Snir Ben Shimol

The Future of Compliance is Now-

67

2 Comments

Join us and GuidePoint Security at GPSec in Philadelphia to hear about upcoming trends in SaaS Security and how you can keep your SaaS stack secure 💪 Get ready to meet our team 👉 Kirra Rice Dustin Crossman Richard Snyder

2

Don’t miss Uri Aronovici's talk at BSidesNYC this Saturday, October 19 at 11:30 AM ET. 🔗 More details on the talk here: https://lnkd.in/gsf28GbE What he'll cover: ☑ Analysis of vulnerabilities in providers ☑ Why we should care ☑ Possible attack flows  ☑ Best practices & mitigations

8

1 Comment

Great benchmarks and quite the sweet spot for most M&A in Cybersecurity. The recent Noname and Zerofox deals also reflect this "mean reversion" type of behavior~

11

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

It's a fucking honor to build products for the 99% of businesses that fall below the Fortune 500 poverty line 💪 While the Fortune 500 said SIEM was tired, the Fortune 5,000,000 showed us how to mic-drop! 🫳🎤 🧠 Affordable, predictive pricing *is* possible if you only store what matters 💾 Retaining / hunting thru petabytes of daily data *won't* break the model 💵 You can protect more than just your critical servers *if* the price is right Can't tell you how dope it feels to work with MSP partners / Customers to completely disrupt these perceptions—currently ingesting logs from 500,000+ data sources! Massive thanks to those Product Lab believers that demanded a new way to SIEM https://lnkd.in/eXKgmEHP and the team at ClickHouse who helped us reimagine a different approach to storage and scalability 🙏 https://lnkd.in/eVSh2Yfx

393

23 Comments

We are shifting compliance left with #Witness and #Hadolint. Want to ensure your Dockerfiles meet compliance controls? This short guide can help you automate the reporting of AC-6, CM-2, and CM-7 for every artifact every time. This is the first in a long series of how to shift compliance left. Follow me and subscribe to never miss out. If there is a tool you would like us to look at and map please let me know in the comments. https://lnkd.in/etNRetSQ

40

5 Comments

Supplements company is coming along well. Website is almost finished, labels finalized, all of the ingredients are ordered. Should be ready to go for at least samples at BlackHat / DEF CON - and *maybe* be ready to order by then. Some cool things, we have licensed some key ingredients that are proprietary (the ingredients are full labeled for transparency - no "proprietary blends") and have a lot of backed research behind them. The pre-workout has S7 - which research has shown through multiple studies to boost nitric oxide (it's one of the best) for vasodilation (the pump and oxygen flow). SantEnergy Nu - a high-quality plant extract from Santa Herba which the research studies show metabolism & energy boosters, antioxidant, and weight regulation/loss booster. zumXR Extended and Delayed which are the only patented delivery system for caffeine release in the body so you don't get a crash and consistent energy use through the day. About a year and a half of research and trial and error to get to this perfection blend of various ingredients. Everyone that's tried it has said so far it's the best pre-workout they've ever taken. I'm really excited about the addition of GABA - we're one of the only ones out there that leverage it which increases natural IGF-1 production if used as a pre-workout 6 fold. GABA also hits the GABA receptors which has an effect of added energy and focus. Lots of other stuff. Coming soon! Citrulline Malate (fermented) – 5000 GABA - 750 (natural IGF-1 production, energy, focus) Beta-Alanine – 3000 (helps regulate acid in muscles and prevent fatigue) Taurine – 2000 (reduces muscle fatigue / increase performance) L-Tyrosine -- 2500 (focus and concentration) Caffeine Anhydrous 200 ZumXR Caffeine Extended – 65 ZumXR Caffeine Delayed – 60 S7 (Pump/Bloodflow) - 50 ZumXR Santenergy Nu – 400 Sodium Chloride – 20 (salt/hydration) Bioperine – 10 (strength, increase endurance, decrease fat mass, and protects lean muscle) Malic Acid – 115 (energy metabolism, improved cardiac function, alleviate sports fatigue, promote regeneration) Yohimbe Extract – 100 (some folks have sensitivity here, note its the extract, very small dosage, and coupled with betaine HCL for digestion, tolerated very well and a good for blood flow and energy kick) Alpha GPC - 300 (recover faster, builds muscle, and improves strength, focus, increases IGF-1) Magnesium Malate – 200 (Magnesium + Malic Acid - bioavailable magnesium for energy production) Silicon Dioxide - 100 (anti-caking) Betaine HCL – 2500 (absorption and digestion) S7(R) - https://lnkd.in/gPQyDTe3 SantEnergy Nu (TM) - https://lnkd.in/grZvzDBV zumXR Extended (R) - https://www.zumxr.com/ zumXR Delayed (R) - https://www.zumxr.com/ https://lnkd.in/gsHvRrsV

67

7 Comments

Big Shoutout to Bar Azouri! One of our own from OX Security just got published! Bar’s insightful article on Medium, titled "Modernizing Secret Management in Development: Transitioning from .env Files to a Secret Manager," is a must-read. In this piece, Bar explores the shift from .env files to advanced secret management systems, detailing how this transition can boost security, optimize workflows, and ensure scalability in your development processes. If you're ready to elevate your secret management strategy, check it out here:https://lnkd.in/gg_pBrpH #SoftwareDevelopment #CyberSecurity #DevOps #NodeJS #AWS #SecretManagement #MediumArticle #Innovation #Security

8

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

What a great f*ing year!! 2024 was nothing short of extraordinary. Six-figure projects, doubling our user base, scaling an unstoppable team, winning awards, closing high-impact partnerships, stepping into European R&D consortiums, you name it. ROOTKey isn’t just growing — we’re redefining the game. As a 24-year-old entrepreneur leading a company not yet three years old, I have come to realize something powerful: success isn’t static. You know you’re truly winning when your old metrics feel outdated, and you’re forced to redefine what success really is to you and aim even higher. But this journey isn’t mine alone. To the incredible ROOTKey team—you’re the backbone of this success. Your dedication, innovation, and belief in our mission inspire me every single day. This year’s achievements are as much yours as they are ROOTKey’s, and I couldn’t be prouder to lead alongside you. 2025? We’re coming for it with more ambition, more bold moves, and an even bigger vision. This is only the beginning. Luís Costa, Miguel Remédios, Vasco Fidanza, Carlota Alves, Daniela Vieira, Miguel Gonçalves, Rafaela Cruz, Adriana Afonso

24

1 Comment

When we joined the Wiz team following the acquisition of Gem Security back in April, it was obvious from the beginning that we were about to create something special, something big. Today, I'm thrilled to introduce Wiz Defend, that sets a new standard for cloud detection and response. We redefined a completely new experience for security operations and incident response teams operating in the cloud, with high-fidelity threat detection, intuitive, context-led investigation and AI-assisted response. We've re-built the Gem technology on top of the code-to-cloud context available in the Wiz Security Graph, natively integrating the Wiz Runtime Sensor and Wiz's Cloud Threat Intelligence. I also want to thank our incredible launch partners, who further extend the value of Wiz Defend through the SecOps ecosystem: Exabeam, Cribl, Torq, Tines, Expel, Sygnia, ReliaQuest, Tamnoon and Panther For more info, check out our blog and feel free to reach out - our team would love to chat! https://lnkd.in/eWkbt-Um Ron Konigsberg Ofir Brukner Assaf Rappaport Yinon C. Raaz Herzberg Ami Luttwak Roy Reznik

746

31 Comments

Vulnerabilities will always exist. No software is perfect. Focus on rapid detection and remediation to minimize the window of exposure. #product #security #remediation #development

12

Have you done IT/infosec audit and summer sales? Come be my best friend. Paramify is 𝗵𝗶𝗿𝗶𝗻𝗴 sales pros - 𝗲𝗻𝘁𝗿𝘆-𝗹𝗲𝘃𝗲𝗹 𝗦𝗗𝗥 𝘁𝗼 𝗔𝗘. 𝗦𝗼𝗺𝗲 𝗯𝗮𝗰𝗸𝗴𝗿𝗼𝘂𝗻𝗱: Paramify is an iron man suit for GRC and security professionals, that allows them to be 1000x more efficient in their documentation processes. We sell to everyone from SMB to enterprise orgs, manager to c-suite. We’re growing like crazy with some big opportunities ahead. 𝗪𝗵𝗮𝘁 𝘄𝗲 𝗮𝗿𝗲 𝗹𝗼𝗼𝗸𝗶𝗻𝗴 𝗳𝗼𝗿: - We want hungry. If you aren’t used to outbound sales and generating some of your own lead flow, you won’t love this job. - Solid track record in sales performance is a must. The cream always rises. - We’re a startup, so you’ll need to be comfortable being uncomfortable. You’ll work harder and more creatively, and you’ll get work experience and exposure that you can’t find at a big company. We call it, “working in dog years”. - We want Field Corn. Houseplants have to be given the right sized pot, in just the right amount of shade and sunlight, with just the right amount of water, or they die. You can drop field corn on the sidewalk, and it’ll find a way and it’ll grow. We want Field Corn. - If you can speak audit/infosec, it’s a huge plus. → 𝗠𝗲𝘀𝘀𝗮𝗴𝗲 𝗺𝗲 𝗼𝗿 𝗰𝗼𝗺𝗺𝗲𝗻𝘁 𝗵𝗲𝗿𝗲 𝗶𝗳 𝘆𝗼𝘂 𝘄𝗮𝗻𝘁 𝘁𝗼 𝘁𝗮𝗹𝗸 𝗺𝗼𝗿𝗲 𝗼𝗿 𝘁𝗵𝗶𝗻𝗸 𝘆𝗼𝘂'𝗿e 𝗮 𝗴𝗼𝗼𝗱 𝗳𝗶𝘁. Paramify is going to be a special one - come be part of it!

35

10 Comments

Join Itamar Sher and I on Tuesday next week (Oct 15) at 2pm ET to learn about some of the upcoming changes in PCI 4 and how to best prepare to them

15

Our ezJailKiosk application allows official third-party users (officers, lawyers, judges, etc.) to meet with inmates virtually within secure facilities! 👍🖥️ During the virtual meetings, the host has complete control of the inmate's kiosk, allowing them to review documents, collect electronic signatures, and manage virtual settings such as volume and screen view. Plus, it's ez for correctional staff- all they have to do is review the shared ezJailKiosk calendar and place the inmates at the appropriate kiosk. It's that ez to conduct virtual meetings. Learn more at: https://lnkd.in/gnh2bJnT #ezJailKiosk #ezSupervision #ezJustice #Correctional #Corrections #kiosks #LawTechnology #CourtTech

2