Jason Meller

SaaS DLP is important. Checkout the recent case at Disney. Metomic can help avoiding this risk. "Claims state that Nullbulge accessed Disney's Slack server and collected information about the company's upcoming projects, including concept art for Disney games. These reports also suggest that login details and personal details of workers were gathered." #SaaS #cybersecurity #dlp #slack

19

Cold-calling CISOs is counterproductive. Don't do it. Rinki Sethi, CISO of Bill.com, explains why and suggests alternate approaches. "If you're going to reach out to me...please put some time into it. I want to see that you've done a little bit of research on what's important to me and what's important to the company I work for. Pay attention to detail, and make sure it doesn’t look like a templated email or you are calling me the wrong name!" Read the blog for further insights: https://lnkd.in/ed3YCAJK

221

19 Comments

Our latest article dives into the specific penetration testing mandates under the #NYDFS Cybersecurity Regulation known as 23 NYCRR 500. We explain what’s required, recent regulatory updates, and how to effectively integrate these requirements into your cybersecurity program to maintain compliance.Get the insights you need—read the full article on our website. #CyberSecurity #Compliance #NYDFS #PenetrationTesting #FinancialServices

4

As a 10+ year cybersecurity professional, I've seen SOMETHINGS!! Business owners ignoring red flags, delaying critical measures, and expecting top-tier protection on a "just fix it" budget. Those days? They’re long gone!! At OQPS we're no longer chasing after businesses to convince them to prioritize their cyber security. If you don’t see the value in protecting your operations before disaster strikes, we’re not the team for you. Here’s the reality: 🛡️ Cybersecurity isn’t a reactive service; it’s a proactive investment. 💰 Top-tier protection requires commitment, not a shoestring budget. 🚨 “Just fix it” doesn’t work when your data, reputation, and future are on the line. If you’re ready to take your security seriously, we’re here to help. But if you’re waiting for a drastic incident to wake you up, we’ll still be here, but it’ll COST you ALOT more. The choice is yours: ➡️ Proactive protection that safeguards your business OR ➡️ Playing catch-up after the damage is done We’re working with clients who value their security, their customers, and their future. If that’s you, let’s talk [email protected] If not, best of luck.

7

1 Comment

Monday motivation from our co-founder and CEO Al Yang: SafeBase isn't just about Trust Centers, or reducing the burden of security questionnaires... At our core, SafeBase is about transparency in a space that needs it most. Al's post perfectly describes why we're ready to lead the charge, solving security's biggest pain points with trust and transparency: https://hubs.ly/Q02DT5ZM0

12

One of the questions I hear the most when talking to AppSec professionals is: what is the difference between a vulnerable and malicious package? See the quick breakdown below. Your organization should be covered for both use cases.

43

3 Comments

Changing the Passive to Active: Updating SaaS Cybersecurity Strategy with Threat Management: The massive Snowflake breach disclosed recently, involving hundreds of millions of stolen customer records, is a stark wake-up call for organizations to proactively manage their SaaS security. No doubt the... The post Changing the Passive to Active: Updating SaaS Cybersecurity Strategy with Threat Management appeared first on Cyber Defense Magazine. https://lnkd.in/gHFq3DfZ

1

Three things to learn from Crowdstrike, even if you know nothing about software or security. 1.Avoid Major Deployments on a Friday Evening Deploying significant updates on a Friday evening is a common mistake. People often assume a fix is simple and rush to get it done before the weekend. However, Friday updates are frequently hurried through testing, leading to issues that can ruin everyone's weekend. 2. Plan a Phased Rollout for Major Changes When implementing major changes, it's wise to plan a phased rollout. Traditionally, this means deploying updates to one company, city, state, or country at a time. The fact that the rollout was instantly global is telling. Most major services segment their customers to avoid widespread issues. It's also common to have an early adopter group, representing a small percentage of the customer base, receive patches and fixes a few hours to a few weeks early. 3. Ensure Errors Can Self-Recover Mistakes are inevitable. In any large piece of software or technology, you can expect developers to make errors over time. What's important is to have a plan for when these mistakes occur. Great software anticipates errors and includes mechanisms to recover automatically. For example, Microsoft has "Safe Mode," Apple has "Recovery Mode," and Netflix uses a practice called "Chaos Monkey" to train for, anticipate, and properly recover from the unexpected. It's likely billions of dollars were lost in the Crowstrike incident but hopefully the real impact will be the companies you never hear about in the future who follow some of these basic principles. 

46

8 Comments

In a world where cybercriminals are leveraging AI to breach defenses, it’s time we turn the tables. Let’s empower your cybersecurity with cutting-edge AI solutions. Together, we can outsmart the threats and safeguard your digital realm.

1

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

Have you come across best practices that are actually a terrible idea? Either for your specific situation, or maybe in general? What best practices are actually the worst? I'll start with a few experiences here: 1. Encryption at rest (long story - destroyed CRM availability, added zero security benefit) 2. MDM on mobile devices (sorry about wiping your personal phones and years of family photos that hadn't been backed up 😬) 3. Security keys (really? authn goes back on a keychain again just after we finished getting rid of RSA tokens?)

19

35 Comments

Ever feel like you're sitting in the principal's office when preparing for a client meeting? It sucks, right? Well, if you can’t prove your vCISO program is delivering value, that feeling is probably creeping in. It’s not enough to run a tight security ship. For your clients, it’s about enabling growth, protecting revenue, and driving success. Miss that, and you'll constantly be under scrutiny. Want to prove your vCISO program is making an impact and erase their doubts? Here’s how to start: (And what to avoid) ✅𝗗𝗼: 𝗙𝗼𝗰𝘂𝘀 𝘆𝗼𝘂𝗿 𝗮𝗽𝗽𝗿𝗼𝗮𝗰𝗵 𝗯𝗮𝘀𝗲𝗱 𝗼𝗻 𝗰𝗹𝗶𝗲𝗻𝘁 𝗴𝗼𝗮𝗹𝘀       - Growth, expansion, earnings ❌𝗗𝗼𝗻’𝘁: 𝗦𝘁𝗶𝗰𝗸 𝘁𝗼 𝗮 𝗼𝗻𝗲-𝘀𝗶𝘇𝗲-𝗳𝗶𝘁𝘀-𝗮𝗹𝗹 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝘆       - That doesn’t address your ICP's objectives ✅𝗗𝗼: 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗲 𝗶𝗻 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝘁𝗲𝗿𝗺𝘀 - Risk avoidance, revenue protection, ops gains ❌𝗗𝗼𝗻’𝘁: 𝗢𝘃𝗲𝗿𝗹𝗼𝗮𝗱 𝗰𝗹𝗶𝗲𝗻𝘁𝘀 𝘄𝗶𝘁𝗵 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗷𝗮𝗿𝗴𝗼𝗻       - Metrics they can’t translate to their bottom line ✅𝗗𝗼: 𝗨𝘀𝗲 𝗱𝗮𝘁𝗮 𝘁𝗼 𝘀𝗵𝗼𝘄 𝗽𝗿𝗼𝗴𝗿𝗲𝘀𝘀      - Less risk, better preparedness, reduced exposure ❌𝗗𝗼𝗻’𝘁: 𝗔𝘀𝘀𝘂𝗺𝗲 𝗰𝗹𝗶𝗲𝗻𝘁𝘀 𝗸𝗻𝗼𝘄 𝘁𝗵𝗲 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗶𝗺𝗽𝗮𝗰𝘁      - Tie the data to explicit business outcomes TL;DR If you’re not showing clients how your vCISO services impact their bottom line, they’re going to start wondering if it’s worth the investment. The question isn’t “is the security working?” ...it’s “is security driving business results?” If you can answer that, you’re not just offering a service - 𝘆𝗼𝘂’𝗿𝗲 𝗼𝗳𝗳𝗲𝗿𝗶𝗻𝗴 𝗽𝗲𝗮𝗰𝗲 𝗼𝗳 𝗺𝗶𝗻𝗱. ------------------------------------------ 👋 Hi there; my name's Jesse. 👇 I help you scale your vCISO program; profitably. https://lnkd.in/gaJ7Chm2 ------------------------------------------

19

8 Comments

Building your vCISO program using outdated techniques? Then you're gambling with years of profits. The old way: - 5 figure commitment for a SaaS tool   - 6-12 months of your best people's time in development   - "Pin-the-tail-on-the-donkey" GTM 🤞 hope someone buys it.  Realistically, you're at least 6 figures in before you even know if it will work or not. Add another year while you iterate and adjust... 💸🔥 Or... - Get your vCISO software free for 12 months   - Access a proven vCISO offer development system - Shorten GTM with a guide who's "been there, done that"  And ROI it all with a single deal. Launching a vCISO program - completely de-risked. It's what the PowerGRYD™ was built to do. So, if you'd like to build your program for success... Drop me a DM with the word "Guide" and start your journey to a new level of profit with vCISO.

17

4 Comments

Cybersecurity is more than an IT issue—it's a business issue. Yet, many companies struggle to communicate cyber risks in terms that the board and executives can understand. This disconnect often leads to poor prioritization and costly mistakes. #cyberrisk #cybermaturity

10

Tuesday Tools One of the best tools out there to double check if your email has been compromised is Have I Been Pwned created by Troy Hunt. What does "pwned" mean? The word "pwned" has origins in video game culture and is a leetspeak derivation of the word "owned", due to the proximity of the "o" and "p" keys. It's typically used to imply that someone has been controlled or compromised, for example "I was pwned in the Adobe data breach" Run you email addresses in the tool and let me know if you have been pwned. #data #databreach #troyhunt #pwned #haveibeenpwned #cybersecurity

1

3 Comments

Companies are over-engineering and over-complicating their compliance programs. Instead of developing risk-based and right-sized security programs with intentionality, too many companies are playing compliance whack-a-mole with band-aid fixes to their compliance needs. It’s short-sighted and causing more long-term harm than value.    The companies with the most effective and sustainable compliance functions don’t focus on checking-off compliance requirement boxes; they focus on implementing security programs that address their organization’s specific risks and opportunities. They operationalize sound security and governance practices, and such practices become engrained within their company’s DNA. Through this approach, fulfillment of compliance requirements becomes a natural result of doing the right thing. If your goal is to build an effective and sustainable compliance program, it pays off to do the right thing from the start.

58

17 Comments

Looking for a bright side? With more companies embracing better cybersecurity tactics, cyber insurance rates are on the decline. How have you adjusted to the changing cyber landscape?

1

If budget/security weren't concerns, which AI tool would you want your company to approve and let you use tomorrow morning? Comment below >>>

21

3 Comments

People are pretty good at finding vulnerabilities, but they're far too expensive to be spending their time hunting for TLS weaknesses and HTTP header misconfigurations 💵 What are some of the other vulnerabilities that we're better off leaving to automation? And what vulnerabilities do we still need a person to help find?

9