Jeff Horton

Cybercriminals Target Florida Hurricane Victims with Fake FEMA Claims As Florida faces Hurricane Helene and prepares for Hurricane Milton, cybercriminals are exploiting disaster victims and relief efforts. Scammers are posing as FEMA to steal personal information and relief funds, while phishing attacks are tricking victims through fake websites. Malicious files disguised as FEMA documents are also spreading malware, putting people at further risk. Always verify the legitimacy of disaster relief websites and emails before sharing personal information. #CyberSecurity #FEMAFraud #HurricaneRelief #DisasterRecovery https://lnkd.in/gcUSJXQS

39

1 Comment

Tap below and discover how NIST CSF 2.0 can help financial institutions strengthen their cybersecurity--especially since the FFIEC CAT will sunset in 2025--and how Schellman’s experts can make your transition seamless and sustainable. 📝: Jeff Schiess

7

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

🔐 You've probably noticed the Two-Factor Authentication (2FA) information box in your account. We ask you to add 2FA to protect it. ICYMI: 2FA is "an identity and access management security method that requires two forms of identification to access resources and data." How do you add it? 1. Press the "Two-Factor Authentication (2FA)" sign, or 2. Go to your Account settings https://lnkd.in/dVJYgKje and set the toggle right (so that the background turns green). Then, the pop-up window will appear. Please follow the instructions written on it. Remember - your data should stay safe to ensure you can work trouble-free. #adsy #guestposting #guestpostingservice ##guestpostingplatform #2FA #onlinesafety

38

7 Comments

Let's not assume that employees don't care about security. Maybe they don't believe that training can protect them or their agencies. What's the efficacy of your security awareness training? How effective is it, on average? How much should we rely on humans (human, all too human) to prevent attacks? Maybe the 20% that skip training are making the right call. If your organization's anti-phishing, endpoint, and identity protection tools can't catch an attack, what makes you think an overworked employee can be reliable, even if they care and have been trained? Isn't it high time we took a hard look at "the human firewall"? What about avoiding eyestrain? What about relieving stress? What about cutting email volume to manageable levels? Why do we still depend so heavily on email anyway? Computing is scalable. Human capacities are not. Let's stop pretending they are. #phishing #securityawarenesstraining https://lnkd.in/gbXrSgNg

6

4 Comments

As CruiseCon is not a typical #cybersecurity event, Casey Yarbrough and I recorded the below video to answer the most common questions and just describe the event. The subjects we cover include: * Why I came up with CruiseCon * How are we bringing the type of event that is typically reserved to Fortune 200 CISOs to the rest of the cybersecurity profession * The opportunities to engage and network with people at all levels * A day by day breakdown of the agenda * How to justify the event to management, if necessary * What to expect from the ship and the event As I also mentioned the entire cost to attend CruiseCon (depending upon the cabin chosen) is less than the cost of registration fees for the other major industry events. Please review the video and reach out with any questions.

38

15 Comments

How to Protect Your Online Privacy: Non-Technical Guide Learn how to safeguard your digital identity and prevent stalking. Join me as I share practical tips to clean your devices, back up data, and create a new profile to disconnect from your past. Protect yourself online, even if you're not tech-savvy. #OnlinePrivacy #DigitalIdentity #StalkingPrevention #DeviceSecurity #DataBackup #NewProfile #CyberSafety #InternetPrivacy #DataProtection #OnlineSecurity

3

In this article for the IACP's Police Chief Magazine, PenLink's Johnmichael O'Hare and our own Trey Amick talk about how digital forensics and open-source intelligence (#OSINT) are playing crucial roles in modernizing police investigations: https://ow.ly/UH9O50SUg9q #DFIR

29

By the end of 2024, the MVP Enclave and 800-171 Compliance Program will have undergone four intense Joint Surveillance Voluntary Assessments within a 12-month period by four distinct DIBCAC teams with four separate small businesses. Building enclaves and 800-171 Compliance Programs correctly is a challenging task. Who is guiding your company towards early assessment and beyond? You deserve to move forward with confidence. You deserve to win in 2025. #DIB #InformationSecurity #CMMC #CCA #CCP #ENCLAVE #JSVA #GOVCON #HAMPTONROADSDIB

67

8 Comments

Don’t fall for a phone scam! Impersonation scams are on the rise and often use the names and titles of government employees. CISA staff will never contact you with a request to wire money, cash, cryptocurrency, or use gift cards and will never instruct you to keep the discussion secret. If you suspect you are a target of an impersonation scammer claiming to be a CISA employee: • Do not pay the caller. • Take note of the phone number calling you. • Hang up immediately. • Validate the contact by calling CISA at (844) SAY-CISA (844-729-2472) or report it to law enforcement. https://go.dhs.gov/3fh

198

5 Comments

‘I don’t see it happening’: CISA chief dismisses ban on ransomware payments. Why it matters: 1. U.S. Cybersecurity and Infrastructure Security Agency Director, Jen Easterly, has dismissed suggestions of a ban on ransomware payments in the U.S., opting instead for execution of federal laws like CIRCIA– the Cyber Incident Reporting for Critical Infrastructure Act—which requires critical infrastructure entities to report cyber incidents. 2. Easterly supports a proactive approach to ransomware prevention, championing initiatives that share threat detection insights with businesses. Such early warning methods have already reportedly thwarted numerous potential ransomware strikes. 3. However, Easterly acknowledges a remaining major challenge: helping businesses with limited security resources better secure their infrastructures. A successful "Secure-by-Design" campaign is seen by her as key to reducing the incidence of cyber vulnerabilities and thereby ransomware attacks. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/e4_tsDcv

3

We really need to stop using FTP servers, especially for sensitive data 🛡️ Sensitive data on nearly 1 million Medicare beneficiaries in Wisconsin was compromised in 2023 due to a ransomware attack exploiting Progress Software’s MOVEit file-transfer service flaw. On September 6, The Centers for Medicare & Medicaid Services (CMS) announced that its contractor, Wisconsin Physicians Service Insurance Corp., was impacted by the MOVEit flaw. The compromised data includes names, Social Security numbers, dates of birth, addresses, hospital account numbers, Medicare beneficiary identifiers, and health insurance claim numbers. CMS began notifying nearly 950,000 affected individuals last week, following Wisconsin Physicians Service’s notification of the breach on July 8. The data breach is part of a larger wave of attacks in May 2023 targeting the MOVEit vulnerability. Organizations like the Texas Dow Employees Credit Union have also recently disclosed breaches related to the MOVEit vulnerability. https://lnkd.in/gP8t4E3C

3

The SEC's new Regulation S-K Item 106 now requires public companies to disclose their processes for managing cybersecurity risks. Historically, this wasn’t required, and there were no guidelines for what constitutes a “good” disclosure. Kayne McGladrey, CISSP reviewed disclosures from nearly 3,000 companies across over 300 industries, identifying trends for robust, meaningful disclosures. 📊 Read the full analysis here: https://lnkd.in/gVUNiZUP #CyberSecurity #SECRegulation #RiskManagement

7

It is time to ensure that all government agency employees throughout the U.S. understand the risk every time they open up an email message at work. CFISA cybersecurity awareness training has been certified by the Texas Department of Information Resources. It is imperative that all government agencies require this vital training for all employees. Center for Information Security Awareness - CFISA State of Missouri LightSpeed Virtual Training #securityawareness #cybersecurity #getyourheadinthegame

3

The DragonForce ransomware group is known for its sophisticated tactics and destructive capabilities. They have targeted various organizations worldwide, exploiting vulnerabilities to encrypt data and demand ransom payments for its release. Their abilities include leveraging advanced encryption techniques to lock victims out of their systems effectively. They often deploy ransomware through phishing emails, exploiting unpatched software vulnerabilities, or using remote desktop protocols (RDP) with weak or stolen credentials to gain unauthorized access to networks. One of the notable recent incidents involving DragonForce was the exploitation of a vulnerability in a widely used software application, allowing them to infiltrate multiple organizations simultaneously. These organizations included government agencies, healthcare providers, and financial institutions, leading to widespread disruption and data loss. Despite law enforcement efforts to disrupt their operations, DragonForce remains a significant threat to organizations globally, highlighting the importance of robust cybersecurity measures and proactive defense strategies.

1

What is vishing? Vishing is a type of cybercrime where criminals use voice calls or voicemails to trick victims into revealing P.I.I. These scammers often impersonate legitimate organizations like the IRS or your bank. If you or your business receive a suspicious phone call, hang up and call the organization directly using a verified number. The best defense against vishing and other crimes is awareness. Contact us today and learn how to protect your data today! #dataprivacy #cybersecurity #tech

2

🔒 Lock down your security game with the latest guidance from National Institute of Standards and Technology (NIST). Early in the month, they gave the green light for syncable authenticators (aka passkeys) to be used for both enterprise and public-facing use cases and called out the potential risks that come along with these handy tools. 💻💡 From securely storing and transmitting keys to implementing strong authentication in shared device scenarios, NIST offers a good framework. But it doesn't go all the way. The real challenge comes when we look at AAL2 standards, where passkeys must be unlocked with a local authenticator (think biometric) or a password. 🤔 So what's the catch? Fraudsters can easily exploit the use of passwords in cloud-based accounts. But fear not, we've got a solution for that too. Introducing #Anonybit, which binds your passkey to your biometric for ultimate security. Only you can access and use your passkey, no tradeoffs between privacy and security necessary. 🙌🏼 Connect with us to see it in action and take your authentication game to the next level. Visit www.anonybit.io/contact

8