Stewart Fey, PCI QSA, CISSP, CISA

SEC Charges R.R. Donnelley & Sons Co. $2.1 Million Fine for Cybersecurity-Related Controls Violations On June 18th, 2024, the U.S. Securities and Exchange Commission announced that RR Donnelley, a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. This SEC settlement with RRD highlights critical issues around cybersecurity and internal controls. Key findings include inadequate controls over material non-public information (MNPI), heightened insider trading risks, and violations of the Securities Exchange Act of 1934. Key Allegations: - Inadequate controls to prevent MNPI misuse - Insider trading risks due to poor monitoring - Regulatory violations and insufficient disclosure controls Inadequate Cybersecurity Response: - Between Nov 29 and Dec 23, 2021, RRD's internal intrusion system issued numerous alerts. - Alerts were reviewed by a third-party MSSP and escalated to internal cybersecurity personnel. - Despite escalations, RRD failed to take timely action, leading to unauthorized data exfiltration of 70 GB, including personal and financial information of 29 clients. - Issues identified included lack of prioritization, workflow for alerts, and inadequate auditing of the MSSP's performance. - Only after an external company alerted the CISO did the firm respond effectively. How AdvisorDefense Can Assist Registered Investment Advisors (RIAs): We offer a comprehensive suite of services tailored to help RIAs meet SEC regulations and bolster their cybersecurity defenses. Our mission is to empower RIAs with the necessary tools and expertise to navigate the cybersecurity landscape, ensuring compliance with regulatory requirements and protecting client information. By partnering with AdvisorDefense, RIAs can enhance their cybersecurity posture, ensure compliance, and protect their clients from evolving cyber threats. Protect your clients. Maintain your reputation. Ensure compliance. Contact us to learn more about how we can support your firm. https://lnkd.in/eVKtr3_x #Cybersecurity #SEC #Compliance #RIAs #AdvisorDefense #CyberRiskManagement #FinancialServices #RegulatoryCompliance #CyberThreats #CyberSecurityAwareness #CyberSecuritySolutions

10

1 Comment

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

How CISA is Preparing For the Influx of CIRCIA Reports

2

Cybersecurity Snapshot: After Telecom Hacks, CISA Offers Security Tips for Cell Phone Users, While Banks Seek Clearer AI Regulations http://ow.ly/hKiE105WiMo

8

NoVa and nearby privacy pros, register now for TOMORROW's IAPP KnowledgeNet Networking Happy Hour in Tyson's Corner 6-8p, food and drinks sponsored by BigID. Space is limited, let us know if we should count you in. https://lnkd.in/eDaytQz9 IAPP IAPP KnowledgeNet - DC Chapter #Dataprivacy #privacy #privacymatters

6

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

2

ISC2's CISSP: Is the Certification Broken? David Malachow interviews Ira Winkler on the Professional CISO Show, discussing Ira's open letter to ISC2 and its implications for CISSP certification. A must-watch for cybersecurity professionals! #ProfessionalCISO ['#ProfessionalCISO', '#Cybersecurity', '#CISSP', '#InfoSec', '#ISC2', '#CybersecurityPodcast', '#InformationSecurity', '#DataSecurity', '#ITSecurity', '#CyberRisk']

17

Happening tomorrow - Secure Software Development Attestation Webinar with Adam Winston of ActZero and Eric Matthews of Parabellyx Cybersecurity

9

The 2019 HIMSS Cybersecurity Survey revealed that IT spending on cybersecurity varies significantly across healthcare organizations. However, using these percentages as a benchmark is not effective for managing cyber risk. As I emphasize in my book (Stop The Cyber Bleeding), cybersecurity is a business risk management issue, not just an IT line item. Comparing your spending to peers overlooks your organization’s unique assets, risks, and risk appetite. Your cybersecurity investment should be tailored to your specific challenges and needs, not a standard percentage of your IT budget. Find the book here: https://bobchaput.com/ #RiskManagement #Cybersecurity #Healthcare #ITBudget

9

Keep it as simple as possible. Scoping for a CMMC audit can feel daunting, but a good chunk of the work is all about preparation and continuous, incremental improvement. Here are a few things you can do now: 1. Start Small and Build Out - Don't try to implement everything at once. 2. Proper Scoping - Avoid the mistake of putting your whole company in scope. 9 times out of 10, your whole company won't be in scope. 3. Operationalize - Make sure the team knows their responsibilities and that the environment is configured as prescribed in your System Security Plan (SSP). 4. Documentation - Keep your CMMC documents up-to-date, dust-free, and ready. They're your friend and guide for your day-to-day CUI activities. 5. Stay Ahead - With CMMC 2.0 upon us, prepare now. At SecureStrux, we learned through our own experiences during our Level II assessment and can apply what we have learned as consultants to help others. We know what it takes to secure an enclave for CUI and the processes, procedures, and documentation required. If you need a team that can bring real-world experience to the CMMC certification process, please don't hesitate to reach out!

17

https://lnkd.in/gQ-kvMFK Maximizing Your Cybersecurity Skills with SANS Training Discover how SANS training can enhance your cybersecurity expertise in just weeks. Gain valuable knowledge from industry experts through digestible content and comprehensive resources. Don't miss out on this opportunity to upskill and obtain prestigious certifications. #CybersecurityTraining #SANSCertifications #IndustryExperts #UpskillYourself #CybersecuritySkills #ProfessionalDevelopment #ComprehensiveResources #CybersecurityExpertise #SANSInstitute #OnlineTraining

1

The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and HHS warned in a joint cybersecurity advisory (CSA) that healthcare organizations should harden their systems to protect against Black Basta ransomware. Black Basta threat actors use tried-and-true techniques such as spear phishing and exploiting known vulnerabilities to gain initial access. These actors have been observed exploiting a ConnectWise ScreenConnect vulnerability involving authentication bypass (CVE-2024-1709)

24

1 Comment

The PCI DSS v4.0.1 update provides much-needed clarifications that can help us all strengthen our cybersecurity measures. With clearer guidelines on MFA and payment scripts, we can better protect sensitive data. How is your organization adapting to these changes? Reach out to Arbure for a deep dive into these updates. #PCIDSS #Cybersecurity #Compliance #PCIUpdate

4

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47