Galina Antova

Is AI a friend or a foe? "There’s no guaranteed path to safety as #ArtificialIntelligence advances" warns Geoffrey Hinton, a pioneer in AI. In a recent interview with Scott Pelley, Geoffrey shares his thoughts on both the benefits and dangers of AI. What's your take? Watch 60 MINUTES: https://lnkd.in/gxJc3YkJ #AI #GenerativeAI To gain weekly insights on #technology and #innovation, subscribe to #CXOSpice newsletter (https://lnkd.in/gy2RJ9xg) and tune in for the latest edition on “Cyber Insurance”. Or subscribe to #CXOSpice YouTube channel (https://lnkd.in/gnMc-Vpj) and tune in for the upcoming episode featuring Vivek Mohindra at Dell Technologies on “AI Open Ecosystem”

304

64 Comments

I dislike using the term “crisis communications” when talking about security incidents because it gives people permission to accept chaos and panic. These are red flags that your decision-making process isn’t ready for prime time. Anyway, I’m always glad to see more security teams recognize that incident communications isn’t just what you say publicly, it’s also how you communicate internally so that you’re proud of how you show up for the people impacted.

24

Payments System Disruption - Free All-Sector TTX - Dec 11, 12-4PM ET Join us and hundreds of your peers for a complementary, all-sector virtual tabletop exercise. Are you prepared to respond to the unexpected? In today’s interconnected landscape, resilience isn’t just about preparation—it’s about collaboration and adaptability across all sectors. Our All-Sector Virtual TTX is designed to help leaders and teams strengthen their response strategies, share insights, and navigate complex challenges together. 🔹 Who should attend? cyber, resilience, risk, payments system, and response professionals 🔹 What to expect? Realistic injects, expert-led discussions, and an interactive, collaborative environment that fosters learning and actionable takeaways. Tackle disruptions across business, technology, and third-party ecosystems in a challenging scenario that tests your organization’s resilience and strategy. Don’t miss this opportunity to connect with others, test your strategies, and build resilience across the board. Secure your spot now and take a proactive step toward safeguarding your organization’s future! Register here: https://lnkd.in/dhSbUPyh #Resilience #RiskManagement #TabletopExercise #AllSectorTTX #OperationalResilience #CISO

24

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

Shadow IT is an especially big security concern in today's SaaS-based business environment. Hear from CEO of Polymer Data Security, Yasir Ali, about his approach to preventing data leakage and shadow IT as part of a proactive cyber risk management program. Catch Cyber Rants Podcast Episode 122 here or on your preferred podcast platform: https://lnkd.in/gywyScbw #cyberrants #cybersecurity #podcast #shadowIT #dataleakage

12

Exciting to analyze the latest insights from the Boeing Ransomware incident. We're seeing notable trends emerge that underscore the evolving landscape of cybersecurity threats for manufacturers. Firstly, the myth that manufacturers are immune to cyberattacks is crumbling. Many have believed they aren't prime targets due to limited personal data holdings, but recent events prove otherwise. Ransomware isn't solely about PII—it's about halting operations until demands are met, hitting manufacturers hard. Secondly, the ransom amounts demanded are soaring. The ransomware industry has matured, with negotiations becoming more complex and costly. A $200 million demand might seem steep, but for Boeing—a company with a substantial market cap (157 Billion in 2023) —it's a calculated fraction, albeit a painful one. Thirdly, Boeing's resolute stance against paying the ransom is commendable. Companies are increasingly refusing to yield to extortion, despite facing fallout like data leaks and disruptions to relationships with customers and partners. These trends underscore the urgent need for heightened cybersecurity measures and resilience strategies across industries. Let's stay vigilant and adaptive in the face of evolving threats. #Cybersecurity #RansomwareProtection #Boeing #Drip7 #Cybersecuritytraining

12

1 Comment

Supplements company is coming along well. Website is almost finished, labels finalized, all of the ingredients are ordered. Should be ready to go for at least samples at BlackHat / DEF CON - and *maybe* be ready to order by then. Some cool things, we have licensed some key ingredients that are proprietary (the ingredients are full labeled for transparency - no "proprietary blends") and have a lot of backed research behind them. The pre-workout has S7 - which research has shown through multiple studies to boost nitric oxide (it's one of the best) for vasodilation (the pump and oxygen flow). SantEnergy Nu - a high-quality plant extract from Santa Herba which the research studies show metabolism & energy boosters, antioxidant, and weight regulation/loss booster. zumXR Extended and Delayed which are the only patented delivery system for caffeine release in the body so you don't get a crash and consistent energy use through the day. About a year and a half of research and trial and error to get to this perfection blend of various ingredients. Everyone that's tried it has said so far it's the best pre-workout they've ever taken. I'm really excited about the addition of GABA - we're one of the only ones out there that leverage it which increases natural IGF-1 production if used as a pre-workout 6 fold. GABA also hits the GABA receptors which has an effect of added energy and focus. Lots of other stuff. Coming soon! Citrulline Malate (fermented) – 5000 GABA - 750 (natural IGF-1 production, energy, focus) Beta-Alanine – 3000 (helps regulate acid in muscles and prevent fatigue) Taurine – 2000 (reduces muscle fatigue / increase performance) L-Tyrosine -- 2500 (focus and concentration) Caffeine Anhydrous 200 ZumXR Caffeine Extended – 65 ZumXR Caffeine Delayed – 60 S7 (Pump/Bloodflow) - 50 ZumXR Santenergy Nu – 400 Sodium Chloride – 20 (salt/hydration) Bioperine – 10 (strength, increase endurance, decrease fat mass, and protects lean muscle) Malic Acid – 115 (energy metabolism, improved cardiac function, alleviate sports fatigue, promote regeneration) Yohimbe Extract – 100 (some folks have sensitivity here, note its the extract, very small dosage, and coupled with betaine HCL for digestion, tolerated very well and a good for blood flow and energy kick) Alpha GPC - 300 (recover faster, builds muscle, and improves strength, focus, increases IGF-1) Magnesium Malate – 200 (Magnesium + Malic Acid - bioavailable magnesium for energy production) Silicon Dioxide - 100 (anti-caking) Betaine HCL – 2500 (absorption and digestion) S7(R) - https://lnkd.in/gPQyDTe3 SantEnergy Nu (TM) - https://lnkd.in/grZvzDBV zumXR Extended (R) - https://www.zumxr.com/ zumXR Delayed (R) - https://www.zumxr.com/ https://lnkd.in/gsHvRrsV

67

7 Comments

🔥 Tomorrow night at 6 pm PDT, join us at the OWASP Orange County #meetup where Mike Larkin, CTO and co-founder of Deepfactor will lead the 90-minute hands-on live #workshop "Vulnerability Reachability Analysis Using OSS Tools” and will dive into: ✅ What vulnerability reachability is and why it is important ✅ Two main ways of understanding reachability (static call graphs and runtime analysis) ✅ Two short exercises for the attendees to gain hands-on experience using both types of tools against real applications with real vulnerabilities We look forward to seeing you there. Check the link in the comments for sign-ups! #AppSec #Security #Deepfactor

13

2 Comments

Non-compliance can cost millions in fines and damage your reputation. Are manual processes keeping you behind? IBM’s 200+ automated workflows tackle compliance challenges across industries: • Effortlessly classify sensitive data across hybrid cloud environments. • Automate workflows tailored to industry-specific standards like HIPAA, GDPR, and SOX. • Save time and reduce risk with custom reporting tools. Compliance isn’t optional—but it doesn’t have to be hard. IBM makes it simple. RSec Group helps you implement, contact us @ rsecgroup.com #ComplianceAutomation #RegTech #DataProtection #IBMpartners #IBMAmplify #RSec #IBM

9

Looking forward to speaking with Joel Jacobs, Matthew Ebben, and Marc Woolward at 11:00am EDT this morning, about navigating Cyber Resilience -- touching on contemporary Trends, Challenges, & the Role of Dependencies. Thanks to our host, vArmour. Hope you can join us, or register and catch the recording later. #cyberthreat #cyberentropy #complexity #cyberdependency #vulnerability #cyberrisk #situationalawareness #riskawareness #riskmitigation #cyberresilience #ciso #cio #coo #boardofdirectors #bia #businessimpactanalyses

12

2 Comments

AI is transforming industries, but when it comes to critical infrastructure—the systems that power our homes, deliver healthcare, and safeguard digital networks—the stakes couldn’t be higher. The U.S. Department of Homeland Security’s Roles and Responsibilities Framework for AI in Critical Infrastructure is a timely blueprint, emphasizing the need for a collaborative, strategic approach to AI deployment. Here’s why this matters and how we can drive meaningful progress. The Framework underscores that securing critical infrastructure is a shared responsibility. It calls on AI developers, infrastructure operators, cloud providers, and the public sector to align across areas like responsible design, data governance, and safe deployment. At the same time, it warns of interconnected risks—from operational disruptions to AI-enabled cyberattacks across sectors. While its voluntary guidelines are a crucial step forward, the global and systemic nature of AI threats demands stronger, proactive regulations and global standards. Transparency in AI systems must extend beyond technical documentation. We need to build a culture of AI literacy among our non-technical stakeholders—policymakers, business leaders, and the general public—so they can engage meaningfully with AI-related decisions. Trust in AI is not only about the systems themselves but about the people who build and govern them. Read more at: https://lnkd.in/eVyix4jv

19

2 Comments

The Security Exchange Commission's latest disclosure rules have significantly increased the pressure on CISOs and security leaders to strengthen their cybersecurity posture. Failure to comply could lead to severe consequences. Questions? We can help you navigate these new regulations with confidence. Contact us today to discuss a strategy for SEC-compliant cybersecurity ✔

1

Don’t get caught off guard 💂‍♂️ The Gartner report provides an essential list of dos and don’ts relating to incident reporting, cybersecurity governance and risk management. Read the report for insights to help you: ▪ Understand the SEC’s new requirements ▪ Identify gaps in your current cybersecurity program ▪ Develop a robust compliance strategy ==

2

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

35 Comments

Thrilled to have joined Strike Graph's podcast (SecureTalk) to discuss building a strong cyber risk management practice! I explored how to develop essential ECRM tools, secure organization buy-in, and transform cybersecurity from a defensive measure into a true competitive advantage. I also shared insights on creating a budget philosophy that aligns with strategic goals. For anyone interested in moving beyond defense and turning cyber risk management into a growth driver, this episode is for you! I’d love to hear your thoughts—how are you approaching cyber risk management as a strategic asset in your organization? Thank you, Justin Beals, for an enlightening conversation! #CyberRiskManagement #CompetitiveAdvantage #ECRM

4

As we get back from the craziness of RSAC, I'm getting ready for the next big event on the horizon. The CISO Village Summit by Team8 is back with 100 CISOs and security leaders joining me this June in California! The magic of the Summit is more than that of a regular conference; our 300-strong community is a place of genuine curiosity, innovation, and collaboration, offering a forum for professional and personal growth alongside the industry's best. Throughout this exclusive five-day event, don't miss the chance to engage in meaningful discussions with industry leaders on: * The changing threat landscape * AI’s impact on cybersecurity’s challenges and solutions * Socio-economics and geopolitical tensions filtering into cybersecurity policy * The complex CISO-CEO relationship * And more. Spots are limited and closing fast— so apply now to not miss out! https://lnkd.in/gKj-jvS5 Team8 #Team8CISOVillage #Cybersecurity

171

9 Comments

The U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency released a Notice of Proposed Rule Making (NOPR) to implement the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) that was signed into law in March 2022. If you are a a #CISO, #CEO #CIO or #Board member, you should be familiar with the 447 page proposal and what it may mean to your organization. Mark Weatherford and I highlight some of the key points and concerns we have with the proposed rules here https://ow.ly/1Lzh50RlRJx Key Takeaways - 1. This would massively expand CISA scope and size and cost $2.6B. 2. This could fundamentally change CISA to be more "SEC-like" in how companies approach their relationship (how will this affect Public-Private partnerships) 3. It puts another reporting requirement for companies that are already grappling with incident reporting. 4. It is unclear what benefit US companies will receive in exchange for reporting and sharing data. 5. It may open up companies to additional liability. 6. It will create a unique data repository that, if breached, could cause serious long term impacts to the cybersecurity community. Learn more: https://ow.ly/1Lzh50RlRJx #cybersecurity #CISA #regulations #breach

48

3 Comments

How do you turn challenges into lemonade when cybersecurity gives you lemons? In the ever-evolving cybersecurity landscape, we find ourselves facing a basket of metaphorical lemons – escalating geopolitical tensions, tightening compliance regulations, and the rise of generative AI. But as the saying goes, when life gives you lemons, make lemonade! The Splunk State of Security 2024: The Race to Harness AI report takes us into this lemonade-making process. Here are my key takeaways: 💡91% of security teams are using generative AI, but 65% of security professionals don’t fully understand its implications. 💡86% say they’ll shift budgets to prioritize meeting compliance regulations over security best practices. 💡48% have experienced cyber extortion, making the attack technique more popular than ransomware itself. So, let’s mix those lemons with insights, stir in some resilience, and raise a glass to a more secure future! Here is the State of Security 2024 Report: https://lnkd.in/gEfm6fWB? #Cybersecurity #AI #RiskManagement #CISO #BoardDirectors #CEOs

47

18 Comments

They say that for a concept to be portable, it must be memorable. In that spirit, I wanted to offer a few suggestions for connecting to the intent of each of the ISO High-Level Structure (#HLS) elements. For those of you building your management system(s), or simply integrating a new MS (like #ISO42001) into your existing management system(s), please keep these quotes in mind. ➡️ Clause 4: Context of the Organization Understanding internal and external dynamics affecting goals and systems. 🖊️ “To know thyself is the beginning of wisdom.” – Socrates This speaks to the importance of self-awareness—an apt metaphor for understanding your organizational context. ➡️ Clause 5: Leadership Demonstrating commitment and setting direction for the management system. 🖊️“A leader is best when people barely know he exists, when his work is done, his aim fulfilled, they will say: we did it ourselves.” – Lao Tzu This captures the essence of leadership that inspires action and responsibility as a cultural norm. ➡️ Clause 6: Planning Determining risks, opportunities, and objectives for continual improvement. 🖊️“In preparing for battle I have always found that plans are useless, but planning is indispensable.” – Dwight D. Eisenhower It underscores the importance of the planning process, even (or especially) when conditions change. ➡️Clause 7: Support Providing resources, competence, awareness, and communication. 🖊️“Give me six hours to chop down a tree, and I will spend the first four sharpening the axe.” – Abraham Lincoln Your focus on preparation and equipping your resources aligns perfectly with this clause. ➡️Clause 8: Operation Executing and controlling processes to meet objectives. 🖊️“Well done is better than well said.” – Benjamin Franklin It emphasizes the importance of action and implementation over mere promises. People believe the behavior, not the words. ➡️Clause 9: Performance Evaluation Monitoring, measurement, analysis, and evaluation of performance. 🖊️“What gets measured gets managed.” – Peter Drucker This highlights the significance of consistent evaluation and feedback, both balancing and reinforcing. ➡️Clause 10: Improvement Continual improvement of the system and corrective action for nonconformance. 🖊️“The greatest glory in living lies not in never falling, but in rising every time we fall.” – Nelson Mandela This resonates with the spirit of continuous improvement and learning from mistakes. Failure isn't fatal unless we choose for it to be. I would genuinely love your feedback…what quote or quotes resonate most with you as you think about architecting your governance and management systems? A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

10

2 Comments