Jason Rebholz

At Gartner IAM? Come meet the Permiso Security Team at Booth 235! Come see how bad actors bypass IAM controls across your IDP, SaaS, and cloud environments. Learn why standard IAM controls miss these attacks and how Permiso helps you get a grasp on and improve your identity risk posture and detect compromised credentials in minutes.

27

Day 2 Gartner IAM! IAM teams: You're masters of identity hygiene and Tier Zero asset protection. Now it's time to lead the charge on identity threat detection. Visit Permiso at Booth 235 to see how your IAM expertise can power better threat detection and incident response across cloud and SaaS. If you are on the Security side, see how we detect compromised credentials across SaaS and cloud in minutes, automate investigation, and enable you to move right to response. Breaking silos between IAM and Security = stronger identity defense. Sanjeev Williams Kyle M. Christine Stevenson

3

This breach at #GlobeLife serves as a reminder that security isn't a one-time setup — it's a continuous process. Regular audits of access permissions and user identity management are essential. Orgs have to continuously evaluate their security posture to address vulnerabilities before they are exploited.

3

As a 10+ year cybersecurity professional, I've seen SOMETHINGS!! Business owners ignoring red flags, delaying critical measures, and expecting top-tier protection on a "just fix it" budget. Those days? They’re long gone!! At OQPS we're no longer chasing after businesses to convince them to prioritize their cyber security. If you don’t see the value in protecting your operations before disaster strikes, we’re not the team for you. Here’s the reality: 🛡️ Cybersecurity isn’t a reactive service; it’s a proactive investment. 💰 Top-tier protection requires commitment, not a shoestring budget. 🚨 “Just fix it” doesn’t work when your data, reputation, and future are on the line. If you’re ready to take your security seriously, we’re here to help. But if you’re waiting for a drastic incident to wake you up, we’ll still be here, but it’ll COST you ALOT more. The choice is yours: ➡️ Proactive protection that safeguards your business OR ➡️ Playing catch-up after the damage is done We’re working with clients who value their security, their customers, and their future. If that’s you, let’s talk [email protected] If not, best of luck.

7

1 Comment

Our latest article dives into the specific penetration testing mandates under the #NYDFS Cybersecurity Regulation known as 23 NYCRR 500. We explain what’s required, recent regulatory updates, and how to effectively integrate these requirements into your cybersecurity program to maintain compliance.Get the insights you need—read the full article on our website. #CyberSecurity #Compliance #NYDFS #PenetrationTesting #FinancialServices

4

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Thanks for the shout-out from RSA Conference Team and Hugh Thompson, Ph.D.'s commentary on this year's themes. https://lnkd.in/e3e4F_u3 "In “Building Your Roadmap to Cyber Resilience – Five Things You Can Do Today,” Jennifer Minella and Alex Sharpe detailed the steps that professionals can take to prepare themselves and their organizations for the inevitability of an attack and prevent some of the associated stress that comes with unknown risks. Unaddressed, this stress, coupled with increased reporting responsibilities and liabilities is producing burnout levels that haven’t been seen since 2021. In addition to rising levels of burnout, Hugh also sees this level of risk causing “the protectors,” as he called them, to hesitate to act which is against their natural instincts and is leading to more successful attacks." #RSAC #cyberresilience #cybersecurity #defense

3

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

**Critical Security Alert** Security Leaders - please check for and remove domains connected to #polyfill if it exists on any of your organizations websites. Please see write up in link for our initial analysis on the script and potential scope of exposure. #javascript #CVE #breach #CISO #Webappsec

16

2 Comments

𝗙𝗿𝗲𝗲𝘇𝗶𝗻𝗴 𝗬𝗼𝘂𝗿 𝗖𝗿𝗲𝗱𝗶𝘁 & 𝗟𝗼𝗰𝗸𝗶𝗻𝗴 𝗬𝗼𝘂𝗿 𝗦𝗼𝗰𝗶𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗡𝘂𝗺𝗯𝗲𝗿 (𝗦𝗦𝗡): 𝗔 𝗦𝘁𝗲𝗽-𝗯𝘆-𝗦𝘁𝗲𝗽 𝗚𝘂𝗶𝗱𝗲 𝘁𝗼 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗻𝗴 𝗬𝗼𝘂𝗿 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 Freezing your credit and locking your SSN doesn’t have to be complicated. We’ve broken down the steps to ensure you're protected from identity theft and fraud across all major credit bureaus—Experian, Equifax, and TransUnion—and as a bonus, how to lock your SSN with the US government. 𝗗𝗶𝗿𝗲𝗰𝘁 𝘄𝗲𝗯 𝗹𝗶𝗻𝗸𝘀 are in the 𝗖𝗼𝗺𝗺𝗲𝗻𝘁𝘀. Note these steps are 𝗳𝗿𝗲𝗲 𝗼𝗳 𝗰𝗵𝗮𝗿𝗴𝗲 and would take 15-30 minutes to complete them all. 1. 𝗘𝘅𝗽𝗲𝗿𝗶𝗮𝗻: • Create or log in to your Experian account. • Select "Add a Security Freeze." • Provide your personal information • Verify your identity (this may involve answering security questions or providing documents). • Once verified, your credit file can be frozen, preventing new credit inquiries. • You can lift the freeze temporarily or permanently using your PIN or password when needed. 2. 𝗘𝗾𝘂𝗶𝗳𝗮𝘅: • Create or sign in to your Equifax account. • Select "Place or Manage a Freeze." • Enter your personal information for identity verification. • Confirm your request, and your credit file will be frozen across Equifax. • To unfreeze, log back in and lift the freeze as desired. 3. 𝗧𝗿𝗮𝗻𝘀𝗨𝗻𝗶𝗼𝗻: • Create or log in to your TransUnion account. • Select "Freeze My Credit" from the dashboard. • Verify your identity by providing necessary personal information and security verification. • Confirm your freeze, and your TransUnion credit report will be inaccessible to creditors until you lift the freeze. • Go to the dashboard to unfreeze your credit as needed. 4. Bonus Step: 𝗟𝗼𝗰𝗸 𝗬𝗼𝘂𝗿 𝗦𝗼𝗰𝗶𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗡𝘂𝗺𝗯𝗲𝗿 (SSN) with E-Verify The E-Verify service provided by the US government allows you to lock your SSN, adding more protection. • Create or log in to your E-Verify account. • Select the "Self Lock" option under your account settings. • Provide the necessary verification details, including your SSN. • Lock your SSN to prevent it from being used for unauthorized employment verification or fraudulent activity. 𝗪𝗵𝘆 𝗙𝗿𝗲𝗲𝘇𝗲 𝗬𝗼𝘂𝗿 𝗖𝗿𝗲𝗱𝗶𝘁? Freezing your credit files at all three major bureaus blocks unauthorized access to your credit reports, preventing fraudsters from opening new accounts in your name. This simple action helps protect against identity theft. 𝗪𝗵𝘆 𝗟𝗼𝗰𝗸 𝗬𝗼𝘂𝗿 𝗦𝗦𝗡? Locking your Social Security Number through Self-Lock prevents misuse in employment verification systems and other forms of identity fraud. Taking these steps now can save you countless hours, money, and stress down the road. Protect your identity today. #CyberSecurity #IdentityTheftProtection #CreditFreeze #SSNProtection #DataBreach #FinancialSecurity#FraudPrevention #CyberRisk Mike Rhea Intelligent Technical Solutions

22

13 Comments

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1

If ICS security and OT Security is on your agenda for this year, check this out. #otsecurity #icssecurity

3

Check out the latest blog by Patrick Garrity 👾🛹💙 covering our release of the VulnCheck CLI tool. Whether you are a researcher, analyst or vulnerability manager, the VulnCheck CLI provides an efficient way to query through vast amounts of vulnerability data. You can work online with live API calls or offline by downloading full backups on demand and querying locally. Supported on Windows, Linux and MacOS. https://lnkd.in/gfWi3BB6

17

Episode 3050 - Jason (Jay) Mar-Tang, CISSP, CCSP of Pentera discusses how ransomware continues to plague organizations. Pentera's RansomwareReady provides a unique offering, enabling organizations to proactively test their defenses against the threat of ransomware on-demand. Pentera just announced a major update to expand the capabilities of the product. RansomwareReady can now test against the Lockbit 3.0 campaign as well as test against the impact of ransomware campaigns like Lockbit 3.0 within vulnerable Linux environments https://lnkd.in/gBXBHmH9 #bhusa #bhusa2024 #blackhat #blackhatusa #blackhatusa2024 #pentera #cybersecurity #pentesting

15

1 Comment

Looking for a bright side? With more companies embracing better cybersecurity tactics, cyber insurance rates are on the decline. How have you adjusted to the changing cyber landscape?

1

API keys are essential to connect applications, services, or data lakes together. Yet, they can also be a security risk. Imagine Alice sets up an API key to give her team or a vendor access to sensitive data—many times these keys are long-lived and often shared across different workloads. If the group uses federation, actions taken by Alice or others occur using a shared credential/role in the environment. This means logs would only show the credential conducting that activity, which again, gets shared with others who have access to the role. Alice's coworker, Bob, has their legitimate cloud credentials compromised. The threat actor uses Bob's credentials to federate into a shared credential/role in the environment. The threat actor exploits native features/functions of the cloud to appear as Bob, thereby blending their activity in to avoid detection. Most security teams today won't spot Bob's impersonator fast enough or at all. Trying to make sense of cloud logs is a real challenge, especially when it's happening in real-time. It can take hours or even days to piece together what happened. And by then, detection and response are delayed and the damage might already be done. What can you do? Security teams can start by keeping a detailed record of all identities, keys, tokens, certificates, and credentials they've provisioned and used, services accounts they have access to, what roles they assume. Then, security teams can set up what's considered "normal" access and behavior. Once the team understands “normal” behavior, they can develop rules and alerts from logs to try to detect and respond to access and behavioral anomalies. At Permiso, we have developed an identity-centric approach to cloud threat detection and response. Our solution can help security teams detect and respond to access and behavioral anomalies in the environments faster and with greater confidence from having the full session access and activity. Want to learn more? DM me or visit https://lnkd.in/gC4DUJ9j to learn about our approach to solving the challenge of detecting and responding to threats in and across IaaS, SaaS, CI-CD, IDP environments.

11