Christopher Puderbaugh

🗞️ In CyberScoop: "[T]he years of work to build up federal collaboration with industry are paying off, from the Joint Cyber Defense Collaborative to the National Risk Management Center — the 'proto' version of the JCDC, [Chris Krebs] said — to the National Security Agency’s Cybersecurity Collaboration Center. "'We’re starting to see that these things work with the resources and time into it, but it’s generating results and there’s no better evidence of the results, I think, than when Russia invaded Ukraine, and the ‘Shields Up’ campaign and the breadth to which that was able to change behavior in industry,' said Krebs, now chief intelligence and public policy officer at SentinelOne." To learn more, read the full article by Tim Starks: https://s1.ai/CS-Collab

42

Known Exploited Vulnerabilities Remain Unmitigated Past Deadlines: - Critical severity KEVS took nearly 4.5 months (137 median days) - High severity vulnerabilities take more than 9 months (238 median days) - Medium severity vulnerabilities take nearly 1.5 years (517 median days) https://lnkd.in/g_RExD96

1

Meet Aeva Black, Section Chief for Open Source Security at Cybersecurity and Infrastructure Security Agency (CISA) and Jack Cable, Senior Technical Advisor also at CISA 👋 Both Aeva and Jack will join Tidelift CEO and co-founder Donald Fischer on Wednesday, June 5 at Upstream for a session titled. “Secure by design: a proactive approach to open source health and security.” 🔐 As you might have heard, just a few weeks ago, a number of companies (including Tidelift ✍️) signed CISA’s Secure by Design pledge. This pledge was a ceremonial continuation of CISA’s year-long initiative to promote building good #cybersecurity practices into technology products from the start rather than making good security an aftermarket technical feature. In this session, Aeva and Jack will share more about the industry-wide efforts discussed in the Secure by Design guidelines, the historical analogies of where this design-first approach has had real impact in other notable industries, and they’ll cover how CISA is working directly with both industry leaders and the #opensource community to proactively improve the software supply chain. If you’re looking to learn more about how the Secure by Design initiative came to be and the actions organizations can take to start their journey into open source, you won’t want to miss this talk at #Upstream2024 on Wednesday, June 5. https://bit.ly/4dY7ygO

11

The growing cyber threat from China requires a united, Collective Defense approach. Blake Cahen, IronNet's Director of Cybersecurity Operations, was featured today in Newsweek, emphasizing the need for a "NATO-style" Collective Defense to combat China's sophisticated hacking program. Sharing data across a Collective Defense community is crucial to prevent breaches and mitigate threats effectively. Read the full article: https://lnkd.in/eJEGc4qQ See Collective Defense in action: https://lnkd.in/e3HZF8UQ #CyberSecurity #CollectiveDefense #IronNet #ChinaThreat #CyberEspionage #DataProtection #Hackers

22

In case you missed it, we're teaming up with KPMG to host a LUCR-3 (#ScatteredSpider) Threat Briefing. Dennis L. and Ian Ahl are going to walk through the TTPs of this threat group in both the cloud and on-prem. They'll be offering tips on how to detect this group in your environment and provide tips on how to defend against them. https://lnkd.in/gFVwUsZ6

19

2 Comments

🎙 In the "The Arms Control Poseur" podcast series, Allison Pytlak from The Stimson Center dive into cyber threats, from state-sponsored #cyber espionage to non-state actors. Insights on the role of #armscontrol and #nonproliferation in managing these threats. 🎧 Tune in now ⤵ https://bit.ly/3UZqZNz

15

📝Full Defense Strategy: https://hubs.ly/Q02tb2pl0 The Pentagon has introduced its inaugural strategy to advance cybersecurity within the defense industry. Announced by David McKeown, the Deputy Chief Information Officer for Cybersecurity, the initiative underscores collaboration with the U.S. defense industrial base to combat ongoing cyber threats. The strategy outlines key goals to enhance cybersecurity governance, boost defense base resilience, and improve collaborative efforts against cyber adversaries. Officials emphasize the necessity of protecting critical information and the U.S. warfighting advantage through a fortified cybersecurity posture. The approach includes evaluating compliance with cybersecurity standards, enhancing threat intelligence sharing, and developing robust responses to cyber incidents. This strategy aligns with the National Defense Strategy and aims to secure critical defense production and information integrity against malicious cyber activities. The release of this cybersecurity framework is part of broader efforts to modernize and secure the U.S. defense industrial base, ensuring it meets the challenges of a complex national security landscape.

3

NEWS: ObjectSecurity Assessed “Awardable” for Department of Defense Work in the CDAO’s Tradewinds Solutions Marketplace - reversing AI models in compiled binaries Thrilled to share that ObjectSecurity's pitch video on detecting and analyzing AI in compiled binaries has been deemed Awardable by the Tradewinds Solutions Marketplace! It’s an honor to be recognized among a competitive field of applicants to the Tradewinds Solutions Marketplace for our innovation, scalability, and potential impact on DoD missions. Government customers, please check out our 5 minute video solution on Tradewinds. More information & sign-in here: https://bit.ly/40EzkuC #ai #cybersecurity #Tradewinds #GovTech #SBIR

5

3 Comments

⚖️ INSIDER ESPIONAGE: The DHS Scandal Unveils Threats Within  The recent sentencing of three former DHS employees highlights the dangers posed by insider threats. This case revealed a conspiracy to steal proprietary software and sensitive databases, showcasing the need for heightened cybersecurity measures in government operations. Challenges   Insider Threat Detection: Individuals with authorized access and knowledge can misuse their positions, making detection challenging.  Protection of Proprietary Software: Preventing unauthorized use and commercialization of government-developed software requires strong safeguards.  Cross-Border Intricacies: Involvement of foreign collaborators complicates investigations and prosecutions, emphasizing the need for international cooperation.  Obstruction of Justice: Attempts to destroy evidence hinder investigations, necessitating quick and effective detection methods. 🧠 Why iCognative™?  iCognative™, developed by Brainwave Science, offers a cutting-edge solution to uncover concealed information from a suspect's mind. This advanced technology is designed to enhance security measures, providing critical insights into unauthorized activities and potential collaborators within sensitive environments.  Proactive Identification: Reveal employees harboring malicious intent towards proprietary assets.  Uncovering Collaborators: Identify accomplices by presenting suspects with crime-specific details.  Verifying Evidence: Assess the truthfulness of claims of ignorance by evaluating suspects' knowledge. We encourage esteemed leaders involved in cybersecurity and law enforcement, to explore how iCognative™ can empower your team to detect insider threats and secure proprietary assets.  Discover how iCognative™ can revolutionize the way we tackle insider threats and safeguard sensitive information: https://lnkd.in/g_HG3gsk  #cybersecurity #insiderthreats #espionage #DHS #iCognative #BrainwaveScience

13

✅ Original Research ✅ Deep Analysis ✅ Expert POV Expect all three in this session presented by Blackpoint's Adversary Pursuit Group (APG). Join this expert team as they go through recent cyber attacks seen within Blackpoint's protected environments and prove how technology and people must work together to solve complex real-world security problems. https://hubs.ly/Q02KCrgq0 Session Location: Lagoon KL, Level 2 #BHUSA

15

For when Airmen and Guardians need to digitally sign documents or send and receive encrypted emails, Workspace Anywhere with Hypori offers a secure and efficient solution. Here are the key points to know. Key Features:  ◾ Digital Signing and Encrypted Email: Hypori allows members to digitally sign documents and manage encrypted emails directly from their personal mobile device, enhancing productivity and security. ◾ Data Security: No data is stored on the physical device, eliminating the risk of data loss or leakage. This ensures that sensitive information remains secure. ◾ User Privacy: Workspace Anywhere operates completely separately from members personal mobile device, providing 100% user privacy. Members personal data and activities remain private and unaffected. Benefits: ◾ Productivity: Stay productive by accessing essential tools and features needed for work, all from a personal mobile device. ◾ Security: Maintain a high level of security with no data stored on a personal device, reducing the risk of breaches or unauthorized access. ◾ Privacy: Keep personal and work data separate, ensuring privacy is intact.   There are a limited number of licenses available for Hypori. To ensure you have access, preregister from a CAC-enabled device at this link: https://lnkd.in/gpenQ466 #WorkspaceAnywhere #BYOD #USAirForce #SpaceForce #DAF #BESPIN #Hypori

26

1 Comment

How can the trustworthiness of open-source security projects be accurately measured and transparently communicated? 💡   The Cybersecurity and Infrastructure Security Agency is in the second phase of its open-source software security roadmap, which aims to enhance visibility into OSS use and risks across the federal government.   🗣 Aeva Black, CISA's section chief for open-source software security said in the blog post that the agency's latest OSS efforts consist of two parts: "Creating a framework for measuring trust and scaling out its usage."   Read more about this new framework: https://lnkd.in/dERP2bjX   #ISMGNews #cybersecurity #CISA #softwaresecurity #opensource Chris Riotta

2

Just complete a DFIR investigation engagement. Instead of repeatedly sharing the ransomware actors’ TTP, I want to point out quite some first responders on how they handle the artifact collection may jeopardize the whole investigation. #BattlefieldDFIR #ShutdowntheEdgeDevice #MissingLog #CherryPickRootCause #NoSiteVisitbutRemote #SeeingPretendNotSeeing #BlametheMalware #BlameNoMFA #BlameNoPatch #BlameNoPentesting #BlameOutdatedProduct …

18

This Cybersecurity and Infrastructure Security Agency guide offers actionable steps to combat the evolving tactics of foreign malign influence operations. More resources available here: https://lnkd.in/ebM9fqFn #security #nationalsecurity #homelandsecurity #infrastructure #criticalinfrastructure #CI #resource #research #resources #highthreat #threat #threats #cybersecurity #cyber #electionsecurity

6