Shira Rubinoff✔

Join us on Wednesday, May 29th at 8:30 AM to discover the joint strategies used by CERT Ukraine and CISA for cyber defense! Don't miss out on this opportunity to learn from the experts. Link in bio for more details and to get tickets. #CyberDefense #CERTUkraine #CISA #CyberSecurity #EventAlert

12

The National Institute of Standards and Technology (NIST) has teamed up with ANALYGENCE to tackle the growing backlog in the National Vulnerability Database (#NVD). As of April 9, 5,799 CVEs from February 15, 2024, onward remain unanalyzed. With the NVD housing 238,213 records, addressing this backlog is crucial. Analygence, with its robust cybersecurity expertise, has secured a five-year, $125 million contract to support NVD's cyber vulnerability processing. This partnership is pivotal for cybersecurity professionals, researchers, and developers who rely on timely and accurate vulnerability data. https://lnkd.in/d226dQSg

30

2 Comments

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

AI systems can boost efficiency but need a backstop of human oversight, said Varsha Agarwal, Head of Information Security, Prosper Marketplace. This was discussed on CISO Series Podcast “Our Guardrails Only Fail When You Try To Go Around Them (LIVE in Seattle).” Listen to the full episode: https://lnkd.in/gmJ7UsCc #CISOseries #CISO #security #infosec #informationsecurity #cybersecurity

4

Big day for #PQC and the evolution of #cybersecurity! QuSecure is proud of our #leadership role in advancing #crypto agility with our #quantum resilient software solution QuProtect. To assist organizations in getting started, contact QuSecure as we are offering organizations the following four opportunities: 1. For CISOs: A free road mapping session with QuSecure, the award-winning company in crypto agility with more implementations than anyone to date. 2. For Boards and Executive Team Members: A half-day briefing with Accenture and QuSecure. Learn what others are doing and how to apply what they have learned to your organization. 3. For Organizations Ready to Test Crypto Agility: A #free #POC addressing your choice of Crypto Agility across applications, networks, and routers. 4. For Anyone Looking to Learn More: QuSecure is teaming with PayPal for a webinar on “Protecting Blockchain & Crypto Against Quantum & AI” on Wednesday, August 14, at 1 pm PT/4 pm ET.

1

Need some #OSINT prompts to get you going with AI? I got ya covered. Keep your eyes out for a major AI for OSINT update webinar coming soon. https://lnkd.in/gVRGBuTt

30

1 Comment

This is such an important reminder of why all orgs need to take cybersecurity and ransomware resilience seriously, and resource and prepare accordingly. If you need help, our team at Gate 15 is here. 👋🏼 New York Attorney General Letitia James and the attorneys general of Connecticut and New Jersey today secured $4.5 million from Enzo Biochem, Inc. (Enzo) for failing to adequately safeguard the personal and private health information of its patients… The Office of the Attorney General (OAG) found that Enzo had poor data security practices, which led to a ransomware attack that compromised the personal and private information of approximately 2.4 million patients… - Attackers were able to access Enzo’s networks using two employee login credentials. - Two login credentials were shared between five Enzo employees and one of the login credentials hadn’t been changed in the last ten years, putting Enzo at heightened risk of a cyberattack. - Once logged in, the attackers installed malicious software on several of Enzo’s systems. Enzo was not aware of the attackers’ activity until several days later because the company did not have a system or process in place to monitor or provide notice of suspicious activity… As a result of today’s agreement, Enzo has agreed to pay a $4.5 million penalty, of which New York will receive $2.8 million, and adopt a series of measures aimed at strengthening its cybersecurity practices going forward. https://lnkd.in/gGaznec6 #cybersecurity #ransomware #resilience #preparedness #liability #gate15 #newyork #criticalinfrastructure #homelandsecurity

3

📢 Unlocking #FedRAMP Marketplace Designations: A Pathway to Enhanced Security and Compliance 🚀 Navigating the FedRAMP Marketplace can be a game-changer for cloud service providers aiming to work with federal agencies. Understanding the designations—FedRAMP Ready, FedRAMP In-Process, and FedRAMP Authorized—is crucial for positioning your service in this competitive space. Key Takeaways: 1. FedRAMP Ready: Initial step, showcasing readiness for rigorous security assessments. 2. FedRAMP In-Process: Actively undergoing authorization. 3. FedRAMP Authorized: Full compliance, allowing wide-scale adoption by federal agencies. Mastering these designations not only boosts credibility but also opens doors to substantial opportunities. Is your cloud service prepared to meet these standards? Dive into the detailed guide to ensure you’re on the right path. 🔗 Read more on the Ignyte Assurance Platform™ website https://lnkd.in/gE_DGmkq #FedRAMP #CloudSecurity #Compliance #Cybersecurity #CloudComputing #FederalAgencies

7

1 Comment

Episode 3 is out of Armis Bad Actors podcast and this time with my favourite duo Andrew Grealy and Michael F.... Check out the new episode which will give you just a small insight into the dark web and threat intelligence/threat hunting!

13

The massive #autoindustry data breach attributed to #CDK continues to unfold, and as a congenital contrarian (and opportunist TBH🤷🏾‍♂️) I’m fascinated by the class action legal battle that is now making its way through the US courts. 🚗 What are the economic and brand implications for the plaintiffs and the defendant? ⚖️ What does this (and the numerous other data breaches) tell us about potential venture opportunities in the auto industry, a historically under technologized sector (in cybersecurity)? 💸 Perhaps most importantly- for my day job anyway- does this market pattern & resulting economic/ brand consequences point to venture opportunities in the legal or insurance industries?🤔 What are you big 🧠s in my network thinking? Jakub Konieczny Samantha Huang William M. Bill Samuels Azadeh Hardiman Erwin A. Raeth, CFA Keith Marvel Eric R West Marcos Fernandez David Gritz Jason Allen Kate Terry Cynthia Hollen Frances Zelazny Jess Mah Anand Upadhye

8

6 Comments

🚩 The momentum going into #blackhat2024 couldn't be better at DirectDefense! This momentum is driven by strategic leadership, industry partnerships, and compelling research, positioning the company for a powerful second half of the year! Can you think of a better time then #blackhat to reach out, connect and setup some time to talk with our team about how we can help? (I can't..... incase you are wondering the correct answer 😉 ) DirectDefense will be hosting a number of events at Blackhat in and around #mandalaybaylasvegas. Reach out and lets set up some time. #mssp #applicationsecurity #pentesting #iotsecurity #otsecurity

11

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Vintage OSINT tool : How it started - How its going https://lnkd.in/eFEdSdtU

19

12 Comments

In scuba diving, we refer to this issue as “task-loading.” Routine tasks require more cognitive energy & time under stress or intense emotions. As Nick Selby often says, “in a crisis we default to our level of training.” And he’s right — we shouldn’t expect any organization to organically rise to the occasion. And what if that training doesn’t include how to regulate our emotions or navigate the emotions of others? Having a plan is one thing. Being able to execute it well in the messy context of human emotion is another — and something few security teams are trained to lead.

11

4 Comments

Is it material? Well, maybe. Good article from Tim Starks in CyberScoop: CDK hack shows SEC disclosure standards are unsettled; The early application of the regulatory agency’s new cybersecurity reporting rules reveal that materiality is in the eye of the beholder. As the damage from the ransomware attack on automotive software provider CDK Global has become clear over recent weeks, numerous auto dealers felt compelled to notify the Securities and Exchange Commission that the breach had harmed their operations. CDK's parent company, Brookfield Business Partners, which apparently paid nearly $25 million in ransom to attackers, does not feel the same way. In a press release issued July 3, the company said "we do not expect this incident to have a material impact on Brookfield Business Partners." Despite the attack's downstream effect on the U.S. auto industry, CDK and its parent company did not file with the SEC under its new rules for reporting breaches. https://lnkd.in/ec3RfdMX #cybersecurity #ransomware #regulations

3

So, it's that time of year again and I will be speaking and traveling a lot. I will be at the following events, and please come to say hi or listen if you want. September 4: CISO Roundtable with Cybertech NY September 5: Incident Response Keynote panel at Cybertech NY with Cytactic September 7: Human Security Engineering at Luminarium Bogata September 10: Human Security Engineering at Luminarium Medellin September 12: Your Budget is a horse's ass at GoSec Conference 2024 in Montreal September 17: Quantitative Techniques for managiing risk exposure webinar, CYE webinar with Reuven (Rubi) Aronashvili, Katherine Kuehn, and Cody Scott September 23: Psychological Indicators of Human Vulnerability, InfoSec World Orlando October 3: Audience Choice at CornCon Cybersecurity Conference, Davenport October 16: Psychological Indicators of Human Vulnerability, ISC2 Security Congress, Las Vegas October 30: TBD Keynote at Layer 8 Masters CISO Forum, San Diego October 31: Applying AI to Cyber Risk Quantification at Cyberdefense Magazine CISO Conference, Orlando November 8: The Worst Cybersecurity Advice I Ever Heard, @Bsides South Florida November 27: Keynote stage, Black Hat MEA, Riyadh December 10: Leave Me the F*ck Alone, Cybersecurity Marketing Society Conference, Philadelphia Februay 8-13: Human Security Engineering, CruiseCon, The Caribbean, where I will be the least esteemed speaker in attendance. ;) I might have left something out, so please remind me if I left out your event. Either way, I will hopefully catch up with friends along the way. I will admit that I am most excited about CruiseCon, but that is my passion project. Either way, I look forward to seeing you all there.

52

16 Comments

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

9

Coalition, Inc. Cyber Risk Awareness Security Report! Could you not want a better summary to highlight the real risks? 🚨"Technology has become ingrained in modern business, and so has cyber risk. Cyber risk is now the most significant concern for business leaders globally." ⭐🔦A warning that continues to be echoed from every corner of the security landscape. In addition, the coming #digitalliabilities explosion where due diligence is under the microscope. Gerry Kennedy, Ivan Savov, FARPI, #cyberrisk #digitalpremisesliabilities #compliancerisks #businessrisk #boardofdirectors #boardroom #executives 🚨"Cyber claims originated in the inbox. More than half of all claims were business email compromise (BEC) or funds transfer fraud (FTF), highlighting the importance of email security as a key aspect of cyber risk management." ⭐🔦As perimeter security strengthens and is heavily focused upon with weak #securityawarenesstraining and weakening information security governing policies to risk manage current and evolving #securitythreats, attacks are directed to the weakest links in the organisation's security system—that is, the human element domain and all vectors surrounding it. Many organisations are not doing enough to strengthen #emailsecurity and continue to rely upon existing controls or poor continuous monitoring and evaluations of current controls. This problem is not expected to be resolved any time soon as security continues to be an emotional factor among IT teams, holding blind relationships with failing strategies and solution providers. 🚨"Businesses using select boundary devices were at greater risk. Firewalls, virtual private networks, and other devices can help reduce cyber risk. However, boundary devices with known vulnerabilities increased the likelihood of a business experiencing a cyber claim." ⭐🔦IT-driven organisation's security can result in the above, where #securityrisk is not well understood at the governance level and #informationsecuritymanagementsystems maturity capabilities are slowly maturing but not at the level for true #cyberriskmanagement. Until #cyberrisk becomes #businessrisk and #boardofdirector becomes cyber risk aware and takes responsibility and accountability for the organisation's #digitaltransformation program, this problem will continue to plague such organisations. Resolving cyber risks requires responsible action from top-level management. #businesssectors #government #ngo #privatesector #publicsector #financialsector #healthsector #insurancesector 

6