Scott Alldridge

YouAttest for Identity Security and Compliance:   NIST Guidelines and frameworks are crucial to government contractors.   https://lnkd.in/erkpffEh Important to these NIST recommendations is attestation of identities controlling sensitive data (PHI, PII and CUI) - https://lnkd.in/g9zSZ_gd Know your identities, and privileges, w/ (now AI-powered)   YouAttest.com, contact us:    https://lnkd.in/g96pUae Wes Jones Jeff Chao Rick Mischka  #ITSecurity #governance #cybersecurity  #compliance #mspsecurity

16

1 Comment

YouAttest for Identity Security and Compliance:   NIST Guidelines and frameworks are crucial to government contractors.   https://lnkd.in/erkpffEh Important to these NIST recommendations is attestation of identities controlling sensitive data (PHI, PII and CUI) - https://lnkd.in/g9zSZ_gd Know your identities, and privileges, w/ (now AI-powered)   YouAttest.com, contact us:    https://lnkd.in/g96pUae  #ITSecurity #governance #cybersecurity  #compliance #mspsecurity

10

1 Comment

**Selecting the Right GRC Tool for CMMC Compliance: What You Need to Know!** Navigating CMMC compliance can feel overwhelming, especially when it comes to choosing the right Governance, Risk, and Compliance (GRC) tool. Many organizations miss crucial steps in this process, leading to costly misalignments. Here’s a structured approach to help ensure your organization selects the best-fit GRC solution: 🔍 **Define Your GRC Requirements** - Clearly identify your organization’s size, compliance needs, and specific areas for improvement. - Engage stakeholders across departments for a comprehensive understanding of diverse requirements. 🛠️ **Research & Evaluate** - Shortlist tools based on functionalities, integration capabilities, and vendor support. - Don’t skip the pilot test! Gather real-world feedback before rolling it out organization-wide. 💰 **Consider Total Cost of Ownership** - Look beyond the initial purchase price to include implementation, training, and ongoing support costs. From my experience, investing time upfront in a detailed assessment not only eases implementation but also sets a solid foundation for long-term compliance success. The right GRC tool can empower your organization to meet NIST SP 800-171 and CMMC standards effectively. Curious to learn more? If you’re navigating the complexities of CMMC compliance, I invite you to comment below or send me a DM to receive my exclusive resource: **CMMC Compliance Unlocked: An IT Pro's Cybersecurity Playbook for DoD Contractors.** This playbook offers actionable insights and strategies tailored for your needs! #CMMCThursday #Cybersecurity #GovernanceRiskCompliance #CMMC #DoDContractors

2

CISA is hosting a webinar on cybersecurity that would be relevant and useful for our members to join. Oregon Stakeholders Session: June 11th, 2024 1:00pm-2:00pm PT Location: Virtual via Microsoft Teams (Link sent upon registration) Registration Link: https://bit.ly/3Re27AM #cybersecurity #ransomware #oregon #publicschools #infosec #security #schools #learning #educationmatters

1

It is our duty to stop these types of attacks! Business Email Compromise (BEC) and Vendor Email Compromise (VEC) are seemingly a daily occurrence now in State and Local Government. Abnormal Security is here to help! We CAN and WILL stop these types of incidents. "In this case, they posed as the contractor's management in emails with the city's engineer, Century West Engineering. The scammer persuaded them of the need to transfer the money to a different account." https://lnkd.in/gPGehEuV https://lnkd.in/gPGehEuV

36

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

35 Comments

Who all will be at #RSAC this time? #Friends #colleagues and buddies DM to catch up and hear what interesting things we are doing at Ardent Privacy and would love to hear what you are working on ! For those who have not attended before do plan your meetings/schedule before , it is big conference. Here is link from #RSAC to get an idea.

7

How a single file broke Windows. What happened with CrowdStrike, and why it's so tedious to fix. By now, you would have read about how a botched update from a cybersecurity firm caused global IT chaos by crashing systems: - Self-service kiosks. - IT systems in banks and hospitals. - Check-ins at airports around the world. - Even 100s of carpark gantry systems in S'pore. All down. At the same time. 𝟭/ 𝗪𝗵𝗼'𝘀 𝗖𝗿𝗼𝘄𝗱𝗦𝘁𝗿𝗶𝗸𝗲? CrowdStrike is a top US-based cybersecurity company valued at US$80 billion. Its products compete successfully across multiple niches. - SIEM. - Cloud. - Endpoint. - Threat intel. - Data protection. - Exposure management. 🔸It's also the leader for Windows endpoint protection for businesses, with around 22% market share, or almost 1 in 4 Windows PC. 🔸Crucially, CrowdStrike is used heavily in the Critical Information Infrastructure (CII) sector, which means areas like healthcare, transportation, and government. 𝟮/ 𝗛𝗼𝘄 𝗱𝗶𝗱 𝗶𝘁 𝗴𝗲𝘁 𝘀𝗼 𝗯𝗮𝗱? The issue was triggered by a faulty file in the Falcon Sensor component of its Falcon solution. The problem file was pushed out as part of an automated update. A problem in the file sent to Windows systems promptly crashed it. Restarting the computer crashes it again, effectively causing a continuous restart loop. 🔸By itself, Falcon Sensor does fairly basic data collection, packages it up, and uploads it to the CrowdStrike cloud (~5-8MB/day). 🔸Despite its name, the *.sys file is not kernel-mode software but used to provide channel updates. It is somehow improperly formatted, causing the CrowdStrike driver to crash. Non-Windows systems are not affected; Windows Server systems with Falcon Sensor are similarly impacted. 𝟯/ 𝗪𝗵𝘆 𝗰𝗮𝗻'𝘁 𝗶𝘁 𝗯𝗲 𝗾𝘂𝗶𝗰𝗸𝗹𝘆 𝗳𝗶𝘅𝗲𝗱? The fix is relatively simple, and entails replacing the offending file. It looks like this: - Sit down at PC and press F4 to boot into safe mode. - Key in unique 48-digit BitLocker key*. - Log in and replace offending file. - Reboot and verify that it works. - Repeat for 𝗲𝗮𝗰𝗵 𝗮𝗻𝗱 𝗲𝘃𝗲𝗿𝘆 PC. There are multiple solutions to reboot/manage PCs remotely. But they are pricey and must be set up ahead of time. 𝘁𝗹𝗱𝗿; Almost everyone is fixing this manually. *BitLocker is a Windows disk encryption feature used by businesses to protect onboard data. The decryption key is unique for every PC. 𝟰/ 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻 Competitors have been quick to release statements deriding the situation. Of course, they tend to recommend their solutions instead. To me, the real question is why the update was pushed out at the same time, and not staggered. Tomorrow, I'll write about what I think will be the repercussions of this. 𝗣𝗵𝗼𝘁𝗼 𝗖𝗿𝗲𝗱𝗶𝘁: Paul Mah --- My name is Paul Mah and I write about tech that matters in #EverydayTechStories 👀 See my other posts: www.techstories.co 🙋 Follow me on LinkedIn: https://lnkd.in/gu5EMKQg #cybersecurity

345

67 Comments

Fundamental info that needs to be understood:

7

Join us TODAY for an essential Cyber Practice Session where we’ll address the everyday risky activities that compromise your online safety! This session is focused on Cyber Hygiene, offering practical steps to protect yourself, your family, and your workplace from common cyber threats. As we approach the end-of-year festivities—a prime time for cybercriminals—this topic couldn’t be more timely. Learn how to: • Spot phishing attempts • Secure your devices and accounts • Avoid risky online behaviors Let’s make safety a habit, not an afterthought. This session is open to all—don’t miss out!

6

Delayed revocation events by the numbers: An epidemic of delayed revocations has infected the public CA community. Jason Soroko and I track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes. #pki #security #CABF #ssl #revocation https://lnkd.in/g6APX-Fx

21

THE RISK AND RESILIENCE HUB DIRECTORY IS FOR YOU! The HUB evolved from the Disaster Resource GUIDE, launched in 1996. The annual GUIDE's directory, loaded with 100s of vendors, was the "go-to" for many years. The BIG NEWS? The Risk and Resilience HUB directory has new functionality. Companies can now upload and manage their listings directly. This means resilience professionals can find current information for the products and services their organization needs. Take a look here >> https://lnkd.in/gc2kiFHF The HUB DIRECTORY is still a work in progress. There's no magic wand! Many current listings are legacy listings that will be replaced with new functionality during the 3rd quarter, 2024. We’re hard at work on this. YOU CAN HELP by encouraging your favorite vendors to update their listings and/or get a new listing. Over the past year we have consulted with dozens of resilience professionals to determine the best main and secondary categories. See the list here. https://lnkd.in/eMxMy-ZC Any suggestions to make? We need your help.  Working together is the best! Reach out to [email protected] #resilienceproductsandservices, #HUBdirectory, #resiliencebuyersguide Dan Swanson Alex Sidorenko Dale Shulmistra Dr. Stephen B. Baruch, CBCP, MBCI Steve Yates, FBCI, CBCP, FICPEM, MEPS

4

2 Comments

𝗖𝗮𝗻 𝘆𝗼𝘂 𝗯𝘂𝗶𝗹𝗱 𝘁𝗿𝘂𝘀𝘁 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝘀𝘁𝗿𝗼𝗻𝗴 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗼𝘀𝘁𝘂𝗿𝗲 𝗮𝗻𝗱 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗺𝗲𝗮𝘀𝘂𝗿𝗲𝘀? 👍 The short answer is Y͟E͟S͟. Security posture and compliance aren't just about checking boxes. They’re strategic assets. Companies that prioritize cybersecurity and compliance send a clear message to their clients: "You can trust us." 🤔 How does this build trust? Client Confidence: When clients know that you have robust security measures in place, they feel secure doing business with you. They trust that their data is safe and that your company is prepared for evolving threats. Regulatory Peace of Mind: Adhering to industry-specific compliance standards (like the FTC Safeguards Rule, HIPAA, or CMMC) demonstrates that you take data protection seriously, reducing the risk of costly breaches and fines. Market Differentiation: Strong security posture can be a differentiator. In competitive industries, companies that emphasize security and compliance are considered more reliable and forward-thinking. It becomes a part of your brand identity, helping you stand out from competitors who may treat security as an afterthought. Security posture isn't just an expense—it’s an investment in your company's reputation, customer loyalty, and long-term success. Hi, I’m Jeff. I help protect manufacturers, auto dealers, and medical offices from cyber threats by enhancing security posture and ensuring compliance. 𝘓𝘦𝘵’𝘴 𝘵𝘢𝘭𝘬 𝘢𝘣𝘰𝘶𝘵 𝘩𝘰𝘸 𝘵𝘰 𝘮𝘢𝘬𝘦 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘺𝘰𝘶𝘳 𝘣𝘶𝘴𝘪𝘯𝘦𝘴𝘴 𝘢𝘥𝘷𝘢𝘯𝘵𝘢𝘨𝘦.

10

2 Comments

Chromium issues a quality ultimatum. In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. Jason Soroko and I relate Chromium's statements and their significance. #pki #security #ssl #cabf https://lnkd.in/ghYPCshs

19

1 Comment

Vinson Protect adds NIST Cybersecurity Framework v2.0! You all asked for it - now it's live! You can now add the National Institute of Standards and Technology (NIST) Cybersecurity Framework v2.0 to your Vinson Protect organization! Building upon the K12 SIX Essential Cybersecurity Protections, Center for Internet Security Critical Security Controls, and ClassLink's Cybersecurity Rubric, the CSF adds another lens through which to evaluate your schools' cybersecurity preparations. https://lnkd.in/gJryspY6 Are you curious about Vinson Protect? Why not join the 100+ schools that are using the application? The application allows schools to create audits, security reports, and security plans, track incidents, and manage/delegate tasks to team members. And it's completely free for schools to use! Check it out and sign up for your account --> https://vinsonprotect.com #vinsonprotect #nistcsfv2 #edtech #cybersecurity

7