Ed Moyle

Listening to a great talk on single point of failure supply chain by Tarah Wheeler at the IANS Boston security forum. Great talk and a great introduction to the discussion led later today on this issue. If you are here and want to continue this massively important issue join my session on supply chain at 1:05 PM. I believe this is one of the biggest problems in cybersecurity today. What can you do about it? What are you doing about it? Tarah is bringing up some great points. Have you implemented her suggestions? What have been your challenges? Have you considered the wide variety of sources of supply chain attacks? Software updates are not the only thing you need to worry about. What tools exist to help you defend against these attacks? This was a great introduction to today’s discussion and I hope it helps people consider the severity of this issue. Come to learn and share how you are dealing with supply chain attacks with your peers.

8

NIST Releases the C-SCRM Due Diligence Assessment Quick-Start Guide for Public Comment https://lnkd.in/dYxE3Uu6

12

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

EFT fraud can happen to any business, no matter what the size or industry. The financial and operational risks are too significant to ignore. From dual verification processes to secure payment portals and cybercrime insurance, there are key measures every business leader should adopt. Proactively safeguarding your financial transactions is not just about preventing losses—it's about maintaining trust with your vendors and customers. Learn more about strategies to protect your business from EFT fraud and secure your operations in today's digital landscape. CMIT Solutions is ready to help. #CyberSecurity #EFTFraud #BusinessProtection https://lnkd.in/eprBEUnN

3

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

New blog post: Improving Cybersecurity Taxonomies Describing Impact and Cyber Harms Against Organizations I’ve introduced a new MISP taxonomy and shared insights into the critical role of impact description in effective information sharing. https://lnkd.in/eUJb-svP #CyberSecurity #MISP #taxonomies #taxonomy MISP Project (@[email protected] ) CIRCL (Computer Incident Response Center Luxembourg)

42

1 Comment

The Hidden Costs of Going Back to Paper and Pencil After a Cyber Attack: Suffolk County, New York, has spent over $25 million on response and recovery efforts. But beyond the financial burden of remediation, there's another, often overlooked cost: the return to manual, paper-based processes. For months after the attack, Suffolk County was forced to revert to paper and pencil to keep essential services running, causing significant disruptions. This not only slowed down operations but also created additional administrative burdens and inefficiencies. Imagine the long lines, delayed public services, and the manual labor required to process records that once flowed effortlessly through digital systems. The cost of lost time, inefficiency, and error rates skyrocketed as the county scrambled to maintain essential services. The Suffolk County cyberattack is a stark reminder of the hidden operational costs of insufficient cyber defenses. Going back to paper may seem like a temporary fix, but it’s expensive. Now more than ever, municipalities must invest in expanding and maturing cybersecurity measures to protect their digital infrastructure and avoid the costly consequences of a breach. Let’s talk about how we can help your locality fortify its defenses. Contact us today to learn more about how TANDMM can assist. #CyberSecurity #MunicipalGovernment #DigitalTransformation #PublicSector #CyberResilience #Ransomware Sources: Suffolk County Ransomware Investigation - The Record Suffolk County Cyber Attack Report

9

Heads up on this once in 5 years opportunity to sponsor Cyentia Institute research into the largest #cybersecurity incidents. See the call for sponsors for the 2025 "Xtreme" edition of the Information Risk Insights Study at the link below. #cyberrisk #cyberresilience #cyberattacks https://lnkd.in/etc6FjsY

39

2 Comments

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

Earlier this year, Cyentia Institute published a meta-study analyzing the top ATT&CK techniques reported across 20+ industry sources. NOT ONE OF THEM reported observing T1195.003 - Compromise Hardware Supply Chain. Hold on - my aid has an urgent message for me...oh my...they what?!...pagers exploding - really?...I see...got it...will do... Sorry for the interruption. As I was saying, T1195.003 was THE MOST REPORTED sub-technique in the entire study! Download it today from the compromised device of your choice: https://lnkd.in/eafNi5u3 #supplychain #cybersecurity #fud

91

6 Comments

The Consumer Financial Protection Bureau has proposed a new rule (https://lnkd.in/giuxe2n9) to limit the hugely grey area that Data Brokers operate within. Glad this is getting news coverage, it's long overdue. #CFPB #DataPrivacy #ConsumerProtection #DataSecurity #PrivacyLaw #Cybersecurity

6

NCUA examiners have said that the ACET is no longer a requirement. They are now recommending that organizations choose an internal framework to align with such as NIST CSF 2.0, CIS, or other! They have stated the new NCUA ISE statements are for them to use as an examination tool and not for credit unions. I would recommend aligning with both an internal framework and the ISE by taking an evidence-based approach so you are prepped for your exam, and meet their requirements!

7

1 Comment

Payments System Disruption - Free All-Sector TTX - Dec 11, 12-4PM ET Join us and hundreds of your peers for a complementary, all-sector virtual tabletop exercise. Are you prepared to respond to the unexpected? In today’s interconnected landscape, resilience isn’t just about preparation—it’s about collaboration and adaptability across all sectors. Our All-Sector Virtual TTX is designed to help leaders and teams strengthen their response strategies, share insights, and navigate complex challenges together. 🔹 Who should attend? cyber, resilience, risk, payments system, and response professionals 🔹 What to expect? Realistic injects, expert-led discussions, and an interactive, collaborative environment that fosters learning and actionable takeaways. Tackle disruptions across business, technology, and third-party ecosystems in a challenging scenario that tests your organization’s resilience and strategy. Don’t miss this opportunity to connect with others, test your strategies, and build resilience across the board. Secure your spot now and take a proactive step toward safeguarding your organization’s future! Register here: https://lnkd.in/dhSbUPyh #Resilience #RiskManagement #TabletopExercise #AllSectorTTX #OperationalResilience #CISO

23

Cybersecurity Snapshot: After Telecom Hacks, CISA Offers Security Tips for Cell Phone Users, While Banks Seek Clearer AI Regulations http://ow.ly/hKiE105WiMo

8

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

We can’t afford our Public Sector to be a continuous target for adversaries. Attacks on State, Local, Tribal, and Public Education sectors are on the rise, along with critical infrastructure sectors such as Water, Electric, Food Processing, and Healthcare. Stay vigilant, maintain continuous cyber hygiene, and proactively manage your security posture. Beat the 1000 eyes prying on you! Read more about cybersecurity threats in the public sector: [Link to the article](https://lnkd.in/gihHjygR)

56

3 Comments