Tim Golden

🚨 Hot Off the Press! 🚨 The DOJ and CISA have just released a Notice of Proposed Rulemaking (NPRM) and Proposed Security Requirements for Restricted Transactions, each implementing Executive Order 14117. These new rules aim to regulate the processing of certain personal data and will impact various sectors. 🔒 Key Highlights: 🗺 Data Restrictions: The proposed rules will limit the transfer of personal data—such as protected health information, financial data, government employee data, biometrics, and bulk data (over 100,000 individuals)—to specific countries. 🗺 Ownership Matters: Restrictions apply to entities more than 50% owned by citizens (both real and corporate) of these countries. It won't be enough to just avoid doing business in a given country. 💡 Why It Matters💡 If you’re building apps or solutions that process personal data for over 10,000 individuals or any government employees, brace yourself for mandatory technical controls and restrictions on outsourcing development and operations. Original Sources: https://lnkd.in/drJ3wgKq https://lnkd.in/dR-iVzzc Stay informed and prepared to adapt your strategies! #DataPrivacy #Cybersecurity #ExecutiveOrder #DOJ #CISA #Compliance #TechDevelopment

1

Chromium issues a quality ultimatum. In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. Jason Soroko and I relate Chromium's statements and their significance. #pki #security #ssl #cabf https://lnkd.in/ghYPCshs

19

1 Comment

Cyberthreat intelligence can bolster your SecOps with actionable info — if you choose wisely. #ThreatIntelligence #CyberSecurity #SecurityOperations #VulnerabilityManagement #IncidentResponse #RiskPrioritization https://lnkd.in/e-V5nJjt

3

🚨 Disgruntled ex-employee deletes 180 servers! We dive into the cost of NOT deactivating accounts Read and listen 👉 Link in comment #InsiderThreats #HIPAA #InfoSec

1

1 Comment

***CISSP Practice Question:*** An organization has implemented a new information security policy to ensure that only authorized personnel can access sensitive data. As part of this policy, multifactor authentication (MFA) has been mandated for all users accessing the organization's network remotely. Which of the following represents the best combination of factors for implementing multifactor authentication? A. Username, password, and PIN B. Password, smart card, and biometric fingerprint scan C. Username, PIN, and security questions D. Password, token, and email verification code Download the app to get more free practice questions: iOS: https://lnkd.in/egPx4tbT Android: https://lnkd.in/eNP483uV  #cisspcertification #cissp #cissptraining #infosec #cybersecurity

1

ISO 27001 ISN’T A ‘SET IT AND FORGET IT’ PROCESS. Yesterday I told you that security is a moving target... so today I want to continue on that theme. Many businesses treat ISO 27001 like a project with an end date. But the truth is, it’s an ongoing commitment. Many organizations fall into the trap of treating ISO 27001 as a one-time checklist—something to tick off and forget about. 🚨But here's the truth: achieving compliance is just the beginning. 🚨 ISO 27001 is about continuous improvement. The landscape of cybersecurity is constantly evolving, and your information security management system (ISMS) needs to evolve with it. This means regular reviews, audits, and updates to your security controls. It requires ongoing training and awareness to ensure your team remains vigilant. The threats don't stop, so neither should your security efforts. Is your ISO 27001 framework evolving as fast as the risks you're facing? If not, it’s time to rethink your strategy. Ensure you’re continuously improving your ISMS with our long-term support packages. You can learn more about these on our website https://lnkd.in/er6kWT4T 👉 Reach out today to discuss how we can help keep your ISO 27001 compliance dynamic and responsive.  ____ I'm Gary, an ISO27001 and GRC specialist. I understand you don't want to be tied down with lengthy security policies and programmes, but you need to improve your security today - this is something we can do quickly and easily. Find out how through our 1hr FREE consultation. DM me for details.

16

"SentryPC is an employee monitoring system designed to help manage real-time operations, activity notifications, event timelines, internet usage, and more. It is intended for use in corporations and educational institutions." https://lnkd.in/gGSuMtDF #sentrypc #monitoring #computermonitoring

1

"Remember: High-quality cybersecurity documentation should provide concise instructions, highlight critical security measures, and include visuals where applicable to ensure users can implement protections confidently. Usable documentation not only enhances security but also reduces the time and effort required to resolve issues." #technicalwriter #cybersecuritytechnicalwriting #securitydocumentation #cybersecurity #infoSec #GRC

1

CISA Director Easterly's Cybersecurity Awareness Month 2024 Message contains tips for protecting your digital environment. https://buff.ly/3U1P3Qc #InfoSec #CyberSecurity #MCSA #MFA #PasswordManager #ThinkBeforeYouClick #AutomaticUpdates

3

An interesting update to NYS law is picking up where 2013 HIPAA left off: HEADLINE: > $1B in STATE GRANTS AVAILABLE TO SATISFY THIS Some of you might think this is redundant, but HIPAA is so old and the requirements so breezy its easy for organizations with no identifiable cybersecurity program to escape regulatory action. This rule aligns with HIPAA and uplifts the requirements. Here's the high level: - ~ CIS IG2 technical requirements - A CISO is mandatory -- but you can contract it out - Annual (or more frequent) risk assessments are mandatory. Identified risks must be managed or accepted. - You must maintain a risk register, and risks must be accepted - The hospital board is required to approve all policy and compensating modifications - Security logs must be retained for 6 years! FortMesa's platform and risk assessments can support MSPs in satisfying all of these requirements. Thanks to Leland Lehrman for noticing this is reaching final stages.

18

5 Comments

Suffolk County September 2022 ransomeware attack report investigating its cause and lack of preparedness. two take aways from this excerpt of the report: "very large amount of systems that were not anticipated, with IP ranges not associated to the county" The obvious question is who were these IP addresses associated with, how did they penetrate Suffolk countys network fir what purpose? They were not authorized otherwise they would have been anticipated...ummm "42 devices found on the network provided by a prohibited vendor" one could ask the question: were these devices related to the non Suffolk County ip addresses that were identified above...how did these devices get purchased to begin with? or were they brought in from outside the procurement process...not good regardless Steve Bellone #stevebellone Lisa Black #lisablack Scott Mastellon #scottmastellon Ari McKenzie #arimckenzie RedLand Strategies Inc. Presidio TracePoint Consulting, an ISG business Palo Alto Networks SVAM International Inc. Northwell Health Michael Dowling Hunter College The City University of New York Babylon Schools Babylon Jr/Sr High School Columbia University Abrams Fensterman, LLP Amy Marion Jay Oliver 60 MINUTES Newsday Media Group News 12 NY Times-Breaking News Richard Rotanz PhD Suffolk County Suffolk County Legislature Excerpt taken from the CyberDefenses report that scanned Suffolk County s network at least 6 months prior to the Sept 2022 attack. Yet more data points on how easily Suffolk County was attack

4

🎯 If your password is "123456", please change it immediately to a passphrase. USEAPASSPHRASE - https://lnkd.in/gpDYypUX When Cristina Chipurici, now a content creator, was 22 years old, she was running the most popular music blog on the internet. One day, when she woke up and logged into her computer, she found that a former employee had cracked her Gmail password, deleted her blog’s entire database containing thousands of articles, hacked her social media accounts, made heavy payments from her credit card, and basically, left her broke. This happened with Cristina despite regularly updating her passwords and diligently following all the necessary precautions. But most people don’t pay much attention to their passwords, as this 2023 research by NordPass suggests. Their study reveals 200 of the most common passwords people used in 2023, and the list is a bit surprising. NordPass is a password management company behind NordVPN. This study, the fifth edition, was carried out by its researchers to explore the future of passkeys. “For five years, at NordPass, we've been mapping out password habits. Sometimes they feel like old tunes that never fade. This year, though, there's an extra layer to the story. We've noticed some patterns, especially on certain platform categories. And with all the chatter about passkeys, one can't help but wonder if there's a better way to do user authentication,” NordPass researchers wrote on the website. Astonishingly, the study revealed that the world’s most common online password in 2023 was “123456.” Plus, it indicated that as many as 70 percent of the passwords in the 2023 list could be cracked in less than a second. To conduct the research, they compiled a list of passwords in partnership with independent researchers specializing in researching cybersecurity incidents. They evaluated a 4.3TB database extracted from various publicly available sources, including those on the dark web, although no personal data was acquired by the company. In addition to this, NordPass partnered with various third-party researchers and analyzed passwords from a 6.6TB database. The resulting list included some of the laziest password combinations such as “1234,” “12345,” “Password,” “Admin,” and more likewise. According to NordPass, 86% of all web app attacks use stolen credentials, and also that passwords make up 18% of the most common items for sale on the dark web. In the “Interesting Findings” section, the company revealed that streaming lovers choose the poorest password credentials. While “123456” was the world’s worst password, “Password” wasn’t any better. “Admin,” which was not in the top 200 list for the past five years, came in second place in 2023. “It’s one of the passwords people do not bother changing,” the report said, per CNBC. “Instead of improving password creation habits, internet users have gone in another direction by sticking to already pre-configured passwords.” #passphrase #password #credentials

1

What happens when you get the best #financialcrime experts in a room with the best #developers? An award winning #AI powered platform, built by compliance professionals in a way that makes it so easy for everyone to do #duediligence on your clients, suppliers, 3rd parties, investors and investments. Our clients often say it is the little things that make all the difference. "At Themis we can really tell you have done the job before as you understand the little niggles that can cause us so much pain in our day to day working lives in a way most tech companies just dont." #Deliberately #Disruptively #Different

14

Fast. Good. Cheap. Pick two. Speed and volume in GRC seem to be hyper-important these days. If there are two things I've learned to look for in external auditors/consultants, it's those items. I can't count how many times I've heard from an external audit firm client "we don't think they can handle the pace" or some variation of "we only want to hire from other high volume, fast-paced firms." My question is, how much quality are we losing in compliance reports when we're mandating our auditors juggle 5-10 audits at a time and complete a full report in a couple weeks? Compliance automation platforms didn't invent this trend. What's the point of a SOC 2, ISO 27001 certification, PCI ROC, HITRUST assessment, etc. if we're not taking the time to do a proper assessment of a client's environment? It seems to be the firms focusing on speed are taking more and more market share away from the firms that focus on quality. So will there always be a place in the GRC industry for the slower-paced higher quality firms? Increasingly, I'm not so sure...but I hope so. #GRC #complianceautomation #speedvsquality

22

20 Comments

🚨 **Security Alert for WordPress Users!** 🚨 A critical vulnerability has been found in the LiteSpeed Cache plugin for #WordPress, potentially putting millions of websites at risk. Known as **CVE-2024-47374**, this flaw allows #hackers to execute #malicious #JavaScript code, with the potential to take over entire sites by targeting admin accounts. 🕵️‍♂️💻 🔍 **What’s the Issue?** The vulnerability lies in the **X-LSCACHE-VARY-VALUE** HTTP header, which doesn’t sanitize input properly. The risk becomes even higher when **CSS Combine** and **Generate UCSS** features are enabled. With over 6 million active installations, WordPress site owners should update to #version **6.5.1** immediately! ⏩🔒 💡 **Pro Tips for Extra Security**: - Disable unnecessary features - Install all recommended updates - Use strong security practices like role-based access controls and two-factor authentication (2FA) 🔐 As WordPress continues to power diverse websites, proactive measures are essential to stay safe. What actions are you taking to protect your website from emerging threats in 2024? Share your thoughts and plans in the comments! 👇 #WordPressSecurity #Cybersecurity #Vulnerability #LiteSpeed #TechUpdates #CyberSécurité #WordPress #CVE

1