Cassie Crossley

By adopting CISA's Cyber Security Evaluation Tool, the Federal Highway Administration is leading by example in cybersecurity. This move not only enhances safety, but also sets a benchmark for others as efforts continue across both public and private sectors to embrace #SecureByDesign. https://bit.ly/3MLT8nI

3

🌐🛡️💧 Protecting our drinking water is a matter of national security and #CriticalInfrastructure protection. Water and wastewater providers must secure their critical infrastructure from cyber threats while maintaining safe, reliable engineering operations. Here is a threat-based approach white-paper to help the community by 🛡🏭 Dean Parsons 🏭🛡 Just publicly released my whitepaper on the Water, Wastewater #CriticalInfrastructure sectors with consideration on the 5 ICS Cybersecurity Critical Controls. “Simply applying traditional information technology (IT) security controls to industrial control systems can be dangerous and misguided, and potentially lead to unforeseen safety consequences.” 📘The Whitepaper Covers: ⚙️ Specific Cybersecurity Controls for ICS ⚙️ Subsystems of the Water Sectors ⚙️ Water System Critical Digital Assets ⚙️ A Threat-based Water Sector ICS Incident Response Scenario ⚙️ The 5 ICS Cybersecurity Critical Controls ⚙️ Cybersecurity Leadership Approach for Water Sectors 📥 https://lnkd.in/ehSbWwG8 #Cybersecurity #OTSecurity #IncidentResponse #RiskManagement #ITSecurity #SCADA

18

2 Comments

Navigating OT risks and managing a racehorse both require a deep understanding of capabilities and vulnerabilities, along with a comprehensive approach to risk management. https://lnkd.in/gPgduE_n

10

1 Comment

Great insights shared by Mandy Andress on the historical contributions of women in technology, Neda. Her reflections highlight the importance of recognizing and continuing the legacy of women who have shaped our field. It’s essential to support and encourage diverse talent to drive innovation and progress in cybersecurity. Let’s keep the momentum going and ensure everyone has the opportunity to lead and contribute! #WomenInCyber #Leadership #Cybersecurity

12

Highly likely that these will be included in the CMEP IP (AML) going forward...

2

As with all emerging technology, it can be difficult to wrap your arms around the true risk, steering clear of FUD, when there are so many unknowns and things are changing every week. It's really important to keep a learning mindset and seek out information about the new types of risk AI deployment in your organization creates BUT also to look at risk that has already been accepted because it falls within the risk tolerance or appetite and understand how AI might impact that risk such that it changes where it falls in the amount of risk the org is willing to take on. #cybersecurity #riskmanagement #AI

3

👍 The U.S. Department of Commerce announced today the release of new guidance and software to help improve the safety, security and trustworthiness of artificial intelligence (AI) systems. The Department’s National Institute of Standards and Technology (NIST) released three final guidance documents as well as a draft guidance document from the U.S. AI Safety Institute that is intended to help mitigate risks. NIST is also releasing a software package designed to measure how adversarial attacks can degrade the performance of an AI system. In addition, Commerce’s U.S. Patent and Trademark Office (USPTO) issued a guidance update on patent subject matter eligibility to address innovation in critical and emerging technologies, including AI, and the National Telecommunications and Information Administration (NTIA) delivered a report to the White House that examines the risks and benefits of large AI models with widely available weights. NIST’s document releases cover varied aspects of AI technology. Two were made public today for the first time. One is the initial public draft of a guidance document from the U.S. AI Safety Institute, and is intended to help AI developers evaluate and mitigate the risks stemming from generative AI and dual-use foundation models — AI systems that can be used for either beneficial or harmful purposes. The other is a testing platform designed to help AI system users and developers measure how certain types of attacks can degrade the performance of an AI system. Of the remaining three document releases, two are guidance documents designed to help manage the risks of generative AI — the technology that enables many chatbots as well as text-based image and video creation tools — and serve as companion resources to NIST’s AI Risk Management Framework (AI RMF) and Secure Software Development Framework (SSDF). The third proposes a plan for U.S. stakeholders to work with others around the globe on AI standards.

10

A #technology outage can have profound downstream impacts. How can companies enhance their capabilities to prevent, prepare and respond to the next disruption? Be sure to join our upcoming webinar on Sept. 13! Link to register:

3

What are people's thoughts on the VET AI Act introduced last week? Although voluntary, it might present a great opportunity to have shared standards on audit practices that are supported by the USG. The VET AI Act would: 📠 Direct NIST, in coordination with the Department of Energy and National Science Foundation, to develop voluntary specifications and guidelines for developers and deployers of AI systems to conduct internal assurance and work with third parties on external assurance regarding the verification and red-teaming of AI systems. 🔄 Such specifications require considerations for data privacy protections, mitigations against potential harms to individuals from an AI system, dataset quality, and governance and communications processes of a developer or deployer throughout the AI systems’ development lifecycles. 🤔 Establish a collaborative Advisory Committee to review and recommend criteria for individuals or organizations seeking to obtain certification of their ability to conduct internal or external assurance for AI systems. Require NIST to conduct a study examining various aspects of the ecosystem of AI assurance, including the current capabilities and methodologies u https://lnkd.in/gXi-BBJE

29

8 Comments

👀 Stay vigilant and secure with Binalyze! Our latest blog dives into how our cutting-edge digital forensics and incident response solutions keep your organization safe from emerging threats. Learn how Binalyze ensures your digital safety. #CyberSecurity #DigitalForensics #IncidentResponse #Binalyze #StaySafe #DFIR #TechInnovation

9

Heading to RSA Conference and looking forward to diving into all things data protection and cybersecurity! ☕️ If you're around, let's catch up over coffee. Direct message me. Plus, don't miss my presentation with Shannon Yavorsky 🗣️ "Bridging Theory and Practice of Privacy and Data Protection" on Monday, May 6th at 9:30 AM. A deep dive into connecting the dots between academic insights and real-world applications. See you there! #RSAC #Privacy #DataProtection #wisporg

29

1 Comment

Full video: https://lnkd.in/ghSJgDgV Transferable Skills: Boosting Cybersecurity Communication Discover how transferable soft skills enhance your effectiveness in cybersecurity. Learn to explain complex concepts simply and gain stakeholder trust, drawing parallels from the food industry's compliance challenges to succeed in governance, risk, and compliance (GRC). #CybersecuritySkills #SoftSkills #Communication #StakeholderEngagement #GRC #Compliance #TechnicalCommunication #DigitalTrust #ProfessionalDevelopment #IndustryInsights

3

https://lnkd.in/enfGeu7N OT (Operational Technology) systems are critical to the infrastructure of many organizations, and FedEx has been focusing on enhancing the security of these systems. Anthony Perry, the director of IT and OT/IoT security at FedEx, shared strategies for developing robust OT security programs. Here are key takeaways from his approach: 1. Unified Security Approach: Integration of IT and OT: By bringing IT and OT under one security umbrella, FedEx has been able to create a cohesive and unified approach to addressing security vulnerabilities. This integration allows for more streamlined and effective security measures. Global Network Segmentation: Perry's team started by segmenting the global network, which is crucial for isolating different parts of the network to prevent the spread of potential threats and to better manage security. 2. Foundational Steps: Assessment and Inventory Management: Perry emphasized the importance of starting with a comprehensive assessment and inventory of all assets. This step is fundamental to understanding the scope of what needs to be protected and to identify any existing vulnerabilities. Continuous Improvement: Establishing an OT security program is an ongoing process. Perry highlighted the need for continuous assessment and refinement of security measures to adapt to evolving threats and vulnerabilities. 3. Use of Common Tools: Enhancing Security Measures: Utilizing common tools across both IT and OT environments can help in enhancing security measures. This approach ensures consistency in security practices and allows for better resource utilization. 4. Resource Allocation: Creative Risk Management: Perry discussed the importance of creatively allocating resources to manage OT risks effectively. This involves prioritizing security investments based on the criticality of different assets and potential impacts. 5. Continuous Assessment: Evolving Vulnerabilities: Security is a moving target, especially in the OT landscape where new vulnerabilities can emerge. Continuous assessment and updating of security protocols are essential to stay ahead of potential threats. In his interview with Information Security Media Group at the Cyber Security for Critical Assets USA Summit in Houston, Perry provided insights into how organizations can build and mature their OT security programs. The focus should be on creating a solid foundation through thorough assessment and inventory, integrating IT and OT security efforts, and continuously adapting to new challenges. By implementing these strategies, organizations can better protect their critical infrastructure and ensure the resilience of their OT systems.

3

FAIR-MAM One Year Out: What Have We Learned about Material Cyber Risk? 🤔 Beyond the narrow issue of reporting to the SEC or other regulators, the FAIR Materiality Assessment Model is an open financial loss model customizable to any organization’s cost structure to help report financial risk internally and inform cybersecurity investment and management decisions for a full range of custom cyber risk scenarios. FAIR-MAM is also the driver behind the FAIR Institute’s informational website How Material Is that Hack? that analyzes breaches, including those disclosed in an SEC Form 8-K, and estimates their ultimate losses. For the most part, companies have been very good about reporting an incident on a Form 8-K. In fact, the SEC noted in a statement in May that many 8-Ks are being filed despite no estimation of materiality. The SEC encourages companies to continue to be forthcoming but to word their 8-Ks in such a way as to not confuse investors. Generally, public companies are filing 8-Ks after a breach whether they think the hack will be material or not. https://lnkd.in/gqXirgXQ

1

1 Comment

What does FISMA have to do with it? ➡ Many critical infrastructure sectors have interdependencies with drinking water and wastewater services. These include the Chemical, Emergency Services, Energy, Healthcare, and more. “Water, water, everywhere, and not any drop to drink” – “The Rime of the Ancient Mariner,” Samuel Taylor Coleridge 🚧 BL: No water doesn't only mean no coffee! ☕ ➡ In November 2023, the Aliquippa Municipal Water Authority in Pittsburgh experienced a cyberattack after one of its booster stations was hacked by an Iranian-backed cyber group known as ‘Cyber Av3ngers.’ Other major critical infrastructure breaches include the 2022 compromise of the Florida water treatment facility near Tampa days before the Super Bowl. ➡ Critical infrastructure is proving to be an easy target with a high margin of success. While the EPA aspires to follow in the footsteps of the Transportation Security Administration and Food and Drug Administration to provide cybersecurity rules for their sectors, Congress will need to provide the EPA with these new authorities. ➡ Immediate action is needed. The EPA and all federal regulators falling under FISMA must prioritize the security of their networks. This is crucial to ensure they can continue their operations, reducing the threat of malicious cyber actors breaching their networks. By doing so, they protect their own digital enterprise and set an example for their sectors. 💡 At Forescout Technologies Inc., We don't just SEE all IT, IoT IMoT, and OT assets on your network; we PROTECT every connected asset - managed and unmanaged. Read the full article here: https://lnkd.in/ezqUfFcC

57

11 Comments

This article underscores the need for better IT-related risk management for all sizes of organizations, including business continuity plans for critical systems. I also think it points to the need for start-ups to stop chasing the "shiny objects" of tech innovation and really ensure that they are taking the time to understand the risks rather than just being first to market. #managerisk

1

Organizations urgently need an OT/IoT/IIoT cybersecurity blueprint to achieve a mature cybersecurity posture," says Raja Ukil, our Senior Vice President of Customer Success and Alliances. Read the complete blog as he shares invaluable insights on why CISOs are more eager than ever to protect their OT & IT security: https://bit.ly/4cjuYMi

23

1 Comment