Jerry Frederick

How does Georgia Banking manage rapid growth without compromising security? With Microsoft Azure and Microsoft security solutions. Read how the bank's move to Azure is getting rave reviews from employees and customers.

1

Charlotte IT and Security leaders! If securing OT is your responsibility, you dont want to miss this session. Todd Wiedman and I will be facilitating a great boardroom discussion where everyone can share their pain points and approaches for improving OT security. We hope you will join us! #evanta #otsecurity #cybersecurity #ciso

44

1 Comment

When a bank aspires to faster growth, security can be a highly effective accelerator. Georgia Banking Company exemplifies the success that’s possible with a tightly connected security tool set. It completed its cloud transformation within 13 months and gained scalable security and efficiency by replacing a collection of disconnected products with Microsoft Security solutions.     As a Microsoft partner, we can help your security operations team achieve similar results, with deeply integrated security solutions that span your entire digital estate. Read the story. 

2

The LinkedIn Learning roadmap "𝐈𝐦𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐘𝐨𝐮𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐨𝐝𝐞𝐥𝐢𝐧𝐠 𝐒𝐤𝐢𝐥𝐥𝐬" includes courses to enhance security professionals' threat modeling capabilities.. 𝐎𝐯𝐞𝐫𝐯𝐢𝐞𝐰 This learning path is around the STRIDE threat modeling framework. Each course in the series delves into one of these categories, providing learners with the tools and knowledge to identify, analyze, and address these threats effectively. 𝐈𝐧𝐬𝐭𝐫𝐮𝐜𝐭𝐨𝐫 Adam Shostack guides the learning path. He brings extensive experience as a consultant and author and provides valuable insights and practical approaches throughout the courses. 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠 𝐨𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐬 The learning path establishes a robust foundation in threat modeling principles and practices. Using the STRIDE model to identify and analyze critical security vulnerabilities, participants will acquire comprehensive skills and practical experience applying threat modeling to secure products and services effectively. 𝐂𝐨𝐧𝐭𝐞𝐧𝐭𝐬 The program includes six courses that cover threat modeling, from foundational principles to specific threats. The first course introduces the principles of threat modeling. Subsequent courses explore specific aspects, such as identity spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each course provides techniques, security risks, and countermeasures to address cybersecurity challenges effectively. 𝐂𝐨𝐧𝐜𝐥𝐮𝐬𝐢𝐨𝐧 This learning path is crucial for diverse professionals who want to enhance their knowledge of threat modeling. It offers a structured approach to comprehending cybersecurity threats and the best practices for handling them. It is valuable for those in security architecture, software development, and IT security management roles who aspire to build or improve their threat modeling capabilities. #threatanalysis #threatmodeling #stride #security #cybersecurity

6

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

10 Most Impactful PAM Use Cases for Enhancing Organizational Security Privileged access management (PAM) plays a pivotal role in building a strong security strategy. PAM empowers you to significantly reduce cybersecurity risks, gain tighter control over privileged access, achieve regulatory compliance, and reduce the burden on your IT team. As an established provider of a PAM solution, we've witnessed firsthand how PAM transforms organizational security. In this article, we aim to show you how PAM can secure your company in real, impactful ways. 1. Enforcing the principle of least privilege# Giving users just enough access to perform their duties is fundamental to maintaining a robust security posture. PAM solutions enable you to grant minimum permissions to employees essential for their work, helping you prevent privilege misuse and potential security incidents. For example, with PAM, you can securely grant access to sensitive payment systems exclusively for your finance department. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

2

From a cybersecurity architecture perspective, there are several fundamental elements which represent fundamental building blocks on which everything else is built. It seems that everyone is focusing on the implementation of security tools in 2024 but no one is focusing on cybersecurity fundamentals. One of these fundamental building blocks is a well defined and a regularly tested incident response plan. I know this sounds simple or even to good to be true given all of the headlines and advertisements about the latest cybersecurity tools but increasingly, industry trends are showing that even with the most popular security tools in place, companies are still be breached and compromised at record levels. I believe that the root cause of this is a failure to implement an end to end basic level of cybersecurity hygiene with a sufficient level of measurable maturity. The post below provides rock SOLID advice on what enterprises should consider as starting point for any minimally viable cybersecurity capability.

6

Cyber Incident Response Planning “tabletop” exercise guidance and templates from the Cybersecurity and Infrastructure Security Agency (guidelines for running different scenarios for different industry sectors): 

8

🎯If you are a Chief Information Security Officer (CISO) there are many things that can keep you up at night. But what are the key things that you should always have your finger on at all times? This infographic is a fun and visual way to help you remember and focus on the Top 10 actions any CISO should focus on and do immediately. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

2

1 Comment

When a bank aspires to faster growth, security can be a highly effective accelerator. Georgia Banking Company exemplifies the success that’s possible with a tightly connected security tool set. It completed its cloud transformation within 13 months and gained scalable security and efficiency by replacing a collection of disconnected products with Microsoft Security solutions. As a Microsoft partner, we can help your security operations team achieve similar results, with deeply integrated security solutions that span your entire digital estate. Read the story.

2

I wanted to share some insights from the 2nd Official Cybersecurity Summit Jacksonville 2024 that I had the privilege of attending today. It was an incredible forum with a lineup of esteemed speakers who focused on the critical task of protecting the business applications and infrastructure. Some key takeaways from today’s discussions: The day kicked off with a discussion on the 13 essential controls that every business should implement to effectively mitigate cyber threats, reduce business risks, and elevate their cybersecurity programs. The key takeaway here was the emphasis on strengthening our internal processes ⚙️ and controls rather than chasing the next shiny security tool. A significant portion of the summit was dedicated to the importance of cloud computing and security. The panel highlighted how the cloud presents new opportunities for hackers to exploit vulnerabilities. They discussed the adoption of cybersecurity mesh, Zero Trust architecture, and Secure Service Access Edge (SASE) as solutions to combat these challenges in the cloud environment. Artificial Intelligence (AI) ✨ and its associated security challenges were also a hot topic. We explored six different types of AI attacks to better understand the threat landscape and received valuable suggestions for securing data, models, usage, and infrastructure. The consensus was clear: securing Gen AI with Gen AI is crucial for a comprehensive security governance approach. The role of the CISO in this evolving threat landscape was another focal point. CISOs must continuously evolve their cybersecurity programs and leadership styles to address the advancements in AI, particularly Gen AI. The ability to translate technical risks into quantifiable business terms was emphasized as a critical skill. The day concluded with a compelling talk by the special agent from the FBI, who shared real-world scenarios of coordinated phishing attacks. It was eye-opening to see how cybercriminals are using sophisticated techniques to infiltrate even the most secure financial institutions. Overall, it was a fantastic opportunity to network 🤝 with like-minded professionals from North Florida and to enhance our collective cybersecurity knowledge. Great work by Bradford Rand and his team in organizing this event. #Cybersecurity #JacksonvilleSummit

84

8 Comments

CISA Details Red Team’s Activity Including TTPs & Network Defense A comprehensive Red Team Assessment (RTA) was conducted recently by the Cybersecurity and Infrastructure Security Agency (CISA) on a critical infrastructure organization in the United States. This assessment, which spanned approximately three months, aimed to evaluate the organization’s cybersecurity detection and response capabilities by simulating real-world threat actors. The CISA red team operated without prior knowledge of the organization’s technology assets and began by conducting open-source research on the target organization. Besides this, cybersecurity researchers discovered that their initial attempts at spearphishing were unsuccessful, but they eventually gained access through a web shell left from a previous Vulnerability Disclosure Program (VDP). Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

2