Jesse Miller

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

Imagine being at the forefront 🚀 yet lagging in essentials.❌ XARF, which stands for Extended Abuse Reporting Format, is gaining popularity as the new standard for handling abuse reports.📊 It's not just a new standard, it's also becoming essential for effective digital communication📱 and security🔒. With dozens of reporters and hundreds of abuse teams already using it.👥 This is not just about adopting a format for Hosting Providers and other service providers. It's about commitment to safety, efficiency, and responsibility.🔐 If your systems balk at handling XARF or flinch at attachments in ARF or ACNS, it's more than a technical glitch.⚠️ It's a failure to meet the basic standards of your role in the digital ecosystem.⚡ Not being able to process these reports isn't a tiny oversight; it's a glaring gap in your capability to safeguard your network and, by extension, your users.👨‍💻 In a world where digital security is paramount, being unprepared is inexcusable.❗ Upgrade, adapt, and take action.📲 Your network's safety and users' trust depend on it.💼 Let's not wait for sympathy.🕓 Let's strive for excellence.🌟 Your move.🎯 What's it going to be?

10

My major concern coming out of the CrowdStrike debacle is that people are going to turn off automatic updates. This is clearly a disaster of epic proportions, but more frequent and more costly disasters in the aggregate happen from software that is not properly updated. If you have an organization that has the people, processes, and technologies to validate each and every upgrade in a timely manner, that's awesome. You are one of the >1% who can afford to validate an update before deploying. If you don't have that capability, even despite this disaster it serves you best to do automatic updates. Cybersecurity is about risk management; not having zero risk. You have to balance the potential risks, and to this point, there have been other disasters from Microsoft and others, but attacks on unpatched systems has cost us exponentially more.

481

145 Comments

This Kiteworks article is a good read for cybersecurity professionals who are interested in a comprehensive checklist for achieving compliance with the Cybersecurity Maturity Model Certification (CMMC) framework. It outlines the steps organizations need to take to meet the requirements of different CMMC levels, from basic cybersecurity hygiene to advanced practices.  Your Complete CMMC Compliance Checklist 👇👇 Get the checklist: https://lnkd.in/eEmiVs79 #cybersecurity #compliance #CMMC #NIST #CUI #blog

19

1 Comment

Why not adopt all of the information security controls from ISO/IEC 27001 Annex A and call it quits? Here's why: https://lnkd.in/gCaE8mu8

17

11 Comments

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

1

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

1

1 Comment

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

Prepare for ransomware. It is not an IF question, but a WHEN question. 85% of SMB's experience ransomware attacks. Ransomware and phishing attacks rise year over year, and human error is still the #1 cause of data loss. How is your team being #CyberSafe? 

3

1 Comment

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

Ensuring your cybersecurity program is robust and comprehensive is no longer a luxury—it's a necessity. One critical element that often gets overlooked is the integration of compliance into your cybersecurity strategy. Compliance frameworks such as ISO 27001, NIST, and GDPR aren't just boxes to check; they serve as the backbone of a strong information security management system (ISMS). Incorporating these frameworks into your cybersecurity program has profound internal and external benefits. Internally, compliance helps mitigate business risks. By adhering to established standards, you reduce the likelihood of data breaches and cyber-attacks. A study by IBM revealed that organizations with a fully deployed security automation program saved an average of $3.58 million per breach compared to those without. This shows how a proactive approach to compliance can safeguard your business's financial health and reputation. Externally, demonstrating compliance builds trust with your clients. In an age where data breaches are all too common, customers want to know their information is secure. By following recognized standards, you're showing clients that you take their data protection seriously. This transparency can be a competitive advantage, helping you attract and retain clients who prioritize security. For example, a report by PwC highlighted that 92% of consumers agree that companies must be proactive about data protection. Integrating compliance into your cybersecurity strategy is a clear signal to your clients that you are committed to maintaining their trust and safeguarding their data. In today's digital landscape, where threats are constantly evolving, integrating compliance into your cybersecurity program is essential. It not only helps you manage risks internally but also strengthens your reputation and trust externally. Make compliance a core part of your cybersecurity strategy to protect both your business and your clients. #CyberSecurity #Compliance #BusinessRisk #RiskManagement #DataProtection #ISO27001 #NIST #GDPR #InfoSec #BusinessContinuity #Trust #ClientSecurity

7

1 Comment

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

148

30 Comments