Brennan O'Brien

I wonder how many SIEM vendors out there are sweating how GenAI will auto-magically translate data normalizations and field extractions, detections, reports, and dashboards between different products to make SIEM replacements far easier to do. I think they probably should be.

23

28 Comments

SEC Charges R.R. Donnelley & Sons Co. $2.1 Million Fine for Cybersecurity-Related Controls Violations On June 18th, 2024, the U.S. Securities and Exchange Commission announced that RR Donnelley, a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. This SEC settlement with RRD highlights critical issues around cybersecurity and internal controls. Key findings include inadequate controls over material non-public information (MNPI), heightened insider trading risks, and violations of the Securities Exchange Act of 1934. Key Allegations: - Inadequate controls to prevent MNPI misuse - Insider trading risks due to poor monitoring - Regulatory violations and insufficient disclosure controls Inadequate Cybersecurity Response: - Between Nov 29 and Dec 23, 2021, RRD's internal intrusion system issued numerous alerts. - Alerts were reviewed by a third-party MSSP and escalated to internal cybersecurity personnel. - Despite escalations, RRD failed to take timely action, leading to unauthorized data exfiltration of 70 GB, including personal and financial information of 29 clients. - Issues identified included lack of prioritization, workflow for alerts, and inadequate auditing of the MSSP's performance. - Only after an external company alerted the CISO did the firm respond effectively. How AdvisorDefense Can Assist Registered Investment Advisors (RIAs): We offer a comprehensive suite of services tailored to help RIAs meet SEC regulations and bolster their cybersecurity defenses. Our mission is to empower RIAs with the necessary tools and expertise to navigate the cybersecurity landscape, ensuring compliance with regulatory requirements and protecting client information. By partnering with AdvisorDefense, RIAs can enhance their cybersecurity posture, ensure compliance, and protect their clients from evolving cyber threats. Protect your clients. Maintain your reputation. Ensure compliance. Contact us to learn more about how we can support your firm. https://lnkd.in/eVKtr3_x #Cybersecurity #SEC #Compliance #RIAs #AdvisorDefense #CyberRiskManagement #FinancialServices #RegulatoryCompliance #CyberThreats #CyberSecurityAwareness #CyberSecuritySolutions

10

1 Comment

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

This week we are going to look at multi-factor authentication, also known as two-factor authentication. This type of authentication has often been referred to as a "best practice" for securing your accounts. I would suggest that today, multi-factor authentication is really a "required practice" both at home, and at work. https://conta.cc/4b9Kg5m

3

CISO reporting to 'The Board'...Scary? Yeah probably. It should be. Its real accountability, and an open challenge to your visions and strategies, and your ability to execute accordingly. As a CISO, I often get questions about how to present to 'The BoD' directly. Truth is, there's no single model - Every business is different, and every Board is different. But you know that already cuz you're in a position of leadership and discernment for a reason :) The right message always remains the same- How does your own leadership role, function, and focus contribute to the greater good of the organization? How does it help the business to determine where and how to accept and navigate risk? Not just avoid it. Sounds simplistic. But you may be surprised how many CISO messages don't answer that basic inquiry sufficiently. Your message, at this level, needs to clearly align to a broader forward-looking strategic narrative. If it doesn't, it doesn't resonate, and you haven't positively moved the needle. You never want to be the best checkers player in a chess match. I’m looking forward to demystifying this exact topic at the CISO ExecNet National Member Symposium July 23rd at the Willis Tower in Chicago with colleagues Eric Galis, Susanne Elizer Senoff, and Michael Calderin. #cisoexecnet #ciso #executiveleadership #boardreporting

132

7 Comments

I'm excited to share a recent milestone in my journey—passing the NACD (National Association of Corporate Directors) Directorship Certification. This achievement isn't just a personal milestone but a testament to the vital role of continuous learning in leadership and cybersecurity governance. Having been on both sides of the boardroom table, I've seen firsthand how navigating the complexities of modern enterprises requires more than deep expertise in a single domain—it demands a broad, strategic understanding across multiple disciplines. Here are a few key points for those aspiring to board roles or looking to deepen their C-level impact: Broaden Your Horizons: Understand your business beyond the technical details. For those seeking a board seat, look behind simply having cyber experience and to what else you can contribute. Commit to Excellence: Pursue excellence in all you do. Hold yourself to high standards, learn from setbacks, and continuously seek ways to improve—even when things go right! Stay Curious: Keep ahead of industry trends, challenges, and innovations. Staying informed and proactive is crucial for making strategic decisions and fulfilling a director's duty of care. The path to a board role can be challenging but it is also rewarding and can have significant impact. For CISOs looking to improve their board interactions, focus on translating technical details into business impact to enhance your role as a strategic partner. Keep learning. Keep growing.

98

12 Comments

The SOC 3 report - To security and compliance professionals in the B2B space? When you have your SOC 2 Type II completed (which is pretty much a requirement if you are going to sell into the enterprise space)? Please also get a SOC 3 report done, and please post it on your website or trust center, without the need for a NDA or signup - that's a big part of the reason they exist. You are much more likely to get a quick response from my initial and annual security reviews if you do this and make it easier for my team to access important security information quickly and easily, without the need to fill out NDAs and sign up for an account, as is often the case for a SOC 2 Type II report.

13

1 Comment

The role of the Chief Information Security Officer (CISO) has evolved significantly in a relatively short period, yet there is still much progress to be made. Conversations like this one are essential for advancing the role. Thank you, 360 Advanced for providing a platform to share our experiences and lessons learned on our journeys to becoming a CISO. #ciso #cisoapproved #leadership #growth

26

As I previously posted, I’m struggling with PCI 4.0 Targeted Risk Analysis(TRA) process on frequency. The frequency on certain activities like vulnerability scanning and user access reviews are already determined by Corporate Policy, not a TRA. And some of these are “influenced” by other regulatory requirements such as SOX - must conduct quarterly user access reviews. Maybe a TRA would be a better approach to determining frequency, but I already have standards. What does the TRA contribute to an existing standard? One could argue that the TRA supports that standard but in reality I think it leads us to a foregone conclusion that quarterly is sufficient. I may end up with some type of TRA word salad that validates whatever frequency that the Company standards dictate. I’m still working on it, version 5. But I think having supporting Corporate Standards allows me to examine the risks of not complying with the aligned standards is the best approach to produce a TRA. Unless I go to version 6, which is unknown at this time.

6 ICS advisories for your review.

5

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

Hey CISO/regulatory/legal/recruiters hive mind... What advice would you give somebody with a background in operations and compliance for acing a "chief of staff" interview? Got a friend with the skills, but never held that particular title before. I'd love to hear your advice.

When planning for your strategy and goals for 2025, it is always good to start with an assessment that assists you in identifying and prioritizing your gaps and then building out a roadmap. Infostream is offering this to our customers to help them build out their Cybersecurity Strategies. If you are interested in improving your cybersecurity posture in 2025, please reach out to us. #Infostream #Cybersecurity #Cyberassessment #AI #HPC #NIST #ISO #SecurityBestPractices

11

1 Comment

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

From the article Jen Easterly director for the Cybersecurity and Infrastructure Security Agency at Black Hat stated “We don’t have a cybersecurity problem. We have a software quality problem”. Some things to think about. 1. Cybersecurity requirements are business / functional requirements. Implement the requirements. 2. Shift left, it is cheaper and quicker to implement requirements if they are integrated at project initiation vs trying to bolt on at the end. 3. Shifting left solves many of the problems related to "its to hard" or "it takes to long". These complaints often occur because cybersecurity is not a stakeholder in the development activity from the beginning. 4. Integrate cybersecurity into all gates in the development process and integrate the possesses so they are as frictionless as possible for the developers. The developers should have the training and tools to develop secure code and test the code to ensure it is secure. These are not new discussion topics but are so important. what would you add to this list? #cybersecurity #technology

37

2 Comments