Kevin Jordan

I often get asked “where do I start with TX-RAMP?” Companies know they need it - they’re told they do. But it’s not easy to know where to start. Here’s what you need to know 👇 1️⃣ File for your provisional certification. This will give you 18 months to get the full certification. 2️⃣ Download the TX-RAMP Security Plan Workbook. This serves as your questionnaire and list of necessary controls (117 for Level 1 certification, 223 for Level 2). 3️⃣ Build your program, one control at a time. Once your program is built, you can submit your workbook and other documents to the Texas DIR for their evaluation. No expensive, third party audits necessary! TX-RAMP Certification is a big project, even for companies that have an existing cybersecurity compliance program. There’s a reason they give you 18 months to go from provisional to full certification! Your certification lasts three years, but there are some ongoing reporting requirements to meet. You need to monitor, fix, and report vulnerabilities and breaches to the Texas DIR. More helpful info can be found in the guide below. https://lnkd.in/etitFTkY 

10

✅ (3/38) CPG 1.C OT Cybersecurity Leadership. In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at OT Cybersecurity Leadership. The intent of this CPG is to establish overall documented accountability and responsibility for your cybersecurity program for Operational Technology. We need a person's name or a position title that is unambiguous. This is very similar to the CPG we covered yesterday, 1.B for Organizational Cybersecurity Leadership, but this is about OT. The CPGs captured this as a separate goal to make sure we have alignment here. It could be the same person, but ideally this would be somebody with authority over OT and understanding of the risks to the OT environment. It's noteworthy that this leader is likely much closer to operations than an organization level leader who may be more focused on overarching corporate strategy. In most cases this will go beyond cybersecurity to include Safety, Operational Resilience and other Operations focused risks. This person needs to be a senior leader in the organization with the authority and political clout to get things done, and engages in: ➡️ Planning ➡️ Resourcing ➡️ Executing This leader is accountable and responsible, but that does not mean they have to do it all themselves. These activities can be delegated, as long as the named leader ensures cybersecurity is managed effectively. I have seen a few programs that named a figurehead to this function, but did not give them the authority they needed to execute. Or did not support the resource requests needed. Resources comes in the way of staff, budget and also organizational support. The most common mistake I see is tasking somebody that does not understand OT with this responsibility. If you have decided that your CISO or similar will be responsible, it's important that we make sure to educate them and other senior leaders to align with OT risks. In our Notion CPG template at https://lnkd.in/eP-pfWfk we provide a high level overview of this goal, and suggest a potential tool, wikijs, to capture this and other details in your program. You could just as easily use SharePoint, a Word doc or commercial tools. The tool does not matter as much as clearly defining accountability and communicating this to the organization. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #cybersecurityleadership

11

1 Comment

Episode 3050 - Jason (Jay) Mar-Tang, CISSP, CCSP of Pentera discusses how ransomware continues to plague organizations. Pentera's RansomwareReady provides a unique offering, enabling organizations to proactively test their defenses against the threat of ransomware on-demand. Pentera just announced a major update to expand the capabilities of the product. RansomwareReady can now test against the Lockbit 3.0 campaign as well as test against the impact of ransomware campaigns like Lockbit 3.0 within vulnerable Linux environments https://lnkd.in/gBXBHmH9 #bhusa #bhusa2024 #blackhat #blackhatusa #blackhatusa2024 #pentera #cybersecurity #pentesting

15

1 Comment

What are your biggest challenges in vulnerability management? How do you prioritize and address them? Stay ahead of cyber threats with Skybox Vulnerability Managementl! Our solution helps you discover, prioritize, and remediate vulnerabilities across your entire attack surface. By integrating with existing security tools, Skybox provides comprehensive visibility and actionable intelligence for proactive risk management. Discover more: https://lnkd.in/gXtF2dFk #Vulnerabilitymangement #Riskreduction #informationsecurity #Ciso

1

Cybersecurity Awareness Month ends on October 31, but our free Awareness Month Kit will still be available. Download your copy today to equip your employees with the knowledge and tools they need to #StaySafeOnline. #SecurityAwareness

1

My favorite new Action1 feature, CISA KEV integration, is a great way to prioritize #patching of vulnerabilities of utmost importance. This new blog post explains it in-depth.

17

3 Comments

The role of the CISO is a big focus area at this year's MWise (Mandiant/Google) conference. What qualities are necessary for this job? A panel of CISOs emphasized empathy, leadership, and open mindedness. The CISO role is about organization/team, not individual, success. #cybersecurity #infosec #MWise #Mandiant #Google #CISO

15

TOMORROW, representatives from the Cybersecurity and Infrastructure Security Agency and Cyentia Institute will take you on a tour through a decade of data analyzing #ransomware trends. This is not your typical "ransomware is really bad cuz [insert anecdote]" event. We'll measure how bad it actually is now vs then with rigorously modeled frequency and loss estimates your organization can use to better manage this risk. Drop any questions/comments about this research here, and we'll do our best to get to them! Register here: https://lnkd.in/eiucDxcD #cyberrisk #cyberattacks #cyberresilience #cybersecurity #infosec

17

3 Comments

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

With #ransomware attacks costing the average SMB over $3M, what steps has your organization taken to mitigate this insidious threat?

1

Dallas Security Community! #CISOs and #CybersecurityExecutives during an intimate dinner and roundtable discussion on Mitigating and Responding to Incidents. Every cybersecurity leader must adapt their approach to what makes their organization competitive in the marketplace—especially as it relates to building the relationships and processes that streamline responding to a major incident. In this collaborative discussion, local security leaders share insights on preventing and responding to incidents. Discuss building relationships and processes to ease decision making, improving key technologies to mitigate risk, and identifying key attack vectors #dallas #cisos #dinner

10