilant when reviewing e-mails, especially those with attachments or links. ✔ A sensible approach showing they had a strategy to deal with incidents like these, which is great! This incident reminds everyone of the importance of robust cybersecurity measures, especially for organizations handling sensitive data. But how do we stop phishing attacks? 🤔 The obvious thing to do is to: • Educate employees on identifying phishing attempts. • Implement multi-factor authentication. • Regularly update and patch systems. • Have a clear communication strategy for employees when they suspect a Phishing attack. But what else is working? do you think the future for businesses is not using email for internal communications? If you are concerned and want to learn more here is the data breach notice: https://lnkd.in/epBfDvSm Some great analysis on Phishing here https://lnkd.in/eiRaJBMJ #cybersecurity #security #StopPhishing

5

TSA issues proposed cyber mandates for pipelines, rail, airlines: The post-Colonial Pipeline proposal requires the agency's charges to follow one cyber mandate to rule them all. The post TSA issues proposed cyber mandates for pipelines, rail, airlines appeared first on CyberScoop. #cyber #cybersecurity #informationsecurity #Innovation #Technology #cloudsecurity #socanalyst #cyberjobs

1

Are there any simple cybersecurity rules you live by—e.g., not opening attachments from unknown senders—that you think significantly mitigate #cyberrisk?

1

What is Compliance? Episode 2 of "What is GRC?" Part 2 of our What is GRC series.. What is compliance? We grabbed a great guest this week in Jacob Cane. We hope to hear.. Does compliance = security? How the two are related.

16

**Selecting the Right GRC Tool for CMMC Compliance: What You Need to Know!** Navigating CMMC compliance can feel overwhelming, especially when it comes to choosing the right Governance, Risk, and Compliance (GRC) tool. Many organizations miss crucial steps in this process, leading to costly misalignments. Here’s a structured approach to help ensure your organization selects the best-fit GRC solution: 🔍 **Define Your GRC Requirements** - Clearly identify your organization’s size, compliance needs, and specific areas for improvement. - Engage stakeholders across departments for a comprehensive understanding of diverse requirements. 🛠️ **Research & Evaluate** - Shortlist tools based on functionalities, integration capabilities, and vendor support. - Don’t skip the pilot test! Gather real-world feedback before rolling it out organization-wide. 💰 **Consider Total Cost of Ownership** - Look beyond the initial purchase price to include implementation, training, and ongoing support costs. From my experience, investing time upfront in a detailed assessment not only eases implementation but also sets a solid foundation for long-term compliance success. The right GRC tool can empower your organization to meet NIST SP 800-171 and CMMC standards effectively. Curious to learn more? If you’re navigating the complexities of CMMC compliance, I invite you to comment below or send me a DM to receive my exclusive resource: **CMMC Compliance Unlocked: An IT Pro's Cybersecurity Playbook for DoD Contractors.** This playbook offers actionable insights and strategies tailored for your needs! #CMMCThursday #Cybersecurity #GovernanceRiskCompliance #CMMC #DoDContractors

2

We have to move to automation and if you don’t the problem of alert fatigue will lead to a major breach. I don’t understand why we are not moving faster with automation. #stratejm #cybersecurity

14

UHG filed an incident update stating they found PHI/PII in initial targeted data sampling "which could cover a substantial proportion of people in America." ➡️ They note this is not an official breach notification. ➡️ It will likely take several months to complete the analysis and notify impacted persons. ➡️ They have setup a support website and call center for people concerned about their personal data potentially being impacted to offer free credit monitoring and identity theft protections for two years. They have also staffed trained clinicians to provide support services. ➡️ They have offered to make notifications and undertake related administrative requirements on behalf of any provider or customer. ➡️ And update on service restoration was also provided. #sec #cyberattack #8k #uhg https://lnkd.in/g4XpqjRc

27

10 Comments

Even healthcare behemoths' cybersecurity isn't foolproof. Months after a #Ransomware attack took a major healthcare company’s systems offline, medical providers, pharmacies, and hospitals all over the country are still feeling the effects. I think the entities involved responded reasonably to the breach, fronting billions of dollars while they fixed the issue, but reacting to damage already done doesn't make up for strong preventative measures. Use this as a reminder to check your systems, upgrade your #Cybersecurity plans, and educate your employees on potential threats and how to prevent them. Tantus Technologies, Inc. can help with your cybersecurity strategy and implementation. #GovCon #FedCon

16

1 Comment