Jon Rogers

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

I was surprised to receive this in the mail! A token of celebration for my nearly year-long journey to becoming an iPEC Coaching Certified Professional Coach. Thank you 🏳️‍🌈 Maril Vernon, CEH, MSCSIA for the thoughtful gift 💜 If you’re a woman in cybersecurity interested in experiencing the power of quality coaching, join me inside the Hacker in Heels community. Group coaching is included in the monthly membership. 1:1 coaching is available at an additional cost only to Hacker in Heels Insiders—and you have to apply. Why? Because I strongly believe we have plenty of resources as part of Insiders that can help women in cybersecurity with many of the common challenges they seek career coaching for. To send people straight towards my highest-ticket offer when I know they can benefit from what I’ve already created at a lower price-point would be out of integrity for me. Trust me, I’d love to sign some 1:1 coaching clients and get quickly on my way to earning back my investment. But I will not prioritize my wallet when I know you don’t need or aren’t ready for 1:1 coaching. So come dip your toes in Insiders! I’d love to help you with your big, bold cybersecurity career goals. #womenincybersecurity #cybersecurity #careercoaching

73

14 Comments

Attention North Eastern Oklahoma Professionals: Are you interested in a seminar on creating or maturing your cybersecurity, privacy, risk, or compliance programs? I'm planning to host a series of free workshops, offering springboard documentation and discussions on effective approaches. Contact me directly if you're interested! #PositiveDisruptor #PosDisruptor #DigitalDucks #ThinkDifferently #ProgramBuilding #Cybersecurity #TechnicalDocumentation #OrgChange #OrgCulture

2

For those in the Defense Industrial Base (DIB) and those who supply the DIB, you better already have a plan to be compliant with the upgrading of CMMC to v2 and ITAR Compliance. Check out this Guide for Defense Contractors Sponsored Post. Discover more: https://lnkd.in/gg9sA78b #cybersecurity #compliance #CMMC #ITAR #blog

7

1 Comment

There are several items that are missed on any data security audit. One is the Cybersecurity Risk Management Plan and Assessment. Typically found in only 1% of audits. An Incident Response Plan. Found less than 1% of the time. But almost never found are Data Flow Diagrams. With over 50% of the organization's data on the cloud, without the data flows completed, no one, yes no one in the organization knows where all the PII, PHI, PFI, PCI and other critical data is located. It takes about a month to complete all the data flows for an organization since all the department heads need to share their knowledge. When complete, these secure documents will allow the organization's leaders to strategize how they will protect their data. Without the data flows, many segments of the organization's data are not properly managed or protected. The organization will not have a backup plan if access to these systems is lost. So ID.AM.03 of the NIST Core V2 is a critical data security control. Please download the CSF and do the work that needs to be done to protect your organization.

10

Executive Cybersecurity Leadership: Responsible for establishing vision and direction for an organization's cybersecurity operations and resources and their impact on digital and physical spaces. Possesses authority to make and execute decisions that impact an organization broadly, including policy approval and stakeholder engagement. T0006: Advocate organization's official position in legal and legislative proceedings T1020: Determine the operational and safety impacts of cybersecurity lapses T1036: Integrate leadership priorities T1038: Integrate organization objectives in intelligence collection T1054: Scope analysis reports to various audiences that accounts for data sharing classification restrictions T1055: Determine if priority information requirements are satisfied T1056: Acquire resources to support cybersecurity program goals and objectives T1057: Conduct an effective enterprise continuity of operations program T1059: Perform cost/benefit analyses of cybersecurity programs, policies, processes, systems, and elements T1060: Advise senior management on organizational cybersecurity efforts T1088: Communicate the value of cybersecurity to organizational stakeholders T1145: Develop strategic plans T1146: Maintain strategic plans T1221: Disseminate incident and other Computer Network Defense (CND) information T1226: Align cybersecurity priorities with organizational security strategy T1227: Manage cybersecurity budget, staffing, and contracting T1234: Develop Computer Network Defense (CND) guidance for organizational stakeholders T1238: Determine the effectiveness of enterprise cybersecurity safeguards T1307: Develop cybersecurity policy recommendations T1308: Coordinate cybersecurity policy review and approval processes T1310: Implement protective or corrective measures when a cybersecurity incident or vulnerability is discovered T1335: Promote cybersecurity awareness to management T1336: Verify the inclusion of sound cybersecurity principles in the organization's vision and goals T1342: Oversee policy standards and implementation strategy development T1354: Identify system cybersecurity requirements T1355: Determine if vulnerability remediation plans are in place T1356: Develop vulnerability remediation plans T1376: Develop critical infrastructure protection policies and procedures T1377: Implement critical infrastructure protection policies and procedures T1450: Allocate and distribute human capital assets T1476: Promote awareness of cybersecurity policy and strategy among management T1518: Develop organizational cybersecurity strategy T1543: Develop cybersecurity policies and procedures T1586: Conduct cybersecurity risk assessments T1779: Coordinate strategic planning efforts with internal and external partners T1862: Establish cybersecurity risk assessment processes T1906: Establish a cybersecurity risk management program

2

1 Comment

6 ICS advisories for your review.

5

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Ransomware Attack on UMC Disrupts Emergency Services UMC Health System in Lubbock, Texas, faced a ransomware attack, forcing it to divert emergency patients. The attack disrupted IT infrastructure, phone systems, and patient portals. UMC remains open, but select patients are still being diverted while services are being restored. John Riggi from the American Hospital Association called it a national security issue, warning that cyberattacks on trauma centers risk lives. Experts like Emily Phelps from Cyware highlight the need for proactive defense through collaborative intelligence to prevent future disruptions. #Cybersecurity #Healthcare #Ransomware #UMC #PatientCare https://lnkd.in/d4gNVTea

37

1 Comment

Given RTO mandates, it’s a good time for employers to refresh their physical office security and training. If your office’s implicit approach to floor and door access, printed documents, IT equipment rooms, and whiteboards is to trust anyone inside, your ISO 27001 certification — and your firm — is at risk. In fact, there are many physical security risks people forget about while working from home:

16

2 Comments

https://lnkd.in/g8BdVkSk One of the biggest takeaways from this incident, IMO, is that when UH paid $21m to BlackCat, they DIDN'T PAY IT TO THE OPERATOR WHO STOLE THE DATA! There is no "code" or moral compass when dealing with these organizations. There is one goal... profit. Interested to see how this plays out with regulatory groups and SEC requirements for notifications based on when data was accessed and when they made it public of the incident. Expensive lesson that hopefully other orgs can learn from.

3

Reading about the updated National Cybersecurity Strategy and its five pillars from Colleen Frye It’s crucial for us MSPs to understand these changes as they'll significantly influence our operations and cybersecurity measures. Check out the full breakdown to ensure your services align with these new federal standards. 💬 Let's chat about how we can leverage this strategy to enhance our cybersecurity approaches and lead the way in compliance. #MSP #CybersecurityStrategy #LeadershipInCybersecurity

2

In this article for Leader’s Edge Magazine, my colleagues Brian Boetig and Sara Sendek comment on the biggest cybersecurity and crisis communications risks facing the U.S. electricity system.

3

Wrapped up an insightful Day 1 at the 19th API - American Petroleum Institute Cybersecurity Conference. Thanks to all the panelists, especially the Influencers in Oil and Gas and Energy. Let's elevate ICS cyber, AI, third-party risk, and supply chain risk management to the forefront of our business strategies! Dd Budiharto CISSP CISM Conan Song Cyber Point Advisory Secure-Tactics IT Solutions #ICScybersecurity #industrialcontrolsystems #artificialintelligence #AI #thirdpartyrisk #TPRM #supplychainrisk #supplychainsecurity

147

6 Comments

A few weeks ago, Jacob Horne posted the most annoying thing about #CMMC is being told that you were already supposed to be meeting the requirements per #DFARS 252.204-7012. I 100% agree with that statement. I'm sure most reading this can relate to a scenario where they've been performing well but someone had to point out the few things they didn't do to be "perfect". Experiences I've had like that certainly got under my skin. The second most annoying thing about CMMC - being told that you need to do it for National Defense. Yes, you read that correctly. The reality is businesses in a capitalist society take action on initiatives when it makes economic sense. DFARS 7012 has a major loop hole in that language that enables businesses to circumvent #DoD's intent and negate the business driver. I'm not here to debate how many businesses read the regulation and know the loophole. The fact is it exists, and I can't blame them for not fully implementing NIST SP 800-171 - especially for SMBs. The real business driver right now is what is absolutely required for the SMB to earn a contract. SMBs don't feel like they have the resources to conduct an information security risk analysis to quantify the operational risks of their current cybersecurity posture. It can be a complex endeavor, and they're focused on grinding every day to keep the lights on and hopefully earn new business along the way. Don't get me wrong. I care deeply about the National Defense. I care about protecting our services members, about protecting the USA's way of life, and doing my part to aid in that effort. The information that individuals like Tara Lemieux share about the threats in today's world truly concerns me - I'm not a person who believes in coincidences. The thought of what could happen motivates me every day to keep doing what I do. I've also had the privilege of listening to many great speakers discuss the importance of cybersecurity for the National Defense that also motivates me to continue what I do. However......I sympathize with a common theme of many SMBs I talk to: "What good is a strong cyber posture if it makes me less competitive, increasing my chance of losing work, ultimately putting me out of business? I care about the National Defense like the next red blooded American, but I need to stay in business too." The CMMC ecosystem must understand the business drivers and communicate both technical solutions AND business strategies that can help #DIB SMBs to the cybersecurity posture they need for their business. I'll start. Cost is always a concern with every business who is going to need a CMMC Level 2 certification. The cost to design and engineer a complaint infosec program is not allowable, but costs to maintain the environment are allowable for many contractors. I'm not an accountant, but Michael Tomaselli is and he's also a cyber professional. Connect with him for a more in-depth conversation. Add more cost effective resources to the comments!

19

9 Comments

As a CISO, I truly believe mentorship is crucial in developing skilled cybersecurity teams and fostering long-term success within companies. Throughout my career, I've seen firsthand how guidance from experienced leaders can shape and elevate careers. Mentorship is a two-way street, benefiting both mentors and mentees by encouraging continuous learning and growth. By investing in mentorship, we create stronger, more cohesive security programs and a resilient workforce. #Cybersecurity #Mentorship #CISOsConnect

40