Jason ODell

How does your organization manage technical debt in development and infrastructure, and what strategies have you found most effective in balancing innovation with maintaining a secure and scalable infrastructure? https://lnkd.in/gTdu2HZ7

8

Public Service Announcement: Protect Yourself from Text Message Scams The USPS will never send you a random text message about a package unless you specifically requested tracking updates. If you receive an unsolicited text claiming to be from USPS, it’s likely a scam designed to trick you. Here’s what you need to know: Legitimate USPS texts are only sent for tracking updates and will never ask you to verify personal information or click suspicious links. Always be cautious with unsolicited messages and avoid responding or clicking links. Help spread the word and keep your loved ones safe. If in doubt, contact USPS directly or report suspicious texts. Stay vigilant!

6

1 Comment

This is a quick shout out to the folks behind the "Minimum Viable Secure Product" https://mvsp.dev/. If your are looking for a brief and concise checklist to verify the security of something (be it your org, a supplier, a service ...), this is by far the best checklist that I know of to cut through the noise and get actionable results fast. #mvsp #security #audit

54

7 Comments

A lot of system admins seem to either be asking or are being asked the question: "Why should we keep antivirus/EDR if it can cause the kind of damage we saw from the Crowdstrike incident?" We have to guide the conversation to the right questions, not the easy questions. This isn't a question about avoiding risk, it's a question about aligning risk posture to strategy. "What does our organization require for operations and competitive advantage?" "How do InfoSec capabilities support our ability to operate?" or "What will go wrong and how can we provide assurance?" "What requirements or limitations exist that can help inform our selection of technologies to deliver an InfoSec capability?" "Are our InfoSec capabilities enhancing our competitive advantage?" This aligns at a high level with the questions that frame the "Threat Modeling With ATT&CK" project. It's a good read and worth the time. https://lnkd.in/gGU3F8EX

1

This is a great article highlighting the value of year-round pen testing. Consider it regression testing for security controls. Of course, it's critical that you find an automated testing tool to help with this process, but it can not only continuously validate your controls but also help you look for drift.

1

One to look out for and ensure your SOC has a use case for. #cybersecurity #phishing

9

Three years ago, I took the Certified CISO (CCISO) certification. Recently, after being hounded to renew, I took some time to reflect on my experience—and why I’m choosing not to renew. The training itself was decent and covered the essentials like governance, risk management, and security program management. However, the exam was a letdown. I had duplicated questions, spelling errors, and even some outright mistakes in the content. Given the hefty price tag, I’ve found myself questioning its value. For most, the CCISO is not going to be a great investment. While it provides valuable knowledge, especially if you’re already in a leadership role, the cost and exam issues make it hard to recommend, even if there weren't alternatives. Certifications are important, but they aren’t one-size-fits-all. If you're looking to break into the field, it’s crucial to weigh the pros and cons of each certification and find the one that aligns best with your career goals.

88

22 Comments

The 3rd party vendor/contractor ecosystem varies greatly in size and capabilities when it comes to cybersecurity. All organizations regardless of size has to raise their games when it comes to operating securely as they may be a vector into their customers or at minimum the information they hold on behalf of their customers. Cybersecurity and best practices regarding systems, information, and culture needs to improve. #CISO #CTO #cybersecurity #cybersecurityawareness #riskculture #cyberriskmanagement #bestpractices #threatvector #sizedoesntmatter #thirdpartyrisk

24

4 Comments

I measure the value of conference by two measures - learning and networking. Days 0 and 1 of Microsoft Ignite were a success by both measures. Satya Nadella kicked off the Day 1 keynote with announcements for several technologies - whether desktop, infrastructure, cloud, artificial intelligence, or big data. Highlighting security all along the way. The most beneficial sessions from the remainder of Day 1 focused on the expanding capabilities of Microsoft Purview (both for Copilot & ChatGPT) and improvements in Defender for attack path mapping to aid in Continuous Exposure Management. From a networking perspective on both days, I had the opportunity to catch up with Paul Goldney and the team from Wizard Cyber. We've identified capabilities to explore such as Microsoft Cloud PC and fully leveraging Purview to protect Copilot. Overall, a success so far. If you're at Ignite, tag me on LinkedIn. I'd like to say hi in between learning sessions.

28

1 Comment

This is getting lots of attention and i know many companies are patching and blocking malicious IPs to protect themselves. #cybersecurity #cisco #vpn #patchmangment

16

2 Comments

Whether it's PrintSpoofer on Windows abusing the Spooler Service or the recent CUPS RCE exploit on Linux, one thing is clear: If a computer doesn’t need to print, 𝐑𝐄𝐌𝐎𝐕𝐄 the printing service. Your web servers and domain controllers don’t need to print. #cybersecurity #Linux

15

2 Comments

🍎 Hey Apple users! Time for a quick but important update! CISA News Update! Just wanted to give you all a heads up - Apple dropped some super important security updates today. Your devices need these to stay safe and secure! ✨ CISA encourages users and administrators to review the following advisories and apply necessary updates (see article for links): iPhones & iPads (iOS 18.1/17.7.1) Macs (Sequoia, Sonoma, Ventura) Apple Watches Apple TV Vision Pro 💫 Pro tip: The sooner you update, the safer your devices will be! It only takes a few minutes - maybe grab a coffee while your devices do their thing? ☕ #Apple #TechTips #DigitalSecurity #StaySafe Anyone else updating their devices tonight? Let me know below! 👇 https://lnkd.in/g9i5V8JA

7

Bring Your Own Device (BYOD) refers to the practice of allowing employees to use their personal devices, like smartphones, tablets, and laptops, to access company resources and data. While BYOD policies offer convenience and flexibility, they also pose significant security risks, especially in companies handling sensitive information. One major concern is that personal devices are often not fully updated or patched with the latest security fixes, making them prime targets for attackers. Hackers can exploit these vulnerabilities to gain access to a device and, subsequently, the company's network, leading to potential data breaches and other cyber threats. To mitigate these risks, it's essential for organizations to enforce strict BYOD policies, ensure devices are secure, and educate employees on the importance of keeping their devices updated. Protecting sensitive information should always be a top priority. #CyberSecurity #BYOD #DataProtection #InfoSec #NetworkSecurity #DataBreach #RiskManagement #ITSecurity

6

Here's to hoping these 68 companies deliver on their promise of delivering software that is secure by design. https://lnkd.in/gWFS7DUM

5

Highlight of RSA was the seeing Rori Boyce-Werner, Shelby Descoteaux, CISSP, Elizabeth Hubbard, and Shawn Powers, session “OperandAI: Practical Security for Artificial Intelligence” - great panel!

99

3 Comments

Hm. Microsoft seems to have come up with a new "security convenience" which I didn't want, and more importantly is far weaker security. Specifically when I log in it wants to send a "code" to my email account. Since September I have been getting these "codes" from people trying to log in from Turkey, China, Iran, the gang of usual idiots. Fine. However this account has (a) A strong password, (b) TOTP based MFA and (c) nothing of value. Normally it wouldn't be a problem as MS would TOTP anyone who managed to somehow guess the password.... But now apparently I can just type my email address and a "code" is sent to my personal email. Enter code, totally logged in. Bypasses password AND TOTP *and* makes it easy for random flunkies to drive me nuts with fake requests. Thanks Microsoft for continuing to waste my time and insisting on using an easily findable email address as my "username". Not sure when they started this, but it looks like it goes back to September. Edit: Hilarious update: You CANNOT REMOVE the email validation method as an appropriate auth. This basically turns Microsoft's accounts into a super weak system with a hole by default. *sigh*

14

1 Comment

Legacy systems are the Achilles’ heel of critical infrastructure cybersecurity https://lnkd.in/gs4mB7vg A very true perspective...older systems are more vulnerable to cyber threats.

5

Could you imagine something like this happening to your business? The city of Wichita Kansas had to shutdown their IT systems on Sunday 5/5/24 due to a Ransomware attack. The city says that first responders are still providing services, with police and fire departments having to switch to business continuity measures where necessary. As for online payment systems for things like water, court citations and tickets - these services are all offline. If you are stressing over what you would do if this happened to your business then give MIS Solutions, Inc. a call. We have a team of experts that can assess your situation and help ensure that your business is well protected. Don't stress call MIS - 770-945-5487

6

A few weeks ago, Jacob Horne posted the most annoying thing about #CMMC is being told that you were already supposed to be meeting the requirements per #DFARS 252.204-7012. I 100% agree with that statement. I'm sure most reading this can relate to a scenario where they've been performing well but someone had to point out the few things they didn't do to be "perfect". Experiences I've had like that certainly got under my skin. The second most annoying thing about CMMC - being told that you need to do it for National Defense. Yes, you read that correctly. The reality is businesses in a capitalist society take action on initiatives when it makes economic sense. DFARS 7012 has a major loop hole in that language that enables businesses to circumvent #DoD's intent and negate the business driver. I'm not here to debate how many businesses read the regulation and know the loophole. The fact is it exists, and I can't blame them for not fully implementing NIST SP 800-171 - especially for SMBs. The real business driver right now is what is absolutely required for the SMB to earn a contract. SMBs don't feel like they have the resources to conduct an information security risk analysis to quantify the operational risks of their current cybersecurity posture. It can be a complex endeavor, and they're focused on grinding every day to keep the lights on and hopefully earn new business along the way. Don't get me wrong. I care deeply about the National Defense. I care about protecting our services members, about protecting the USA's way of life, and doing my part to aid in that effort. The information that individuals like Tara Lemieux share about the threats in today's world truly concerns me - I'm not a person who believes in coincidences. The thought of what could happen motivates me every day to keep doing what I do. I've also had the privilege of listening to many great speakers discuss the importance of cybersecurity for the National Defense that also motivates me to continue what I do. However......I sympathize with a common theme of many SMBs I talk to: "What good is a strong cyber posture if it makes me less competitive, increasing my chance of losing work, ultimately putting me out of business? I care about the National Defense like the next red blooded American, but I need to stay in business too." The CMMC ecosystem must understand the business drivers and communicate both technical solutions AND business strategies that can help #DIB SMBs to the cybersecurity posture they need for their business. I'll start. Cost is always a concern with every business who is going to need a CMMC Level 2 certification. The cost to design and engineer a complaint infosec program is not allowable, but costs to maintain the environment are allowable for many contractors. I'm not an accountant, but Michael Tomaselli is and he's also a cyber professional. Connect with him for a more in-depth conversation. Add more cost effective resources to the comments!

19

9 Comments