Preston Jennings

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

What happens when you get the best #financialcrime experts in a room with the best #developers? An award winning #AI powered platform, built by compliance professionals in a way that makes it so easy for everyone to do #duediligence on your clients, suppliers, 3rd parties, investors and investments. Our clients often say it is the little things that make all the difference. "At Themis we can really tell you have done the job before as you understand the little niggles that can cause us so much pain in our day to day working lives in a way most tech companies just dont." #Deliberately #Disruptively #Different

14

We really need to stop using FTP servers, especially for sensitive data 🛡️ Sensitive data on nearly 1 million Medicare beneficiaries in Wisconsin was compromised in 2023 due to a ransomware attack exploiting Progress Software’s MOVEit file-transfer service flaw. On September 6, The Centers for Medicare & Medicaid Services (CMS) announced that its contractor, Wisconsin Physicians Service Insurance Corp., was impacted by the MOVEit flaw. The compromised data includes names, Social Security numbers, dates of birth, addresses, hospital account numbers, Medicare beneficiary identifiers, and health insurance claim numbers. CMS began notifying nearly 950,000 affected individuals last week, following Wisconsin Physicians Service’s notification of the breach on July 8. The data breach is part of a larger wave of attacks in May 2023 targeting the MOVEit vulnerability. Organizations like the Texas Dow Employees Credit Union have also recently disclosed breaches related to the MOVEit vulnerability. https://lnkd.in/gP8t4E3C

3

How to Protect Your Online Privacy: Non-Technical Guide Learn how to safeguard your digital identity and prevent stalking. Join me as I share practical tips to clean your devices, back up data, and create a new profile to disconnect from your past. Protect yourself online, even if you're not tech-savvy. #OnlinePrivacy #DigitalIdentity #StalkingPrevention #DeviceSecurity #DataBackup #NewProfile #CyberSafety #InternetPrivacy #DataProtection #OnlineSecurity

3

As CruiseCon is not a typical #cybersecurity event, Casey Yarbrough and I recorded the below video to answer the most common questions and just describe the event. The subjects we cover include: * Why I came up with CruiseCon * How are we bringing the type of event that is typically reserved to Fortune 200 CISOs to the rest of the cybersecurity profession * The opportunities to engage and network with people at all levels * A day by day breakdown of the agenda * How to justify the event to management, if necessary * What to expect from the ship and the event As I also mentioned the entire cost to attend CruiseCon (depending upon the cabin chosen) is less than the cost of registration fees for the other major industry events. Please review the video and reach out with any questions.

38

15 Comments

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

QR codes… can be VERY dangerous and bypass a lot of the security safeguards we set up on the perimeter. Interesting read… Now Hackers Are Using Snail Mail In Cyber Attacks—Here’s How https://lnkd.in/eC_tTgwT

11

2 Comments

🔐 You've probably noticed the Two-Factor Authentication (2FA) information box in your account. We ask you to add 2FA to protect it. ICYMI: 2FA is "an identity and access management security method that requires two forms of identification to access resources and data." How do you add it? 1. Press the "Two-Factor Authentication (2FA)" sign, or 2. Go to your Account settings https://lnkd.in/dVJYgKje and set the toggle right (so that the background turns green). Then, the pop-up window will appear. Please follow the instructions written on it. Remember - your data should stay safe to ensure you can work trouble-free. #adsy #guestposting #guestpostingservice ##guestpostingplatform #2FA #onlinesafety

38

7 Comments

What is the NIST CSF Assessment Process? We break down the 5 phases of the process helping you understand what you’ll encounter during a Schellman NIST CSF assessment. Tap below to learn more. 📝: Jeff Schiess

7

For anyone still dealing with the fallout of the Crowdstrike/Windows issue; I wanted to give a tip that we are using with some success to automatically and centrally remediate systems that match a certain set of characteristics. This isn't a "silver bullet" to fix all systems everywhere, but where it works it doesn't require bitlocker keys, safe mode, or preboot environments. The system has to be boot looping or restarted. The opportunity that allows this to work: we identified that most systems which are crashing actually get far enough into the boot process that the network stack and Windows Server service are starting, briefly. We see a few second window when the system is available on the network before Crowdstrike fully loads and the system crashes. This also why some systems "self-heal." During the brief period before the crash, Crowdstrike may have enough time to download the fixed channel update before the system crashes, This small network availability window has given us a way to delete the channel file using a delete command from another system on a UNC path to the impacted system. There are a number of caveats that limit the success of this approach: 1. Host must using a wired network connection (wireless may work, but we haven't been able to definitively test) 2. The host IP must be known or resolvable via DNS (the system is "on" the network for less than 12 seconds, so this is often a problem). 3. The script must be run from a fully functional system, in the context of a credential that has previously established (before the Crowdstrike channel update) local workstation administrator level privilege 4. Executing against a single host one at a time has shown a higher rate of success than executing against a large number of hosts or an entire network range in parallel. In other words, this isn't a guaranteed fix. Said another way, this seem to have the highest success against wired hosts that are continually boot looping. Please comment if you find other constraints or errors in my list. A system can be tested to see if this approach will possibly work by continually pinging the IP address of a system that is crashing, while its crashing. There will be a string ping failures followed by a few replies then failures. While the system is able to reply to the ping, the delete command can be run. We originally triggered the script once we saw an ICMP reply, but are having better success just executing the delete against the UNC path against whole subnets repeatedly. In a "healthy" system, executing the delete against a UNC path will result in a delete failure as Crowdstrike appears to have the (fixed) channel file in use/locked. If the 'delete \\[hostip/hostname]\[UNC path to CS channel file]' command succeeds, the system boots normally into windows. If it doesn't, the system will BSOD again.

201

19 Comments

It is well documented that being a leader can be a lonely experience. If you've ever lead a project, a team, a department, or a company you know how the weight of the mantel of responsibility for outcomes and decisions can lead to isolation. But, in those moments of crisis when teams must be formed, guided, and motivated to rise to a challenge that leadership takes on a new dimension. This is the case I found myself in during the morning of July 19, 2024. By the time I was involved, the emergency management function was well engaged, understating the scope and impact of the problem and developing remediation steps and planning for how to best use the small army of volunteer "technologists" who would serve as the backbone for the on-site, hands-on recovery work. I jumped in and helped where I could, but there was already significant momentum. Then an opportunity presented itself: someone automated a fix. I tracked down Jeremiah Heyt (JR) and confirmed he was having success recovering systems centrally. Was this was a chance to fix many systems without having to touch them? It was worth exploring. JR didn't work for me, I had never talked to JR before that moment, but he was ready and willing to jump into a bigger effort. We pulled in a few other people and before long we had formed a "script swat team" to look into automating and expanding the idea of centralized recovery. By the end there were 12 people working on various aspects of the script and supporting tech. This team also spear headed the development of telemetry to confirm when systems had been fixed, a key element for the hands-on teams as well. In the end, it is estimated that the script resolved between 6% and 8% of impacted systems. That doesn't sound like much, but it meant that the amazing army of over 500 in-field volunteers didn't have to touch almost 2,500 systems and those 2,500 systems were put back into the hands of users faster than they might otherwise have been. Of the 12 people on the team, I was the "upline" of only three. The common cause was greater than hierarchy and positional authority. It was a privilege to be a part of this great team: Jeremiah Heyt, Dan Boik, Eric Craddock, Kenny Daldine, Joshua Hineline, Travis Hughes, Adam C. Johnson, Jeremy Jordan, Jason Lehman, Alex Meyer, Jeremy Reynolds,John Schiffman. Thank you Scott Dresen for your support and participation! Jerry Matt and Nina Padavil, thank you for being there every step of the way! This view is but small part of the work that went into recovering. The untold part of this story is that the Corewell Health team was in the go-live of a multi-year project to consolidate the EMR when the Crowdstrike outage occurred. Our CIDO, Jason Joseph, described it as "launching a rocket in a hurricane." This could only be possible because of a team dedicated to a mission greater than oneself. Awesome job team, I'm proud to be a small part of this amazing group of dedicated professionals!

32

3 Comments

Cybersecurity in Crisis: Sheboygan, Wisconsin Faces Ransom Demand after Cyberattack This week, Sheboygan, WI, faced a cyberattack that led to a ransom demand and network disruptions. City officials have isolated systems to protect critical infrastructure and are working closely with cybersecurity experts and law enforcement. Public safety services continue with minimal interruption, though no group has claimed responsibility. This incident highlights the rising cybersecurity challenges cities face and the need for strong, proactive defenses. #Cybersecurity #RansomwareAttack #DataProtection #MunicipalSecurity #ITSecurity #RiskManagement #DigitalDefense https://lnkd.in/gPRxUbD2

46

Why NIST is Changing the Rules for Passwords? The National Institute of Standards and Technology (NIST) has taken a bold step by dropping two long-standing recommendations from its password guidelines: Complexity Requirements and Mandatory Password Resets. What’s Changing? 1. No More Forced Complexity: Users are no longer required to create passwords with a mix of characters, numbers, and symbols. Instead, NIST recommends supporting longer passwords ranging between 15 and 64 characters, which can include ASCII and Unicode characters. This shift encourages passphrases that are easier to remember but much harder to crack. 2. Goodbye to Routine Password Resets: The practice of changing passwords every 60-90 days is now considered counterproductive. Frequent changes often lead to users choosing predictable and weak passwords. Instead, NIST suggests resetting passwords only if there's evidence of a credential breach. Why Does This Matter? For years, security teams have enforced these rules, thinking they improved security. However, research shows that such policies can actually weaken defenses as users revert to unsafe habits like writing passwords down or using predictable patterns. These changes align with a user-centric security approach — one that prioritizes both security and usability. It's time we rethink our strategies and embrace a smarter way of securing accounts!

28

2 Comments

🔒 Lock down your security game with the latest guidance from National Institute of Standards and Technology (NIST). Early in the month, they gave the green light for syncable authenticators (aka passkeys) to be used for both enterprise and public-facing use cases and called out the potential risks that come along with these handy tools. 💻💡 From securely storing and transmitting keys to implementing strong authentication in shared device scenarios, NIST offers a good framework. But it doesn't go all the way. The real challenge comes when we look at AAL2 standards, where passkeys must be unlocked with a local authenticator (think biometric) or a password. 🤔 So what's the catch? Fraudsters can easily exploit the use of passwords in cloud-based accounts. But fear not, we've got a solution for that too. Introducing #Anonybit, which binds your passkey to your biometric for ultimate security. Only you can access and use your passkey, no tradeoffs between privacy and security necessary. 🙌🏼 Connect with us to see it in action and take your authentication game to the next level. Visit www.anonybit.io/contact

8

Several voter registration databases for Illinois were left publicly exposed without encryption or any form of authentication, allowing unrestricted access to sensitive voter information for an indeterminate period of time. The database contained all sorts of details including SSN, Driver’s License Number, Historical Voting Records, Home Address, etc.   The security of our elections extends far beyond the voting process; it directly impacts the safety of the individuals who participate in it. In today's volatile political climate and with the world in a state of uncertainty, it's all too easy to imagine the disastrous consequences that could arise from neglecting this responsibility. We must do better—because the stakes are higher than ever.   “The exposed databases contained .csv documents with lists of available or active voters, absentees, early mail-in voting records, and duplicate voters. Other documents marked as “voter records” contained far more potentially sensitive personal information, including full name, physical address, some email addresses, date of birth, SSN (full and partial) or driver’s license number, and historical voting records. The database also contained copies of voter registration applications, death certificates, and records of change of address, jurisdiction, or state. There were also candidate documents (such as statements of candidacy) detailing personal phone number, email address, and home address. These candidate documents also included petitions with voter signatures, addresses, candidate loyalty oath, economic interest, and additional supporting documentation. There were also documents marked as official ballot templates for primaries and general elections.”   “The potential risk of a coordinated disinformation campaign using voter lists and voter registrations is a serious concern from both outside actors (such as Russia or China) and domestic activists looking to sway political opinions. According to a study conducted by the Pew Research Center in 2020, 75% of American voters believed there would be outside interference in the presidential election. Having PII of voters would potentially allow malicious actors to send them misleading information (about voting dates, locations, or requirements) based on their party affiliation. Another possible risk is voter intimidation, which includes using past voter history to threaten or harass voters.”   https://lnkd.in/gRJ-mh24

3

1 Comment

CISO reporting to 'The Board'...Scary? Yeah probably. It should be. Its real accountability, and an open challenge to your visions and strategies, and your ability to execute accordingly. As a CISO, I often get questions about how to present to 'The BoD' directly. Truth is, there's no single model - Every business is different, and every Board is different. But you know that already cuz you're in a position of leadership and discernment for a reason :) The right message always remains the same- How does your own leadership role, function, and focus contribute to the greater good of the organization? How does it help the business to determine where and how to accept and navigate risk? Not just avoid it. Sounds simplistic. But you may be surprised how many CISO messages don't answer that basic inquiry sufficiently. Your message, at this level, needs to clearly align to a broader forward-looking strategic narrative. If it doesn't, it doesn't resonate, and you haven't positively moved the needle. You never want to be the best checkers player in a chess match. I’m looking forward to demystifying this exact topic at the CISO ExecNet National Member Symposium July 23rd at the Willis Tower in Chicago with colleagues Eric Galis, Susanne Elizer Senoff, and Michael Calderin. #cisoexecnet #ciso #executiveleadership #boardreporting

132

7 Comments

Cybersecurity and Infrastructure Security Agency posted another list of 5 known exploited vulnerabilities across several platforms. Take a look here and contact our team if you need advice: https://lnkd.in/gd_iWtgV #cybersecurityawareness #exploitedvulnerabilities

6