Daniel Johnson

I wonder how many SIEM vendors out there are sweating how GenAI will auto-magically translate data normalizations and field extractions, detections, reports, and dashboards between different products to make SIEM replacements far easier to do. I think they probably should be.

23

28 Comments

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

We are a mighty cybersecurity awareness team! Kelly Crisp Isaac J. Galvan Ben Woelk, CISSP, CPTC, and yours truly - we've been preparing weekly for our panel at the Educause Annual Conference in San Antonio next week! If you're going to be there, be sure to attend our session on Wednesday afternoon at 1:45 - Crafting Effective Cybersecurity Awareness on Campus I'm excited to collaborate with my brilliant colleagues - we have a great discussion planned! #cybersecurityawareness #cyber #cybersecurityawarenesstraining

33

4 Comments

One of the topics I have discussed most since joining CyberRisk Alliance is #securitymetrics. CISOs and senior leaders face a daily challenge of putting their security programs into a context that results in action. I have always said metrics fall into 4 categories, “what should I track”, “what can I track”, “what am I tracking”, and “what doesn’t need to be tracked.” Finding what goes in which bucket is the challenge.

18

2 Comments

ISC2's CISSP: Is the Certification Broken? David Malachow interviews Ira Winkler on the Professional CISO Show, discussing Ira's open letter to ISC2 and its implications for CISSP certification. A must-watch for cybersecurity professionals! #ProfessionalCISO ['#ProfessionalCISO', '#Cybersecurity', '#CISSP', '#InfoSec', '#ISC2', '#CybersecurityPodcast', '#InformationSecurity', '#DataSecurity', '#ITSecurity', '#CyberRisk']

17

Think again if you believe hackers are your biggest cybersecurity threat. It's not the shadows we should fear most but the gaps in leadership within our security teams. Here's a secret: the linchpin of robust cybersecurity isn't just more sophisticated tools or stronger firewalls—it's visionary leadership. Why? Because technology evolves, and so do threats. But the human element—how teams are led, motivated, and empowered—decides our fate against cyber attacks. The gap in leadership isn't just a missing piece; it's a chasm where potential falls through. I've seen firsthand how a shift towards strategic, empathetic leadership can transform security posture from reactive to proactive. It's about fostering a culture where every team member feels responsible for the organization's digital safety, continuous learning is encouraged and required, and leadership listens as much as it guides. Imagine a world where cybersecurity teams are led by visionaries who understand the importance of culture, innovation, and resilience. Where leaders are not just commanders but coaches, mentors, and chief motivators. Here's what we can do: start conversations in our networks about the importance of leadership in cybersecurity. Share stories of success and lessons learned. Advocate for leadership development programs within our organizations. Let's not wait for a breach to highlight the importance of strong leadership. The time to act is now. Are you ready to contribute to the change? Join the Next Generation CISO Network. https://lnkd.in/eqZK4GGU

10

1 Comment

We are just under a month out from my next Certified CMMC Assessor (CCA) training class. This training is required to become a CMMC assessor but it is also helpful for consultants and employees of assessed companies to understand the assessment process and use that knowledge to prepare for formal assessment. This class is unique vs other options in that it is an evening style course that meets twice a week for 6 weeks. This is convenient for those that are unable to take a week off from work for the typical bootcamp style course. It also allows you extra time to digest the content and ask questions. You can attend this class without having a Certified CMMC Professional (CCP) if you just want to hear the knowledge but you would not be able to take the CCA exam without first taking CCP training and obtaining the CCP certification. This CCA training is delivered live online for 2 nights a week, 1.5 hours a session, Mondays and Wednesdays, for 6 weeks. This course runs from August 19th through October 2nd. Registration link: https://lnkd.in/eDs-YwMk Hope to see you there, questions and discussions during the course is my favorite part! #cmmc #dib #cybersecurity #nist800171 #supplychainsecurity

31

2 Comments

Koren Wise - so true and so important. There are many qualified organizations offering CMMC Advisory Services from CUI studies and boundary determination to gap analysis and remediation. BUT NOT EVERYONE WHO REPRESENTS THEMSELVES OR THEIR COMPANY AS CAPABLE AND QUALIFIED ACTUALLY IS. The consequences for a company that is legitimately trying to satisfy 800-171 requirements and then pass a CMMC certification assessment in anticipation of receiving an award can be catastrophic. They could lose the opportunity to receive the award they expected and will need to spend additional time and money to conform with the standard and pass a certification assessment. And not every company will have the resources or the willingness to try again. It is a matter of caveat emptor - buyer beware. Ask smart questions to protect yourself against false claims. References are important, especially from clients that have passed JVSAs or DIBCAC Highs. This begs the question: should there be a certification available for companies and individuals providing advisory services? An RPO designation is not at all meaningful, but could be misleading to the uninformed. Just a thought.

20

1 Comment

Analyzing Phishing Email Headers: Protect Yourself from Online Scams Discover how to analyze phishing email headers in this informative video. Learn how to identify urgent or alarming language, generic greetings, suspicious links, and more. Stay safe from online scams and protect your personal information. #OnlineSafety #PhishingScams #EmailSecurity #CyberSecurity #ProtectYourself #StaySafeOnline #PhishingAwareness #OnlineScamPrevention #EmailFraud #InternetSafety

8

Cybersecurity Snapshot: After Telecom Hacks, CISA Offers Security Tips for Cell Phone Users, While Banks Seek Clearer AI Regulations http://ow.ly/hKiE105WiMo

8

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

https://lnkd.in/gQ-kvMFK Maximizing Your Cybersecurity Skills with SANS Training Discover how SANS training can enhance your cybersecurity expertise in just weeks. Gain valuable knowledge from industry experts through digestible content and comprehensive resources. Don't miss out on this opportunity to upskill and obtain prestigious certifications. #CybersecurityTraining #SANSCertifications #IndustryExperts #UpskillYourself #CybersecuritySkills #ProfessionalDevelopment #ComprehensiveResources #CybersecurityExpertise #SANSInstitute #OnlineTraining

1

CMMC self assessment in progress... But seriously, I love the Cybersecurity Maturity Model Certification framework. Do you have any other good Cyber related captions for this classic LOTR gif?

4

Cybersecurity Alert: Ransomware Hits Municipalities Hard RansomHub claimed attacks on Coppell, TX, and the Minneapolis Park and Recreation Board, disrupting services and exposing data risks. The group, linked to 210+ incidents this year, continues targeting public and private sectors. #CyberSecurity #Ransomware #DataProtection #PublicSafety #Technology https://lnkd.in/gQywnYdy

46

Just two more weeks until the final rule implementing the Cybersecurity Maturity Model Certification (CMMC) takes effect. As a CMMC Third-Party Assessment Organization (C3PAO), we want you to be as prepared as possible. So I think this is a great time to point out a potential “gotcha” in the CMMC final rule. The rule removes the requirement for an external service provider (ESP) to have a level 2 certification. BUT…there’s additional language that could trip you up, especially if you’re an ESP with hundreds of clients. Say you choose not to have an assessment. That means someone from your organization must be at every one of your clients’ assessments. That person has to present all the artifacts and evidence and be available to answer questions about your ESP offerings. Does your ESP have enough representatives to cover all your clients in person if they get assessed? If the answer is no, you could unwittingly be setting up your clients to fail. It may be worth your while to go for the CMMC level 2 certification. Even if it isn’t technically required. #CMMC #BestAdvice #cybersecurity #CyberDefense #DoD

73

Integrity and transparency do not promise to sound pretty, but guarantees trust and respect.

7