Trevor Tupper, PMP

I encourage my network to watch this great conversation between Mike Battistella and Richard Pharro on Cybersecurity Beyond Compliance Mike dispels the misconception that passing a compliance audit guarantees long-term security. Richard and Mike explore how continuous improvement is vital for cybersecurity and why organizations must go beyond compliance to protect their digital assets. Mike also highlights the crucial role of leadership in embedding cybersecurity into business strategy, ensuring it’s seen as essential for survival, not just a technical necessity. #cybersecurity #cybersecurityrisk #nistcybersecurityframework

7

I had a great conversation with David Monnier on the Future of Threat Intelligence podcast. We discussed: The transformative role of AI in simulating cyber attack paths and enhancing defense strategies. The importance of technical proficiency in operating systems and networking for aspiring cybersecurity professionals. and more Check out the full episode here: https://spoti.fi/4fgxLbd #futureofthreatintelligence #cybersecurity #threatintelligence

109

9 Comments

For those of you who are in the process of CMMC compliance, here is your funny for the day.

2

As we gather this Thanksgiving, reflecting on the blessings and opportunities in our lives, I’m reminded of the parallels between our personal traditions and the work we do in cybersecurity. Just as we protect and cherish our families, homes, and communities, we must also guard the digital spaces that have become such an integral part of our lives. This season, I’m grateful for the incredible people who work tirelessly to secure our systems and data. From the analysts monitoring threats to the engineers building resilient systems, to the employees across organizations who are committed to best practices, your efforts don’t go unnoticed. I want to especially thank my team and the work they do day in and day out. But Thanksgiving also serves as a reminder to remain vigilant. While many of us unplug to spend time with loved ones, cybercriminals are often at their most active, exploiting the holiday season with phishing campaigns, fraudulent shopping sites, and ransomware attacks. A few tips to keep cybersecurity top of mind this season: - Beware of Holiday Scams: Be cautious of unsolicited emails offering deals that seem too good to be true.  Remember, if something sounds too good to be true, most of the time it is! Verify before clicking! - Secure Your Personal Devices: Update software and enable multifactor authentication to keep your accounts protected. - Strengthen Work-From-Home Security: If you're catching up on emails, ensure you're using a secure connection and company-approved tools. - When was the last time you checked the firmware of your routers, or verified your home network is using a trusted DNS like 8.8.8.8 or 9.9.9.9? - Educate Your Family: Share simple cybersecurity tips with loved ones—everyone benefits from better awareness. Share the tips above with your family and friends who may not be as cyber-aware. Let’s celebrate the season with gratitude and purpose, recognizing that the best defenses—whether for our homes or our networks—are built on trust, collaboration, and shared responsibility. Wishing you a safe and secure Thanksgiving! 🦃 #Thanksgiving #CyberSecurity #Gratitude #CyberResilience #CISOLeadership

1

"Scaling security and compliance efforts is not feasible with just people and manual processes, technology is necessary to keep up with the growing attack surface and regulations," CEO Tom McAndrew explained our people + tech approach to solving these challenges. https://ow.ly/bk8j50SxijG #compliance #cybersecurity #technology

2

CyberMaxx is excited to collaborate with DEFENDERS FOR CHILDREN this holiday season! Dedicated to supporting children's rights and well-being, this nonprofit aids in donating and training law enforcement K9s that specialize in electronics detection. With this assistance, police departments can locate illegal electronic devices, prosecute offenders, and safeguard numerous children. Discover how you can support this initiative and help us build a safer world for the most vulnerable. Together, we can make a significant difference! Read the blog post from our CEO: https://gag.gl/o7B6nK #savethechildren #defenders #K9s

2

This past weekend, Patelco Credit Union made the incredibly difficult decision to shut down most of their operations. The customers still don't have access to their accounts and as of Monday afternoon, the HQ branch tellers were still on pen and paper! They’ve had to set up a "Security Incident Updates & Information Center" and after 3 days admit they experienced a ransomware attack. Imagine the pressure on Patelco's leadership. Taking critical systems offline, leaving customers without access, and ultimately admitting failure. These are not easy choices, but the most difficult part, retaining customers, is yet to come. This incident underscores how crucial preparedness is in cybersecurity. We simply cannot eliminate Cyber attacks. The best-prepared amongst us can only reduce the probability of material impact on the business. Having the controls in place including an actual Incident Response plan (other than shutting everything down) allows institutions to react efficiently when a breach occurs. I talk about breach prevention, Incident Response plans etc. every day, but this breach hits particularly close to home. I’ve been a long-time customer of Patelco, but not for much longer. While Patelco's situation is unfortunate, their best efforts in communicating the incident is commendable. Let's hope they recover quickly. No organization is immune to cyberattacks. Are you prepared? #cybersecurity #ransomware #dataprivacy #patelco #incidentresponse

40

3 Comments

Cybersecurity Alert: Hackers and Fraudsters Targeting Jobs Today's The Wall Street Journal article highlights a new threat in the cybersecurity job market: hackers posing as job applicants, made harder to detect by AI tools. With a global shortfall of 4 million cybersecurity professionals, fraudsters are seizing the opportunity. Key takeaways: - Be vigilant during the hiring process. - Implement robust identity verification and skills tests. - Stay updated on the latest AI-aided cyber threats. #Cybersecurity #AI #Hiring #FraudPrevention #WSJ

24

1 Comment

Looking forward to this one! CISA will be doing a great session of Risk Assessment training, followed by a little bit of yours truly :). SkipFlo Inc will have new “AI Myths& Realities” infosheets for you! #SkipFloInc #SkippyAI #PublicSpeaking

30

1 Comment

I rarely pre-order things, but I preordered this book months ago and it showed up on my door step today. Vulnerability management is easy to do poorly while wasting valuable time and resources. Doing it well and doing it effectively are much harder. I’m looking forward to digging into Effective Vulnerability Management.

37

8 Comments

Last week, we were LIVE with Brian Carrier at Techno Security & Digital Forensics Conference in Wilmington, NC. How do you know your suspect was the one committing the crime vs a remote user? Watch now: http://csh.social/hO7xDf #dfir #investigation #digitalforensics #infosec #osint #cybersecurity #digitalinvestigations #incidentresponse #ai

3

Come see us at the #StateRAMPCyberSummit! Coalfire experts are ready to answer all your pressing StateRAMP #compliance questions.

3

📊 The Verizon Data Breach Investigations Report (DBIR) 2024 is out ( and I'm a few days late), but it provides some crucial insights! Thanks to this year's contributors, and of course the Verizon Business team for putting it all together. Here are some of my significant takeaways from this year's report: Ransomware and Extortion - Ransomware was present in 23% of breaches, while extortion increased to 9%. When combined, they accounted for 32% of all breaches! A substantial growth from the previous year... It's clear that ransomware and extortion tactics remain a top concern for organizations across all industries. Vulnerability Exploitation - Attacks involving the exploitation of vulnerabilities nearly tripled compared to the previous year, largely driven by the exploitation of zero-day vulnerabilities in widely-used software. This highlights the importance of timely patch management. (The median time reported was 55 days to address 50% of critical vulnerabilities!) Supply Chain risks - This year's DBIR introduced a new metric called "supply chain interconnection" to capture third-party risk, which increased to 15% of breaches, a 68% increase from the previous year. As businesses increasingly rely on third-party software and services, managing your supply chain risks is absolutely critical! The human element - The human element continues to be a significant factor, contributing to 68% of breaches. Social engineering tactics, such as phishing and pretexting, remain effective tools for attackers. Investing in employee security awareness training and implementing strong authentication measures are crucial to mitigating these risks! Finally, last but not least Credentials remain a top target - The use of stolen credentials was involved in 24% of breaches. (followed closely by ransomware at 23%) Implementing strong passphrase policies, MFA, and monitoring for credential compromises are essential to preventing unauthorized access. (Exhibit A - the UHC breach!) #CybersecurityAwareness #DBIR2024 #RiskManagement #DataBreach #InformationSecurity Read more in the report here:

11

1 Comment

I’m thrilled to announce the launch of CMMCheck™, a tool we’ve been developing at CMMC Zone to help organizations streamline their journey to CMMC compliance. 🎉 We know how complex compliance can be—especially with the evolving demands of the Cybersecurity Maturity Model Certification (CMMC). That’s why we designed CMMCheck™ to simplify the process by providing: ✔️ Clear readiness assessments tailored to your organization. ✔️ Support and guidance to prepare you for certification with confidence. Our mission is to empower businesses in the Defense Industrial Base to secure their operations while staying competitive in a highly regulated space. If you’re working through CMMC compliance, I’d love to hear your thoughts or discuss how CMMCheck™ can support your efforts. Together, we can strengthen the security of our nation’s defense supply chain. 💻 Check it out here: https://www.cmmc.zone #CMMC #Cybersecurity #Compliance #DefenseIndustry #CMMCheck

47

This week, Field Effect published the initial version of our Customer Responsibility Matrix (CRM) for CMMC Level 2 on our Trust Center (https://lnkd.in/eVgDBBQR). This in-depth document establishes the responsibilities for our customers and our MDR service, and outlines how to document Field Effect as a Security Protection Asset in a System Security Plan. We hope our CRM will provide a solid foundation for our customers to achieve their CMMC compliance goals and instill confidence that Field Effect will be there to support them on their journey. #CMMC

34

1 Comment

I'm attending the 11th Annual DC Metro Official Cybersecurity Summit, rated Top 5 InfoSec Conference, on Thursday, July 18! Join me at this educational event to learn from leading industry experts about the latest threat landscape & best practices in combatting #cybercrime and protecting your company from a #breach. Hope to see you there! #OfficialCybersecuritySummit #CSSDC #CRAEvents #cybersecurity #infosec #ciso #cyber

33

1 Comment