Eric Sorenson

👿👨‍🏫 The Dark Side of Brilliance👨‍🏫👿 How Hackers are Exploiting Real Estate Transactions and Small Businesses One of my perverse cybersecurity joys is appreciating the evil genius of hackers. Many of their attacks are so effective. So patient. So financially rewarding. It’s hard to not see the brilliance in their simplicity. In the last month I’ve stumbled upon a new favorite that goes something like this: ***The Scheme*** 🎯 Breach: Hackers infiltrate a network processing large financial transfers (think mortgages or business deals). 🕶 Lurk in the Shadows: They spend months studying the system, communication styles, and payment methods. Basically, they become silent observers. ❗ Strike Time: They identify high-value, time-sensitive transfers - every minute counts for them. 👩‍🏫 Fake Customer Service: These cyber-cons then impersonate real customer service, mimicking communication styles down to a tee. They "verify" details like service, name, and payment dates. 💸 Wire Fraud: The unsuspecting victim, trusting the "verification," sends the money (often around $100k) straight to the fraudster's account. 🤦‍♀️ Confusion Reigns: The real vendor starts asking for the actual transfer, and guess what? The fake vendor does the same! This double request creates chaos, leading to even more misplaced funds. 💔 Fallout: Home sales fall through, businesses are crippled, and hackers walk away with millions - all thanks to a simple hack, patience, and some basic social engineering. Here's the Shocker: This happens THOUSANDS of times a month, and most go unresolved! **How to Fight Back? ** ✅ Never Trust, Always Verify: Don't respond to calls or emails claiming to "verify" transfers. Reach out directly to your authorized contact using previously established methods. 📂 Old School is Cool: Paper checks are a pain, but way harder to hack than wire transfers. Consider them for extra security (yes, it might take longer). 🏦 Think Local: Whenever possible, work with local sales reps or lenders. Building a face-to-face relationship can be a powerful defense. By staying vigilant and implementing these simple steps, you can protect yourself from falling victim to these elaborate scams. Let's outsmart the cybercriminals together! #cybersecurity #realestatescam #informationsecurity #staysafe Check out this article for a deeper dive into this specific scam. https://lnkd.in/gRmTPWKM

5

CornCon Cybersecurity Conference Review and Gratitude I am disgusted. I am shocked. I am Steve's complete surprise that this conference is such an unknown to the greater cybersecurity industry. ;) This cybersecurity conference brings together thought leaders in cybersecurity in such a Quad City way. It is not flashy. It is not pretentious. It is full of people who care about the industry, about the work, and about the people who do the work. It has created a welcoming environment where students, professionals and leaders comingle together to lift each other up. I am from Moline, IL, which sits across the Mississippi River from Davenport, IA. I attended St. Ambrose University just up the hill from where this conference was held. I have a lot of personal connection to the area and I have immense pride/gratitude in what John D. Johnson has created. I represented Green Shoe Consulting as a partner and supporter of Mental Health Hackers. Eric Lee showed me the MHH ropes and created a beautiful space for mental health advocacy. I was fortunate enough to catch talks by the following: Ira Winkler kicked the conference off by discussing the worst career advice he's ever heard. If you have ever seen him speak, you know he has a unique capacity and skill set for storytelling. If you haven't seen him speak, I encourage you to do so. Gene Spafford provided a mind altering perspective to the lack of defined components to software. This concept has me thinking about the implications for stress and burnout in cybersecurity. I may look to incorporate this into posts and articles. Stay tuned. Joshua Copeland discussed how cybersecurity is broken and gave some practical strategies to fix these things. Rob Labbé provided a very compelling discussion on lessons learned from the Crowdstrike outage; specifically, he started his talk highlighting the importance of psychological support for incident responders during incident response. Chris Roberts wrapped up the conference using minions, dragons, and AI imagery to discuss his Top 10 for the industry. There were too many great talks that I missed. The biggest takeaway I had was the importance community and connections. I am fortunate enough to be accepted into this community because I and Green Shoe Consulting are looking to serve... not take (or sell). We look for ways to help those in this space because they do a noble and critical job. They protect people. I was able to meet and get to know some in the industry who are doing and have done important work. People like Kathryn B., Bill Bernard, Richard Greenberg, CISSP, Javier Gonzalez and others. I apologize for those I may be leaving out. I had many conversations and I know I'm missing several people. This is an event to put on your calendar. The items below are a kindness challenge coin from Mental Health Hackers and a fake tooth. DM if you want to know what these are. I've run out of space (*LI).

98

20 Comments

Cyberattacks are not just about data; they can disrupt critical healthcare services. In this episode of The Beat, Steve Cagle, CEO of Clearwater delves into the alarming rise in cyberattacks targeting sensitive patient data, and stresses the critical importance of prioritizing data security and patient safety, emphasizing that cybersecurity is not only about protecting data but also safeguarding lives. Steve presents Clearwater's approach to assisting healthcare organizations by conducting thorough risk analyses, fostering a robust cybersecurity culture, and implementing scalable security programs that align with industry standards. Clearwater is dedicated to supporting smaller healthcare providers through its comprehensive Clear Advantage Program, offering top-tier cybersecurity services tailored to their unique needs. 🎧 Tune in and learn how to protect your organization and patients from cyber threats, while staying on top of your game 👉 https://ow.ly/FKBH50SM8SP #TheBeat #Cybersecurity #DataProtection #HealthcareIT #CyberAwareness #HealthcareSecurity

10

In studying for ISC2 CC cert, I've learned a LOT about Disaster Recovery (DR) and a BCP (Business Continuity Plan). While it's mostly focused on cybersecurity, physical security is also, of course, a huge focus. In regards to the recent hurricanes, I saw this story on the AquaFence, a barrier system which protected a Tampa hospital during the hurricane, installed by the hospital in 2019: a perfect example of a proactive procedure in order to restore / maintain business operations. So incredible, and a perfect example of putting human health and safety first!! #GRC #BCP #DR #disasterrecovery #aquafence #isc2cc

8

Day 1 of my inaugural "2023 MSSP results week" - let's start with the $100M winner (and big winners in general). You see, I'm in heaven geeking out on the data, so I figured why not give myself 5 whole days to bore you all to tears with observations. As for the $100M, yep, you read that right. One single Medicare Shared Savings Program participant saved CMS $138M and took home $100M of it. Health Connect Partners (Providence) but get this... this is their second year running at around $100M in shared savings. Quick stats. ~125k beneficiaries. >8% savings rate. You bet I'm going to be digging into this one more because with this type of year to year success and a risk score that is actually reasonable along with 125k lives (talk about actuarial credibility) this isn't an anomoly, there is some best in class to share. Next up in the big winners. How about a 19.44% savings rate?! Congrats to Citrus Aco who took home a cool $10M for their ~7k lives. In case you are wondering that's $122 per beneficiary per month in shared savings. So how did they hit that number? Well their risk score is 1.419 for Aged Non-Duals compared to 1.077 for the $100M winner above. So when I tell clients risk score matters just as much as utilization for ACO (REACH or MSSP) you can see why... wonder how year 2 and year 3 of HCC v28 will play out for Citrus as it seems accurate risk coding is a key to their success. Side note, they are low revenue, wonder if they have any plans for ACO Flex? And to round out this quick top $$ winners edition: 🤑 The 6 participants that took home >$50M in shared savings - Baylor Scott & White Health ($79M, 118k lives), Palm Beach ACO, a perennial success ($73M, 78k lives), Mercy HealthACO ($70M, 115k lives), MercyHealth Select ($60M, 87k lives), Caravan Health Pathways ($57M, 247k lives - FYI only 2.65% savings they are just BIG, so total savings not very impressive) and Privia Health Quality Network, LLC, only one of their eight MSSP ACOs ($70M, 61k lives) Don't worry, I'm going to cover the biggest winners NOT based on totals but based on savings rates later in the week. And dedicate a day to the "aggregators" like Privia and Aledade. And of course dedicate a day to biggest losers although there aren't many this year - which is a story unto it's own. So what do you want to see tomorrow? We at BP2 Health may have fun investing in effecting REAL change with The Reverse Mullet Healthcare Podcast but we also know ACOs like the back of our hand.

31

9 Comments

Trying to solve security control and attack surface protection gaps by logging into security tools one at a time is like getting 10 band aids to cover a severe burn wound. Especially if your company is growing, you should: 1) Find the right security people who are hyper focused on tackling security data problems. 2) Re-evaluate the tool kit and technology you're arming these people with to solve the problem. Don’t use 10 band aids when it’s not the right standard of care 🤕

37

6 Comments

Fast. Good. Cheap. Pick two. Speed and volume in GRC seem to be hyper-important these days. If there are two things I've learned to look for in external auditors/consultants, it's those items. I can't count how many times I've heard from an external audit firm client "we don't think they can handle the pace" or some variation of "we only want to hire from other high volume, fast-paced firms." My question is, how much quality are we losing in compliance reports when we're mandating our auditors juggle 5-10 audits at a time and complete a full report in a couple weeks? Compliance automation platforms didn't invent this trend. What's the point of a SOC 2, ISO 27001 certification, PCI ROC, HITRUST assessment, etc. if we're not taking the time to do a proper assessment of a client's environment? It seems to be the firms focusing on speed are taking more and more market share away from the firms that focus on quality. So will there always be a place in the GRC industry for the slower-paced higher quality firms? Increasingly, I'm not so sure...but I hope so. #GRC #complianceautomation #speedvsquality

22

20 Comments

QR codes… can be VERY dangerous and bypass a lot of the security safeguards we set up on the perimeter. Interesting read… Now Hackers Are Using Snail Mail In Cyber Attacks—Here’s How https://lnkd.in/eC_tTgwT

11

2 Comments

To say you don't need cybersecurity expertise because you have an IT guy is like saying you don't need a trained pilot because you have someone who can drive a car. Just as flying an airplane requires specialized skills and knowledge beyond those of driving, managing cybersecurity involves specific expertise that goes beyond general IT capabilities. You absolutely need cybersecurity expertise for your business. Does your IT person have the skillset to manage these cyber threats: ☁️ Cloud platform attacks ⚠️ Network attacks 💻 Computer attacks Explore how Griffin Cybersecurity works in tandem with your IT person as a full-spectrum cybersecurity partner: https://lnkd.in/gfzziJMa #GriffinCybersecurity #Cybersecurity #BusinessSecurity #BusinessProtection #DigitalSecurity #CyberThreats #IT #Cybercrime

1

Like 87,999 others, my data was included in the Access Sports data breach. Access is an orthopedics practice based here in New Hampshire. Per the notification letter I received, Access detected attacker activity in their environment in early May, at which time a ransomware group had already exfiltrated an enormous cache of data. This data was published on the dark web in June, and is still available at this very moment. I have been reviewing it all morning. The data runs an enormous and depressing spectrum - intake forms, insurance claim data, insurance cards, operational financials, photo IDs, scheduling, imaging logs, the list goes on and doesn't stop. This organization lost practically everything it digitally records day-to-day to run its business. It's a sickening state of affairs, and it is the reality every one of us working to secure the health sector face every single day. Access is offering limited free credit services through Cyberscout (A TransUnion Brand), which if you are impacted, you should take advantage of. The enrollment process is not complicated and only takes a few minutes, and there's no real reason not to do this, even if you're already being covered by another service. The sad reality here is this: the more you are seen at a practice or medical facility, the larger the digital footprint that is left behind. Credit is a concern for everyone impacted, maybe the foremost concern. But there is a universe of other fraud possible for many individuals, especially frequent flyers, based on the kind of information that was dumped. Every person needs an identity theft monitoring service. I don't have one to recommend. But we are well past the point where these services are "nice to have". They cost too much. But every one of us are stuck. Start by finding out if your employer provides this as a benefit. Going through this data turns my stomach. It probably turns your stomach too, and you are only looking at a screenshot. A time will come when this doesn't happen. That's what I keep telling myself.

9

1 Comment

Compliance Doesn’t Equal Security Being compliant means you're secure. I see a lot of organizations flaunting their ISO or SOC 2 certifications like it’s a bulletproof vest. Hackers don’t care if you passed an audit—they care about your vulnerabilities and weak spots. Compliance is just a minimum standard. It’s about checking boxes, not defending against real-world threats. Sure, compliance frameworks are a good start, but they’re not enough. Security is about being proactive, continuously adapting, and having systems in place to stop attacks before they happen. So, if your focus is just on passing audits, you’re missing the bigger picture. Compliance should be the baseline, not the end goal. Let’s focus on building systems that actually protect, not just “look good” on paper. What’s your take? Are we relying too much on compliance? Drop your thoughts in the comments or DM me if you want to chat about building real security strategies. #Cybersecurity #Compliance #CxO #SecurityLeadership #RiskManagement

2

HIPAA compliance isn't cybersecurity. Let that sink in. Now, let's get into the why. HIPAA sets the floor, not the ceiling. Compliance means you're at the starting line. Cybersecurity is the race. Let's draw a line. HIPAA compliance checks boxes. Cybersecurity is a lifestyle. Compliance is static. Cybersecurity is dynamic. Think of HIPAA as your base camp. Cybersecurity is the mountain you need to conquer. Why does this matter? Hackers aren't polite enough to follow compliance guidelines. They exploit the smallest cracks, compliant or not. In the world of digital health, this distinction matters. HIPAA compliance doesn't guarantee breach safety. It's the minimum, the absolute least you can do. Cybersecurity is about going beyond and vigilance. It's preparing for what's next, not just what's now. So, ask yourself. Are you just compliant, or are you secure? In this era, the latter is non-negotiable. ✍️How do you approach cybersecurity & compliance? --- 𝘘𝘶𝘦𝘴𝘵𝘪𝘰𝘯𝘴 𝘢𝘣𝘰𝘶𝘵 𝘏𝘐𝘗𝘈𝘈? 💎𝘛𝘳𝘺 𝘰𝘶𝘳 𝘏𝘐𝘗𝘈𝘈 𝘎𝘗𝘛: 𝘩𝘵𝘵𝘱𝘴://𝘵𝘪𝘯𝘺𝘶𝘳𝘭.𝘤𝘰𝘮/2𝘱93𝘳8𝘹𝘫 💎𝘍𝘳𝘦𝘦 𝘏𝘐𝘗𝘈𝘈 𝘎𝘶𝘪𝘥𝘦: 𝘸𝘸𝘸.𝘪𝘯𝘩𝘦𝘳𝘦𝘯𝘵𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺.𝘤𝘰𝘮

12

4 Comments

COMPLIANCE SHOULDN'T BE A HEADACHE 🤕 But if you're manually checking boxes for: • PCI • HIPAA • SOC2 • [Other frameworks] ...you're doing it wrong. Mission Cloud Secure automates compliance monitoring across your entire AWS environment. One dashboard. All frameworks. Zero stress. Which compliance framework gives you the biggest headache? Comment below 👇 Learn more: https://ow.ly/5pOP50U1hnG

14

I've heard several talks and discussions on Threat Modeling (TM), but none of them come close to this conversation between Sandesh Mysore Anand and Anshuman Bhartiya. Most TM talks I've found are more theoretical and less practical. In contrast, this talk touched on many practical aspects of TM, like ROI of TM, dealing with developer behavior, and AI for TM. Enjoyed listening to this discussion. Thanks, Anshuman and Sandesh, for sharing your thoughts & experiences with Threat Modeling. Looking forward to more insightful discussions like this. I would love to hear your thoughts on TM for AI as well.

21

1 Comment

Organizations are inundated with alerts, struggle with attack surface visibility, and face challenges tracking attackers. Recorded Future's Ransomware Solution equips your security team with the tools and data needed to stay ahead of threats: 1️⃣ Visibility into Attack Surface Exposures: Detect high-risk CVEs, misconfigurations, end-of-life software 2️⃣ Prioritization of Critical Alerts: Reduce noise and focus on the alerts that matter with risk scoring and evidence 3️⃣ In-depth Insights on Adversaries: Gain comprehensive visibility into the ransomware landscape, including bad actors, TTPs, targets, and intent

13

1 Comment

This is telling: Hackers broke into the "cloud" control system for a line of Robot vacs and downloaded patches which included them driving around and screaming racist slurs. It's a problem because security is considered an expense during development, so why bother with it? Also an issue since more and more devices have to be connected to some sort of "cloud" to work. Over the spring I got a outdoor water control device that wanted access to my Wifi. When I sniffed it I could see it was connecting to a C&C site in China. What would prevent this company from doing a firmware update to sniff my network for traffic and send it who knows where? The best solution is to run your own cloud. I use Home Assistant, all of my automatons and appliances connect to a system I control, in MY house, with data and updates under *MY* control. And if a device doesn't support open connections, why would I use it? https://lnkd.in/erYQ-SiN PS: For that water control I ripped out the Chinese computer control and installed my own Raspberry Pi pico. Now it's under my control and works perfectly.....

14

1 Comment

Is Your File Transfer Really Secure? I enjoyed this refresher on managed file transfer vs more traditional file transfer protocols.  It’s not just about a secure method to transfer files, but how to manage this at scale – who sent what? When?  With some thought, a robust MFT can protect your sensitive data, ensure compliance, and streamline your operations—all in one go. https://lnkd.in/gVUnfrDk #CyberSecurity #DataProtection #Compliance #InfoSec 

7

UnitedHealth Group, Optum, and Change Healthcare...just a thought... I'm pretty sure a comprehensive, enterprise-wide risk analysis (required at  45 CFR §164.308(a)(1)(ii)(A)) followed by the development and execution of good old-fashioned risk management (required at  45 CFR §164.308(a)(1)(ii)(B)) would have come in less than $2.5B. Obviously, the controls checklist approach didn't work... https://lnkd.in/ehsRAdKs

27

5 Comments

I've had a lot of clients come to us with avoidable Cybersecurity Labeling Deficiencies. Here's an approach that can help you avoid some of them. The FDA Cybersecurity Guidance says: "The following are examples of information that may be included in labeling to communicate relevant security information to users ..." and then it has a list of 15 items to address. Not all 15 items make sense for all devices. For example one item is: "A description of backup and restore features and procedures to restore authenticated configurations." Many radiology AI/ML SaMD products are pass-through and don't store any data. Thus, backup and restore isn't needed. However, even so I suggest creating a table that lists the location of each of these items. If it doesn't apply, explain why. You can then copy this table into the eSTAR question about labeling. If your team needs FDA Cybersecurity support for an upcoming submission, let me know! We can provide a gap assessment and help you fill the gaps. #medicaldevices #fda #cybersecurity #sbom #labeling #510k #denovo

61

5 Comments