Nathan Sportsman

This recent ransomware attack on an Arkansas water treatment facility highlights a growing concern for critical infrastructure security. I shared some thoughts on what this breach means for the future of cybersecurity in the water sector and how we can better defend these essential services. Check out my full commentary and the detailed coverage below! 👇 #CyberSecurity #CriticalInfrastructure #Ransomware #WaterSecurity

31

1 Comment

I often get asked “where do I start with TX-RAMP?” Companies know they need it - they’re told they do. But it’s not easy to know where to start. Here’s what you need to know 👇 1️⃣ File for your provisional certification. This will give you 18 months to get the full certification. 2️⃣ Download the TX-RAMP Security Plan Workbook. This serves as your questionnaire and list of necessary controls (117 for Level 1 certification, 223 for Level 2). 3️⃣ Build your program, one control at a time. Once your program is built, you can submit your workbook and other documents to the Texas DIR for their evaluation. No expensive, third party audits necessary! TX-RAMP Certification is a big project, even for companies that have an existing cybersecurity compliance program. There’s a reason they give you 18 months to go from provisional to full certification! Your certification lasts three years, but there are some ongoing reporting requirements to meet. You need to monitor, fix, and report vulnerabilities and breaches to the Texas DIR. More helpful info can be found in the guide below. https://lnkd.in/etitFTkY 

11

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

We are shifting compliance left with #Witness and #Hadolint. Want to ensure your Dockerfiles meet compliance controls? This short guide can help you automate the reporting of AC-6, CM-2, and CM-7 for every artifact every time. This is the first in a long series of how to shift compliance left. Follow me and subscribe to never miss out. If there is a tool you would like us to look at and map please let me know in the comments. https://lnkd.in/etNRetSQ

40

5 Comments

CMMC Level 2 Assessment Objective: Data in Transit PRACTICE: Organizations must implement cryptographic mechanisms to prevent unauthorized disclosure of controlled unclassified information (CUI) during transmission unless otherwise protected by alternative physical safeguards. ASSESSMENT: The intent of this requirement is to ensure CUI is cryptographically protected during transit, particularly on the internet. The most common way to accomplish this is to establish a transport layer security (TLS) tunnel between the source and destination using the most current version of TLS. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST cryptographic mechanisms or mechanisms supporting or implementing transmission confidentiality. (CMMC Assessment Guide: Level 2 Version 2.11, page 222) #CMMC #DoD #cybersecurity #NIST #InformationSecurity https://bit.ly/45HMpUs

41

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

Why Security Matters: A Lesson from the Golf Course https://lnkd.in/duCjZ4s5

1

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

Heads up on this once in 5 years opportunity to sponsor Cyentia Institute research into the largest #cybersecurity incidents. See the call for sponsors for the 2025 "Xtreme" edition of the Information Risk Insights Study at the link below. #cyberrisk #cyberresilience #cyberattacks https://lnkd.in/etc6FjsY

39

2 Comments

Tracking your SPRS score doesn't have to be a guessing game. Victor Cich, Compliance Consultant at RADICL, explains how our platform’s live SPRS score calculator simplifies NIST 800-171 compliance. With real-time updates, you can easily monitor progress, identify roadblocks, and ensure your team stays on track. In this clip, Victor walks through how our tool makes compliance management effortless for both teams and executives. How are you tracking your compliance progress? #SPRS #NIST800171 #CyberSecurity #Compliance #RealTimeTracking #RADICL

6

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

Highly likely that these will be included in the CMEP IP (AML) going forward...

2

DIGITAL PRIVACY ALERT--CMOs for HEALTHCARE SERVICE PROVIDERS: See important article below regarding another data hack of major USA Healthcare service provider. The CYBER security experts with whom we speak are now dissecting how the "bad guys" infiltrated their systems. This is complicated cyber-security detective work, which often results in no clear answers. Yet one thing is increasingly clear, digital tracker codes on healthcare service provider websites are viewed as a possible "data PRIVACY" backdoor risk area.Part of our Web3.0 privacy protecting marcomtek service here at Didgebridge, is "digital data PRIVACY assessing" tracker code possible risk on healthcare websites. So in assessing tracker code presence on website (below) from this Healthcare service provider, what data-hoovering tracker codes did we find? How about this list: Facebook, Linkedin, Google Analytics, Google-Doubleclick, Yahoo, Bing, etc. This last-gen, privacy challenged approach to digital marketing has become increasingly antiquated & ethics (full dislosure?) challenged. If any CEOs and General Counsels are curious about a better way to conduct digital marketing in 2025, we'd welcome your discussion, here at Didgebridge. Our Web3.0 Intellismart, digital data-protecting marcomtek platform might be a solution worth considering? (BELOW ARTICLE)

7

1 Comment

I had a great time today speaking about communicating cyber risk. Shout out to the right side of the room at the Houston Data Connectors Cybersecurity Community! Special thanks to 360 Advanced for the invitation to speak. In my presentation I focused on what you can say to get your cybersecurity project funded. The finance team doesn't say "high impact". They say, this project will save $2.5 million dollars for the organization. The sales team doesn't say "high sales". They say, this deal will generate $250,000 annually and has a 70% chance of closing. The customer support team doesn't say "high customer satisfaction" they say, customer retention is 97% this year. But somehow in cybersecurity we think it is okay to say "high risk" and expect that, others will 1) understand what we are saying and 2) we will get what we need to reduce organizational risk. The value of quantitative risk is that it can be used to... 1) Get on the same page with senior management about organizational risk. 2) Prioritize cybersecurity initiatives 3) Understand how important various security projects are to lowering organizational cyber risk. Even if you don't buy-in, take a look and think about how you can make your cybersecurity program more quantitatively focused. You can take baby steps in this direction. What do you think of quantifying cyber risk? Exciting? Terrifying? #fciso

48

10 Comments

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

TX-RAMP is becoming an increasingly important cybersecurity certification. Texas is leading the way in protecting its agencies from vendor risk by legally requiring cloud service providers to get the certification. Many SaaS, Edtech, and Healthtech companies are now on deadlines to get the certification. For larger companies with existing compliance programs, it’s not such a big deal. For midsize and smaller companies who don’t? It’s a significant lift. Smart and capable employees can get bogged down as they stretch to take on new compliance tasks. They’re capable of doing them, but figuring it all out takes time. We’re trying to make it easier for them with our new program, TX-RAMP Champ. TX-RAMP Champ makes it easier for companies to earn TX-RAMP by taking a lot of the guesswork out of the equation. We provide: 1️⃣ A complete TX-RAMP implementation plan. 2️⃣ High-quality documentation templates with required TX-RAMP components included. 3️⃣ Videos with step-by-step instructions on completing policies, templates, and other required documentation. 4️⃣ Personalized support to quickly clear roadblocks. We’ve designed this to help companies that don’t need a full-service Virtual CISO, but need a little bit of help completing their certification. Learn more at our fancy new TX-RAMP Champ webpage! #fciso https://lnkd.in/eiUNfg_E

27

7 Comments

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

Attention all cybersecurity enthusiasts! 🚨👨‍💻 Globe Life, a prominent Texas-based insurance holding company, is currently investigating a potential data breach involving one of its web portals. 😱 The incident, discovered on June 13, 2024, highlights the critical importance of robust access permissions and user identity management. As a proud member of the HYPR team, The Identity Assurance Company, I cannot stress enough the significance of implementing phishing-resistant MFA and passkeys. These cutting-edge solutions, championed by the FIDO Alliance, provide unparalleled protection against phishing attempts and unauthorized access. 🔐 While the full extent of the breach is yet to be determined, Globe Life has taken swift action by removing external access to the affected portal and activating its incident response plan. They have also engaged external security experts to assess the scope, nature, and impact of the incident. 🔍 This event serves as a stark reminder that no organization is immune to cyber threats. It is crucial for companies to prioritize the security of their digital assets and the sensitive information of their customers. 🙌 I encourage everyone to stay informed about the latest developments in cybersecurity and to advocate for the adoption of robust security measures within their own organizations. 💪 To learn more about this developing story, check out the article by Sergiu Gatlan on Bleeping Computer: https://lnkd.in/gGRz8vD4 #CybersecurityAwareness #DataBreach #IdentityManagement #HYPR #FIDOAlliance

10