John Bingham

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

Join us at the Detroit CIO & CISO Executive Summit on June 18th to learn how Generative AI is reshaping cybersecurity! Discover the latest threats, data protection strategies, and mitigation techniques for this powerful yet risky technology.

36

3 Comments

A video worth watching for those looking cybersecurity regulation in the U.S. As Senator Gary Peters holds a hearing of the Homeland Security Government Affairs committee to discuss the need to streamline Federal Cybersecurity Regulation. Cybersecurity risk management is a facing a significant amount of change as U.S and other national regulators move to address public and private sector compliance through regulation. This initiative does come with its challenges, namely the need to ensure that regulators focus upon the same standards and outcomes across Federal, State and Industry. Standards that will effect both public and private sectors organisation operating inside the U.S and those trading with the U.S. The committee pushed for legislation to create an executive/ Federal body that would be responsible for convening federal government and agencies, to work on harmonizing cyber requirements across the government. The committee comes at the time when the White House ONCD released its findings on regulatory harmonisation on the 4th of June. That found overwhelmingly support from respondents for cybersecurity regulatory harmonization and reciprocity. (https://lnkd.in/eUTGybhD) One sees U.S regulatory harmonisation coming, focused on common and agreed standards across CNI sectors. Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner Faisal Khan Veritas GRC #cybersecurity #cyberriskmanagement #cyberregulation

4

1 Comment

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

The question often arises whether an organization needs a penetration test. I had my doubts about testing until I had a conversation with Joe Oleksak, CISSP, and CRISC, and now my options have changed. They are not only necessary but informative on changes needed in an organization's security posture. How about you? #cybersecurity

13

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

On the 11th day of Cybersecurity Awareness Month, I bring you one of my favorites: Matt Mitchell and I talked about privacy, surveillance and security. Listen and share with your friends!

3

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

The cybersecurity risk score for education and non profit sectors are at an all time high.

2

From deep inside the Hollow Earth, I reveal how the CMMC assessment methods guarantee fraud and will inevitably be challenged in court or via contract award protests. And all because NIST won't fix NIST SP 800-171, and The Cyber AB won't create rules ensuring ethical application of the three prescribed assessment methods (interview, examine, and test.) #cmmc #cybersecurity #fraud #dod #fedgov #nist https://lnkd.in/ef5sCsuA

5

NIST Report on the 2024 Accordion Cipher Mode Workshop

3

CPF Coaching Recommends Tenable for your vulnerability scanning needs. Proactive vulnerability management is crucial to your organization's healthy hygiene. https://lnkd.in/ec7xuWfT

7

1 Comment

Hope you can join us for a robust discussion on an important topic!

9

CRG helps clients dominate the IAM landscape with unparalleled expertise in winning and managing large-scale cybersecurity programs. Contact [email protected] or visit crgroupinc.com to position your firm at the forefront of IAM innovation. #CRG #Cybersecurity #IAM #ZeroTrust #FederalContracts #AI #ML #Cyber #CloudSecurity #NetworkSecurity #PatchManagement #ITArchitecture #TechStacks #Software #Hardware #Modernization

3

The National Institute of Standards and Technology (NIST) recently released its first major update of the popular and well-respected Cybersecurity Framework (CSF). 🔐 🖥 NIST CSF 2.0 broadens its reach, sharpens its focus on governance and supply chain risks, and introduces new tools to enhance your #cybersecurity strategy. Stay ahead of threats with #TeamCAI here: https://lnkd.in/gwS_tgKs

10

1 Comment

Current state of MITRE ATT&CK: the essential tool to support the Intrusion Kill Chain Prevention Strategy.: Rick Howard discusses MITRE ATT&CK with Frank Duff, Amy Robertson, and Rick Doten #cyber #cybersecurity #cybersecurityjobs #innovation #management #informationsecurity #technology #cyberjobs

1

Bridging IT/OT divide by developing risk management approach to safeguard organizational crown jewels https://lnkd.in/d2W2ECv2

2