Keyaan Williams

The Cybersecurity and Infrastructure Security Agency (CISA) has recently published guidance on implementing Encrypted DNS to enhance security for federal agencies. This proactive step aims to protect sensitive information and mitigate DNS-based threats. Stay informed by reading the full article here: https://lnkd.in/d3Ncqctk 🛡️💻 #CyberSecurity #CISA #EncryptedDNS #DataProtection

1

State, County, and Local Governments in Florida, are you aware of the mandatory cybersecurity awareness training and cybersecurity for executives and managers? The Arruda Group is here to help you check this off your to-do list with a compliance logo for your website. Contact us today at (813) 382-0859 or [email protected] to schedule your training and get your compliance logo. Let us help you focus on your job as a network fire fighter. #Florida #CybersecurityAwareness #ComplianceLogo #cybersecuritytraining

4

OMB's Cyber Budget Priorities Memo out: "Agency budget submissions should demonstrate how agencies are reducing risk by increasing maturity of information systems across the pillars outlined in the Cybersecurity and Infrastructure Security Agency’s (CISA) Zero Trust Maturity Model." https://lnkd.in/e2dvJU3k

24

4 Comments

UPDATED with link to event recording here: https://lnkd.in/gEnj2i_7 Today's U.S. National Institute for Standards and Technology’s Standards Forum was a real treat! The main theme was NIST’s commitment to advancing global standardization as a strategic priority for the U.S. - super-relevant for these times, and great to see brilliant minds sharing their experience and ideas to catalyze innovation and economic growth through standards. Key topics covered: -Advancing standardization for Critical and Emerging Technologies, which includes AI and cybersecurity (core for M&E!) -Creating and leveraging public-private partnerships -Pre-standardization strategies (there’s a lot of necessary and useful things to do before actually writing standards!) -Engaging industry stakeholders Follow the links for information on the Standards Forum and the U.S. National Standards Strategy for CET https://lnkd.in/gEnj2i_7 https://lnkd.in/gvMFajgq #NIST #ArtificalIntelligence

22

6 Comments

Please watch and enjoy this informative episode of 3 Questions With featuring Paul LaFlamme of Centrend Technology Results, Inc discussing cybersecurity, the cloud and more https://lnkd.in/eTkp6iYE #cybersecurity #cloudcomputing #dataprotection

1

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

The user fee in the proposed Health Infrastructure Security and Accountability Act (HISAA) applies to covered entities and their business associates. We review what that could mean and more in this episode. Read and listen 👉 Link in comment #HIPAA #InfoSec

1

1 Comment

You don’t want to miss this event Wednesday, April 24th! The ISACA Greater Washington, D.C. Chapter Diversity Equity and Inclusion 2024. Sponsored and hosted by AWS SECURITY ASSURANCE SERVICES LLC! Our Panel Discussion: Unconscious Bias in Artificial Intelligence (AI) Technology will be Moderator by Jermaine M. Stanley, CISA, CDPSE (GWDC President) With Panelists: Eri O. (SIID Technologies), Jeff Stovall (Abt Global ) and I! We will touch on key topics to include: 1. Proactive strategies for mitigating bias: Highlighting best practices and innovative approaches to mitigate bias in AI systems. 2. Building a more ethical AI future: Discussing the role of leadership and collaboration in promoting responsible AI development that benefits all. Register here and join the conversation: https://lnkd.in/gAWGKDrF

66

3 Comments

As I mentioned earlier this month. It is National Critical Infrastructure Security and Resilience Month. CISA has published a great collection of resources that can help start or advance your journey toward higher levels of Security and Resilience.

7

1 Comment

Please watch and enjoy this informative episode of 3 Questions With, featuring Paul LaFlamme of Centrend, Inc. discussing cybersecurity, the cloud and more https://lnkd.in/eTkp6iYE #cybersecurity #dataprotection #cloudcomputing

9

1 Comment

The recent cyberattack on Ascension, a major Catholic health system, which forced the diversion of patients and the delay of surgeries, accentuates the critical importance of having a robust incident response plan in place. In response to the attack, Ascension took several key systems offline, a move indicative of an active incident response strategy aimed at containing the breach and assessing its impact. The attack is suspected to have been executed through sophisticated malware, exploiting vulnerabilities potentially introduced by third-party vendor software or through phishing schemes targeting the healthcare system's employees. The swift shutdown of critical operational software following the breach was likely a preemptive measure to prevent further spread and damage, highlighting the necessity for immediate and decisive action in the wake of a security incident. Incident response investigations play a crucial role in not only addressing the immediate threats but also in preparing for future security challenges. These investigations help in understanding how the breach occurred, the extent of the infiltration, and the data compromised. In the case of Ascension, a comprehensive forensic analysis would be essential to determine the specifics of the malware used, the entry points exploited, and any data exfiltration that may have occurred. This situation illustrates the importance of incident response as a fundamental component of cybersecurity, especially in sectors like healthcare, where the stakes involve not just data privacy but direct patient care. Through meticulous investigation and a structured response approach, healthcare providers like Ascension can better manage cyber threats, mitigate the impacts of such incidents, and refine their security measures to prevent future attacks. #incidentresponse #databreachinvestigations #Ascension #ransomware

2

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1

Key mitigation from the recent Joint Cybersecurity Advisory "Social Engineering Tactics Targeting Healthcare & Public Health Entities and Providers": "MFA bypasses should not be allowed for any individual calling into the Help Desk." How is your organization handling these calls? Are there exceptions, and if so, are there guardrails to prevent them from being leveraged by threat agents? The advisory can be found at the following link: https://lnkd.in/e2SpXUFM #cybersecurity #criticalinfrastructure #socialengineering #mfa #riskassessment #riskanalysis #healthcare #hipaa #hitrust #IC3 #CISA

3

Excellent read for anyone navigating the complex world of Erate for K12 cybersecurity. Thanks Scott Bailey for your expert perspective on this subject! #cybersecurity #k12 #protecteducation #erate

4

Our team is seeing more and more companies leaning in to adopt continuous improvement that quantifies control and risk profile changes over time. At TrustMAPP we continually innovate solutions that address everyday challenges to meet customers where they are and where they need to go. A CIO at one of our customers mentioned: "Connecting cybersecurity deficiencies with integrated tasks allows us to track how we are doing against our goals and report that progress quarterly to our Board." Another customer (Security Program Manager) said: "We now have a full lifecycle of measurement without the hassle of conducting a new assessment or chasing down data from contributors outside the information security organization." Teams supporting their security programs want a seamless, low-effort process that aligns with NIST's guidance to achieve continuous improvement and monitoring. #informationsecurity

8

2 Comments

While I am reposting this is that many of my connections have to adhere to 23 NYCRR 500 and it will be useful to them, publishing a template like this is also horrible to get it followed. I was talking with Deborah Nitka at dinner today, and she mentioned how she would examine compliance related documents, and it is clear that they basically just did a universal Cut and Paste on company name. Sharing a template like this can result not in people actually implementing a compliant program, but in creating a document that looks like they are. That is a major difference.

40

3 Comments

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

35 Comments

Excited to be speaking at the Eleventh Annual Atlanta Cybersecurity Summit! Join me tomorrow, September 17th, 2024, at the Atlanta Cybersecurity Summit for the insightful keynote presentation: "More Regulatory Scrutiny Means IRR Must Be a Priority". The cybersecurity landscape is rapidly changing, and recent developments reflect a significant shift towards more regulatory scrutiny. With the SEC's new rules on disclosing cybersecurity risk management strategies and the material impact of incidents, it's critical for security leaders to stay ahead of the curve. We'll discuss: - The increasing global trend of accountability in Incident Readiness and Response (IRR). - Proactive measures security leaders should consider for risk mitigation. - Best practices for incident response to ensure effective threat containment, system recovery, and future preparedness. I’ll be sharing new data from a recent survey of 500 security leaders on their current priorities and future plans for IRR. Don’t miss this opportunity to learn how to bolster your organization’s cybersecurity defenses and prepare for the challenges ahead. Looking forward to seeing you there! #CyberSecurity #IRR #IncidentResponse #RiskManagement #CyberRisk #ChicagoCyberSummit #LevelBlue For more details, visit:

16

2 Comments