Tom K.

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

Big day for #PQC and the evolution of #cybersecurity! QuSecure is proud of our #leadership role in advancing #crypto agility with our #quantum resilient software solution QuProtect. To assist organizations in getting started, contact QuSecure as we are offering organizations the following four opportunities: 1. For CISOs: A free road mapping session with QuSecure, the award-winning company in crypto agility with more implementations than anyone to date. 2. For Boards and Executive Team Members: A half-day briefing with Accenture and QuSecure. Learn what others are doing and how to apply what they have learned to your organization. 3. For Organizations Ready to Test Crypto Agility: A #free #POC addressing your choice of Crypto Agility across applications, networks, and routers. 4. For Anyone Looking to Learn More: QuSecure is teaming with PayPal for a webinar on “Protecting Blockchain & Crypto Against Quantum & AI” on Wednesday, August 14, at 1 pm PT/4 pm ET.

1

📢 Check Point Again a Frost Radar XDR Leader in 2024 In this report, Check Point was cited as a Growth and Innovation Leader in Extended Detection and Response (XDR). Check Point XDR/XPR Key Highlights: • Collaborative Threat Prevention • AI Copilot • Consolidated Threat Intelligence and Analytics • Infinity Playblocks Automation • Centralized IOC Management • Threat Intelligence & Event Correlation Download your free copy of the Frost Radar™ XDR Report to learn more about why Check Point is a Growth and Innovation leader in Extended Detection and Response 👉 https://lnkd.in/gecJVKrG Yael Cinamon

4

For far too long we’ve “one sized” access across multiple resource types - often granting far too much access to users to try to remove friction from our business. But we should be able to provide the RIGHT amount of access at the RIGHT time. Here Justin McCarthy - our co founder and CTO - explains how StrongDM can “right size” the authentication process to step up access when needed whilst introducing just enough friction for the task at hand. All within the confines of the industrys most open and powerful PAM infrastructure. Do things differently and get different results…

19

1 Comment

We are shifting compliance left with #Witness and #Hadolint. Want to ensure your Dockerfiles meet compliance controls? This short guide can help you automate the reporting of AC-6, CM-2, and CM-7 for every artifact every time. This is the first in a long series of how to shift compliance left. Follow me and subscribe to never miss out. If there is a tool you would like us to look at and map please let me know in the comments. https://lnkd.in/etNRetSQ

40

5 Comments

Once NIST SP 800-171 and SP 800-171A are published this month, federal agencies are on the clock to start using Revision 3 (outlined in the Office of Management and Budget (OMB) Circular No. A-130, “Managing Information as a Strategic Resource.” The policy states on page I-16: “For legacy information systems, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines within one year of their respective publication dates unless otherwise directed by OMB. The one-year compliance date for revisions to NIST publications applies only to new or updated material in the publications. For information systems under development or for legacy systems undergoing significant changes, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines immediately upon deployment of the systems.” Visibility of how your sensitive data is being handled through it's lifecycle will.be essential; even when it's sitting somewhere within your supply chain. Seclore Data Centric Security is a strong part of NIST and achieving zero trust. https://lnkd.in/efiMejPG #NIST800171 #SecurityRequirements #NIST800171A #AssessmentProcedures #CUI #OMBCircularA130

7

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

189

2 Comments

Is AI a friend or a foe? "There’s no guaranteed path to safety as #ArtificialIntelligence advances" warns Geoffrey Hinton, a pioneer in AI. In a recent interview with Scott Pelley, Geoffrey shares his thoughts on both the benefits and dangers of AI. What's your take? Watch 60 MINUTES: https://lnkd.in/gxJc3YkJ #AI #GenerativeAI To gain weekly insights on #technology and #innovation, subscribe to #CXOSpice newsletter (https://lnkd.in/gy2RJ9xg) and tune in for the latest edition on “Cyber Insurance”. Or subscribe to #CXOSpice YouTube channel (https://lnkd.in/gnMc-Vpj) and tune in for the upcoming episode featuring Vivek Mohindra at Dell Technologies on “AI Open Ecosystem”

299

63 Comments

Keep paranormal privileged access out of your organization with Just-in-Time access from Entitle. https://lnkd.in/eq2qeVTS Data and employees secure. Horrors left at the door. ☑️ Enable controlled, self-serving just-in-time privileged access ☑️ Decrease configuration fatigue & refine employee permissions ☑️ Reduce your access request support tickets by 85% Find out more and watch the demo via the link above. #JustinTime #privilegedaccess #IdentitySecurity #PAM #BeyondTrust

11

Regulatory compliance? 🙄 I know right? But ensuring that you enforce geographic specific access to certain systems doesn't need to be hard... one simple policy...

2

really liked the takeaways SeeMetrics distilled from this, esp about consensus security metrics still being unsettled as the technology, threats, and understanding levels are changing very quickly. https://lnkd.in/gZrxbsWQ

19

1 Comment

🕸 The Security Data Fabric Shift Explained🕸 Last month, Zscaler acquired Avalor for $350M. A security data fabric and vulnerability management startup that only came out of stealth in April of 2023. This acquisition sparked tons of interest and funding activity in the security data management space. It also reignited the platform v. best-of-breed debate and hinted at what's to come for AI in security products. However, this acquisition had many question marks surrounding it. In this deep dive, I cover: ✅ What security data fabrics and security data ETL are ✅ The flurry of activity that happened immediately after the acquisition ✅ Why the acquisition makes sense for Zscaler ✅ What other vendors are doing with data fabrics including CrowdStrike, Microsoft, F5, and SentinelOne. ✅ The implications for the security industry, including incumbents, startups, and security teams I also explore the growing importance of data and AI in security and how this acquisition positions Zscaler well for the next 5-10 years. What are your thoughts on this acquisition and the security data management space? Let me know what you think in the comments section! 👇 🔗 Link for the full post in the comments! #cybersecurity #datasecurity #AI #acquisition #innovation #infosec

62

23 Comments

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

The latest update for #Indusface includes "CVE-2024-27348 – A Critical RCE Vulnerability in Apache HugeGraph Server" and "15 Best #APISecurity Tools in the Market in 2024". #cybersecurity #infosec https://lnkd.in/euZhNK3x

1

Announcing a Valuable New Data Security Incident Response Service! Did you know that data is the fastest growing attack surface in the world? Your organization’s data is vulnerable to numerous potential risk scenarios that require specific evaluations to get ahead of them. This makes Data Security Incident Response a vital component of your organization's cybersecurity strategy. Cyera recently announced their Data Security Incident Response service which allows organizations to leverage and retain a team of elite cybersecurity practitioners to evaluate and respond to data security incidents post breach, helping you identify data security risks, remove ambiguity related to materiality, and determine the fastest path to recovery. Essential in this age of Data Sovereignty and the era of global privacy / regulatory compliance! Viva Cyera! Learn more about our Incident Response service today:

42

12 Comments

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

The wave of consolidation in security (and in this case identity) is showing no signs of slowing down. But waves tend to crash, or at least crest, at some point. FWIW, I don't think this one has at this point but I'm thinking about what will be the signal we've hit peak consolidation. I think one pretty likely signal will be when a public company takes out a private at a valuation level high enough that Wall street really punishes the public with a double digits valuation haircut (at the time I'm writing this the impact on CYBR is a blip...up 1.3% during trading today and down only 0.76% after hours, so not this one). Apart from that, what I think this one has in common with the blockbuster SIEM deals of last week is financial consolidation. According to the article: "...Venafi is expected to add around $150 million in annual recurring revenue ***and will be accretive to CyberArk's margins immediately***" [*** mine] which I read as financial consolidation more so than product expansion / fulfillment of vision. The interesting thing about it is that there's a new cohort of startups doing Non Human Identity. Often that means the status quo is not satisfying the needs of the market and the discovery diligence of founders indicates the incumbents are vulnerable to a new generation of tech. Will be interesting to see how that plays out.

24

6 Comments

Big changelog for our #CERT's #ransomware cartography! 🤠New version (v27) available on our CERT GitHub: https://ow.ly/P4gM50TwWrN 💡Entities are clickable for our World Watch clients to read more about threat groups and malware strains. #cyberthreatintelligence #cti

6

💡 Unlock the Potential of Your PKI with the PKI Maturity Model! Are you maximizing the benefits of your Public Key Infrastructure (PKI)? The PKI Maturity Model (PKI MM) isn't just a tool - it's your roadmap to elevating your PKI's performance and security standards. 🛠️ Tailored Guidance: PKI MM offers a comprehensive framework, integrating best practices and expert recommendations to refine your PKI's maturity. From identifying improvement areas to implementing robust security measures, it's your go-to resource. 🔍 Assess, Improve, Excel: Leverage PKI MM to conduct thorough assessments, pinpointing vulnerabilities, and enhancing efficiency. Elevate your PKI's maturity level, mitigate risks, and align seamlessly with industry benchmarks. 👥 Stand Out: As a service provider, showcase the caliber of your PKI offerings by leveraging PKI MM to demonstrate excellence to your clientele. Consultants and auditors, use it to drive tangible improvements and provide unparalleled guidance to your clients. 📊 Benchmark and Adapt: Gain invaluable insights by benchmarking your PKI against peers. Stay ahead of trends, refine practices, and ensure your PKI stays agile and resilient. 🌐 Flexible and Dynamic: Designed to cater to diverse organizational needs, PKI MM is adaptable across various PKI implementations - both internal and external. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Leigh Bailey

22