Rick Caccia

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

As we get back from the craziness of RSAC, I'm getting ready for the next big event on the horizon. The CISO Village Summit by Team8 is back with 100 CISOs and security leaders joining me this June in California! The magic of the Summit is more than that of a regular conference; our 300-strong community is a place of genuine curiosity, innovation, and collaboration, offering a forum for professional and personal growth alongside the industry's best. Throughout this exclusive five-day event, don't miss the chance to engage in meaningful discussions with industry leaders on: * The changing threat landscape * AI’s impact on cybersecurity’s challenges and solutions * Socio-economics and geopolitical tensions filtering into cybersecurity policy * The complex CISO-CEO relationship * And more. Spots are limited and closing fast— so apply now to not miss out! https://lnkd.in/gKj-jvS5 Team8 #Team8CISOVillage #Cybersecurity

171

9 Comments

Supplements company is coming along well. Website is almost finished, labels finalized, all of the ingredients are ordered. Should be ready to go for at least samples at BlackHat / DEF CON - and *maybe* be ready to order by then. Some cool things, we have licensed some key ingredients that are proprietary (the ingredients are full labeled for transparency - no "proprietary blends") and have a lot of backed research behind them. The pre-workout has S7 - which research has shown through multiple studies to boost nitric oxide (it's one of the best) for vasodilation (the pump and oxygen flow). SantEnergy Nu - a high-quality plant extract from Santa Herba which the research studies show metabolism & energy boosters, antioxidant, and weight regulation/loss booster. zumXR Extended and Delayed which are the only patented delivery system for caffeine release in the body so you don't get a crash and consistent energy use through the day. About a year and a half of research and trial and error to get to this perfection blend of various ingredients. Everyone that's tried it has said so far it's the best pre-workout they've ever taken. I'm really excited about the addition of GABA - we're one of the only ones out there that leverage it which increases natural IGF-1 production if used as a pre-workout 6 fold. GABA also hits the GABA receptors which has an effect of added energy and focus. Lots of other stuff. Coming soon! Citrulline Malate (fermented) – 5000 GABA - 750 (natural IGF-1 production, energy, focus) Beta-Alanine – 3000 (helps regulate acid in muscles and prevent fatigue) Taurine – 2000 (reduces muscle fatigue / increase performance) L-Tyrosine -- 2500 (focus and concentration) Caffeine Anhydrous 200 ZumXR Caffeine Extended – 65 ZumXR Caffeine Delayed – 60 S7 (Pump/Bloodflow) - 50 ZumXR Santenergy Nu – 400 Sodium Chloride – 20 (salt/hydration) Bioperine – 10 (strength, increase endurance, decrease fat mass, and protects lean muscle) Malic Acid – 115 (energy metabolism, improved cardiac function, alleviate sports fatigue, promote regeneration) Yohimbe Extract – 100 (some folks have sensitivity here, note its the extract, very small dosage, and coupled with betaine HCL for digestion, tolerated very well and a good for blood flow and energy kick) Alpha GPC - 300 (recover faster, builds muscle, and improves strength, focus, increases IGF-1) Magnesium Malate – 200 (Magnesium + Malic Acid - bioavailable magnesium for energy production) Silicon Dioxide - 100 (anti-caking) Betaine HCL – 2500 (absorption and digestion) S7(R) - https://lnkd.in/gPQyDTe3 SantEnergy Nu (TM) - https://lnkd.in/grZvzDBV zumXR Extended (R) - https://www.zumxr.com/ zumXR Delayed (R) - https://www.zumxr.com/ https://lnkd.in/gsHvRrsV

67

7 Comments

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

📢 Check Point Again a Frost Radar XDR Leader in 2024 In this report, Check Point was cited as a Growth and Innovation Leader in Extended Detection and Response (XDR). Check Point XDR/XPR Key Highlights: • Collaborative Threat Prevention • AI Copilot • Consolidated Threat Intelligence and Analytics • Infinity Playblocks Automation • Centralized IOC Management • Threat Intelligence & Event Correlation Download your free copy of the Frost Radar™ XDR Report to learn more about why Check Point is a Growth and Innovation leader in Extended Detection and Response 👉 https://lnkd.in/gecJVKrG Yael Cinamon

4

If it’s true that Thoma Bravo is once again exploring a SailPoint IPO, a few things need to happen for the exit to succeed. On the surface, this move seems like it's defying the odds for a normal four-to-seven year private equity holding period. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for over 1,000 days (and counting). Current market conditions are anything but favorable, at least for anyone other than the crème de la crème of the IPO pipeline. SailPoint is anything but typical, though. I'm not convinced they even needed to go private in the first place, but here we are. News of an impending IPO is exciting to anyone who (a) likes SailPoint, and (b) wants this IPO drought for our industry to end. This is far from a done deal, but it's credible enough to do some educated speculation about what it might take for SailPoint to go public again and stay there this time. My latest article is about the metrics, narrative, and alternatives that could lead to a second SailPoint IPO. You can read more by following the link on my profile.

37

4 Comments

They say that for a concept to be portable, it must be memorable. In that spirit, I wanted to offer a few suggestions for connecting to the intent of each of the ISO High-Level Structure (#HLS) elements. For those of you building your management system(s), or simply integrating a new MS (like #ISO42001) into your existing management system(s), please keep these quotes in mind. ➡️ Clause 4: Context of the Organization Understanding internal and external dynamics affecting goals and systems. 🖊️ “To know thyself is the beginning of wisdom.” – Socrates This speaks to the importance of self-awareness—an apt metaphor for understanding your organizational context. ➡️ Clause 5: Leadership Demonstrating commitment and setting direction for the management system. 🖊️“A leader is best when people barely know he exists, when his work is done, his aim fulfilled, they will say: we did it ourselves.” – Lao Tzu This captures the essence of leadership that inspires action and responsibility as a cultural norm. ➡️ Clause 6: Planning Determining risks, opportunities, and objectives for continual improvement. 🖊️“In preparing for battle I have always found that plans are useless, but planning is indispensable.” – Dwight D. Eisenhower It underscores the importance of the planning process, even (or especially) when conditions change. ➡️Clause 7: Support Providing resources, competence, awareness, and communication. 🖊️“Give me six hours to chop down a tree, and I will spend the first four sharpening the axe.” – Abraham Lincoln Your focus on preparation and equipping your resources aligns perfectly with this clause. ➡️Clause 8: Operation Executing and controlling processes to meet objectives. 🖊️“Well done is better than well said.” – Benjamin Franklin It emphasizes the importance of action and implementation over mere promises. People believe the behavior, not the words. ➡️Clause 9: Performance Evaluation Monitoring, measurement, analysis, and evaluation of performance. 🖊️“What gets measured gets managed.” – Peter Drucker This highlights the significance of consistent evaluation and feedback, both balancing and reinforcing. ➡️Clause 10: Improvement Continual improvement of the system and corrective action for nonconformance. 🖊️“The greatest glory in living lies not in never falling, but in rising every time we fall.” – Nelson Mandela This resonates with the spirit of continuous improvement and learning from mistakes. Failure isn't fatal unless we choose for it to be. I would genuinely love your feedback…what quote or quotes resonate most with you as you think about architecting your governance and management systems? A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

10

2 Comments

This is a very interesting way to think and talk about security. Think of all the improvements or alignments that have been "saved for a later time." This is a compounding risk. I appreciated how this highlighted the fact that leaders aren't the only ones accumulating this technical debt, as teams across an organization can contribute to this issue the longer they put off an update, policy change, or procedure. Leaders need to be aware of the underlying risks seemingly invisible on the surface. Using strategies to combat underutilization can help combat the issues brought about by blind spots in detection, architecture, and engineering. Managed services are a great way to accelerate the reduction of technical debt. Ericka Chickowski, CSO Online #Cybersecurity #Leadership #CISO

8

1 Comment

FINALLY. I have been waiting years in my career for this. The moment when someone calls out the rampant corruption taking place between CISOs, security vendors, and VCs. As an *ethical* security practitioner and founder, witnessing this behavior has been maddening. For all the people who haven’t been able to break into the CISO role they’re more than qualified for, Consider the machine that is enabling these people to rotate among companies. These CISOs hop over and over again, rip out perfectly good solutions, invest in poorly built ones, upset the teams, and pocket a very very big penny despite causing chaos and wasting heaps of money. ➡️ How many times has your CISO brought in a new tool and as a practitioner you had to spend more time teaching THEM how to build the product, than you actually using and getting value out of it? This behavior puts our society at risk, and drives cybersecurity talent out of our industry. Its time for CISOs to be held accountable, with this conflict of interest put to an end. Thank you Brian Krebs for sharing this article. #cybersecurity #ciso #vc

358

40 Comments

It's a fucking honor to build products for the 99% of businesses that fall below the Fortune 500 poverty line 💪 While the Fortune 500 said SIEM was tired, the Fortune 5,000,000 showed us how to mic-drop! 🫳🎤 🧠 Affordable, predictive pricing *is* possible if you only store what matters 💾 Retaining / hunting thru petabytes of daily data *won't* break the model 💵 You can protect more than just your critical servers *if* the price is right Can't tell you how dope it feels to work with MSP partners / Customers to completely disrupt these perceptions—currently ingesting logs from 500,000+ data sources! Massive thanks to those Product Lab believers that demanded a new way to SIEM https://lnkd.in/eXKgmEHP and the team at ClickHouse who helped us reimagine a different approach to storage and scalability 🙏 https://lnkd.in/eVSh2Yfx

393

23 Comments

really liked the takeaways SeeMetrics distilled from this, esp about consensus security metrics still being unsettled as the technology, threats, and understanding levels are changing very quickly. https://lnkd.in/gZrxbsWQ

19

1 Comment

🕸 The Security Data Fabric Shift Explained🕸 Last month, Zscaler acquired Avalor for $350M. A security data fabric and vulnerability management startup that only came out of stealth in April of 2023. This acquisition sparked tons of interest and funding activity in the security data management space. It also reignited the platform v. best-of-breed debate and hinted at what's to come for AI in security products. However, this acquisition had many question marks surrounding it. In this deep dive, I cover: ✅ What security data fabrics and security data ETL are ✅ The flurry of activity that happened immediately after the acquisition ✅ Why the acquisition makes sense for Zscaler ✅ What other vendors are doing with data fabrics including CrowdStrike, Microsoft, F5, and SentinelOne. ✅ The implications for the security industry, including incumbents, startups, and security teams I also explore the growing importance of data and AI in security and how this acquisition positions Zscaler well for the next 5-10 years. What are your thoughts on this acquisition and the security data management space? Let me know what you think in the comments section! 👇 🔗 Link for the full post in the comments! #cybersecurity #datasecurity #AI #acquisition #innovation #infosec

62

23 Comments

Made some words on Help Net Security about what it means to be an industry leading Enterprise DSPM. Sure, cloud is great and it's benefits are massive, but we can't ignore data on-prem and most importantly, sitting on mainframes processing transactions every day for the last 50-60 years! It's time for contextual visibility across all data domains to ensure proper security, compliance, privacy and governance. Enterprise DSPM the 1touch.io way enables teams to unlock the value of their sensitive data in a privacy-preserving way to drive new business and avoid running into the regulatory buzzsaw. https://lnkd.in/emwjfVG3

17

A new article from Nucleus Security COO Scott Kuffer on Cybersecurity Insiders is on security debt. I'll add the link to the article in the comments.

16

1 Comment

I dislike using the term “crisis communications” when talking about security incidents because it gives people permission to accept chaos and panic. These are red flags that your decision-making process isn’t ready for prime time. Anyway, I’m always glad to see more security teams recognize that incident communications isn’t just what you say publicly, it’s also how you communicate internally so that you’re proud of how you show up for the people impacted.

24

We are shifting compliance left with #Witness and #Hadolint. Want to ensure your Dockerfiles meet compliance controls? This short guide can help you automate the reporting of AC-6, CM-2, and CM-7 for every artifact every time. This is the first in a long series of how to shift compliance left. Follow me and subscribe to never miss out. If there is a tool you would like us to look at and map please let me know in the comments. https://lnkd.in/etNRetSQ

40

5 Comments

🔒 Ransomware strikes again, and the CISO is shown the door. Is this fair?   Finding someone to blame doesn't help to improve any organization's security posture. Let’s work to make this industry more collaborative and transparent, working together to mitigate vulnerabilities before attackers exploit them. So, what can you do? 1. Use security validation tools to continuously test security posture to enhance an organization’s resilience against attacks.  2. Communicate risks with Stakeholders to balance business needs against security needs. 3. Agree on a risk mobilization plan and operational service level agreement, to consistently improve posure. Pentera #cybersecurity

35