Richard Freiberg CPA

Fast. Good. Cheap. Pick two. Speed and volume in GRC seem to be hyper-important these days. If there are two things I've learned to look for in external auditors/consultants, it's those items. I can't count how many times I've heard from an external audit firm client "we don't think they can handle the pace" or some variation of "we only want to hire from other high volume, fast-paced firms." My question is, how much quality are we losing in compliance reports when we're mandating our auditors juggle 5-10 audits at a time and complete a full report in a couple weeks? Compliance automation platforms didn't invent this trend. What's the point of a SOC 2, ISO 27001 certification, PCI ROC, HITRUST assessment, etc. if we're not taking the time to do a proper assessment of a client's environment? It seems to be the firms focusing on speed are taking more and more market share away from the firms that focus on quality. So will there always be a place in the GRC industry for the slower-paced higher quality firms? Increasingly, I'm not so sure...but I hope so. #GRC #complianceautomation #speedvsquality

22

20 Comments

Marketing & e-commerce best practices need to evolve. If you have to trick people or withhold information to convert a sale, that should tell you something about the true value of what you're selling.

5

It’s becoming apparent that cybersecurity training should be required for all employees. Policies need to be set to avoid incidents like these. https://lnkd.in/eDwvyeJV #protectdata #cybersecurity #learningisliving

2

GLBA / FTC Safeguard Rule - This explains in plain language the specific information you need to provide. The revised Rule requires financial institutions to notify the FTC as soon as possible – and no later than 30 days after discovery – of a security breach involving the information of at least 500 consumers. Here is the link to the online reporting form you'll need to fill out: https://lnkd.in/dJUwQxAG

2

There have been scores of articles about Midnight Blizzard that give an overview of the Microsoft breach, resulting in loss of critical emails for state department officials. The severity of the breach prompted a scathing report from the DHS's "Cyber Safety Review Board." Last month, CISA issued an Emergency Directive in response to the Russian hacking group Midnight Blizzard targeting Microsoft corporate email accounts. The directive requires federal agencies to take immediate action to analyze potentially affected emails and reset compromised credentials. It states that Midnight Blizzard is using information from Microsoft corporate email systems to gain access to customer systems. After speaking with numerous CISOs and CIOs about cyber issues, including Midnight Blizzard, two key messages have emerged: 1. Consolidating security products into a small number of best-of-breed platforms is logical but there is no such thing as a God security platform that provides you with all of your security needs. Most enterprise CIOs want three separate security platforms that integrate with each other using APIs:  - Identity management  - Inline cloud security platform  - Endpoint security This becomes the foundation of Zero Trust architecture and offers a holistic and effective approach to safeguard against various threats and vulnerabilities. Implementing a multi-vendor approach ensures the highest standards of quality across various domains, as it avoids reliance on a single vendor. 2. To effectively mitigate risks, it is crucial to separate application providers from security providers. It’s concerning when vendors sell applications with security vulnerabilities, and then sell additional security products to address those issues. Hyperscalers provide great cloud platforms and applications but cybersecurity needs to be separate. Imagine your email provider is also providing you with email security and cloud security and if one of those services is compromised, it could put your entire data at risk or potentially make your mission critical applications unavailable impacting your business. Consolidating scores of security products to a small number of best in class platforms plus implementing Zero trust architecture is critical to reduce our business risk. Read more about Midnight Blizzard from our ThreatLabz Security Research team blog for more technical details: https://lnkd.in/gp5D6sST

995

25 Comments

A 'The More You Know' tidbit. If you do an Incident Response table top exercise without attorney-client privledge, the exercise is discoverable in the event of an actual incident or audit.

22

2 Comments

In 2023, I closed $4M for an MSSP making them the #1 fastest growing on INC5000. I then consulted another MSSP and they closed a $4M deal (their highest ever) in less than 90 days. This year, I started my own business offering 1:1 coaching for sales reps, team coaching for Series funded Startups, business consulting and outsourced SDR services, and now I'm wrapping up my sales book and releasing it in 2025! I'm sharing all my secrets now in a book I call "MONEY FOLLOWS PAIN: Introducing The PTV Method™ - A Simpler Sales Process designed to help you Close More Deals Faster™" Yep its a long title LOL but you HAVE to know that I mean every word of it. Your sales pipeline will never be the same! PREORDER NOW ON MY WEBSITE CLOUDSALESCOACH.COM. Estimated arrival of 2025. #moneyfollowspain #theptvmethod #salesprocess #salesmethodology #discoverycall #mssp #startup #salesgrowth #salesframework

7

11 Comments

Did you miss the LBMC Cybersecurity webinar? -- "PCI 4.0: Q&A with QSAs" It's not too late to listen in. If you shoot me over a message, I'll be sure you receive a copy of the recording. Andy and I had a lot of great PCI 4.0 questions that apply to many organizations. #webinar #PCI40

12

What’s the big deal with picking a bargain basement auditor? Selecting an auditor is like selecting any other professional service. You could pick the handyman that has the lowest rates but… - Will he be responsive when you ask questions? - Will he finish the work in a timely manner? - Will the work look good when others come over to your home? These are some of the challenges we see with low cost auditors. They are not signing the deal to lose money. That means that they need to cut the service in some way. - Do they use overseas talent that has timezone and communication barriers with your team? - Do they explain what they need and why? These things take time. - Do they cut corners by giving you rigid requirements instead of taking a risk based approach to the audit? Do they understand your business enough or are they going to force you to generate busy work that does not have business value? We see a strong auditor relationship as critical to achieving good outcomes with the audit. The goal of many audits is to have a report that customers, investors and other constituents can have confidence in. If your report was prepared by Charlie’s Cheap Compliance, customers may not take the results seriously. For more insights into the auditor relationship, I am a guest at an upcoming webinar that will be valuable to anyone who thinks that they could either do better than their existing auditor or are looking to start a compliance program. Details in the comments. What are some keys to success that you see in the auditor relationship? #fciso #compliance

28

13 Comments

Why are we continuing the trend of giving the attackers control of both the situation and the narrative in a cyber attack? Last week's story about an August breach Fidelity Investments only perpetuates this challenge. Is there a world where we can turn these into security wins? I think so, and lay it out on this week's Intentional Brief from Intentional Cybersecurity.

1

Did a poll on the r/cybersecurity subreddit regarding GRC Engineering. We have our work cut out for us, most people in the industry still aren't aware there's a better way to practice GRC! Some comments were highlighting how people chose GRC to leave the technical side/stop being on call. These are valid reasons but also shows GRC as a side quest or an area for CoastFIRE. GRC is just as important and just as exciting as the other verticals and GRC Engineering is an effort to demonstrate that to everyone!

48

21 Comments

The biggest mistake I see MSPs make when trying to have the risk conversation with clients. (And it's not what you think) The risk discussion shouldn't start with risk: Huh? 🤔 ❌ You're at risk of breach ❌ You're at risk of losing revenue ❌ You're at risk of falling behind in your industry These all may be true... But they haven't happened yet. The business just doesn't care, sorry to say. These approaches bring up the client's shields. "No thanks, we'll take our chances." - they'll say to you. Right? A perpetual cycle of cleanup after the fact. Instead... Start with the positives. Show how your MSP service is ALREADY providing basic security foundations: ✅ Asset Management ✅ Patching/AV ✅ Backups Show where they would be without that. "𝗪𝗶𝘁𝗵𝗼𝘂𝘁 𝗼𝘂𝗿 𝗠𝗦𝗣 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀, 𝘆𝗼𝘂'𝗱 𝗯𝗲 𝗮𝘁 𝗮𝗯𝗼𝘂𝘁 𝟵𝟬% 𝗿𝗶𝘀𝗸. 𝗖𝘂𝗿𝗿𝗲𝗻𝘁𝗹𝘆, 𝘆𝗼𝘂'𝗿𝗲 𝗮𝘁 𝟳𝟬%" You're showing them you're on their side. You're also effectively neutralizing the "we thought you did this for us already" comment. Now you can say: 'We see clients in your range at risk for a cyber breach - here are the services we use to prevent that." Feel the difference? You literally said the same thing, but... Instead of an attack, it's a consultation. 🤯 TL;DR - Think rhetorically; play the long game; win as a trusted risk advisor for your clients. ------------------------------------------ 👋 Hi there; my name's Jesse. 🚀 I help MSPs crack the code for profitable vCISO services. ------------------------------------------

47

23 Comments

Compliance is dead. Long live compliance. Let's understand something: as practiced today, security audits are designed to accomplish one thing - the piece of paper that says you've completed an audit. Well, that, and making the audit firms rich. But wait, you say, what about all the "findings" audits expose that have to be "remediated," which in turn reduces our risk exposure? Have you read your audit scoping statement and all the sundry disclaimers? You didn't actually think any real-world audits covered your entire enterprise or were based on your actual current control posture, did you? Let's also not forget the lifeblood of the traditional audit process: the manual data call, the screenshot, and the word of a control owner. Are you stitching together all your various audits from all the different scopes and time frames to try completing the puzzle that's meant to represent your overall security posture? Right, because nothing is more relevant to your ability to defend your environment from real-time threats than manually collected control artifacts from last year. Pro tip: bad guys don't care about checkboxes. They care even less about the ones from last year or the year before. The cyber audit and compliance emperor isn't wearing any clothes - and he never has. The sooner we realize the futility of this entire manual audit model, the sooner we can make compliance actually mean something, maybe for the first time ever. Evolving to what I've termed the Converged Continuous Compliance vision of a real-time, data-driven, fully automated audit and compliance lifecycle, is the path to compliance integrity, compliance confidence, compliance agility, and compliance reporting accountability. If you want to learn how to make this vision your reality, check out qmulos.com, the only firm actually delivering true, end-to-end, real-time compliance automation at the enterprise scale - on-prem, cloud, hybrid, and everything in-between. Come see us next week at Gartner Security & Risk Management conference at the National Harbor in DC, booth 901. #compliance #security #cybersecurity #securitystrategy #ciso #audit

13

If you knew 30% of all SOC2 reports get rejected, would you be more inclined to not pick the cheapest audit firm? You get what you pay for is still relevant with auditing firms. 🤔🫨 #quality #security #compliance #audits #buysmarter #securityprogram featuring Cameron Youngblood and Ellie bean ❤️

25

2 Comments

Remember everyone's favorite cybersecurity cocktail party saying? "Compliance is not security." Sure. It's just the thing keeping you from your revenue sources in defense work. Once again, Jacob Horne shares valuable insights on why waiting to get started on #CMMC will have turned out to be a major mistake on the part of vendors vying for defense contracts. The issue isn't just finding someone to have your enterprise assessed, it's finding a competent implementer to fill the control gaps keeping you from attaining your required CMMC posture. And now that most are finally waking up to the reality of losing DoD business over their CMMC non-compliance, the problem is becoming more acute and urgent. #cmmc #compliance #cybersecurity #dod

3

2 Comments

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

🚨 Countdown to Compliance: 40 Days Left to File Your BOIR Report! 🚨 The clock is ticking! All businesses are required to file their Beneficial Ownership Information (BOIR) reports by December 31, 2024—and the holidays are quickly approaching. 🎄 Why Act Now? ✅ Avoid last-minute stress during the busy holiday season. ✅ Protect your business from potential penalties and loss of good standing. ✅ Enjoy peace of mind knowing your filing is complete before the year's end. Don’t Wait! With only 40 days left, time is running out to ensure your business meets the deadline. Let BOIR Easy Filing handle the paperwork for you—quickly, securely, and with no hassle. 🎁 Holiday Tip: Filing early means you can enjoy the holidays stress-free and focus on what matters most! 👉 Get Started Today: https://lnkd.in/guBGEKpF Have questions? We’re here to help. Reach out to our team for personalized support. #BOIRFiling #BusinessCompliance #FileNow #DeadlineAlert

1