Elliott Franklin

No matter where your organization is on your #ZeroTrust journey, achieving optimal maturity is always the end goal. Check out some tips and tactics to help you build your #ZTA with CDW VP of Security Stephanie Hagopian! #Security https://dy.si/RhqFA

19

🚀 Road to CISM: a weekly update Almost 2 months with this prep. ✅ Done with domain three "Information Security Program" and domain four "Incident Management" HIPAA, PCI-DSS, SOC1, SOC2, BCP, DRP, RTO, MTO, SDO, hot site, cold site...A "déja-vu" feeling. 😬 ✅ Done with Isaca QAE on adaptive mode. Not sure I will use this again, because I start to remember answers. ✅ Done with Isaca practice tests. 77% and 72% so, this is a improvement. ✅ 450 Answered questions with pocket prep. 🎯Next steps : Keep practicing questions with Mike Chapple and Peter H. Gregory

50

15 Comments

It's not working. Cybersecurity continues to get more expensive and the number of vulnerabilities, breaches, and incidents continues to grow. We preach collaboration and building a security culture, but awareness is not enough. How we truly involve the business in securing their domains, such as data protection, application security, and other focus areas, is likely going to determine the next generation of security strategy. Democratizing cybersecurity—it's about empowering every member of the organization to integrate security practices into their work. By shifting from a top-down control model to a collaborative one, SMEs can strengthen their defenses and navigate the evolving threat landscape with confidence. In fact, Gartner predicts that over a quarter of organizations will design their application security findings to be consumed directly by application owners, rather than the security team. #BusinessShift #Cybersecurity #WorkplaceOrganization

16

1 Comment

Traditional isn't always best. As we continue to navigate the ever-evolving digital landscape, the only thing that we can say for sure is that traditional security approaches are no longer sufficient. To truly protect our organizations, we need to figure out holistic strategies that addresses the entire ecosystem - from device health to identity management to data and telemetry. We have spoken of defense-in-depth approaches for years, but the result was an overly complex web of overlapping solutions, with a massive price tag. The identity-based #zero-trust strategy seems like a good evolution. Time will tell. #HolisticStrategy #Cybersecurity #DigitalLandscape

6

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

Ok this is very cool. Risk management can feel very daunting regardless of the business size. A lot of us cheat by just implementing things like CIS controls, but to do #CyberSecurity right you really should be starting with risk. Otherwise your security approach will always feel expensive, because it is. You can't get to variable security sizing unless you have some kind of risk approach. The real gem in this is the free training.

5

1 Comment

It is about time that Microsoft takes action to protect customers from ActiveX attack vectors. Action is needed to take advantage of Microsoft’s new controls including GPO configuration changes. Let me know if you still have ActiveX being used in your organization and what it is being used for.

16

The countdown has started ... less than a month away. CornCon X: The Cyber Games, taking place on October 4-5, 2024 in Davenport, IA. This isn’t just another cybersecurity conference. It’s a unique experience that combines top-tier professional insights with a vibrant community atmosphere. What sets CornCon apart? 🌟 - Diverse Topics & Expert Speakers: With over 65 world-class speakers, CornCon covers a wide range of topics from ransomware and IoT to AI and medical devices. - Hands-On Villages & Training: Engage in interactive sessions and hands-on training that provide practical skills you can apply immediately. - CISO Executive Summit: A dedicated summit for CISOs to discuss the latest trends, challenges, and strategies in cybersecurity leadership. - Kids’ Hacker Camp: A unique feature where the next generation of cybersecurity experts can learn and play. A huge shoutout to John D. Johnson, the visionary founder of CornCon. Don’t miss out on this incredible opportunity to learn, network, and grow. Register now and join us in Davenport for an unforgettable experience! https://corncon.net #Cybersecurity #CornConX #CyberGames #CISO #HackerCamp #CyberCommunity

19

As an IT leader, it's important to recognize that real power lies in creating partnerships. Yet when leaders make team members feel undervalued and disconnected, productivity inevitably wanes. "Instead of seeing their roles as integral to the company's success, they may begin to view their work as strictly functional -- a series of tasks to be completed, rather than contributions to a shared mission," says Ashley Cruz. This not only dampens enthusiasm and engagement, but can also lead to a lack of personal and professional development as growth opportunities become overshadowed by a focus on maintaining and managing technology. Check out this great piece from John Edwards for more. #IT #Leadership #Partnerships #Success #Growth

4

Excellent insights came out of the RSA Conference this year from top #cybersecurity and #technology leaders. There is definitely a growing theme of strategic integration of cybersecurity initiatives with the organization's overarching business goals. As Sumedh Thakar pointed out, quantifying #risk regarding business impact on the board/CFO/IT team poses a unique challenge for CISOs, but doesn't have to be overwhelming. Translating for the business is crucial to being seen as the business leaders that we want to be.

10

1 Comment

This is quite a useful blog, if a little dated (June 2024): "Rethinking #Cyber #Security Budgeting," delves into a new approach to budgeting that balances offensive and defensive capabilities while aligning with your organization’s risk appetite. https://bit.ly/4fKbsKn

11

1 Comment

This week, Chad Robinson and I delve into a critical security incident in Columbus, Ohio, right in our home state. Join us on C.S. Cyber Weekly as we unpack the details of this ongoing situation, discuss initial attack vectors, and explore vital mitigation strategies. Key Highlights: 🔍 Analysis of the Columbus incident and its implications 🔐 Importance of EDR (Endpoint Detection and Response) in cybersecurity 🧑‍💻 The role of user awareness and firewall controls 🛠️ Tips on network segmentation and next-gen firewalls Tune in for expert insights and practical advice to keep your organization secure—watch now on SecureCyber’s YouTube channel: https://lnkd.in/e9jVRFdK #CyberSecurity #EDR #Ransomware #CyberAwareness #NetworkSecurity #ColumbusIncident

12

CMMC compliance is not a simple task. It’s extremely rare for an organization to be compliant by default. The certification process can also be very expensive, so you’ll want to begin the process by setting a budget (across people, processes, and technologies) for CMMC compliance. This will likely depend on the value of current and future DoD contracts to your organization. We have worked with hundreds of #defensecontractors right-size their CMMC strategy. We mention the most impactful time and cost saving strategies in our FREE CMMC Readiness Resource. Download Your Copy Today: https://lnkd.in/e6C4FrS4

6

ONNX phishing service targets Microsoft 365 accounts at financial firms A new phishing-as-a-service (PhaaS) platform called ONNX Store is targeting Microsoft 365 accounts for employees at financial firms using QR codes in PDF attachments. The emails impersonate human resources (HR) departments, using salary updates as lures to open the PDFs, which are themed after Adobe or Microsoft. The victim is prompted to enter their login credentials and 2FA token on the fake login page, and the phishing site captures these details in real-time. #o365 #phishing #phaas #phishing-as-a-service #databreach #humanfirewall #informationsecurity #informarionsecurityawareness #cybersecurity #cyberawareness #datasecurity #microsoftoffice #microsoft #microsoft365 https://lnkd.in/d9K7Q8Hc

3

Attackers are adapting to the standard practices for vulnerability management. They aren’t using CVSS severity as the criteria for compromise. Instead, they are prioritizing the most exploitable vulnerabilities, which are often those ranked as medium or low severity. If security and patching teams are too focused on critical CVEs, they can miss middle-of-the-road exploits that allow attackers to gain network access and then move laterally into business-critical systems. Following your monthly scan, analyze vulns by the ease of exploit and compare that to the CVSS score. It may shed light on gaps you didn't know existed. #cybersecurity, #vulnerabilitymanagement, #proactivesecurity

13

2 Comments

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1