Laura Nielsen

I dislike using the term “crisis communications” when talking about security incidents because it gives people permission to accept chaos and panic. These are red flags that your decision-making process isn’t ready for prime time. Anyway, I’m always glad to see more security teams recognize that incident communications isn’t just what you say publicly, it’s also how you communicate internally so that you’re proud of how you show up for the people impacted.

24

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

Are you ready to undergo an ISO42001 certification assessment? Have you addressed the items below? 1. Leadership and Commitment ➡Clause 5.1: Leadership and commitment ➡Clause 5.2: Policy ➡Clause 5.3: Organizational roles, responsibilities, and authorities 2. Risk Management ➡Clause 6.1: Actions to address risks and opportunities ➡Annex B.6.3: Risk management processes 🔲Conduct comprehensive risk assessments related to AI use and implement appropriate mitigation strategies. 🔲Maintain detailed records of identified risks and mitigation measures. 3. Data Management and Quality ➡Clause 7.5: Documented information ➡Annex B.6.2: Data quality and management controls ➡ISO5259 Series: Data quality guidelines for AI systems 🔲Implement data governance practices, including data quality, security, and privacy controls. 🔲Document data sources, processing methods, and quality control measures. 4. System Design and Development ➡Clause 8.1: Operational planning and control ➡Clause 8.2: Requirements for products and services ➡Annex B.6.2: System design and development controls 🔲Ensure AI systems are designed and developed following ethical AI principles. 🔲Conduct verification and validation to ensure AI systems meet specified requirements and perform reliably. 5. Operational Controls ➡Clause 8.3: Design and development of products and services ➡Clause 8.4: Control of externally provided processes, products, and services ➡Clause 8.5: Production and service provision 🔲Document all operational processes related to AI systems, including design, development, deployment, and maintenance. 🔲Ensure all processes comply with relevant legal and regulatory requirements. 6. Training and Competence ➡Clause 7.2: Competence ➡Clause 7.3: Awareness ➡Clause 7.4: Communication 🔲Provide training to all relevant personnel on ISO42001 requirements and their roles within the AIMS. 🔲Maintain records of training, certifications, and competence of all personnel involved. 7. Internal Audits and Reviews ➡Clause 9.2: Internal audit ➡Clause 9.3: Management review 🔲Regularly conduct internal audits to assess the effectiveness of the AIMS and identify areas for improvement. 🔲Conduct management reviews to evaluate the performance of the AIMS and ensure continuous improvement. 8. Documentation and Records ➡Clause 7.5: Documented information (control of documents and records) ➡Annex B.7: Detailed documentation requirements 🔲Maintain detailed documentation of all aspects of the AIMS, including policies, procedures, risk assessments, and compliance records. 🔲Ensure accurate and accessible record-keeping to demonstrate compliance with ISO42001. 9. Continuous Improvement ➡Clause 10.2: Nonconformity and corrective action ➡Clause 10.3: Continual improvement 🔲Develop and implement plans for continuous improvement based on audit findings and management reviews. 🔲Implement corrective actions for identified non-conformities and monitor their effectiveness. @A-LIGN #iso42001

9

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

Thrilled to have joined Strike Graph's podcast (SecureTalk) to discuss building a strong cyber risk management practice! I explored how to develop essential ECRM tools, secure organization buy-in, and transform cybersecurity from a defensive measure into a true competitive advantage. I also shared insights on creating a budget philosophy that aligns with strategic goals. For anyone interested in moving beyond defense and turning cyber risk management into a growth driver, this episode is for you! I’d love to hear your thoughts—how are you approaching cyber risk management as a strategic asset in your organization? Thank you, Justin Beals, for an enlightening conversation! #CyberRiskManagement #CompetitiveAdvantage #ECRM

4

We did something new (for us) in the latest edition of the Information Risk Insights Study (IRIS) that focuses on #ransomware - we projected financial losses. Normally, we restrict ourselves to known publicly-reported losses. But in this case, we felt that wouldn't do proper justice to the true impact of ransomware on the economy. But don’t worry—we didn't abandon our core principles and ride the trolley into the Neighborhood of Make-Believe. We took the data we had on ransomware losses over the last five years, fit a distribution, and then applied properly sampled values to incidents that had no loss info on public record. Using this method, we calculate the total financial losses from publicly known ransomware incidents over the last five years to be about $274 billion dollars. How does that fit with your intuition or analysis? Too high? Too low #cyberrisk #cyberattacks Read the full report, sponsored by CISA, here: https://lnkd.in/eWEnwj8n

91

7 Comments

How CISA is Preparing For the Influx of CIRCIA Reports

2

Interesting article highlighting the importance of the CISO position and why organizations should value the insight and knowledge qualified CISOs provide.

8

Organizations encounter cyberthreats in an asymmetric landscape, executives and boards rarely have the luxury of digging deep into their security leader’s management skills or technical acumen. For most organizations, cyberthreats are too imposing to get bogged down in low-impact exercises. A good insight into looking at series of five questions designed to help executives and board members test their confidence in a CISO’s ability to excel in their job from our former boss and thought leader in Cybersecurity

1

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

I'm excited to share a recent milestone in my journey—passing the NACD (National Association of Corporate Directors) Directorship Certification. This achievement isn't just a personal milestone but a testament to the vital role of continuous learning in leadership and cybersecurity governance. Having been on both sides of the boardroom table, I've seen firsthand how navigating the complexities of modern enterprises requires more than deep expertise in a single domain—it demands a broad, strategic understanding across multiple disciplines. Here are a few key points for those aspiring to board roles or looking to deepen their C-level impact: Broaden Your Horizons: Understand your business beyond the technical details. For those seeking a board seat, look behind simply having cyber experience and to what else you can contribute. Commit to Excellence: Pursue excellence in all you do. Hold yourself to high standards, learn from setbacks, and continuously seek ways to improve—even when things go right! Stay Curious: Keep ahead of industry trends, challenges, and innovations. Staying informed and proactive is crucial for making strategic decisions and fulfilling a director's duty of care. The path to a board role can be challenging but it is also rewarding and can have significant impact. For CISOs looking to improve their board interactions, focus on translating technical details into business impact to enhance your role as a strategic partner. Keep learning. Keep growing.

98

12 Comments

It's not too late to register for Enhanced Vendor Risk Assessments: Maximizing Risk Reduction and Strengthening Vendor Relations on Tuesday July 30 at 1 PM ET Vendor risk assessments have been a cornerstone of security for years, but how effective are they? Join us for an in-depth presentation where we dive into the intricacies of vendor risk assessments and explore strategies to enhance your process. Key Topics Covered: ➡ Effectiveness of Traditional Assessments: Evaluating the real value of current practices. ➡ Assessment Types: How to decide when to send questionnaires, accept security attestations and other assessment methods. ➡ Process Enhancements: Innovative methods to improve your assessment framework. ➡ Role of AI: Leveraging artificial intelligence to scale and optimize vendor risk programs. 💡 Attendees will receive a comprehensive security assessment matrix, designed to help you map out and right-size your vendor assessment programs according to the specific risks and resources of your organization. Join us to ensure your vendor risk assessments are not only thorough but also efficient and effective, paving the way for stronger vendor relationships and enhanced security. #cybersecurity #supplychainsecurity #vendorrisk

6

1 Comment

CrowdStrike Responds to Delta's Legal Threats Over Software Update Outage 💥 Cybersecurity firm CrowdStrike is pushing back against Delta Air Lines' legal threats following a recent software update that disrupted Delta's operations. In a strongly worded letter, CrowdStrike claims Delta misrepresented the situation and that it was Delta's own IT decisions that worsened the outage. CrowdStrike also states that they repeatedly offered assistance to Delta, including a direct offer from their CEO to Delta's CEO, but received no response. This public exchange escalates the tension between the two companies. It remains to be seen whether Delta will pursue legal action or if the companies can find a way to resolve this dispute. #cybersecurity #aviation #software #Delta #CrowdStrike #dispute https://lnkd.in/ezRb24cJ

6

4 Comments

Do you need to be CMMC Level 2 compliant, but are having trouble translating the cybersecurity gobbligook into real actions that your IT team can take? We are having a live webinar on June 27, 2024 at 2pm EST to demonstrate the Kieri Compliance Documentation. This is a full-featured program for CMMC Level 2 and NIST SP 800-171 compliance which includes policies, procedures, system security plan, user agreements, record-keeping databases, account request form, self-assessment form, and other vital resources needed to be compliant. Monthly Q&As and over 50 hours of video training included. Kieri Solutions uses this program to efficiently manage our CMMC Level 2 compliance. We passed a DoD assessment for CMMC Level 2 and NIST SP 800-171 compliance with a perfect 110 score using this governance program. We have over a hundred clients using the KCD to manage their compliance and prepare for CMMC Level 2 assessment themselves. 𝐃𝐨𝐞𝐬 𝐭𝐡𝐢𝐬 𝐬𝐨𝐮𝐧𝐝 𝐥𝐢𝐤𝐞 𝐲𝐨𝐮? 🔸 You are frustrated with your policies and procedures… 🔸 You don’t know how to perform some CMMC requirements, or how to answer assessment objectives like “define non-essential functions”… 🔸 Your documentation is out of date… 🔸 You bought compliance templates elsewhere and they are too complex to get through… 🔸 You are paying a huge monthly fee to a GRC website and you’re still stuck filling in blanks… 🔸 You don’t have a record keeping system that makes it easy to gather the info you need for assessment… 🔸 Your users are asking how to mark CUI and you don’t know how to help them… If so, please join us for this webinar. We will be showing the program that we use to reach and maintain a "110" score. https://lnkd.in/eRjbVFrD Kieri Solutions - Authorized C3PAO

38

6 Comments

🚨 You've Been Breached...Now What? 🚨 In our latest IJIS Institute Podcast, we dive deep into how to effectively respond to a cyber incident. Using the NIST Cybersecurity Framework (CSF), we cover essential controls to have in place for taking action during a cyber event. Stay tuned until the end, where Jeramy Cooper-Leavitt and I share practical tips you can implement today! Don't miss out on this crucial episode! #CyberSecurity #NISTCSF #CyberIncidentResponse #IJISPodcast #PracticalTips

7

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

Check out our latest blog post: "Fraudster’s Fumble: From Phish to Failure," authored by @GuidePoint's Gabe Renfro and Jake Plant. Discover how our #DFIR experts successfully identified and thwarted a complex Business Email Compromise (#BEC) incident. This piece offers valuable insights to strengthen your #cybersecurity measures. Dive in here: https://okt.to/64yhG3 #ThreatIntel

4