Eddie Harmoush

Interesting to see that major cloud providers and tools like cloudflare get to face disruption due to again and again, BGP hijack. "Cloudflare blames recent outage on BGP hijacking incident" I wonder if people rushing blindly in digital transformation and cloud actually realize that BGP is not properly secured (RPKI anyone ? !) and this means that cloud is inherently a huge issue (not even considering the CPU security leaks allowing to steal encryption keys....but you know, at this point...) cloud=leak #cybersecurity failure, is the definition of public cloud. #clowd #bgp https://lnkd.in/eeCiHhKp

19

5 Comments

🔊 “Using traditional IT for the OT is like putting a square peg into a round hole.” -Gartner Traditional IT solutions are NOT meant for being used within OT environments. You'll end-up with: - #Cybersecurity risks - #Scalability issues - Not being in control due to #Lack of #insights - Unnecessary #Complexity & #Costs Context ⬇

5

A recent incident serves as a stark reminder of why we need to be vigilant about who has access to our systems… A former employee of NCS in Singapore was recently sentenced after illegally accessing his ex-employer’s systems and deleting 180 test servers. This act of revenge cost NCS a whopping $678,000. The employee’s access should have been revoked immediately after his termination, but due to an oversight, he retained a login. This enabled him to wreak havoc over several months, ultimately leading to significant financial damage and operational disruption. What can we learn from this? - Revoke access immediately: Ensure that access credentials are deactivated as soon as an employee leaves the company. This should be a standard part of your offboarding process. - Regularly audit access: Conduct periodic reviews of who has access to what. Even current employees should only have access to the information and systems necessary for their role. - Implement stringent controls: Use multi-factor authentication (MFA) where you get a code on another device to prove it’s you. Other security measures add layers of protection. This makes unauthorized access much more difficult. - Monitor and enhance: Keep an eye on your systems and regularly update your security protocols. Stay informed about the latest security practices and adapt as necessary. Remember, a small oversight can lead to huge losses. When did you last review who has access to what? If it’s been more than a few months, it’s time to get to work. My team can help if needed. Send me a DM. #CyberSecurity #BusinessSafety #AccessControl https://lnkd.in/eWFSv9Cw

3

Excited to see Google joining forces with GASA and the DNS industry to fight online scams! A recent article on The Hacker News discusses Google's collaboration with GASA and the DNS industry to establish a new platform, GSE, to combat online scams. This is a significant step forward in our collective effort to improve scam identification and disruption. GSE, which stands for "Global Scam Exchange," will function as a central information-sharing platform, allowing organizations to exchange data on fraudulent activities. This collaborative approach will empower us to collectively identify emerging threats and develop more effective countermeasures. Google's commitment to this initiative is commendable, particularly their upfront contribution of data to the platform and their ongoing efforts to promote its adoption across the industry. By fostering collaboration and information exchange, GSE has the potential to significantly reduce the impact of online scams. This is a positive development for cybersecurity professionals and the online community as a whole. #cybersecurity #onlinescams #gse #google #collaboration https://lnkd.in/gTv5ibNY

21

1 Comment

Attendee advice on how to get the most out of attending the #CiscoLive conference. If you have never been to Cisco Live, it can be very overwhelming. There is a ton going on and it is easy to get lost in the shuffle of things. I highly recommend planning your days out and thinking bout what you really want to get out of the conference. Also, slots are filling up in the breakout sessions. Register for the ones that interest you the most. http://cs.co/6049jaYgx

4

One of the most common frustrations I hear from people who hire in IAM is that people can't articulate their IAM knowledge, but claim they're an 'expert'... What many do say is they're an expert in a particular IAM vendor solution (and even their 'expert' status is sometimes questionable) One Identity, CyberArk, Sailpoint, Ping/Forgerock, or something else Knowing one or more of these solutions is great, there's a lot of demand for expertise, BUT it's important to remember that IAM is not 'a tool' Policies, processes, technologies and more make up what 'IAM' is, and there's so many different contexts and potential situations you might find yourself in Think beyond the shiny tools 🤓 #iam #identityandaccessmanagement #recruitment

78

17 Comments

Making PCI Compliance easier with network visibility. Gigamon Deep Observability Pipeline can make network logs application aware. That visibility and awareness can help aid with compliance and security frameworks. PCI is one such framework. From a networking perspective PCI is good digital hygiene. Some examples are: no unencrypted traffic, no expired or self signed certs, and no communication between protected and unprotected networks. I have put together a blog and white paper on how Advanced Metadata Intelligence can be leveraged to help achieve compliance and then aid in the ongoing verification of the compliant state. The paper is designed in three sections. The first section is for Executive staff, the second section is for the architect to understand the solution and lastly the appendix has tactical practitioners guide on what to turn on so Gigamon can aid in that specific requirement. All 12 requirements are covered for the sake of completeness even if Gigamon has no visibility or control in that area. Please feel free to reach out to me personally if you have questions! Blog: https://lnkd.in/gftGJfnF Paper: https://lnkd.in/g-jDzpqx

4

Just got a call from a new client. Private school in Southern California. Fairly large UniFi Wifi deployment. Reviewing the clients setup, there were 5 or 6 fundamental problems with the setup that I was able to identify within about 20 minutes of review. We came up with a plan, and instructions for the client with the following 20 minutes, and the client is ardently pursuing the solutions I gave him. Total cost to the client, one hour of my time. Value to the client, well hopefully the value of a school network that lets the kids get their work done is value enough to make the cost worthwhile. Does your complex WiFi environment need a high level assessment? I can tell you exactly how to fix your problems, or I can do it all for you. Your choice.

4

1 Comment

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

#Election Day, 2024. Every presidential election reminds me of just how far technology has come since the last one. Here is a brief recap of my adult lifetime of presidential elections cycles. In 1992 and 1996, election night meant watching results on TV or reading about them in newspapers. By 2000, with Bush v. Gore, computers started to change things—we'd log into CNN and refresh Netscape Navigator over and over, waiting for a result that never quite came (#danglingchads). The Obama elections in 2008 and 2012 showed what data could do, with his campaign embracing analytics. We were starting to get election updates on our Blackberries in 2008, and by 2012, we were checking results on our iPhones. In 2016 and 2020, it was all about the power and pitfalls of social media—disinformation, echo chambers, and the energy that ultimately led to January 6th, 2021. While election security has always been an area of concern, this came under intense scrutiny in 2020 with what has turned out to be unfounded claims of tampering with voting machines. This has led to more communications from CISA and others leading up to 2024 on election safety and security. Now it's 2024. AI is making predictions and analyses, and election coverage is more accessible than ever, right on our phones. I just saw an Apple widget that offers live updates from the lock screen. It's fascinating to watch how the technology surrounding elections evolves with each cycle—and it makes me wonder where we'll be in four years. #cybersecurity

4

We are half way through 2024, so #MSP and #MSSP should be fairly advanced in their #vciso offering building. ➡ 86% of Companies Currently Offer or Are Planning to Offer vCISO Services by the End of 2024 🔜 I'm already providing vCISO services from the get go, as security consulting has always been part of my career. For this, I use the Cynomi platform, which saves me tons of time 🔁 I used to have excel templates and all, but I realized that consulting in security, aside of documenting an actual compliance work, such as targeting ISO27001 certification, is not always as restrictive. 💡 My goal is enhancing the security posture, and overall privacy, through SMBs, without running after certifications. Very often, asking the right questions is already bringing tremendous insights in regards to security posture enhancement. Is your organization providing #vCISO services ? Are you using #cynomi platform ? Are you just focusing on certification, or are you looking at enhancing security posture at large ? #cybersecurity

14

2 Comments

Do your PDFs have blank pages when you open them from a file server? Do you map drives to a File Server with a batch file or a Group Policy Object that uses the Replace command to map drives? If so, consider using the Update command in the Group Policy Object; it may allow you to view PDFs without blank pages. If you need help updating your GPO, email [email protected].  

6

I came across this fascinating report by the folks over at Coalition, Inc.. 3 things that stood out to me from their research: Cisco Adaptive Security Appliance (ASA): Cisco ASA users were nearly 5x more likely to experience a claim. Fortinet: Fortinet boundary device users were 2x as likely to experience a claim in 2023. Remote Desktop Protocol (RDP): Businesses with internet-exposed RDP were 2.5x more likely to experience a claim when not protected by a boundary device. The first to tell me that security architectures anchored around on-prem security devices fall short in today's cloud environment. The second I see as failure to secure the virtual perimeter in a cloud-heavy environment. In other words:

17

The "Honor System" does not scale. As part of an ongoing Zero Trust project, I reviewed a security change with colleagues this week. I explained the security and data protection benefits of Protocol A used by App 1 over Protocol B used by App 2. After a thorough discussion, “Joe” suggested he could make App 2 work like App 1. While Joe's effort is commendable, the reality is that the other 11,999 employees might not follow suit. Joe’s implicit question was, “Hey, don’t you trust me?” In a Zero Trust world, the answer is, “No.” This isn’t personal; it’s about the system not trusting anyone implicitly. The “Honor System” does not scale. Consider this analogy: I lock my doors when I am away and at night. I trust my neighbor John on my left and Nichole on my right. I also trust Marco and Shaum across the street, and even the neighbors who sing karaoke too loudly and off-key. But beyond them, I don’t know everyone in my neighborhood. Similarly, in cybersecurity, we can’t rely on implicit trust because we don't know all potential actors on the internet. As we approach Zero Trust, we must separate human nature and community trust from our systems and networks. We must assume breach, eliminate implicit trust, enforce least privilege access, and inspect all traffic. On the Internet, everyone with a public IP address is essentially a neighbor and only a few network hops away. Even entities we “think” we trust, such as employees or on-premises networks, may be compromised by malicious insiders, compromised credentials, or a connected third-party actor with network access. In conclusion, adopting Zero Trust principles is crucial. Our systems must be designed to operate without implicit trust, ensuring security and resilience in an ever-connected world. #zerotrustnetworkaccess #ztna #cybersecurity

29

1 Comment

In response to wingkam wong comment below, I rarely quote Donald Rumsfeld, but his ideas are helpful here. He talked about three types of knowledge, and we can apply that to our #zerotrust approach: Known Knowns: Things we know we know. For example, everyone uses ERP systems, and these systems are crucial. We should understand them well. Known Unknowns: Things we know we don’t know. For example, some systems are set up directly by business units instead of IT. We can find out about these systems with some effort and discovery. Unknown Unknowns: Things we don’t know we don’t know. This is where “discovery” comes in. Using Discovery to Uncover Unknowns When starting a Zero Trust (ZT) project, you might begin with a flexible approach to let the business continue operating. This allows you to observe and gather data. As the system collects more data, you can start to uncover these unknown unknowns. For instance, I discovered that “Protocol B used by App 2” was more common than I initially realized. Making Informed Decisions Instead of rejecting what’s currently in use, offer better alternatives. For example, if Protocol B is being used, you could suggest switching to Protocol A. Explain that while Protocol B might work, Protocol A provides better cyber and data controls to achieve the same result. #cybersecurity #dataprotection #datalossprevention

1

OT networks and ICS platforms are going to continue to be a festering wound for organizations. They've been neglected for years because organizations could not or would not justify the downtime to maintain them. They hid behind the shield of you can't connect to the network except through "highly" controlled means and toss out phrases like "We implemented the Purdue Model" as mantras to ward off objections from IT security professionals and auditors alike. All the while the same organizations were punching holes into the Purdue model in the name of JIT, QA, real time order tracking, streamlined design, process improvement and every other latest trend under the sun. Well attackers are actively exploiting all the holes organizations have punched in their OT Networks. Time to pay attention and start the care and feeding of your OT networks because announcements like this are not going to end. Start identifying your critical assets, mapping you data flows, looking at micro-segmentation.....hey wait that sounds like Zero Trust 🤔 #OTSECURITY #ZEROTRUST https://lnkd.in/gw7v-2Hr https://lnkd.in/gw7v-2Hr

17

1 Comment

Added some additional context to the Okta and CrowdStrike NextGen SIEM User Dossier. Bottom right you see a new table that leverages the test() function. Because I am merging Falcon telemetry and Okta data together I am checking to see if the Okta Geo Data matches up with what I have for the Corporate system running the Falcon Sensor. If a first responder (Help desk, service desk or even SOC analyst) types in a user name and immediately sees that the there is a discrepancy between their Okta access IP and their AIP (SASE's excluded) they can immediately be put "en garde" that something might be going on. We also see any observed Risks by Okta as well as (further down) Falcon Detections. This is what we were promised with Legacy SIEM solutions that we are now delivering. The added benefit of leveraging two disparate data sets to deliver instant context. Below we have fjones logging into Okta from Germany yet his Falcon Sensor resides in Ashburn.

229

6 Comments

Want to run a flawless vCISO cadence call? Then follow these 6 steps. One of the core values I have MSPs focus on in their vCISO program is to 𝗮𝗱𝗱 𝘃𝗮𝗹𝘂𝗲 𝘄𝗶𝘁𝗵 𝗲𝘃𝗲𝗿𝘆 𝗶𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝗼𝗻. Want to know what DOESN'T do this? Dull, lifeless review calls that the client dreads showing up to. So how do we turn this back into the client's time, where they come away excited and satisfied? I'm glad you asked 😁 Steal my easy-to-action model that's been tested and proven to add value in literally hundreds of client calls over the years. 1. 𝗥𝗲𝘃𝗶𝗲𝘄 "𝗛𝗼𝘁 𝗦𝘁𝗼𝘃𝗲" 𝗜𝘁𝗲𝗺𝘀 - Identify new or critical issues that need immediate attention, especially questions or concerns the client has voiced via email or other methods. 2. 𝗥𝗶𝘀𝗸 𝗮𝗻𝗱 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝘆 𝗔𝗱𝗷𝘂𝘀𝘁𝗺𝗲𝗻𝘁𝘀 - Assess emerging risks or metrics since the last meeting and prepare to discuss tactical or strategic adjustments to the current roadmap. 3. 𝗧𝗮𝘀𝗸 𝗮𝗻𝗱 𝗣𝗿𝗼𝗷𝗲𝗰𝘁 𝗥𝗲𝘃𝗶𝗲𝘄 - Discuss progress and actions required to keep tasks aligned with strategic goals. 4. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝗔𝗹𝗹 𝗗𝗲𝗰𝗶𝘀𝗶𝗼𝗻𝘀 - Capture decisions, action items, and assignments during the call - always have next steps. Make sure any task has a Resource Committed to a Time for completion (RCT) 5. 𝗣𝗼𝘀𝘁-𝗖𝗮𝗹𝗹 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 - Finalize documentation of the call template and send it to all parties. 6. 𝗙𝗼𝗹𝗹𝗼𝘄-𝗨𝗽 𝗼𝗻 𝗔𝗰𝘁𝗶𝗼𝗻 𝗜𝘁𝗲𝗺𝘀 -Track progress on action items using a system for accountability. Come to the next call having done what you committed to do, and watch trust skyrocket. It's just one of the litany of templates, methods, and workflows you get in the PowerGRYD vCISO System. But don't take my word for it. If you want to see the results, drop a comment below to get access to my cadence call template, and try this with a client or two. Then when you see the difference it makes, come back for the whole system 😎 ------------------------------------------ 👋 Hi there; my name's Jesse. 👇 I help you scale your vCISO program; profitably. https://lnkd.in/gaJ7Chm2 ------------------------------------------

27

15 Comments

Webinar Alert: A Universal Approach to Zero Trust through Unified SASE An often overlooked aspect of Secure Access Service Edge (SASE) is the transformative power of a single-vendor solution. When cybersecurity and IT networking teams operate on disparate technology stacks, it can inhibit successful implementation, compromise security, and degrade the user experience. Join our upcoming webinar on December 11th at 9:00 AM PT where Jon Taylor(Director of Security Evangelism at Versa) and Fred Van Keirsbilck(Strategic Network & Security Partner Manager, Verizon) will dive deeper into how addressing these organizational roadblocks can accelerate your digital transformation journey. Gain insights into: 1. The benefits of a simplified network architecture 2. How to ensure seamless connectivity and robust security 3. Real-world experiences on overcoming integration challenges for a smooth SASE deployment Don’t miss out on this opportunity to learn from the experts. Secure your spot now: https://lnkd.in/g43CpUBz #SASE #ZeroTrust #Cybersecurity #DigitalTransformation #NetworkSecurity #ITNetworking #UnifiedSolutions #SecureConnectivity #Versa #Verizon #ChannelPartners

4