Mike B.

VM remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from VM to exposure management and effectively prioritize high-risk exposures across their complex attack surface. http://ow.ly/oGFk105PbnX

3

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

Vinson Protect adds NIST Cybersecurity Framework v2.0! You all asked for it - now it's live! You can now add the National Institute of Standards and Technology (NIST) Cybersecurity Framework v2.0 to your Vinson Protect organization! Building upon the K12 SIX Essential Cybersecurity Protections, Center for Internet Security Critical Security Controls, and ClassLink's Cybersecurity Rubric, the CSF adds another lens through which to evaluate your schools' cybersecurity preparations. https://lnkd.in/gJryspY6 Are you curious about Vinson Protect? Why not join the 100+ schools that are using the application? The application allows schools to create audits, security reports, and security plans, track incidents, and manage/delegate tasks to team members. And it's completely free for schools to use! Check it out and sign up for your account --> https://vinsonprotect.com #vinsonprotect #nistcsfv2 #edtech #cybersecurity

7

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5

Highly likely that these will be included in the CMEP IP (AML) going forward...

2

Cyber risk: Get on top of your controls and frameworks. Thursday, Oct. 24, 11am - 12pm ET (10am CT / 9am MT / 8am PT) In an era of escalating cyber threats, organizations face mounting pressure to ensure their cybersecurity controls are not just compliant but are effective in protecting critical technology and assets. With the threat landscape constantly evolving, it's crucial for cyber and IT risk professionals to be confident that their controls are robust, aligned with industry frameworks, and capable of adapting to new risks. But how do you ensure you're not missing something vital? How do you prove to your board, certification bodies and regulators that you're actively protecting the organization? This webinar will tackle the pressing questions about cyber and IT controls and provide strategies to help you stay ahead of cyber threats while gaining assurance that your controls are performing as expected. Join Protecht’s Michael Howell, Senior Manager, Research & Content, and Mike Franklin, Cyber Security Lead, as they explore practical solutions to common cyber and IT risk management challenges. https://lnkd.in/eZV32cVP

6

NIST Report on the 2024 Accordion Cipher Mode Workshop

3

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

It's not too late to register for Enhanced Vendor Risk Assessments: Maximizing Risk Reduction and Strengthening Vendor Relations on Tuesday July 30 at 1 PM ET Vendor risk assessments have been a cornerstone of security for years, but how effective are they? Join us for an in-depth presentation where we dive into the intricacies of vendor risk assessments and explore strategies to enhance your process. Key Topics Covered: ➡ Effectiveness of Traditional Assessments: Evaluating the real value of current practices. ➡ Assessment Types: How to decide when to send questionnaires, accept security attestations and other assessment methods. ➡ Process Enhancements: Innovative methods to improve your assessment framework. ➡ Role of AI: Leveraging artificial intelligence to scale and optimize vendor risk programs. 💡 Attendees will receive a comprehensive security assessment matrix, designed to help you map out and right-size your vendor assessment programs according to the specific risks and resources of your organization. Join us to ensure your vendor risk assessments are not only thorough but also efficient and effective, paving the way for stronger vendor relationships and enhanced security. #cybersecurity #supplychainsecurity #vendorrisk

6

1 Comment

CRG helps clients dominate the IAM landscape with unparalleled expertise in winning and managing large-scale cybersecurity programs. Contact [email protected] or visit crgroupinc.com to position your firm at the forefront of IAM innovation. #CRG #Cybersecurity #IAM #ZeroTrust #FederalContracts #AI #ML #Cyber #CloudSecurity #NetworkSecurity #PatchManagement #ITArchitecture #TechStacks #Software #Hardware #Modernization

3

On the 11th day of Cybersecurity Awareness Month, I bring you one of my favorites: Matt Mitchell and I talked about privacy, surveillance and security. Listen and share with your friends!

3

The Security Exchange Commission's latest disclosure rules have significantly increased the pressure on CISOs and security leaders to strengthen their cybersecurity posture. Failure to comply could lead to severe consequences. Questions? We can help you navigate these new regulations with confidence. Contact us today to discuss a strategy for SEC-compliant cybersecurity ✔

1

This recent ransomware attack on an Arkansas water treatment facility highlights a growing concern for critical infrastructure security. I shared some thoughts on what this breach means for the future of cybersecurity in the water sector and how we can better defend these essential services. Check out my full commentary and the detailed coverage below! 👇 #CyberSecurity #CriticalInfrastructure #Ransomware #WaterSecurity

31

1 Comment

Risk is handled through Avoidance, Acceptance, Mitigation, and Transfer. A CISO cannot avoid business risk, and must deal with it. Mitigation is what you do in your #cybersecurity program, which leaves Transfer and Acceptance. Without adequate #CyberRiskQuantification, you have no idea what you're doing. It is critical to get this right, or you could be in very serious trouble.

15

Read this important advisory from CISA regarding Operational Technology and Industrial Control Systems vulnerabilities. #ICSsecurity #OTsecurity

13

1 Comment