Chris H.’s Post

Boston Public Library 📚 Someone recently sent me a screenshot from visiting the Boston Public Library I was really surprised to see my book Software Transparency from Wiley is at the library Looking back as a young boy growing up in a inner city (Cleveland) to a single mom, I never would of guessed I would have a book floating around libraries It's something I'm really proud of Despite being 18~ months old, I still put this book on the topic of Software Supply Chain Security up there with some other great ones from folks such as Cassie Crossley, Michael Lieberman and Brandon Lum And - the topic is only getting more critical, from open source, commercial products, SaaS and more, attackers continue to realize the opaque, complex and brittle attack surface that the modern software supply chain represents

Organizing Security for Digital Transformation So much of the conversation around security hyper-focuses on the tech. From our acronym soup of security tools, to the latest buzzwords. The reality is, the way teams are structured and operating have a massive impact on organizational outcomes - even in security. This is a great paper from Phil Venables and the Google Cloud Security team discussing reshaping security teams and they way they operate for digital transformation. It discusses moving from a centralized to a product-oriented style, embracing cloud, and the various modern security organization models across areas such as cloud, SecOps, IR, IAM and more. Great read and food for thought when it comes to how security is structured and engages with business and engineering peers. #ciso #cyber #leadership

Naval Aviation & STEM Always a great show at Naval Air Station Oceana’s Air Show Big shout to Naval Sea Systems Command (NAVSEA) and Naval STEM who do a great job exposing all the area schools to robotics, engineering, aviation/naval concepts, coding and more! Thousands of kids eager to learn, tinker and explore - representing our future generation of innovators. And of course our amazing Naval Aviators who are such a great representation of what our service members are capable of 🇺🇸

"Built in not bolted on" Just kidding, let's just use it and dump all of our sensitive data into it. Looks like the industry is off to repeat previous cycles such as with Cloud - rapid adoption, with security as an afterthought but this time for AI. Feels like we've seen this movie before.. What could go wrong? 🤔 Buckle up 💺 https://lnkd.in/emRpxiXh #ciso #cyber #ai

Federal Cyber FOCAL Plan Recently Cybersecurity and Infrastructure Security Agency )CISA_ published the FCEB Operational Cyber Alignment (FOCAL) Plan It's aimed at helping Federal agencies set cyber priorities, and lays out 5 FOCAL priority areas, including: - Asset Management This includes centralized hardware and software inventory databases, automated asset discovery and documented coverage. - Vulnerability Management Activities include regularly performing full-credentialed scans, maturing vulnerability prioritization (a big one IMO), and improving remediation timelines. - Defensible Architecture This orients around Zero Trust, least-permissive access control, network segmentation and accounting for third-parties such as PaaS and SaaS - Cyber Supply Chain Risk Management (C-SCRM) The ever-present and complex supply chain involves maturing C-SCRM processes, integrating it into procurement/contracting, and broader software supply chain security considerations. - Incident Detection & Response Improving SOC governance, threat intel, and enabling continuous detection and rapid response. Good stuff for anyone dealing with Federal cyber environments to be familiar with. #cyber #ciso #nationalsecurity

Security & Cost If security is a subset of quality.. And quality products have higher costs.. Who’s going to pay the price for more secure products? Until next time in unanswered questions in cybersecurity.

IR for GenAI Workloads As organizations increasingly build workloads on top of IaaS environments and managed-AI services, there is a need to modernize approaches to Incident Response (IR). This is a great blog from the team at Amazon Web Services (AWS) discussing some key considerations when it comes to preparing for IR on GenAI workloads - It covers key components of GenAI workloads, from models, guardrails agents and data - Methodology for IR on GenAI workloads - Example incidents and key aspects to inspect, answer and consider Great work by Anna McAbee, Steve de Vera and AJ Evans https://lnkd.in/efxt58NP #ciso #cyber #cloudsecurity

What is "Secure"? We continue to hear about the need for "Secure-by-Design" or mantras like "Security is a subset of quality" Yet, as an industry, we have no universal definition of what "secure" even means. In fact, a paper from Office of the National Cyber Director, The White House points out problems with software measurability and cyber quality metrics. We hear about the need for software liability, and safe harbor, but lack any clear objective standard for what sufficient security is. We also keep pretending that security should just be there, and has no cost. The problem is, everyone wants to be secure. But no one wants to pay for it. https://lnkd.in/gvUJSFzp #ciso #cyber #appsec

Privileged Access in Multi-Cloud There's no denying that organizations struggle with security and complexity when it comes to multi-cloud environments. This includes managing privileged access and mitigating risks associated with credential compromise. This very comprehensive paper from Mandiant (part of Google Cloud) dives deep into the topic, covering: - Risks and attack vectors associated with hybrid and multi-cloud environments using real-world observations - Attack scenarios involving domain compromise and compromises of multi-cloud workloads - A proposed tiered security model in the cloud to deal with unique multi-cloud considerations - Architecture examples across AWS, Azure and GCP This is a very robust publication covering nuances associated with privileged access protections in multi-cloud environments! #ciso #cyber #cloudsecurity