Andrew Cannata, Veteran

The newest Action1 release of Vulnerability Management today is set to partially address the NIST NVD Backlog Crisis. Action1 is now able to detect software vulnerabilities for applications listed in Software Repository even if the vulnerability data is not yet available in the National Vulnerability Database (NVD). Given the alarming slowdown of NIST NVD updates, this critical capability adds the much-needed visibility over many previously undetected vulnerabilities and allows to automate their remediation: https://lnkd.in/g6UY-iF7 As of right now 18,000+ CVEs are unanalyzed. National Institute of Standards and Technology (NIST) has still a long way to go in terms of analyzing newly published CVEs. As of September 21, 2024, 72.4% of CVEs (18,358 CVEs) in the NVD have yet to be analyzed, VulnCheck said, adding "46.7% of Known Exploited Vulnerabilities (KEVs) remain unanalyzed by the NVD (compared to 50.8% as of May 19, 2024)." It's worth noting that a total of 25,357 new vulnerabilities have been added to NVD since February 12, 2024, when NIST scaled back its processing and enrichment of new vulnerabilities.

26

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

New On Target! Incident Response Plans #IncidentResponsePlan #Risk #RiskManagers #ArcherEnergySolutions #CriticalInfrastructure #Compliance #NERC #FERC #Cybersecurity #PhysicalSecurity https://lnkd.in/gy4352ft

1

Are current remediation efforts enough? We measured the percent change in the number of open vulnerabilities each month for each firm. Taken together, these monthly measures reveal whether security exposures are piling up... Read the full report: https://lnkd.in/e4EAeQ6v

1

🚀 Navigating ISO42001 AIMS Controls: Your Roadmap to Controls Implementation 🚀 As compliance executives, implementing ISO42001 AIMS controls can be a daunting task. Below are my thoughts on how to incrementally select, design, and then implement controls for your AIMS. 1️⃣ Identify Standards & Conduct Risk Assessments: Start by understanding the specific ISO42001 requirements applicable to your AI systems. Conduct a detailed risk assessment to uncover potential vulnerabilities and threats. For instance, if your AI handles sensitive data, focus on controls that address data privacy and security risks. 2️⃣ Design Tailored Solutions: Design controls that are tailored to the risks you’ve identified. Ensure these controls not only comply with legal and ethical standards but are also practical for your daily operations. Engage stakeholders from various departments—like IT, legal, and operations—to gather a variety of insights that ensure comprehensive coverage. For example, if your risk assessment highlights a potential for data breaches, you might design an AI control that includes both encryption of data at rest and rigorous access controls. 3️⃣ Implement Controls "Smoothly": Integrate these controls seamlessly into your existing business and IT processes. Before full implementation, pilot these controls in a controlled/dev environment to iron out any issues. Comprehensive training for all users is critical to ensure smooth adoption. For example, after introducing a new AI monitoring tool, conduct training sessions to help your staff understand how to use the tool effectively and recognize signs of system anomalies. 4️⃣ Monitor, Document, and Adjust: Maintain detailed documentation of all AI controls, their implementation processes, and their effectiveness. Regular monitoring is vital — set up dashboards that track compliance in real-time and alert you to any deviations if you aren’t using a platform like Vanta or Drata. Regularly review and refine your new controls to adapt to new technological developments or changes in regulatory requirements. For instance, if a new data protection regulation is passed, review your AI data handling controls to ensure they remain compliant across geographies. 🌐 Interested in a deeper dive or specific examples tailored to your industry? Connect with me for a personalized discussion on optimizing your ISO42001 AIMS implementation!  #AICompliance #AIManagement #ISO42001 #Cybersecurity A-LIGN #iso42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

5

🔔 CMMC 2.0 Update: Get Ahead of the Curve 🔔 The CMMC 2.0 rule is on #track to be finalized by October 2024, with third-party assessments starting shortly after. If you're part of the Defense Industrial Base (#DIB), now is the time to ensure your organization is prepared for the new cybersecurity standards. Key Focus Areas: Security Audit: Conduct a thorough review of your current practices and map out any gaps to CMMC requirements. Early assessment is critical for a smooth certification process. Expertise: Many teams face resource constraints. Consider bringing in external support to assist with preparation and implementation. Documentation: Start organizing and updating your security policies and procedures to prevent delays during the assessment. Being #proactive now can save your organization from compliance #challenges and #secure DIB contracts. Not sure how to get started, let our #Federal Compliance experts at Concertium help guide you through a successful audit! #CMMC #Cybersecurity #Compliance #DefenseIndustry

4

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

2

c1secure's NIST Policy to Control Mapper uses an innovative approach to align policies with their corresponding NIST 800-53 control families. This alignment helps compliance teams manage and track the relationships between different policies and controls effectively. By organizing controls into specific families, the Policy to Control Mapper simplifies the compliance process, providing a clear and organized view of how various policies relate to each control, and enabling easier management and oversight through a user-friendly dashboard. Contact [email protected] today to speak to us about our NIST Policy to Control Mapper! #security #compliance #NIST #c1secure #FedRAMP

8

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

For those who desire cybersecurity metrics that actually align to the business value, seek out Gavin and Grace! They can show you how metrics can optimize #cybersecurity resources to deliver meaningful value to the organization!

4

Please check out our latest blog from the Mark43 Security Team (authored by Nick Gerteisen) which dives into the crucial role of SSO and SCIM in access and identity management for public safety agencies. Mark43 proudly offers SSO and SCIM integrations. Embracing standards like SCIM can be a game-changer for those looking to gain efficiencies in their access management processes. As technology advances, it's essential for agencies to stay ahead in this rapidly evolving threat landscape. #CyberSecurity #InfoSec #DataProtection #IdentityManagement #SSO #SCIM #PublicSafety #TechInnovation #SecurityAwareness #AccessManagement

13

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1

Many of you have questions about ISO42001, and many don't even know where to begin. It's a lot...a lot to take in, a lot to think through, a lot to consider. To help you build momentum, A-LIGN has published a new ISO42001 Frequently Ask Questions (FAQs) blog, so if you're not sure where to start on your journey, this is the place! https://lnkd.in/e3yV93kh #iso42001 #iso27001 #ethicalAI #resonsibleAI #AIGovernance #TheBusinessofCompliance #ComplianceAlignedtoYou

67

1 Comment

Attackers are adapting to the standard practices for vulnerability management. They aren’t using CVSS severity as the criteria for compromise. Instead, they are prioritizing the most exploitable vulnerabilities, which are often those ranked as medium or low severity. If security and patching teams are too focused on critical CVEs, they can miss middle-of-the-road exploits that allow attackers to gain network access and then move laterally into business-critical systems. Following your monthly scan, analyze vulns by the ease of exploit and compare that to the CVSS score. It may shed light on gaps you didn't know existed. #cybersecurity, #vulnerabilitymanagement, #proactivesecurity

13

2 Comments

The #CISSP exam continues to evolve – Beginning today, all CISSP examinations worldwide will take place in Computerized Adaptive Testing (CAT) format.   Learn more: https://ow.ly/lNGL50Rgtpx   #CISSP30

1,070

21 Comments

Properly managing your organization’s access can greatly impact your #Cybersecurity. Discover the latest insights and trends in our 2024 Cybersecurity Report with CDW’s Buck Bell – don’t miss it! https://dy.si/o2X6g

5