Carl Brown

⏰ Sharing this latest news! ✅ one reminder why cybersecurity vendors should not point fingers when others fail but double their efforts to continuously check their products and internal processes. The worst risk is not learning from others' mistakes. #cybersecurity #cyberawareness #security #misconfiguration #emailcompromise #proofpoint

1

The Cybersecurity and Infrastructure Security Agency's new Secure by Demand guide provides questions that customers should ask of #software manufacturers to understand the security mindset of the software design & development. The guide is a counterpart to the Secure by Design guide. Read more: https://lnkd.in/gEFYEpsS

15

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

🔐 CMMC Needs Clear SSO Rules: Here’s Why- Current CMMC, NIST 800-171/172, and FedRAMP lack explicit controls for Single Sign-On (SSO), creating critical security risks. The Problem ⚠️ No defined SSO boundaries ⚠️ Unrestricted third-party SSO poses risks ⚠️ Breach amplification and reduced visibility The Solution * Define SSO boundaries * Restrict SSO to vendor ecosystems * Align with Zero Trust principles The financial sector enforces strict SSO controls—shouldn’t defense systems do the same? 💬 What’s your take? Should SSO boundaries be mandatory in cybersecurity frameworks? #Cybersecurity #CMMC #NIST #DefenseIndustry #ZeroTrust #SSO #DoD #CISA #NSA

4

⚡ Cybersecurity threats are evolving fast! To stay ahead, organizations must embrace new security approaches involving fresh strategies, technologies, and a cloud-ready mindset. 🌐 Enter MITRE ATT&CK — the ultimate guide for security practitioners packed with invaluable insights into attacker techniques and behavior. Pretty handy, right? 💡 Sysdig's eBook show you how to identify and defend against common threats to #AWS environments using open-source Falco rules mapped to the ATT&CK framework. Boost your #AWScloud security and tackle any threat head-on by giving it a read today:

3

According to the 2024 Deloitte-NASCIO study, 49% of CISOs consider that recruiting and retaining talent in cybersecurity remains a major challenge. This skills shortage complicates the management of increasing cybersecurity threats, while budgets remain tight. For more details, check out the full study:  https://lnkd.in/gQN3MSUc #cybersecurity

17

1 Comment

Attackers no longer hack their way in; instead, they log in. Assess your attack readiness plus learn how the free, open source tool Halberd can simplify security testing to detect and stop identity and cloud attacks.

1

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

💡 Where can I access the PKI maturity assessment tools? Are you looking to enhance your PKI maturity and drive your organization to new heights of security excellence? 🔍 Discover the PKI Maturity Assessment Tools 🔍 Head over to the Tools section in the PKI MM documentation to access resources, including: 📋 PKI Maturity Assessment Tools 📚 Step-by-Step Guidance for Conducting Assessments 📝 Templates for Reporting Assessment Results These tools are crafted to help you evaluate your PKI maturity, pinpoint areas for improvement, and stay ahead of the curve with the latest best practices and industry standards. 🌐✨ 🔄 Why Wait? Take the First Step Towards PKI Excellence Today! 🔄 Tools are regularly updated to ensure you have the most current and effective resources at your fingertips. Stay tuned because we are preparing interesting updates to tools! Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

12

1 Comment

Why Security Matters: A Lesson from the Golf Course https://lnkd.in/duCjZ4s5

1

5 Key Questions CISOs Must Ask Themselves About Their Cybersecurity Strategy

1

World Password Day – May 2nd 2024 Thursday, May 2, 2024, is World Password Day. Established in 2013, the event is observed on the first Thursday of May with the goal of improving awareness of the importance of creating complex and unique passwords and adopting password best practices to keep sensitive information private and confidential. Passwords were first used to protect accounts against unauthorized access in computing environments in the 1960s. In 1961, researchers at the Massachusetts Institute of Technology (MIT) started using the Compatible Time-Sharing System (CTSS). The system ran on an IBM 709 and users could access the system through a dumb terminal, with passwords used to prevent unauthorized access to users’ personal files. The system is widely believed to be the first to use passwords and was also one of the first to experience a password breach. In the mid-1960s, MIT Ph.D. researcher Allan Scherr needed more than his allotted 4-hour CTSS time to run performance simulations he had designed for the computer system. He discovered a way to print out all passwords stored in the system and used the passwords to gain extra time. Interesting read about Are Your Passwords in the Green?

11

Enhancing Cybersecurity for SMBs: Key Metrics That Matter

7

Corncon24 is in day two and we are listening to Zach Kromkowski drop some knowledge on asset hardening.

16

3 Comments

Businesses are getting broken into because attackers want their data. If you don’t understand where it is exposed, if you don’t understand how it’s being used, how can you properly protect it? That’s part of the problem we help organizations solve. #data #AI #security

4

1 Comment

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

This is really neat to have our Velocity platform listed on CISA's website 😊 As stated below, our vision is to "Secure the Planet" and we knew that in order to do that, we would need to have a freemium model to make it more accessible. Our platform provides an opportunity for companies to evaluate their cybersecurity posture and quantify risk. Yes, you can really evaluate CMMC Level 1, CISv8 Group 1, CISA Shields Up, 405(d) HICP (Small Orgs), and more, for free within Velocity. #securetheplanet #cybersecurity #cyberriskquantification

85

16 Comments