Francisco Najera, CISSP, CISM

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5

VM remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from VM to exposure management and effectively prioritize high-risk exposures across their complex attack surface. http://ow.ly/oGFk105PbnX

3

Get your complimentary Identity Security Assessment today! 🔎 ✔️ Get up and running in 𝗹𝗲𝘀𝘀 𝘁𝗵𝗮𝗻 𝗮𝗻 𝗵𝗼𝘂𝗿 and gain actionable findings paired with rich context - all within a day! ✔️ 𝗥𝗲𝘃𝗲𝗮𝗹 𝗮𝗹𝗹 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀, entitlements, configurations, and paths to privileges that attackers could exploit across on-premises, cloud, SaaS, and IdPs ✔️ 𝗛𝗮𝗿𝗱𝗲𝗻 𝘆𝗼𝘂𝗿 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗼𝘀𝘁𝘂𝗿𝗲 & detect the abuse of identities, privileges, and identity infrastructure through optimized workflows This offer also includes 30 𝘥𝘢𝘺𝘴 𝘰𝘧 𝘤𝘰𝘯𝘵𝘪𝘯𝘶𝘰𝘶𝘴 𝘮𝘰𝘯𝘪𝘵𝘰𝘳𝘪𝘯𝘨 against active abuse of privileges and paths to privilege. You've got nothing to lose, but everything to gain when it comes to strengthening your identity security posture. Find your privileged risks now... https://lnkd.in/eqDgRWxq #IdentitySecurityInsights #InsightsAssessment #BeyondTrust #IdentitySecurity #PrivilegedAccess

8

Useful tips for CUI scope management for CMMC.

4

Tired of your Pen Tests surfacing IAM risks? Find & fix misconfigurations and identify vulnerabilities first with Identity Security Insights. Detect hidden paths to privilege and new privilege risks with continuous monitoring. Secure your total identity fabric with ease. Effortless deployment inside an hour, full dashboard in less than 24 🔎 Start your complimentary identity security assessment today.  https://lnkd.in/gHfgCyeu #IdentitySecurityInsights #IdentitySecurity #PathstoPrivilege #PenTesting

11

Tired of your Pen Tests surfacing IAM risks? Find & fix misconfigurations and identify vulnerabilities first with Identity Security Insights. Detect hidden paths to privilege and new privilege risks with continuous monitoring. Secure your total identity fabric with ease. Effortless deployment inside an hour, full dashboard in less than 24 🔎 Start your complimentary identity security assessment today.  https://lnkd.in/gHfgCyeu #IdentitySecurityInsights #IdentitySecurity #PathstoPrivilege #PenTesting

2

⚡ Cybersecurity threats are evolving fast! To stay ahead, organizations must embrace new security approaches involving fresh strategies, technologies, and a cloud-ready mindset. 🌐 Enter MITRE ATT&CK — the ultimate guide for security practitioners packed with invaluable insights into attacker techniques and behavior. Pretty handy, right? 💡 Sysdig's eBook show you how to identify and defend against common threats to #AWS environments using open-source Falco rules mapped to the ATT&CK framework. Boost your #AWScloud security and tackle any threat head-on by giving it a read today:

3

🔍 CISA warns of actively exploited Apache HugeGraph-Server bug 🔍 https://lnkd.in/eYA8nQaz #CISA #Apache #Cybersecurity #Vulnerability #SoftwareSecurity #HugeGraph #CyberThreats #DataProtection #SecurityAlert #Exploit #InfoSec

3

Imperva protects customers from CVE-2024-4577, a critical vulnerability in PHP. See this blog from Imperva Threat Research for details and an analysis of attack activity. #CyberSecurity

7

The recent XZUtilities incident, rooted in the manipulation of open-source repositories, illustrates the rising vulnerability of commonly-used open-source software. Learn more about this sophisticated attempt to infiltrate the software supply chain: https://lnkd.in/g_DYy6Te

2

You know, the CrowdStrike incident shook the agenda last week as we closed the week.👨‍💻 So what happened other than that ❓️ Here I have a great resource suggestion where you can find the answer to this question ❗️😌 Don't forget to review.🤞🌸 🚨 Apache Web Server: Multiple Critical Vulnerabilities Discovered 🚨 SAP Al Core Vulnerabilities Patched After Security Risks Exposed 🚨 Google Chrome 126 Patches Critical Vulnerabilities 🚨 Oracle Releases Critical Patch Update with Over 260 Remote Exploits 🚨 Critical OpenSSH Flaw Patched but Risk Remains 🚨 Atlassian Patches Critical Vulnerabilities in Popular Products Thank you to the XM Cyber family for these useful details.🌟🙌 I share the link of the related resource in the comment.⬇️ Have a nice week❗️🫶 #cybersecurity #infosec #exposures #exposed #crowdstrike #weekly #roundup #apache #sap #atlassian #google #oracle #critical #vulnerabilities #exploit #product #resourcesharing #newsletter #learningeveryday

1

1 Comment

Join us and GuidePoint Security at GPSec in Philadelphia to hear about upcoming trends in SaaS Security and how you can keep your SaaS stack secure 💪 Get ready to meet our team 👉 Kirra Rice Dustin Crossman Richard Snyder

2

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

43

1 Comment

EC2 Compromise Leads to S3 Bucket Exfiltration

53

#K12's - can we talk about the elephant in the #k12cybersecurity room for a minute? We worry about #Snowflake (and Powerschool, K12-360 and possibly Edgenuity) and dozens other potentially affected vendors who may have had data stolen as a result of this: https://lnkd.in/gbu3dHvw with potentially *millions* of stolen records. Here's my question... can we STOP sending data to vendors they do not actually need to do the job we've hired them for? Do vendors really need parent home address or phone number if they have a parent contact email? Do vendors really need gender and birthdate on kids if they have grade-level? Do they really need a student's full name if they have login username? With today's advanced field syncing tools, you can pick and choose which data elements you hand over. Can we, as districts, get serious about greatly reducing (and even hashing or proxying the data) so that WHEN (not if) our trusted vendor gets pwned - maybe even not their fault - we've lost as little student (and staff) data as possible? And make sure your district-to-vendor contracts *demand* they delete data when the contract expires, otherwise they'll hoover it up into their data lake - and please ask that they always encrypt your data at rest.

33

4 Comments

How Can You Retain Control Even After the E-mail Is Sent? Even after sending your email, you retain the flexibility to freely adjust your security settings, including access permissions, forwarding and downloading options, and the expiration date. Understand the critical differences between phishing and spear phishing to effectively safeguard yourself and your organization from cyber threats: https://lnkd.in/g_U3whXC Stay connected with us on LinkedIn: https://lnkd.in/ggi_8FPq

5