Dan VanBeek

🚨 October Surprise 🚨 Nope, it’s not a plot twist in your favorite TV show… the real surprise this October is that the CMMC Final Rule is officially here! 🎉 If you’re a #DoD contractor, you’ve got until Q1 2025 to start seeing CMMC requirements in your contracts, with full implementation rolling out through 2027. So, consider this your friendly reminder: It's time to start getting your ducks in a row (or, in this case, your controls in place)! 🦆💻 But don’t panic. Working with an experienced CMMC Readiness Provider like Concertium means you won’t be left scrambling. We’ll guide you from that nerve-wracking self-assessment all the way through to the final audit, and we’ll stick around to help manage the program post-audit too. Basically, we’ll be your security sidekick! 🦸‍♂️ Don't wait until the last minute or leave it to chance—reach out to us at www.concertium.com to ensure a smooth CMMC journey. #CMMCCompliance #DoDContractors #CMMCRollout #OctoberSurprise #CyberSecurity #Concertium #ComplianceJourney #StayAuditReady #ConcertiumCMMC

11

This is a critical need for us all and one I fear we are once again speaking to without working toward a solution. But let me explain why this matters to me….. I am a college dropout teenage dad. I worked those odd jobs, ending up working in a printing plant for several years. I got lucky and an interest in gaming led to a skill in PC hardware salvage. That skill in PC salvage led to my own business and working IT support in a steel mill in the 90s. Eventually that skill led to much more. My story is any one of tens of millions of people with millions of background variations. My path was a very real path to technology in the 90s when the PC was newer to the corporate world. The method still exists, though the path has shifted to add cyber and artificial intelligence alongside technology. There are hundreds, really millions of people who are where I was, and they are unaware of their potential and where they can go if given the opportunity. Many of these people are limited because from their seat they do not see a path that leads them to success. The gap is further ahead than the suggested putting people together with jobs. https://lnkd.in/ejvFwyvE  The gap is in getting people to realize they have a natural skill and in that there is an educational path forward for those people. This is even more day-today to me as my adult soon to be son-in-law required financial support this past semester. He would love to have an affordable education path into any of these proposed initiatives. Adult education for people regardless of their state of diversity are much less available than we like to pretend. We need to focus on a program that begins with recruitment, training, education, and support that leads to the place education does, “recruiting, hiring, and engagement”. It isn’t that the talent isn’t out there. It is that the path appears impossible and unaffordable for the millions without support. I am more than excited about this excellent and absolutely needed initiative. We still need more. We need the offer of financial support to create that new talent. We need support from start to finish. 

10

Everybody have fun on Friday? 😅 Maybe 5yrs ago the FCA ran an industry engagement session. The key message was that the two biggest threats to the industry - based on the regulatory breaches data they were willing to share - were related to (1) Supply chain incidents; & (2) Change control incidents. We don’t know the specifics for the Crowdstrike issue(s) but I don’t think the FCA we’re wrong to call out those vectors back then, or even today if they were to run that session again. Supply chains (attacks) are a big area of focus and their challenges require continual development and investment; and the importance of good governance and controls will never change.

35

2 Comments

I’m curious if anyone has insights into the current cyber expertise levels on S&P 500 boards? Have there been any reports published in 2024? This is from last year: A report found that S&P 500 organizations have gaps in their cybersecurity leadership when it comes to risk mitigation. The study found that 57% of companies in the S&P 500 lack specialized experience in non-cyber technology categories. Twelve percent of S&P 500 companies have specialized cybersecurity expertise among their directors, such as a chief information security officer (CISO), former chief executive officer (CEO), or former chief information officer (CIO) of a cyber company on their boards. Seven percent had a current or former CISO on their boards. Link in comments

24

10 Comments

Challenges attracting and retaining new people is nothing new for the cybersecurity industry, but the new FTC ruling brings this challenge front and center more broadly across industries. Where noncompete agreements have been used to retain staff, people strategy will need to be evolved. In a discussion with Fortune, Peter Ragnar said “Whether it’s with engineers or scientists, those people aren’t getting poached every single day. They got poached when they’ve either reached the end of the line at a company, have a pay dispute, are not treated well, or a larger equity opportunity comes up.” I have found, that the ability to retain staff comes down to crafting a compelling vision of the future and working to create that future on an individual and enterprise basis. In the end, business is about maximizing value to our customers which is directly impacted by our ability to create value for our staff. Talented staff can always find opportunities, but finding opportunities where they truly thrive is rare. Where I work, what keeps me is that we are driving better health outcomes for our members, I have a work environment with both a focus on excellence and on creating the conditions for everyone to thrive, a great team to work with, and a robust commitment to finding the optimal answers to the challenges we face. #FTC #Retention #FutureOfWork #Leadership #PeopleStrategy

12

Charlotte IT and Security leaders! If securing OT is your responsibility, you dont want to miss this session. Todd Wiedman and I will be facilitating a great boardroom discussion where everyone can share their pain points and approaches for improving OT security. We hope you will join us! #evanta #otsecurity #cybersecurity #ciso

44

1 Comment

I've frequently been told to do more with less. First when growing up when I was told to make do with what we have. Second when joining the military and told quite explicitly to make it happen (IYKYK). And now I hear the same sentiments echoed within information security. At first, it was with to imply that more work is taken on without additional headcount or increase in salary which I'm sure most would agree can be frustrating. But now the sentiments are changing, and IMO is getting to the heart of what "do more with less" is about -- being good stewards with the resources that are made available. Most times, I've seen this reflected in terms of money, resources and/time. Lately, I'm seeing this directly called out in the increased software spend companies make. Personally, it's great that the conversation is now addressing vendor bloat (specific to InfoSec, but org wide as well) and how it impacts an organization's ability to get after its strategic objectives while still remaining within the operating budget. I'm no financial expert, but I've long been under the impression that most InfoSec budgets are part of a cascading effect meaning the security budget aligns with the priorities of the IT budget which aligns with the priorities of the organization's strategy. That being said, we all still have that urgent funding request for when our systems inevitably go bump in the night or when an emerging threat is discovered. I've just come to realize that not every fire requires a niche vendor solution to put it out. 🤷🏽‍♂️ #informationsecurity #innovation #strategy #technology

6

Want to know what compensation your expertise is commanding in the marketplace right now, cyber folks? Want to know what other people's expertise is commanding in the marketplace so you can make intelligent decisions about what to learn next? Follow Stuart Mitchell and pay attention to his updates. Knowing what live opportunities are paying today can help you plan your career for tomorrow. #cybersecurity

8

Cyber Jobs List, details below

1

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

AT&T is one of at least 100 companies impacted by a wave of attacks targeting Snowflake customer environments. AT&T spokesperson Andrea Huguely told Cybersecurity Dive the customer data was stolen from the carrier’s Snowflake database. The attacks targeting Snowflake customers were not caused by a vulnerability, misconfiguration or breach of Snowflake’s systems, Mandiant said last month in a threat intelligence report. Stolen credentials obtained from multiple infostealer malware infections on non-Snowflake owned systems were the point of entry for the attacks, Mandiant said. Impacted customer accounts were not configured with multifactor authentication. https://lnkd.in/eqE5cAjY

12

1 Comment

I don't quite agree with how they've presented everything in this report, though there are a number of interesting points. I'm not seeing the increase in comp that this suggests, if anything I'm seeing comp ranges come down for advertised CISO positions. What I think is happening is companies are paying their CISOs more to retain them. For me, this is the main issue in the market currently: The report also notes that fewer companies are seeking a new CISO, and fewer CISOs are seeking a new company: CISO rotation dropped from 21% in 2022 to a projected 11% in 2024. It isn’t clear whether the slower CISO churn reflects the general post-pandemic economic situation (if you’ve got a job, hang on to it), or indicates a growing maturity in the security marketplace. https://lnkd.in/gnEz4aAF

15

🔐 Breaking Down NIST CSF Subcategory GV.SC-06 🔐 When it comes to cybersecurity, it’s not just about what happens inside your organization—it’s also about who you do business with. That’s where NIST CSF Subcategory GV.SC-06 comes into play. GV.SC-06 emphasizes the importance of performing thorough planning and due diligence to reduce risks before entering into formal relationships with suppliers or other third parties. Why is this important? Imagine partnering with a vendor who has weak security practices. That connection could become a gateway for cyber threats, putting your entire organization at risk. GV.SC-06 helps ensure that before you sign any contracts or agreements, you’ve carefully evaluated the potential risks and taken steps to mitigate them. For those unfamiliar with the NIST Cybersecurity Framework, it’s a set of guidelines designed to help organizations manage and reduce cybersecurity risks. It’s a widely respected tool used across various industries to build strong and resilient security strategies. 🌐 By conducting proper due diligence before partnering with third parties, you’re not just protecting your organization—you’re also building a stronger, more secure business network. #Cybersecurity #NISTCSF #RiskManagement #ThirdPartyRisk #DueDiligence

6

Now that we have some space between us and Black Hat, here are a few things I learned this year: 1) I would recommend the CISO summit, every single year. Just the ideas the conversations triggered are worth it alone. Chatham house rule meant people were quite open. We CISOs really need to band together more. 2) If you are focused and know your go-forward security strategy, a day is enough at the 'business hall'. Check out the vendors who will be there, look at the map to figure out where, and even schedule meetings in advance. 3) The briefings... I didn't make it to a single one but they will all be available online, so I didn't prioritize that. But still... Day 1 or 2 could/should be stacked with presentations which trigger ideas for you. 4) Black Hat is for defenders. DefCon is for attackers. I'm not an attacker anymore, so... that makes DefCon a bit of a circus. I recommend you band up with someone who's more current on attacks, and prepare yourself for the village(s) you plan to visit. For instance, the AI village was either a) folks who couldn't figure out how to log in, or b) folks churning away at submitting findings. Neither group was especially helpful in tutoring me (I had a fantastic finding, but couldn't reproduce it and didn't find anyone who could offer help). 5) You can probably do everything you need in 2 days (CISO summit excluded). I'd split my days and do briefings half the day and business hall the other, and repeat on day two. 6) Vendor parties are not productive. You never meet the vendor, can't hear what others are saying, and end up exhausted. 7) As someone who neither drinks, smokes, nor gambles, Vegas is kind of lost on me. The friendliest hotel is Vdara, which does not have a casino. You can head straight through the lobby to your room. 8) You really can walk places, but it takes 2x longer than you would expect. It's also going to be hot. But Uber is crazy, especially at Mandalay Bay. You can walk to the con each day, and then walk across the street to the McDonalds and hail an Uber from there (pro tip from one of my Uber drivers) 9) Get a burner phone number to share at BH, because your phone WILL ring off the hook for a couple of weeks afterwards.

83

22 Comments

A little late...but wanted to share my #SpotifyWrapped top 5 podcasts for this year. I highly recommend all 3 podcasts from the CISO Series podcast family. Cyber Security Headlines is usually around 8 minutes or less and gives you a quick rundown of the top news stories in cyber security for the day. It's great for staying in the loop on the latest news. The Cyber Ranch Podcast always has great topics and excellent guests to tackle relevant topics. Life of a CISO is more about mindset, but gets a little repetitive after a while. Stay a student of the game and always stay learning! If you have any good podcasts, let me know...I'd love to mix in a few more to the rotation. Have a happy holiday season and a happy New Year! #podcasts #cybersecurity #infosec

6