Paul Calatayud

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

A new AD is available for public comments: 3946: NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations To post comments, create a FREE account and add comments in the box with the red balloon https://hubs.la/Q02J94Vh0 #unifiedcompliance #cybersecurity #authoritydocuments #riskmanagement

3

Prepare for the Cybersecurity Assessment Tool (CAT) Sunset coming in 2025. Learn about its impact on financial institutions, alternative frameworks like NIST 2.0, and how to crosswalk existing controls. https://okt.to/ZfnCdM #Cybersecurity #Alert #CATSunset #RiskAdvisory

2

We really need to stop using FTP servers, especially for sensitive data 🛡️ Sensitive data on nearly 1 million Medicare beneficiaries in Wisconsin was compromised in 2023 due to a ransomware attack exploiting Progress Software’s MOVEit file-transfer service flaw. On September 6, The Centers for Medicare & Medicaid Services (CMS) announced that its contractor, Wisconsin Physicians Service Insurance Corp., was impacted by the MOVEit flaw. The compromised data includes names, Social Security numbers, dates of birth, addresses, hospital account numbers, Medicare beneficiary identifiers, and health insurance claim numbers. CMS began notifying nearly 950,000 affected individuals last week, following Wisconsin Physicians Service’s notification of the breach on July 8. The data breach is part of a larger wave of attacks in May 2023 targeting the MOVEit vulnerability. Organizations like the Texas Dow Employees Credit Union have also recently disclosed breaches related to the MOVEit vulnerability. https://lnkd.in/gP8t4E3C

3

Catch the Latest Episode of the Security Swarm Podcast! 🎙️ In this episode, host Andy Syrewicze and guest Paul Schnackenburg discuss critical issue of software quality in cybersecurity. They explore why we don't just have a cybersecurity problem, but a fundamental software quality problem. Key insights include: 🔹 Why software innovation shouldn't come at the cost of stability 🔹 The challenges in developing secure code 🔹 How the tech industry can prioritize security and reliability Don't miss out on this insightful discussion. Listen to the full episode here: https://lnkd.in/exCBHSB5 #Cybersecurity #SoftwareQuality #TechSecurity #SoftwareDevelopment #SecuritySwarmPodcast

6

Marketing & e-commerce best practices need to evolve. If you have to trick people or withhold information to convert a sale, that should tell you something about the true value of what you're selling.

5

Happy #CMMC Day! Quick thoughts on the rule from my first pass at a read below. In short, exciting times, and it puts me back in a bit of nostalgia remembering the early DFARS 7012 days and the first whispers of "CMMC" on some webinars. What a process it's been. See the rule here: https://lnkd.in/grPxUnTx Anyway, my thoughts: Chiefly, I see a number of smart, common-sense determinations from DoD on some major architectural concerns we had. On the concern regarding managed services providers like Sentinel Blue possibly being deemed in scope for FedRAMP requirements, we see language that make much clearer that the services we provide to our partners does not scope us in for FedRAMP. On the concern that tools we use to provide security protection to our partners, deemed security protection assets, would require full implementation of all 110 requirements, we see language that provides a much more reasonable interpretation, allowing SPAs to only be assessed against security requirements that are “relevant to the capabilities provided” On the concern that virtual desktop infrastructure may be scoped in a way that would require us to protect the “dumb client”, or the computer you open the virtual desktop from, we see language where DoD has made clear that we can keep those assets scoped out using appropriate technical controls to prevent data transfer. On the potential requirement for Sentinel Blue to achieve CMMC Certification before any of the partners we support could achieve theirs, the final rule no longer creates any requirement that Sentinel Blue and MSP/MSSPs even need a CMMC Certification. That’s a significant change that shifts things around a bit. These are good moves on the whole, and I think improve things for the DIB vs. the way things were looking. #msp #compliance #cybersecurity #cmmc #dfars #dib

56

5 Comments

Come and help us "Keep Austin Weird", April 30th, as Grace Beason, Matthew Rosenquist and I share the stage to discuss all things #METRICS in Cybersecurity, Risk Management and Governance at InnoTech's Austin Information Systems Security Association (ISSA) Security Conference. Details below... See you there! #ciso #issa #isaca #atx

21

3 Comments

AI vulns in the NVD… Cool! Like the NVD maintainers have nothing left to do with “non-AI” vulnerabilities. In the same article, the good news, however, is Congress is finally concerned about the NVD situation: “…actively exploring solutions to help NIST address this problem...” #NVD #vulnerabilitymanagement https://lnkd.in/gB-zdHHW

7

🤔 Curious to see what's new in NIST CSF 2.0? From governance enhancements to strategic refinements, the NIST Cybersecurity Framework just received a significant update! Join James Tarala as he walks through these crucial changes and offers actionable steps to implement them in your organization’s security strategy. 👉 Register now: https://lnkd.in/eu9PgU_M #CyberRiskManagement #NISTFramework #SecLeadership

24

1 Comment

Are you registered for our Managed Detection and Response Thought Leadership Discussion on July 23rd? ​ We’ll be covering a lot of different topics, including:​ 👉 Current Trends in MDR​ 👉 Live Demo: Tabletop Exercise​ 👉 Live MDR Experience​ 👉 Threat Research and Intelligence​ 👉 Lateral Movement Demystified​ 👉 EDR vs. MDR​ 👉 How We Can Help​ Don’t miss this opportunity to enhance your understanding of MDR and fortify your organization’s defenses against emerging threats.​ Sign up here by July 20th: https://hubs.li/Q02FzLgH0 #ManagedDetectionandResponse #CybersecurityThreats #CybersecurityEducation #InformationTechnology #BusinessTechnology​ ​

4

Regulatory compliance is a moving target. Utah's recent modifications to its breach notification law highlight the importance of staying informed. With Cyber RegScout™, you'll receive comprehensive coverage and expert analysis to keep your compliance efforts on track. Learn how now! #cybersecurity #breach #incidentresponse #notification #regulation #compliance

7

🚨 Neglecting certificate lifecycle management can expose your organization to risk. During our upcoming #PKI Insights webinar, we’ll share best practices for improving your PKI’s overall health and security. Whether you’re responsible for managing PKI or evaluating your organization’s security posture, this webinar is packed with practical insights you don’t want to miss! 📅 Thursday, Oct. 31st 🕝 10am Pacific Register today to stay ahead of the curve: 🔗 https://ow.ly/nWZO50TVKji #PKISolutions #DigitalCertificates #CyberSecurity

5

👻 https://lnkd.in/eFHd2fXA Strengthen your organization's defenses against lurking cyber threats with a next-gen SOC. Discover how WEI’s modern SOC solutions can enhance incident response and keep your team a step ahead. #Cybersecurity #SOC #IncidentResponse

Episode 176 of CISO Stories featuring Michael C. Redmond, PhD, MBA, ISO Cyber Certifications, Deputy CISO of Louisville Metro Government Available now! Hosted by Todd Fitzgerald, Best-Selling Author of CISO Compass and VP, Cybersecurity Strategy, CyberRisk Alliance Data Governance is a key component in protecting the data from different points of view including information security confidentiality, integrity, and availability. There are several standards that have control requirements for Data Governance relating to PCI, HIPAA, and PII, data security and more. Two of the Internal Standards having Data Governance requirements are: GDPR, ISO/IEC 27001:2022 The internal policies pertaining to gathering data, processing data, storing date, and disposal of data storing data, and disposal of data are a concern of information security. These polices also affect but also asset management, It governs who can access what kinds of data and what kinds of data are under governance. https://lnkd.in/gBS9UVdJ #ciso #collaboration #grc #datagovernance

7

💡 How does my PKI’s status compare to that of others? Understanding where your Public Key Infrastructure (PKI) stands compared to others can be a game-changer. It’s not just about identifying benchmarks and best practices but also uncovering areas ripe for improvement. 🌟 While it’s crucial to tailor your PKI evaluation to fit your organization’s unique needs and constraints, benchmarking against industry reports, case studies, and peer-reviewed publications can offer invaluable insights into your PKI’s performance. 📊✨ Though the PKI Consortium doesn’t publish individual maturity assessment results, we provide a vibrant community where you can exchange experiences and learn from others. Join our working groups and tap into a wealth of shared knowledge! 🤝🌐 Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium

13

Datastor Assured Recovery (DAR) is comprehensive ransomware protection and recovery at scale. Instantly scalable means you can seamlessly expand your infrastructure w/ swift deployment, streamlined administration, and effortlessly adaptable scalability, all at your fingertips. https://lnkd.in/gVtwk_U6

13

If you're struggling with compliance and security challenges, CCM might me the game-changer you need. Here's why: 🏆 Rapid Certification: Achieve compliance certifications like SOC 2, CMMC, or NIST CSF in record time – like a FedRAMP High In Process package in just 3 months. 📊 Automated Evidence Collection: Cut audit prep time by up to 60%, saving costs and improving accuracy. Always be audit-ready! 🗺️ Streamlined Compliance: Map a single control across multiple frameworks, eliminating redundant tasks and ensuring a harmonized compliance posture. 🔄 DevSecOps Integration: Embed compliance checks directly into your development pipeline, maintaining security without disrupting workflows. #ContinuousControlsMonitoring #Compliance #Cybersecurity #RiskManagement #RegScale

4