Kyle Hanslovan

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

Take advantage of this folks! I have always used "Investigation Theory" as a foundational course when building teams and creating talent pipelines from the help desk and IT engineering teams over to cybersecurity. Link in comments (and I'm not getting paid for this - I just think it's good 😉)

6

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

As a 10+ year cybersecurity professional, I've seen SOMETHINGS!! Business owners ignoring red flags, delaying critical measures, and expecting top-tier protection on a "just fix it" budget. Those days? They’re long gone!! At OQPS we're no longer chasing after businesses to convince them to prioritize their cyber security. If you don’t see the value in protecting your operations before disaster strikes, we’re not the team for you. Here’s the reality: 🛡️ Cybersecurity isn’t a reactive service; it’s a proactive investment. 💰 Top-tier protection requires commitment, not a shoestring budget. 🚨 “Just fix it” doesn’t work when your data, reputation, and future are on the line. If you’re ready to take your security seriously, we’re here to help. But if you’re waiting for a drastic incident to wake you up, we’ll still be here, but it’ll COST you ALOT more. The choice is yours: ➡️ Proactive protection that safeguards your business OR ➡️ Playing catch-up after the damage is done We’re working with clients who value their security, their customers, and their future. If that’s you, let’s talk [email protected] If not, best of luck.

6

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

At Gartner IAM? Come meet the Permiso Security Team at Booth 235! Come see how bad actors bypass IAM controls across your IDP, SaaS, and cloud environments. Learn why standard IAM controls miss these attacks and how Permiso helps you get a grasp on and improve your identity risk posture and detect compromised credentials in minutes.

29

Day 2 Gartner IAM! IAM teams: You're masters of identity hygiene and Tier Zero asset protection. Now it's time to lead the charge on identity threat detection. Visit Permiso at Booth 235 to see how your IAM expertise can power better threat detection and incident response across cloud and SaaS. If you are on the Security side, see how we detect compromised credentials across SaaS and cloud in minutes, automate investigation, and enable you to move right to response. Breaking silos between IAM and Security = stronger identity defense. Sanjeev Williams Kyle M. Christine Stevenson

4

Articles like these are why I use Brian Krebs articles in my workshops. If you want to learn how follow investigative thread to track down miscreants, see if you can copy one of Brian’s step by step investigative paths. https://lnkd.in/gbZDiH6Z

8

1 Comment

Immediate Steps to Take After a Cyber Breach When a cyber breach hits, time is money—and every second you lose could cost your business thousands. So, what's the game plan? First, isolate the breach to prevent further damage. Next, protect your data by locking down sensitive systems and begin assessing the scope of the attack. Don't waste time—speed is everything here. If your business isn't prepared to respond within minutes, you're already behind. Does your company have a clear post-breach response plan? Let's get one in place before it's too late. #PostBreach #IncidentResponse #CyberSecurity

8

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

43

1 Comment

While we need to modernize our approach to security… “There are whole Private Equity firms that have built a business around buying End of Life Products and putting them on life support.” ☠️ - Andrew Morris on risky biz The industry needs to EOL more products and get them off the internet! 🙃 #cybersecurity #infosecurity

20

1 Comment

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

Why Security Matters: A Lesson from the Golf Course https://lnkd.in/duCjZ4s5

1

If you’re in the Orlando area July 25th, I’ll be speaking at InfraGard with some great people and the Breacher.ai team to cover Deepakes. I believe #Deepfakes are a very real threat, and we’re seeing an explosive rise. We’ll be covering some insights into how organizations can protect themselves and how to combat Deepfakes. Join us, it’s free! https://lnkd.in/e4vSzii8

10

2 Comments

When you realize your #SOC2 report is full of holes. Just like when your kid (or grandson) is missing a sock🧦 That’s right…just like my grandson’s 𝘮𝘪𝘴𝘴𝘪𝘯𝘨 𝘴𝘰𝘤𝘬, some SOC2 reports out there are 𝐢𝐧𝐜𝐨𝐦𝐩𝐥𝐞𝐭𝐞, 𝐢𝐧𝐜𝐨𝐧𝐬𝐢𝐬𝐭𝐞𝐧𝐭, and 𝐝𝐨𝐰𝐧𝐫𝐢𝐠𝐡𝐭 𝐮𝐬𝐞𝐥𝐞𝐬𝐬. The culprit? 𝐒𝐎𝐂𝟐 𝐦𝐢𝐥𝐥𝐬. ⁣ You know the type—𝐜𝐡𝐮𝐫𝐧-𝐚𝐧𝐝-𝐛𝐮𝐫𝐧 operations 𝘤𝘳𝘢𝘯𝘬𝘪𝘯𝘨 out “𝘚𝘖𝘊2 𝘤𝘰𝘮𝘱𝘭𝘪𝘢𝘯𝘵” reports faster than you can say, “𝐈𝐬𝐧’𝐭 𝐭𝐡𝐢𝐬 𝐣𝐮𝐬𝐭 𝐚 𝐠𝐥𝐨𝐫𝐢𝐟𝐢𝐞𝐝 𝐜𝐡𝐞𝐜𝐤𝐛𝐨𝐱?” I was chatting with Brian and Rob the other day about #SOC2 and setting the scope up and talked about being careful of listing the same control in too many places and the importance of quality audit firms. ✔️SOC 2 report is supposed to be 𝐦𝐨𝐫𝐞 𝐭𝐡𝐚𝐧 a 𝘳𝘶𝘣𝘣𝘦𝘳 𝘴𝘵𝘢𝘮𝘱. ⁣ 🪞It’s a reflection of your organization’s 𝐜𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 to 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 and 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞; 🅣🅡🅤🅔 𝐦𝐞𝐚𝐬𝐮𝐫𝐞 of your 𝘢𝘣𝘪𝘭𝘪𝘵𝘺 to protect client data. ⁣ ⁣✂️But when 𝘤𝘰𝘳𝘯𝘦𝘳𝘴 are ⒸⓊⓉ, you’re left with something that looks good on the surface but falls apart under scrutiny. So todays #spicyMonday real talk ➡️A SOC 2 report from 𝐚 𝐥𝐨𝐰-𝐪𝐮𝐚𝐥𝐢𝐭𝐲 mill might pass the 𝘴𝘯𝘪𝘧𝘧 test for your clients 𝘵𝘰𝘥𝘢𝘺, but when an 𝐢𝐧𝐜𝐢𝐝𝐞𝐧𝐭 happens, that ̲𝚙̲̲𝚊̲̲𝚙̲̲𝚎̲̲𝚛̲-̲𝚝̲̲𝚑̲̲𝚒̲̲𝚗̲ “audit” ⓦⓞⓝ’ⓣ ⓢⓐⓥⓔ ⓨⓞⓤ.⁣ ➡️The biggest risk? Trust. Your clients 𝐝𝐞𝐬𝐞𝐫𝐯𝐞 better than a check-the-box audit. 𝐘𝐨𝐮 deserve 𝐛𝐞𝐭𝐭𝐞𝐫 than flying blind. What you 𝐬𝐡𝐨𝐮𝐥𝐝 look for in your SOC2 ̲𝚓̲̲𝚘̲̲𝚞̲̲𝚛̲̲𝚗̲̲𝚎̲̲𝚢̲:⁣ 1️⃣ Auditors who ask the 𝐡𝐚𝐫𝐝 𝐪𝐮𝐞𝐬𝐭𝐢𝐨𝐧𝐬 and 𝐝𝐢𝐠 𝐝𝐞𝐞𝐩; not just breeze through your checklists.⁣ 2️⃣ A report that 𝐚𝐜𝐭𝐮𝐚𝐥𝐥𝐲 𝐫𝐞𝐟𝐥𝐞𝐜𝐭𝐬 your security controls, 𝐧𝐨𝐭 just what you 𝘵𝘩𝘪𝘯𝘬 𝘺𝘰𝘶𝘳 𝘤𝘭𝘪𝘦𝘯𝘵𝘴 𝘸𝘢𝘯𝘵 𝘵𝘰 𝘴𝘦𝘦.⁣ 3️⃣ A 𝐩𝐚𝐫𝐭𝐧𝐞𝐫 who ensures your SOC2 aligns with your broader 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 goals; not just 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐟𝐨𝐫 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞’𝐬 🅢🅐🅚🅔.⁣ ⁣ So next time you’re thinking about a SOC2 report, ask yourself ❓Is it sock-solid or full of holes? 💪Let’s stop settling for the checkbox and start demanding something better. If you are looking for an audit firm check out Pelican3 Consulting LLC, CPAs & IT Advisors ControlCase Insight Assurance 360 Advanced #Cybersecurity #Compliance #MSPs #SecureYourFuture

45

9 Comments

My interview with Irina Tsukerman at the Washington Outsider Radio Show was published last night, and I wanted to share it with all of you. We discuss my book and the real-life events that inspired the story, which are shocking by most standards. We get into how an investigation into embezzlement quickly turned into a large identity theft investigation involving health insurance brokers and American Income Life, and how that investigation brushed up against organized crime and potential nation-state activity with indications that my family was targeted due to multi-generational history with the US Army Corps of Engineers, and with all frankness, the sloppiness of my father's and the organization's security practices that left them open to vulnerabilities that affected the safety of potentially the entire city of Portland, Oregon. We also discussed the blowback I received for coming forward with such alarming information and how that endangered my safety and well-being both in general and in a particular incident best described as local yokel social engineering that resulted in me being at the wrong end of a madman with a gun. We also discuss the Russian Orthodox Church in Bend, OR, the ties between specific individuals in that church and the Oregon health insurance broker community, and connections that indicate they are profiting from the theft of Social Security numbers and banking information via identity theft and money laundering. We also touch on how the attorney I had appears to have been blackmailed, possibly due to his firm showing up in the Panama Papers, which I didn't realize then but discovered later when I took the investigation into my own hands. It's tough to summarize, and since this was the first time anyone sat me down to discuss this with probing questions, it's quite revealing and likely a story you all haven't heard in this way before. With that in mind, I hope you listen to this and all enjoy it. Be safe out there, my friends. #Fraud #InsiderThreats #IdentityTheft #PPPfraud #insurance #healthinsurance #Oregon #Obamacare #LifeInsurance #Espionage #Corruption #ACA

7

3 Comments