Mark Consigli

With Arctic Wolf MDR, Harbor Air’s environment, including endpoint, network, cloud, and identity sources are monitored 24x7 by the purpose-built technology of the Arctic Wolf Platform, along with the human experts of Arctic Wolf Security Teams, to accurately detect and swiftly respond to any unusual activity, stopping a threat before it becomes an incident. Read more about how Harbour Air, North America’s largest seaplane-only airline, is more secure with Arctic Wolf: https://ow.ly/CTrE50SOh7A #EndCyberRisk

8

Security integrators are becoming aware of new threats to their correctional facility clients: drones dropping contraband. Legacy perimeter intrusion detection systems have gaps, so integrators are rethinking security frameworks and opting to include comprehensive airspace threat detection. Anna Kim, Echodyne’s Regional Sales Manager for the US and Latam, penned a piece on the topic for Security Sales & Integration in order to help security integrators better understand which sensors help detect against drones and dark drones and how to futureproof perimeter instruction detection systems. Read the full article here >>> https://lnkd.in/g_QxqkvR #drones #dronedetection #cuas #CriticalInfrastructure #CriticalInfrastructureProtection #Security #CorrectionalFacilities #PrisonSecurity #SecurityIntegrators

35

1 Comment

Great write-up on the importance of layered security and the growing burden drone threats place on correction facilities. What measures are you seeing implemented in response to drone threats? How do you think correction facilities can further enhance their security? Share your thoughts and experiences in the comments below! Let's discuss.👇 #LayeredSecurity #DroneThreats #CorrectionFacilities #SecuritySolutions

7

The Financial Regulatory Authority (FIRNA) and SEC note that cybersecurity is a perennial priority focus area affecting financial organizations in regulatory examinations. Fortify your organization by implementing these 7 effective cybersecurity practices to reduce the frequency and magnitude of cyberattacks and weather SEC and FINRA exams and other regulatory inquiries in the coming year: https://lnkd.in/ehJqwV5z Guidehouse Financial Services | #Cybersecurity #RiskManagement #Compliance

1

👔 White Collar Forensic LLC Tuesday Tip - Avoiding Investigative Bias 💡 💡 Each Tuesday, we publish a tip based drawn on our collective investigative, forensic accounting and compliance experience. 🗓 Today's tip is about avoiding investigative bias. An investigation must be rooted in the facts and supported by evidence to be credible. There is no room for preconceptions as to guilt or innocence, whether we think the allegations are true or if the source of the allegations is trustworthy. 👩🏽‍🎓 As much as we like to think we can be objective, we all carry around biases. Biases are preconceptions about people, events and things. For example, we may be skeptical about the motivations of a witness that came forward or question the credibility of anonymous whistleblower. A certain amount of skepticism is good as long is that it doesn't influence the results of the investigation. ✂ It is important to evaluate the allegations critically and separate them from who raised them or how they were first surfaced. In this way, we can attempt to isolate the source of our skepticism such as the credibility of the person who is raising the issues, from the issues themselves. This allows the investigator to test the allegations without biasing the results and allowing preconceptions to influence the investigative plan. 🏫 Here's one way to approach an investigation that is free from bias. 📝 Write down the allegations. ℹ Formulate the investigative steps that can be taken to determine if the allegations are true. ⚙ Execute on the investigative steps and analyze the data. ⚗ Analyze and report the results. 👀 Analyzing the results is simply this. Look at the evidence gathered and determine if it supports the allegations that were raised. ❓ For example, if the allegations were that an employee is working with outside parties to steal the company's intellectual property, one investigative step may be to obtain and analyze that employee's emails. 📨 If the review of the emails reveals conversations involving the employee and non-employees in which company-sensitive data is being discussed, targeted or disclosed and those conversations don't appear to be for the benefit of the company, this is evidence that supports the allegations that this employee may in fact be involved in the theft of intellectual property. 🚨 The Bernie Madoff Ponzi Scheme had been reported 8 years earlier but the investigators who initially received the allegations allowed their preconceptions about the person raising the allegation to bias them. Because of this, they didn't act on the allegations and the fraud continued for 8 more years. 📷 Focusing on the allegations and the evidence that either supports or refutes them and separating them from the source of the allegations, is one important way to avoid allowing your preconceptions from biasing the results your investigation. https://lnkd.in/exb_Prg8 #WhiteCollarForensic #TuesdayTips

3

1 Comment

(FINRA) Cybersecurity Alert - FINRA Notifies Member Firms of MOVEit Software Vulnerability (CVE-2024-5806) Impact: All Firms Firms should review this information with any vendors who provide information technology services to the firm. On June 25, 2024, Progress Software released the MOVEit Transfer Critical Security Alert Bulletin (the Alert Bulletin) for CVE-2024-5806, a newly identified Critical Vulnerability, which was described as an Improper Authentication vulnerability in MOVEit Transfer, Secure File Transfer Protocol (SFTP) module and could lead to Authentication Bypass. In the Alert Bulletin, Progress Software recommended performing an upgrade to the latest software version. The Alert Bulletin also described a newly identified vulnerability in a third-party component used in MOVEit Transfer, which elevates the risk of the original issue mentioned above if left unpatched. While the patch distributed by Progress Software on June 11th successfully remediates the issue identified in CVE-2024-5806, this newly disclosed third-party vulnerability introduces new risk. Please work with your internal teams to take the following steps to mitigate the third-party vulnerability: 🔹 Verify you have blocked public inbound RDP access to MOVEit Transfer server(s); and 🔹 Limit outbound access to only known trusted endpoints from MOVEit Transfer server(s). When the third-party vendor releases a fix, Progress Software will make that available to MOVEit Transfer customers. #FINRA #Buckler #CybersecurityAlert #AlertBulletin #MOVEit #thirdparty #tprm #vendorrisk #vendorriskmanagement #VRM #vulnerability #patch #unpatched https://lnkd.in/eyGBX2gv

1

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/gfn9pcYM #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

7

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/gZZFskPA #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

62

Sometimes deciding on a CMMC training could be apprehensive. Many go with the flow - go to the ones who are delivering the most! That does not always work. What matters is YOU! Take a look at how we at Step Ahead do it. And we are with you until you pass your CCP/CCA in the VERY FIRST ATTEMPT! You get more for what you pay for! CMMC Professionals Network (CPN) Logical Operations Boeing locheed martin Leidos Northrop Grumman NASA - National Aeronautics and Space Administration Defense Acquisition University DIBC | Defense Industrial Base Consortium CMMC Consortium Santa Clara University Santa Clara University Leavey School of Business Santa Clara University School of Law San José State University Stanford University Stanford University Graduate School of Business

1

🎧 Missed Our Latest OIG Roundtable Episode? Here’s Why You Should Watch! Jessie Siegel, CPC, CPMA, CDEO, shared her key takeaway from this important discussion: "The comment about documenting notes really stood out—shifting the focus from personal recall to ensuring clarity for others is key. With clear, detailed SIU policies and procedures, teams can streamline investigations, making it easier for everyone, even new staff, to follow consistent guidelines." Eric, Wade and Matt explore both sides of compliance under the ACA. Providers need effective compliance programs to avoid financial penalties, and SIU teams must also operate within compliant environments. It’s all about staying on the right side of the street when it comes to healthcare compliance! 🎥 Learn how to ensure your compliance program is up to standard. Watch here: https://lnkd.in/eQS7DqAF #OIGRoundtable #SIU #HealthcareCompliance #MedicareMedicaid #AdvizeHealth #DocumentationBestPractices #OIGRoundtable #SIU #Investigation #HealthcareCompliance #AdvizeHealth #DocumentationBestPractices

3

Quick update on cybersecurity compliance: The SEC has fined R.R. Donnelley & Sons Co. over $2 million for cybersecurity-related violations. This penalty underscores the growing need for firms to maintain robust cybersecurity measures and adhere to absolutely necessary regulatory requirements. Learn more about how your organization can avoid similar pitfalls in our recent article: https://lnkd.in/e4BWNaDb #SEC #CyberViolations #RRDonnelleyAndSonsCo

13

The U.S. Treasury Department and IRS issued new regulations on broker reporting for digital assets on June 28, 2024. These rules affect transactions from January 1, 2025, using IRS Form 1099-DA, to be released soon. Learn more below. #IRS #DigitalAssets #Transactions

1

DoD took another step on the path toward implementing the Cybersecurity Maturity Model Certification (CMMC) Program when it issued a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS). The proposed DFARS Rule includes solicitation and contract clauses that will apply CMMC to individual procurements and obligate defense contractors and subcontractors to store, process and transmit Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) only on information systems that have achieved the CMMC level required by the contract. There is also a significant new provision establishing a 72-hour notice period for “any lapses in information security.” The proposed rule neglects to define what would be considered a "lapse" sufficient to trigger the notice period. This ambiguity (not to mention another reporting obligation) is likely to present compliance challenges for the DIB.

1

In this edition of Vigilant's Monthly Newsletter, we covered the following below: 💡 Vigilant Insights; 🚨 News and Alerts; 🔎 SEC Charges; and 📰 SEC Releases To learn more about the information above from June, click the image below! #ComplianceNewsletter #VigilantInsights https://lnkd.in/etgK_idr

7