Youssef Takhssaiti, CISM, CISA, CDPSE, CCSK, C CISO

Join to learn about our online MS in Cybersecurity program with industry leaders covering current business - cyber landscape.

3

Cybersecurity is a Business Issue. Matthew Rosenquist explained the problem most organizations face today regardless of their size/industry in his open letter along with the solution to Microsoft's CEO. https://lnkd.in/gK_UiFkm. In business, it is always and always a leadership/management issue, whatever the problems are. Cybersecurity is not any different. You need to ensure business perspective and leadership understanding, support, and involvement at the highest level along with having the right people part of the team, if you want to survive in the next 5-10 years. If you are just getting started and/or you want to get that business perspective, check out our online MS in Cybersecurity program, with a bit more emphasis on business. Along with other leaders and experts, we are lucky to have Matthew as part of our MSC program advisory board https://lnkd.in/gaKg6RMA.

2

National Institute of Standards and Technology (NIST)  has released the RMF Small Enterprise Quick Start Guide. For organizations of all sizes, managing risk (including information security and privacy risk), is critical for organizational resilience. This guide is designed to help small, under-resourced entities understand the value and core components of the NIST Risk Management Framework (RMF) and provide a starting point for designing and implementing an information security and privacy risk management program. This document is not intended to replace the RMF; it is intended to be an introductory guide to help organizations get started. Link: https://lnkd.in/deZ9csya PDF Source: https://lnkd.in/dJaetyYx #NIST #dataprivacy #RMF #cybsersecurity #risk

1

A recent #CyberPhysical attack in #Lebanon, where #pagers and #walkietalkies used by Hezbollah operatives were remotely detonated, serves as a stark reminder of the evolving landscape of #cyberwarfare. Israeli intelligence reportedly infiltrated Hezbollah's #network, compromising their #supplychain and targeting specific pager devices, resulting in mass casualties. This incident may mark the beginning of a new form of warfare, where cyber capabilities are used not just to disable #CyberPhysicalSystems (CPS) but to cause mass casualties in the physical world. A similar attack on mobile phones could be even more devastating, given their widespread use. This incident underscores critical lessons for #SecurityOperators worldwide: 1) Organizations must prioritize securing their supply chains, especially hardware components. 2) Necessity for constant assessment of the #securitylandscape, not just for #CuttingEdge technologies but also for #LegacySystems. 3)Harden systems against similar attacks on physical infrastructure, including #IoT devices, industrial control systems (#ICS), and any hardware connected to critical processes. The exploding pager and walkie talkie incidents in Lebanon serves as a cautionary tale about the potential risks associated with technology. While the exact cause of the explosion may remain unclear, it underscores the importance of prioritizing #safety and #security in the development and use of electronic devices. #CyberSecurity #LegacyTech #IncidentResponse #TechVulnerabilities #CyberAwareness #DigitalTransformation #DigitalSecurity #AMon #OEM #CERTIn #CyberSafeIndia #CyberResilience #ThreatIntel

55

8 Comments

The Ransomware Defense Initiative (RDI) was just introduced at RSAC 2024. RDI offers a structured framework to evaluate your cybersecurity program’s maturity. Using our self-assessment tool at rdishield.com, you can measure your current control maturity, identify gaps in your program, and determine areas needing more focus. You'll receive a real-time report assessing your readiness to handle ransomware threats based on MITRE ATT&CK well known techniques. This proactive approach helps you stay ready against evolving threats, refine your strategies, and draft or update your cybersecurity plan. Whether you're a small business or a large enterprise, RDI provides the necessary tools and guidance to enhance your defenses. Visit rdishield.com.

10

🌟 Honored to be Featured in VMblog's 2024 National Cybersecurity Month Round-Up! 🌟 A big thank you to VMblog for letting me part of their latest 2024 National Cybersecurity Month round-up. The article shares insights from lots of impressive security thought leaders on the latest cybersecurity trends and threats, including how to effectively manage organizational risk tolerance. Check out the article to gain valuable insights from experts in the field. Let's continue to stay informed and proactive in our cybersecurity efforts! #Cybersecurity #NationalCybersecurityMonth #SecurityTrends #RiskManagement #ThoughtLeadership

21

CMMC Level 2 Assessment Objective: Data at Rest PRACTICE: Organizations must protect the confidentiality of controlled unclassified information (CUI) at rest. ASSESSMENT: CUI at rest means information that is not moving through the network; typically this means data currently stored on hard drives, media, and mobile devices. The focus of protection at rest is not on the type of storage device or the frequency of access but rather the state of the information. Organizations can use different mechanisms to achieve confidentiality protections, including the use of cryptographic mechanisms and file share scanning. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST mechanisms supporting or implementing confidentiality protections for information at rest. (CMMC Assessment Guide: Level 2 Version 2.11, page 239) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

Optimize your decision-making and resource allocation by accepting and recasting risks in Tenable Security Center. 👀 Watch now! ➡️ Learn more: https://lnkd.in/ePsC_KhU #Cybersecurity #RiskManagement #Tenable

11

"The Identity Underground Report, offers valuable insights into the challenges and vulnerabilities organizations encounter in managing digital identities. The report paints a vivid picture of the "hidden" identity security liabilities where attackers leverage Identity Threat Exposures (ITEs) such as forgotten user accounts and misconfigurations to breach organizations' defenses, with each ITE posing a significant threat to organizations' security posture. These findings reveal alarming statistics that underscore the widespread prevalence of ITEs across organizations of all sizes: - 67% of organizations unknowingly expose their SaaS applications to potential compromise through insecure password synchronization practices. - 31% of user accounts are service accounts, which attackers seek to target as security teams often overlook them. - A single misconfiguration in Active Directory spawns an average of 109 new shadow admins, enabling attackers to change settings and permissions, and gain more access to machines as they move deeper into an environment." #cybersecurity #identity #IAM

3

⚙ AI Impact Assessment Template Aligned with ISO42005⚙ Today I'd like to share a rough template based on ISO42005 guidelines that will help your organization evaluate the consequences of deploying AI systems, ensuring they align with ethical standards and regulatory requirements.  ⚙ AI Impact Assessment Template  Section A: System Information ➡AI System Description: Provide a high-level overview, including architecture, functionalities, and operational context. ➡Purpose and Objectives: Clearly state what the AI system is designed to achieve within your operational framework.  Section B: Stakeholder Identification ➡Relevant Interested Parties: List all stakeholders affected by the AI system, including direct users, indirectly affected parties, and oversight bodies.  Section C: Impact Analysis ➡Potential Benefits: Describe the expected positive impacts on efficiency, decision-making, cost reduction, and other operational improvements. ➡Potential Risks and Harms: Identify any potential negative consequences, including ethical concerns, privacy issues, and the risk of bias.  Section D: Data Governance ➡Data Types and Sources: Detail the data used, including its origins, scope, and how it is processed. ➡Data Quality and Integrity: Ensure the data meets high-quality standards and is handled ethically and legally.  Section E: Algorithmic Accountability ➡Algorithm Description: Provide details about the algorithms used, including their development, functionality, and basis of decision-making. For help here, I recommend BABL AI and Shea Brown...they set the standard. ➡Impact of Algorithms: Analyze how these algorithms could affect various stakeholders, considering different scenarios of use and misuse.  Section F: Compliance and Monitoring ➡Regulatory Adherence: Verify compliance with relevant AI regulations and standards. ➡Ongoing Monitoring and Evaluation: Establish processes for continuous review and updating of the AI system impact assessment, reflecting changes in the AI system or its operating environment.  Section G: Documentation and Reporting ➡Assessment Documentation: Maintain comprehensive records of the impact assessment process, findings, and actions taken. ➡Disclosure and Transparency: Ensure transparent reporting to all stakeholders, detailing the AI system's impacts, the basis for conclusions, and measures taken to mitigate risks.  Final Notes ➡Approval and Revision: Document the approval process for the impact assessment and outline procedures for periodic review and updates. ➡Ethical Considerations: Address any ethical concerns related to the AI system’s deployment and operation. This template serves as a foundational tool to guide your organization in conducting AI impact assessments, but you must make it your own. For help getting started, please don't hesitate to reach out. #iso42001 #iso42005 #AIImpact @A-LIGN

72

4 Comments

Join 3 HTi, Kevin Hyde and me tomorrow (9/27) at 12p ET as we discuss what Cybersecurity Maturity Model Certification (CMMC) means for government contractors and how your organization can be ready for it.

7

CISA just released a FREE Anonymized Treat Response Guide for K-12 Schools. It outlines a structured approach for schools to address anonymous threats, especially those delivered via social media. Key aspects include: 1. Early Detection and Reporting: Schools should build awareness among students, staff, and families to report threats early rather than reposting them. Encouraging "Report, Don’t Repost" helps limit the spread of alarming but often unsubstantiated threats. 2. Partnership Development: Schools should establish partnerships with law enforcement, mental health professionals, and other stakeholders to manage threats effectively. Multidisciplinary threat assessment teams are recommended for evaluating and responding to threats. 3. First Response Actions: Every threat should be treated as credible initially. Schools should take pre-planned steps to ensure safety, including low-visibility law enforcement presence, before escalating responses like lockdowns or school closures as needed. 4. Mental Health Resources: Anonymous threats often signal underlying student issues. Mental health professionals play a key role in addressing these concerns, helping mitigate threats, and reducing trauma. 5. Communication and Preparedness: Clear communication with the school community is vital to managing the situation and minimizing panic. Schools should also engage in regular drills and establish protocols to be prepared for future threats. These strategies aim to ensure a balanced, informed response that prioritizes student safety while minimizing disruption and trauma​.

8

Not a bad high level cliffs notes on CMMC. If you haven’t had time to get up to speed on what’s happening in the federal space with CMMC, this will help you start in 15 min or less. I love a good summary article. #CMMC #NIST800171 #NIST800172

9

When making extraordinary things happen in organization, leaders engage in what we call “The Five Practices of Examplary Leadership” - Model the way - Inspire a shared vision - Challenge the process - Enable others to act - Encourage the heart From The Leadership Challange.

20

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

CISA (Cybersecurity and Infrastructure Security Agency) has proposed new reporting requirements for significant cyber events across critical infrastructure sectors, including healthcare. These requirements aim to enhance cybersecurity measures but have raised concerns within the medical community. MGMA (Medical Group Management Association) has suggested that instead of adding duplicative reporting requirements, CISA should collaborate closely with HHS (Department of Health and Human Services) to streamline existing regulations under HIPAA. They also expressed concerns about the proposed size-based threshold, which could impose reporting obligations on smaller physician offices with revenues as low as $9 million annually. Do you agree that collaboration between CISA and HHS could streamline regulatory burdens? #HealthcareSecurity #CISA #CybersecurityReporting

5

🚨 Iranian Hackers Increased Influence Operations Against US Election Iran is increasing efforts to influence U.S. elections through cyber attacks targeting Presidential campaigns and the public. Top 5 takeaways: 🇺🇸 The ODNI, FBI, and CISA released a statement on Iranian efforts to influence U.S. elections, highlighting increased Iranian activity targeting Presidential campaigns. 🥷 Iranian state-backed actors breached former President Trump’s campaign, stealing and leaking confidential information. ⚡️ Iran is spreading misinformation and using tactics like password spraying and spear-phishing. 🛡️ The statement emphasizes the importance of strong passwords, official email accounts, software updates, and multi-factor authentication to enhance online security. 🥈 Iran ranks second, after Russia, in foreign interference activities, as reported by Meta. #cybersecurity #news #iran #us #elections #InfluenceOperations #misinformation #kraven #KravenSecurity #adamgoss #cti #threatintelligence

2