Samuel Bradley

𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 ≠ 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 As we enter the new year, many of us will start the annual third-party attestations. It’s important to remember that holding a third-party attestation only provides a baseline assurance on the effective implementation of management, operational, and technical controls. Compliance demonstrated by a clean SOC 2 report, ISO 27001 certification, HITRUST certification, etc. does not equate to ironclad security. It only assures that a third-party has audited the system and reviewed evidences against a set of controls. Following are a few security-related projects that should be on the radar of a security team that are outside the scope of audit: ➤ Threat modeling ➤ SCA/SAST/DAST ➤ Source code review ➤ Assessing vendors after they had an incident or breach ➤ BCP call-tree exercise ➤ Social media account security ➤ Proactive brand protection from cybersquatting ➤ AI Governance ➤ AI Guardrails ➤ AI Observability ➤ PRD reviews, Tech spec reviews ➤ Internal pentest of major feature releases ➤ Vulnerability Disclosure (VDP) / Bug Bounty Program ➤ Secure code training (only ISO 27001:2022 & HITRUST require it) ➤ Quality/effectiveness of security awareness training ➤ Data loss/leakage protection (DLP) ➤ Security of browser extensions, Slack bots, etc. ➤ Policy exception and annual review of approvals ➤ Integration with third-party systems ➤ Privacy on reporting (k-anonymity, l-diversity, t-closeness) ➤ Risk assessment with Delphi technique ➤ M&A due diligence It's easy to come up with a list of another 20, but the goal is to emphasize that while obtaining a third-party attestation is a great first step, the job of a security team is just getting started. I spent the majority of my career in GRC and don't want to discount the effort the above compliance standards would require, however, the goal of this post is to encourage us all to look beyond the singular focus of obtaining a certification and dive into other areas of security, compliance, and privacy. #grc #appsec #prodsec #privacy #compliance #infosec #security

49

10 Comments

Most "third party risk management" programs are a colossal waste of resources. Look at the data you're collecting and ask "what changes am I making based on these answers?" If you can't answer "what changes" then you're inventorying risk, not managing it. Period.

148

15 Comments

🔒 When it comes to SOC 2 audits, the competence and experience of your assessors can make or break the process. From understanding unique client architectures to leveraging advanced audit technology, having the right team in place is crucial. Learn what to look for in an assessor and how to ensure your SOC 2 report builds the trust your customers deserve: https://ow.ly/9HLE50SWnih #SOC2 #compliance #cybersecurity

2

Our CISO and current Chair of the IJIS Cybersecurity Working Group, Lawrence F. Zorio III, was joined by fellow Working Group member, Jeramy Cooper-Leavitt on the IJIS Institute Sounds of Safety Podcast to unpack the NIST “Respond” core function. In this episode, which is part of the broader “Navigating Cybersecurity: From Awareness to Action” Series, Larry and Jeramy breakdown the fifth core NIST function: Respond. They discuss how this function enables organizations to maintain the continuity and integrity of the organization's operations and data when they are the victim of a cyber-attack. This is a must listen! Stream the latest episode now: https://hubs.la/Q02--Lms0 #Cybersecurity #NIST #IJIS #Respond #CyberAwareness #PublicSafety #SecurityFirst

9

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Wayne Pierce, CISM discusses how to operationalize the new changes in cybersecurity framework NIST CSF 2.0 into your organization. Watch the whole video here: https://lnkd.in/grb_BT-G If your organization needs assistance with compliance and cybersecurity frameworks, contact us at www.cyberforceq.com. #cybersecurity #NISTCSF #Riskmanagement #Businessoperations #secops #infosec

10

If you're like me and have experienced following when producing high quality system security plans and compliance documentation: - Headaches - Long hours of manual work - Control language ambiguity - Tedious nature of getting the small things right, repeatedly Then you might be interested in what advantages are found in leveraging automation in this space. I'll be speaking this Thursday at the Amazon Web Services (AWS) Midwest Community Day on how we leveraged custom assessments in #AuditManager to automate and augment our assessment capabilities! Would love to see you there and connect! #GRCEngineering

40

7 Comments

During last night’s Connection Call, Kim Cote and I came up with (what I think is) a pretty great idea. What if we treated internal audit like a rotation opportunity for cybersecurity practitioners? I’m not saying we can’t have audit careerists… (We probably should) …but after last night’s Connection Call where Kim shared everything she learned about security from auditing Google’s data centers, it’s clear there’s a lot of skills that could be gained. - Communication - Relationship-building - Conflict resolution - Technical mastery Could a 1-2 year rotation onto an internal audit team be a development pathway for mid-career professionals to senior cybersecurity leadership? If your company is struggling with how to retain and develop talent, how might this strategy work (or not!) for your people? #cybersecurity #audit #leadership

35

6 Comments

🔒 As non-human identities (NHIs) continue to outpace human identities at an accelerating rate, securing these machine-to-machine credentials is no longer optional—it's essential. NHIs like API keys, OAuth tokens, and database credentials have become a prime target for attackers, as seen in breaches like Schneider Electric and GitHub. At Autonomos.AI, we recognize the urgent need for comprehensive NHI management solutions. With advanced threat detection, lifecycle management, and proactive remediation strategies, organizations can secure their NHIs while aligning with IAM and PAM practices for a 360-degree security framework. As the landscape evolves, integrating NHIs and human identities will be pivotal in creating resilient, scalable cybersecurity defenses. Let’s work together to address this growing threat vector and build secure, connected systems. 🚀 #scalablecybersecuritydefenses #360degreesecurityframework #proactiveremediationstrategies #advancedthreatdetection #lifecyclemanagement #machinetomachinecredentials

6

🔒Cybersecurity Compliance Made Simple? Not quite. For many navigating NIST SP 800-53, it’s a complex but essential journey. Compliance isn’t just a checkbox—it’s a commitment to security. Let’s explore the top challenges and practical ways to address them. 👇 𝗧𝗼𝗽 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 Achieving compliance with **NIST SP 800-53** is critical for organizations working with government systems. However, many face hurdles that complicate the process, leading to delays and frustration. Here are the top three challenges—and actionable strategies to overcome them. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟭: 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸’𝘀 𝗖𝗼𝗺𝗽𝗹𝗲𝘅𝗶𝘁𝘆 NIST SP 800-53 outlines hundreds of controls across categories like Risk Assessment and Access Control. Its technical language can overwhelm teams trying to implement them effectively. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Simplify**: Tackle one control family at a time. - Bring in Experts**: Work with consultants experienced in federal compliance. - Use Tools**: Automate mapping controls to existing processes for efficiency. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟮: 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗻𝗴 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗶𝗻𝘁𝗼 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀 Compliance is often treated as a “bolt-on” after development, leading to costly rework and inefficiencies. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Start Early**: Embed compliance into the development process. - Collaborate**: Form cross-functional teams with developers, security, and compliance experts. - Adopt DevSecOps**: Integrate compliance into development pipelines for ongoing alignment. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟯: 𝗞𝗲𝗲𝗽𝗶𝗻𝗴 𝗨𝗽 𝘄𝗶𝘁𝗵 𝗖𝗵𝗮𝗻𝗴𝗶𝗻𝗴 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱𝘀 NIST SP 800-53 evolves with emerging threats. Revision 5, for example, emphasizes supply chain risk and privacy controls, challenging organizations to adapt quickly. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Stay Updated: Regularly review updates from [NIST.gov](https://www.nist.gov). - Train Continuously: Equip teams to understand revisions and implement changes effectively. - Perform Audits: Regularly assess compliance gaps and address them proactively. 𝗪𝗵𝘆 𝗧𝗵𝗶𝘀 𝗠𝗮𝘁𝘁𝗲𝗿𝘀 Non-compliance isn’t just about penalties—it’s about protecting critical systems and data. Organizations that prioritize compliance also position themselves as trusted partners in the federal space, enhancing security and reliability. 𝗬𝗼𝘂𝗿 𝗡𝗲𝘅𝘁 𝗦𝘁𝗲𝗽𝘀 At Steel Rail Security, we help organizations navigate these challenges with tailored guidance. Whether it’s gap analyses, strategy development, or full compliance support, we’ve got you covered. What’s your biggest challenge with NIST SP 800-53 compliance? 👇Share your thoughts below or reach out to start simplifying your journey to compliance. 🔑 Let’s build a more secure future—together.

1

📢 HITRUST's Combined Assessments: The Swiss Army Knife of Compliance! ⚔️ Tired of juggling multiple assessments? HITRUST's Combined Assessments are here to save the day with their "Assess Once, Report Many™" approach. 🙌 Now, you can use this one framework to check your #compliance with others like HIPAA or the NIST #AI Risk Management Framework. Talk about efficiency! ⚡ Ready to streamline your compliance efforts? Dive deeper here: https://ow.ly/AlPT50Thu6Z #HITRUST #riskmanagement #compliancemadeeasy

3

What do you know about Continuous Threat Exposure Management (CTEM)? In our latest Q&A, Alton Crossley, security engineer extraordinaire, explores the intricacies of this process, which he calls "an umbrella program that crosscuts security practice silos." Read his insights: https://lnkd.in/env8hniZ Want to dive deeper into CTEM? Alton is hosting the "Fast Focus: Give Your Security Program Traction" session at Live!360 this November. Learn more about it in the article! #CTEM #DataSecurity #Cybersecurity #CyberThreat #Security #ITPro

2

The Security Exchange Commission's latest disclosure rules have significantly increased the pressure on CISOs and security leaders to strengthen their cybersecurity posture. Failure to comply could lead to severe consequences. Questions? We can help you navigate these new regulations with confidence. Contact us today to discuss a strategy for SEC-compliant cybersecurity ✔

1

Check out our latest blog post: "Fraudster’s Fumble: From Phish to Failure," authored by @GuidePoint's Gabe Renfro and Jake Plant. Discover how our #DFIR experts successfully identified and thwarted a complex Business Email Compromise (#BEC) incident. This piece offers valuable insights to strengthen your #cybersecurity measures. Dive in here: https://okt.to/64yhG3 #ThreatIntel

4

Are you ready to undergo an ISO42001 certification assessment? Have you addressed the items below? 1. Leadership and Commitment ➡Clause 5.1: Leadership and commitment ➡Clause 5.2: Policy ➡Clause 5.3: Organizational roles, responsibilities, and authorities 2. Risk Management ➡Clause 6.1: Actions to address risks and opportunities ➡Annex B.6.3: Risk management processes 🔲Conduct comprehensive risk assessments related to AI use and implement appropriate mitigation strategies. 🔲Maintain detailed records of identified risks and mitigation measures. 3. Data Management and Quality ➡Clause 7.5: Documented information ➡Annex B.6.2: Data quality and management controls ➡ISO5259 Series: Data quality guidelines for AI systems 🔲Implement data governance practices, including data quality, security, and privacy controls. 🔲Document data sources, processing methods, and quality control measures. 4. System Design and Development ➡Clause 8.1: Operational planning and control ➡Clause 8.2: Requirements for products and services ➡Annex B.6.2: System design and development controls 🔲Ensure AI systems are designed and developed following ethical AI principles. 🔲Conduct verification and validation to ensure AI systems meet specified requirements and perform reliably. 5. Operational Controls ➡Clause 8.3: Design and development of products and services ➡Clause 8.4: Control of externally provided processes, products, and services ➡Clause 8.5: Production and service provision 🔲Document all operational processes related to AI systems, including design, development, deployment, and maintenance. 🔲Ensure all processes comply with relevant legal and regulatory requirements. 6. Training and Competence ➡Clause 7.2: Competence ➡Clause 7.3: Awareness ➡Clause 7.4: Communication 🔲Provide training to all relevant personnel on ISO42001 requirements and their roles within the AIMS. 🔲Maintain records of training, certifications, and competence of all personnel involved. 7. Internal Audits and Reviews ➡Clause 9.2: Internal audit ➡Clause 9.3: Management review 🔲Regularly conduct internal audits to assess the effectiveness of the AIMS and identify areas for improvement. 🔲Conduct management reviews to evaluate the performance of the AIMS and ensure continuous improvement. 8. Documentation and Records ➡Clause 7.5: Documented information (control of documents and records) ➡Annex B.7: Detailed documentation requirements 🔲Maintain detailed documentation of all aspects of the AIMS, including policies, procedures, risk assessments, and compliance records. 🔲Ensure accurate and accessible record-keeping to demonstrate compliance with ISO42001. 9. Continuous Improvement ➡Clause 10.2: Nonconformity and corrective action ➡Clause 10.3: Continual improvement 🔲Develop and implement plans for continuous improvement based on audit findings and management reviews. 🔲Implement corrective actions for identified non-conformities and monitor their effectiveness. @A-LIGN #iso42001

9

Explore the importance of Human Risk Management (HRM) in protecting your organization from risks related to human behavior and decisions. Read Compass IT Compliance's latest blog post to find out how to ensure long-term success and stability. https://bit.ly/4b2cP4k

5