Phil Pham

It's that time again, the Las Vegas Cyber Breakfast Club meeting is coming up on Wed 11/27 and we are looking to add to our membership. We invite all Senior IT or Cyber leaders who are interested in keeping their skills up to date and want to attend in the Pacific time zone. You can join here: https://lnkd.in/giwHFxyt Top reasons to join: 1.) You are so busy that you don't have time to network 2.) You are looking for a job, but having a tough time 3.) You spend all your time on LinkedIn dodging salespeople (we don't allow them here) 4.) You want to rub elbows with top Cyber professionals, coast to coast. 5.) You already spent big money on groups that aren't giving you ROI. 6.) You have knowledge to share or you wish you hone your board or speaking skills in a safe environment. If any of these reasons resonate, come join us as we build up this newest chapter! Registration for our group is free and takes two minutes to receive our monthly invites. Our speaker this month is Ross Young, former CIA and CISO of Caterpillar Financial on preparing for an AI Incident. This is sure to be a favorite session, so mark your calendar now for 11/27 from 7:45am - 9am. See you soon!

22

1 Comment

Using Hypori Halo for Government with the FedRAMP High designation allows any federal agency or department to reduce capital expenses by replacing a government device. Federal employees can now gain secure access to connect and collaborate on the go. Learn more about our FedRAMP "In Process" designation - https://lnkd.in/g5t2FpGb #FedRAMP #HyporiHalo #BYODfortheDOD

3

During the blur that is/was RSA this blurb on this innovative company 1up popped up on my timeline. It's kind of a departure from my usual cyber /CTI posts, but I love what they are doing. If you are at a large organization in a regulated vertical and seems like you spend half your time dealing with security questionnaires or in procurement dealing with similar time sucks with RFP questionnaires, then read on. There is a lot here that resonates. Check out their Memes library as a fun distraction - https://lnkd.in/gj_2wJS2 They have 4 products - RFP automation: https://lnkd.in/gff4kxWy - Security Questionnaire Automation: https://lnkd.in/gAH2NN4m - Knowledge Automation; https://lnkd.in/gb26JnXt - Sales Enablement Tool:https://lnkd.in/gb26JnXt here is a recent article on their RFP product https://lnkd.in/g_5qzZB3

13

Thinking about the Crowdstrike issue this past week… There are a lot of lessons that I hope that are learned from today’s Microsoft server outages attributed to a Crowdstrike update. These are particularly important to the military and critical infrastructure and services. 1) being the first to install an update isn’t wise. Let others go first. This week would have been less impactful if some non-critical businesses went first. Let something less critical be the canary in the coal mine. Waiting to update critical infrastructure is somewhat counterintuitive. You want to critical infrastructure to be well protected, but this must be balanced with availability. 2) Product diversity is important. ItMs not wise to put all your eggs in one basket. Imagine if every server went down. As a country we would be vulnerable if all military servers went offline. 3) Critical military infrastructure should not reveal what commercial products it is based on. Observations 1 & 2 are critical here too. You don’t want everything based on the same products and you don’t want to risk availability for the sake of being first in line for an update. Finally, products need to be thoroughly tested. This is the lesson for Crowdstrike. Mistakes will happen. We must always work to minimize the consequences when they do.

15

4 Comments

🚀 This week’s focus: Wrapping up the CIS-ITSM requirements! I’m really diving deep into ServiceNow and learning so much about how it supports IT Service Management. One thing that’s been on my mind: in the military, there’s often a doctrine—the “official” way to get things done—and then there’s the real way we adapt to challenges in the field. Is it the same in tech, especially with platforms like ServiceNow? Do we find ourselves balancing between following best practices and making practical workarounds to fit real-world needs? 🤔 Would love to hear your thoughts on this dynamic! How do you bridge the gap between theory and practice in your field? #TechThoughts #ServiceNow #CISITSM #LearningJourney #TheoryVsPractice

14

12 Comments

I'm torn here... not sure govt can do a lot here, but applaud the effort. I like removing degree requirements for some positions for reasons already discussed at length, but not for all as it's still the most effective large scale soft-skill filter. Obviously this filter is less than ideal, but tell me a better one. I think training programs are a step in the right direction, but part of me thinks there is less available capability among the target set humans for these programs than we think. I think there needs to be a better filter here too for those to push through these programs. When I was in govt part of me naively thought this was something the market was well positioned to address with higher salaries, etc. Obviously not a silver bullet either. In many ways the gap is no difference than the one for other skilled trades. It seems the most effective solution there is apprenticeship programs, so maybe that's best here too. Thankfully that's number 2 on the list, but curious how to encourage that at scale across businesses with little incentives for them w/o grants/etc. Just my 2 cents to chew on. https://lnkd.in/ezjSR3cu

18

5 Comments

Throughout my career in cyber security I often see or get asked "How do I get into cyber security?" "What certifications should I get to get an entry level cyber role?" "How were you able to get xyz certification?" My answer is simple! I recommend to use Udemy for great courses that can train on various skills that a cyber professional would need. Oh and guess what? It's FREE for Military, so there are no excuses about cost! "But who should I watch?" I will stand on my hill that Jason Dion is one of the BEST instructors on their platform! I have used his material for every one of my CompTIA certifications. Being able to download and print out his notes, follow along with the videos, and being able to take his free practice test at the end of the course, or get his practice test bundle has truly helped so much! "But what if I don't want to create a free account to their platform?" YouTube has some great content creators that provide free learning access. One of the most common names on their platform is Professor Messer. I personally used his content to help with any topics that I may want to touch up on before test day, or I may even go through his course for a fresh set of eyes on the material. "This is great and all, but what certification should I go for next?' My answer is always, "What do you want to do? What do you want to protect/attack?, Do you have a niche area you would like to stay in?" I then follow up with Paul Jerimy's Security Certification Roadmap. This list is a great way for newbies to learn where they are at on the totem pole and also what should be their next target. Its easy to take that first step, so what's the excuse stopping you from exploring new opportunities? LINKS TO RESOURCES: Jason Dion Udemy page: https://lnkd.in/g7ktxtqT Professor Messer website: https://lnkd.in/gdFJAFJc Professor Messer YouTube: https://lnkd.in/g-mdsXyH Paul Jerimy Security Certification Roadmap: https://lnkd.in/gutJEq_r

4

1 Comment

Southern California study finds high levels of airborne plasticizers

1

The SoCal CISO Summit is only 3 weeks away! Don't miss this all-star lineup with Emily O'Carroll, Jonathan Chow, and Arthur Lessard, discussing "The Imperatives of PAM" on May 21st. Organizations have suffered relentlessly from cyberattacks, each week it seems there are new headlines highlighting ransomware attacks or data breaches. With the sensitivity of privileged accounts, unpatched vulnerabilities, and an extensive remote workforce, privileged access management (PAM) is essential to securing your most critical systems and data. Join this panel session to discuss: -Why PAM plays a crucial role in mitigating cyberattacks -Gaining executive buy-in on effective solutions -Having a proactive approach to implementation and configuration Qualified InfoSec leaders, register below! #evantaciso #socalciso #informationsecurity

57

4 Comments

This is cool, and hopefully helpful to others. The #SanDiego #Regional #CyberLab has announced it's initiative #MyeCISO is now live. I had a chance to play with this when it was in beta - and now it's out. 𝗢𝗙𝗙𝗜𝗖𝗜𝗔𝗟 𝗥𝗘𝗟𝗘𝗔𝗦𝗘 We are pleased to announce that My #eCISO is now live! My eCISO, a conversational #AIchat #bot utilizing #Anthropic’s #Claude #3 Haiku #LargeLanguageModel (#LLM), has been developed to provide custom #cybersecurity #evaluations through a natural language conversation utilizing the #NIST framework. After speaking with My eCISO, users receive a PDF “cyber report card” which summarizes where you are performing well and where you should focus on improving. If you believe you could use assistance in identifying blind spots in your cyber security practices, My eCISO is here to support you. https://lnkd.in/getxnvvB

7

This is a lot of potentially compromised keys. If this affects you, updating PuTTY will not be enough as you must assume any of your nistp521 keys used with vulnerable versions are already in the hands of malicious actors.

1

Two words people and my IT friends, Change Control!!!! Good cyber processes can prevent bad patching. It is sad that the people that are suppose to protect us from cyber attacks caused the issue!!!! Anyone else have thoughts on this subject?

1

Wednesday morning thoughts from an employee of a DIB manufacturing company. I frequently see posts and comments questioning the actions of DIB companies. Let me set the stage for things from my perspective. We are sent questionnaires asking if all 110 NIST 800-171 controls are implemented. NIST 800-171A is never mentioned, nor 320 objectives. Manufacturers are not cybersecurity experts; they are not GRC experts; this information isn't relayed to them, nor do they have the time to research it. The simple answer is to utilize a third party for compliance. Okay, great, now the problem becomes who. Only some RPOs, CCPs, or CCAs are honestly qualified or the right fit, but they are all listed on the cyber AB. I can do a quick Google search, and the top results are from companies that should not offer services. How many of your webinars or conferences are attended by OSCs? It is mainly other organizations offering compliance services. The DoD and primes aren't giving us this information. It took me two years into the 800-171/CMMC journey to meet another person who had even heard of it. How can you find this information if you don't know who to follow? I have had negative experiences with vendors that promised one thing but sold another. I've found that even some of the more prominent names in the game are snake oil salespeople. We might not know what to ask, or we may ask the right questions and receive the correct answers but are provided with different results. We are tired of wasting money that we didn't have to waste on people who said, "We can help you reach compliance." I will gladly share my experiences from the other side because they don't look how you would expect. Signed a very tired employee trying to do what is right.

75

67 Comments

It's a long read, but worth the investment. Following STIGs and checklists can only get you so far. The threats of exposed secrets is far more serious. As someone who has worked on in the entire stack, I can't tell you how many times bots have hit my endpoints simply looking for an .env file. There are better options. It’s time to deprecate the .env file for a better stack https://lnkd.in/eEBkeTUu

3

Cyber unicorn Aqua Security axes 10% of workforce Aqua, which raised $60 million at a $1 billion valuation earlier this year, is laying off around 50 employees. In December 2022, the company laid off about 65 employees, including 20 in Israel. In January, the company raised $60 million at a valuation of $1 billion. So far, the company has raised $235 million. https://lnkd.in/eR-7r4qM For more information on open positions, we are working on globally with our Portfolio Clients then contact Andrew Robinson FREC, louise robinson or Rebecca Beauchamp call us on +44 (0)1923 312435. Why not follow Paradigm Recruitment. #paradigmrecruitment #hiring #careers #startup #recruitment #IPO #cybersecurity #cybercareers #cyberjobs #startupjobs #cloud #cloudsecurity #security #cloudsecurity #AI #Boiometrics #Analytics #MachineLearning #ThreatIntelligence #DarkWeb #IAM #PAM #CIAM #SIEM

4

🚨 Security Lessons from the Disney Insider Threat Incident 🚨 A former Disney employee was recently charged with unauthorized access and sabotage, highlighting serious risks tied to insider threats. This case emphasizes the importance of robust post-termination protocols and vigilant monitoring. 🔑 Key Takeaways: 1. Access Control: Immediately revoke system access for terminated employees. Rapid deactivation is essential to protect against malicious actions. 2. Monitoring & Audit Trails: Track system access and unusual activity post-termination. Early detection of insider threats can prevent or mitigate damage. 3. Multi-layered Defense: Implement multiple layers of defense (e.g., VPN usage alerts, IP tracking) to identify any unauthorized attempts to circumvent security measures. The Disney case underscores how critical it is to strengthen insider threat defenses and incident response. #InsiderThreat #Cybersecurity #AccessControl #IncidentResponse #RiskManagement https://lnkd.in/eYHi5hJU

2