Mandy Andress

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1

There are several items that are missed on any data security audit. One is the Cybersecurity Risk Management Plan and Assessment. Typically found in only 1% of audits. An Incident Response Plan. Found less than 1% of the time. But almost never found are Data Flow Diagrams. With over 50% of the organization's data on the cloud, without the data flows completed, no one, yes no one in the organization knows where all the PII, PHI, PFI, PCI and other critical data is located. It takes about a month to complete all the data flows for an organization since all the department heads need to share their knowledge. When complete, these secure documents will allow the organization's leaders to strategize how they will protect their data. Without the data flows, many segments of the organization's data are not properly managed or protected. The organization will not have a backup plan if access to these systems is lost. So ID.AM.03 of the NIST Core V2 is a critical data security control. Please download the CSF and do the work that needs to be done to protect your organization.

10

It’s time to define a new cyber risk equation. One that rethinks what’s possible and defies old obstacles. Here’s a look at how we’re reframing our best-in-class portfolio. See more on our product page.

3

Welcome to part TWO of our three-part NIST InfoSeries with Christopher Hills. In this short video, Chris highlights the six core tenets of NIST CSF 2.0, and why each of them is a crucial part of the cybersecurity framework. ✔️ Govern: the newly added function, Govern, allows you to align your cybersecurity efforts with your overall goals and risk management approach – providing a holistic cybersecurity strategy for your organization. ✔️ Identify: Identify enhances your organization's cybersecurity posture by thoroughly assessing your assets, systems, data, and supply chain dependencies. ✔️ Protect: Protect implements robust safeguards for access control, data security, and technology infrastructure hardening, enabling you to gain unparalleled protection for your critical assets. ✔️ Detect: Enable timely discovery of cybersecurity incidents by implementing processes to identify and analyze potential attacks or compromises. ✔️ Respond: When an incident is detected, Respond guides your team with the appropriate actions to contain the impact. This includes incident response planning, mitigation, reporting, and effective communication. ✔️ Recover: After an incident, the Recover function helps restore normal operations and services for your organization. Swiftly bring affected assets and systems back online while communicating during the recovery process. Follow along for part three of the series when we'll be sharing three easy ways you can get started on meeting the NIST CSF 2.0 requirements. Until then, you can learn more in this recent blog post. https://lnkd.in/e4s87VUG #NIST #NIST2 #NISTFramework #Cybersecurity #Compliance #BeyondTrustInfoSeries #Governance

6

Power up ⚡ your vulnerability remediation cycle with the platform designed to zap 21st century headaches. We're talkin' saving time spent patching, automating your work, and getting back on CISA's good side. Here's how Vicarius helps: 🔹 See everything in one place: Forget siloed data and endless spreadsheets. Vicarius provides a single source of truth for all your vulnerability data. 🔹 Prioritise like a pro: Vicarius goes beyond just severity scoring. It uses real-time context to prioritise vulnerabilities that matter most to your organisation. 🔹 Patch smarter, not harder: Integrate patching for Windows, Linux, Mac, and third-party applications – all from the same platform. 🔹 Automate the mundane: Free yourself from repetitive tasks. Vicarius automates patching, threat mitigation, and even vulnerability scans. Try vRx today, risk-free, pain-free. (Seriously, why wait? ) #vulnerabilitymanagement #cybersecurity #CISA #automatedsecurity #patching

2

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

My favorite new Action1 feature, CISA KEV integration, is a great way to prioritize #patching of vulnerabilities of utmost importance. This new blog post explains it in-depth.

17

3 Comments

Reading about the updated National Cybersecurity Strategy and its five pillars from Colleen Frye It’s crucial for us MSPs to understand these changes as they'll significantly influence our operations and cybersecurity measures. Check out the full breakdown to ensure your services align with these new federal standards. 💬 Let's chat about how we can leverage this strategy to enhance our cybersecurity approaches and lead the way in compliance. #MSP #CybersecurityStrategy #LeadershipInCybersecurity

2

In my July 1, 2024 blog post, Accountability for Cyber Risk Management: A Critical Imperative for C-Suite Executives and Board Members (https://lnkd.in/gG5Yt2i6), I wrote about the lack of accountability for strong cyber risk management across all industries. This "hall pass" may be going away in healthcare with the introduction of a new bill, the Health Infrastructure Security and Accountability Act by Senators Wyden and Warner. See: https://lnkd.in/eknVc9zs FINALLY! YAY! Hopefully, this bill will pass and provide overdue air cover and support to all the CISOs, CPOs, CROs, CCOs, et al out there! The bill includes a section similar to the SOX requirement on CEOs and CFOs: "(v) provide a written statement signed by the chief executive officer and chief information security officer (or equivalent thereof) stating that the covered entity or business associate is in compliance with security requirements adopted under part 160 of title 45, Code of Federal Regulations, and subparts A and C of part 164 of title 45, Code of Federal Regulations (or a successor regulation), including the applicable security requirements adopted under paragraph (1)(B)." It will take some time, but it's a great start! #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

16

1 Comment

⚠️ Don't fall victim to action bias in #cybersecurity! Learn how attackers exploit urgency and fear to manipulate victims into making hasty decisions. Josiah Dykstra shares how to recognize and mitigate this bias in the latest Resilience Rundown podcast: https://ow.ly/qWY730sClct

3

While some posture and exposure management tools may not offer a complete picture of the potential impact of various exposures, the issue isn't tool fatigue. It's an incomplete understanding. Just like in medicine, where we constantly strive to understand human physiology better, we need to continue developing and refining our methods for assessing our digital environment. We can't fix problems we're not aware of. Let's take charge and actively discard ineffective assessment methods. Doing so can pave the way for better tools that provide a more accurate understanding of our digital blast radius associated with those complex and dynamic exposures in our environments today.

7

1 Comment

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

43

1 Comment

I'm starting a series of articles about Open Bullet 2: fraudsters' favorite tool to conduct credential stuffing attacks. https://lnkd.in/guY_t-B2 In this first article, I give an overview of Open Bullet 2, and its main features, in particular the integration with CAPTCHA farms and the possibility of importing credential stuffing Loli script. The next articles will probably be a bit more technical, e.g. to investigate the fingerprints of Open Bullet with Selenium/Puppeteer, and if attackers can easily modify them from Open Bullet to bypass detection.

29

4 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

58

70% of organizations surveyed in the 2024 Arctic Wolf Trends Report reported that they were the targets of an attempted business email compromise (BEC) attack within the last 12 months. Read more from my blog below on the trend and some key things organizations can do to mitigate that risk.

23

If you need a deep dive on Active Directory - how it works, and how to defend it - then look no further than this guide from CISA and their Aussie friends. #ad #activedirectory

2