Chris Loucks

I wonder how many SIEM vendors out there are sweating how GenAI will auto-magically translate data normalizations and field extractions, detections, reports, and dashboards between different products to make SIEM replacements far easier to do. I think they probably should be.

23

28 Comments

Before we brace for #PatchTuesday - A quick note on a recent #CISA blog. "Bake Security In" evolved into "Secure by Design", which is now morphing into "Secure by Demand" The "Secure by Demand" initiative helps educate organizations as to what criteria and strategies they should use, when vetting vendors for new software. Classic. Reverse. Psychology. CISA: Vendors, please harden your software and provide SBOM's Vendors: No CISA: World, ask software vendors these questions in this nice informative guide. If they don't say yes, don't give them business Vendors: CISA: **mic drop** #infosec #cybersecurity https://lnkd.in/dgNRVvAc

5

Several voter registration databases for Illinois were left publicly exposed without encryption or any form of authentication, allowing unrestricted access to sensitive voter information for an indeterminate period of time. The database contained all sorts of details including SSN, Driver’s License Number, Historical Voting Records, Home Address, etc.   The security of our elections extends far beyond the voting process; it directly impacts the safety of the individuals who participate in it. In today's volatile political climate and with the world in a state of uncertainty, it's all too easy to imagine the disastrous consequences that could arise from neglecting this responsibility. We must do better—because the stakes are higher than ever.   “The exposed databases contained .csv documents with lists of available or active voters, absentees, early mail-in voting records, and duplicate voters. Other documents marked as “voter records” contained far more potentially sensitive personal information, including full name, physical address, some email addresses, date of birth, SSN (full and partial) or driver’s license number, and historical voting records. The database also contained copies of voter registration applications, death certificates, and records of change of address, jurisdiction, or state. There were also candidate documents (such as statements of candidacy) detailing personal phone number, email address, and home address. These candidate documents also included petitions with voter signatures, addresses, candidate loyalty oath, economic interest, and additional supporting documentation. There were also documents marked as official ballot templates for primaries and general elections.”   “The potential risk of a coordinated disinformation campaign using voter lists and voter registrations is a serious concern from both outside actors (such as Russia or China) and domestic activists looking to sway political opinions. According to a study conducted by the Pew Research Center in 2020, 75% of American voters believed there would be outside interference in the presidential election. Having PII of voters would potentially allow malicious actors to send them misleading information (about voting dates, locations, or requirements) based on their party affiliation. Another possible risk is voter intimidation, which includes using past voter history to threaten or harass voters.”   https://lnkd.in/gRJ-mh24

3

1 Comment

Great advice from Kevin, and worth checking in your business if Quick Assist is enabled.

3

SEC Charges R.R. Donnelley & Sons Co. $2.1 Million Fine for Cybersecurity-Related Controls Violations On June 18th, 2024, the U.S. Securities and Exchange Commission announced that RR Donnelley, a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. This SEC settlement with RRD highlights critical issues around cybersecurity and internal controls. Key findings include inadequate controls over material non-public information (MNPI), heightened insider trading risks, and violations of the Securities Exchange Act of 1934. Key Allegations: - Inadequate controls to prevent MNPI misuse - Insider trading risks due to poor monitoring - Regulatory violations and insufficient disclosure controls Inadequate Cybersecurity Response: - Between Nov 29 and Dec 23, 2021, RRD's internal intrusion system issued numerous alerts. - Alerts were reviewed by a third-party MSSP and escalated to internal cybersecurity personnel. - Despite escalations, RRD failed to take timely action, leading to unauthorized data exfiltration of 70 GB, including personal and financial information of 29 clients. - Issues identified included lack of prioritization, workflow for alerts, and inadequate auditing of the MSSP's performance. - Only after an external company alerted the CISO did the firm respond effectively. How AdvisorDefense Can Assist Registered Investment Advisors (RIAs): We offer a comprehensive suite of services tailored to help RIAs meet SEC regulations and bolster their cybersecurity defenses. Our mission is to empower RIAs with the necessary tools and expertise to navigate the cybersecurity landscape, ensuring compliance with regulatory requirements and protecting client information. By partnering with AdvisorDefense, RIAs can enhance their cybersecurity posture, ensure compliance, and protect their clients from evolving cyber threats. Protect your clients. Maintain your reputation. Ensure compliance. Contact us to learn more about how we can support your firm. https://lnkd.in/eVKtr3_x #Cybersecurity #SEC #Compliance #RIAs #AdvisorDefense #CyberRiskManagement #FinancialServices #RegulatoryCompliance #CyberThreats #CyberSecurityAwareness #CyberSecuritySolutions

10

1 Comment

Data privacy isn't optional anymore. It’s the backbone of trust in modern GRC. Data is the lifeblood of every organization, but with great power comes great responsibility (Uncle Ben). Privacy regulations like GDPR, CCPA, and others are more than just legal checkboxes - they’re about trust. Here’s the reality: Businesses collect more data than ever. → Customer information. → Employee records. → Sensitive financial details. But here’s the issue. Most GRC frameworks aren't built to handle today’s data explosion and leaders need to rethink their GRC approach. A robust GRC framework is essential for managing the complexity of data privacy. Here’s why: → It centralizes privacy compliance across multiple jurisdictions. → It tracks how data is collected, stored, and shared - transparently. → It integrates privacy-by-design principles into your core operations. Your framework must prioritize data privacy at every level: → Clear policies for data collection and retention. → Real-time monitoring for risks and vulnerabilities. → Transparent reporting to regulators and stakeholders. Organizations that treat data privacy as a priority, not an afterthought, gain more than compliance. They gain trust, loyalty, and a competitive edge in the market. Because in today’s world, protecting privacy isn’t just good governance, it’s good business. How is your organization approaching data privacy in its GRC strategy? #GRC #DataPrivacy #GDPR #CCPA #Compliance #PrivacyByDesign

4

CISO job dissatisfaction is at an all time high - average tenure is 18-26 months compared to 4.9 years for other execs. It does not need to be this way! There are a few changes that can be made to address some of the biggest concerns: 1. Make sure the job is scoped well and not just a catch all of tech. 2. Include them in executive level decisions. 3. Make them an officer or director so they fall under your D&O. Or get cyber insurance that covers them personally.

4

1 Comment

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

We all know CrowdStrike from their endpoint detection tool, IR services and threat intelligence. But it looks like we’re getting a Next-Gen SIEM as well. #RSA #RSAC #RSAC24 __________________________________________ Hi! My name is Maverick! #TheDataLawyer I’m the Founder & Managing Attorney for Avant-Garde Legal, PC I post about pretty much anything related to Data and why you should consider a legal/risk management approach first or in tandem to upping your tech stack. More so, I just like making content on how this applies in real life so follow share and engage with my posts! #data #dataprivacy #dataprotection #dataprotectionlaw #artificialintelligence #ai #databreach #privacy #privacylaw #privacypro #cybersecurity Check out my last post here: https://lnkd.in/enTmezeU

5

2 Comments

“AI systems give rise to new types of harms that do not require malicious intent. This, in turn, means that the traditional incident-response playbook needs to be updated for AI systems.”

7

2 Comments

What happened with Cloudstrike and why it is interesting from a security perspective (1) What happened Cloudstrike sells falcon security software which its customers install on their computers. This software can update itself by checking for, and then downloading, software updates from Cloudstrike servers. On Friday, Cloudstrike made such an update available to its customers, which caused some of its customers' Windows computers to crash and restart with a "bugcheck\blue screen error". Until this problem is fixed, these customer Windows computers will not work at all. (2) What was the result This apparently caused flight delays, surgery cancellations, banking issues, and amongst other issues an outage of Starbucks' mobile order-ahead feature requiring baristas to direct customers with handwritten signs to "plz come to walk-up." (3) Was customer data accessed in an unauthorised way, lost, stolen, or held for ransom It does not seem so. (4) How do customer security teams generally react to problems like this Generally, major technology security problems are categorised as (1) business continuity / disaster recovery events which stop customers from accessing or using technology, such as third-party technology systems not being available, pandemics, power failures, telecommunications failures, war, insurrection, etc. and/or (2) a major security issue which often manifests as data breaches, viruses/ransomware/malware, hacking, social engineering (tricking people), denial of service attacks, etc. (5) How customer security teams are reacting For impacted customers, this is definitely (1) a business continuity / disaster recovery event. While seemingly not malicious, any incident involving downloading third party software to multiple local computers which unexpectedly causes those computers to crash and not recover without intervention will also be treated by security teams as (2) a major security issue. (6) What makes this interesting from a security perspective Security specialists generally think about systemic technology risk in the context of the risk of very large numbers of customers using the same technology hosting provider (such as Google Cloud Platform, Amazon Web Services, etc.) or the same operating system (Microsoft Windows). This is interesting because one update, to one type of software installed on customers' computers, provided by one software vendor has caused such significant issues.

10

1 Comment

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Malwarebytes has a nice tool (used for marketing) to check for your "personally identifiable information" (pii) (including sensitive pii like your SSN, DOB, address, phone number, email address) that may have been leaked to the dark web from the AT&T data breach. When you enter your email and click "scan now," you'll receive an email with a code to enter and get a personalized report on the Malwarebytes website. https://lnkd.in/eqtVYPGd If you discover that your sensitive pii was published on the dark web, place security credit freezes on your credit reports. For more info and verified links to Experian, Equifax and TransUnion credit freeze pages, visit FrozenPii.com and click the "Freeze My Credit" button. It also would be a good idea to create and lock down online accounts with the Social Security Administration (SSA) and the Internal Revenue Service (IRS). For more info and verified links to the SSA and IRS, visit FrozenPii.com and click the "Claim My Gov ID" button.

9

3 Comments

When was the last time you read the “Destroy All Confidential Information” clause in an NDA and thought, Wait… how does this apply to my backups? This often-overlooked provision seems straightforward—until you realize that deleting information from backup systems isn't as simple as hitting "delete." Data lingers in archives, across multiple servers, and within retention systems designed to prevent loss. Full compliance could mean massive expense, disruption, or even the impossible. 🔥 Why This Matters: Many NDAs require parties to destroy confidential information upon request or when the NDA ends. But here’s the catch: Backups are built to endure – By design, backups aren’t easy to tamper with. Cost of compliance – Purging backups can mean system-wide overhaul or forensic-level data scrubbing. Legal gray areas – If destruction isn’t practical, are you technically in breach? How to Tackle This: Negotiate upfront – Add clauses that exclude backups from destruction, or limit destruction to "commercially reasonable efforts." Retention periods – Specify how long backups are kept and when they will naturally expire. Certifications – Offer to certify that data won’t be restored or accessed, instead of full deletion. Transparency – Clearly outline your backup process during negotiations. 💡 Pro Tip: If you spot this clause in your next NDA, don’t breeze past it. Address it early to save yourself from future headaches (and unexpected bills). #NDATips #LegalCompliance #DataPrivacy #ContractNegotiation #BackupDilemma

11

4 Comments

As I previously posted, I’m struggling with PCI 4.0 Targeted Risk Analysis(TRA) process on frequency. The frequency on certain activities like vulnerability scanning and user access reviews are already determined by Corporate Policy, not a TRA. And some of these are “influenced” by other regulatory requirements such as SOX - must conduct quarterly user access reviews. Maybe a TRA would be a better approach to determining frequency, but I already have standards. What does the TRA contribute to an existing standard? One could argue that the TRA supports that standard but in reality I think it leads us to a foregone conclusion that quarterly is sufficient. I may end up with some type of TRA word salad that validates whatever frequency that the Company standards dictate. I’m still working on it, version 5. But I think having supporting Corporate Standards allows me to examine the risks of not complying with the aligned standards is the best approach to produce a TRA. Unless I go to version 6, which is unknown at this time.