Maria Varmazis

Practices that are NOT going to reduce #ransomware attacks? 1. Working in silos. 2. Releasing lists and guidelines that don't align with one another. 3. Using "a bunch of jargon that people can't understand." 4. Failing to realize that "cyber safety is patient safety." And that's just a few of them, according to Erik Decker, who spoke wit Drex DeFord during a recent Unhack the Podcast about the importance of #standardization and #collaboration in cybersecurity. “We’ve got to get cyber out of the back room and into the clinicians’ understanding." https://lnkd.in/etmphKrz #cybersecurityleadership #patientsafety Thanks, as always, to the This Week Health team for pushing critical stories forward! Sarah Richardson Bill Russell Meghan Trevorrow Holly Russell

12

Read this blog by VulnCheck CTO Jacob Baines. It outlines four weeks of analysis on how quickly VulnCheck is able to publish vulnerabilities as our Community solution now boats over 5K registered users. That's right. What's interesting in this post specifically, is the comparison of how VulnCheck NVD++ provides CPE for 76.95% of CVEs published YTD to NIST's NVD CPE data, which covers 41.35% of CVEs. Also, on average, VulnCheck NVD++ delivers CPE data four days faster than NVD via extensive automation and monitoring. VulnCheck NVD++ is available as a free community offering - you should use it if you aren't already. #vulncheck #exploitintelligence #threatintelligence

3

Big changelog for our #CERT's #ransomware cartography! 🤠New version (v27) available on our CERT GitHub: https://ow.ly/P4gM50TwWrN 💡Entities are clickable for our World Watch clients to read more about threat groups and malware strains. #cyberthreatintelligence #cti

6

It’s happening TOMORROW [09-06-24]. This Friday’s Super Cyber Friday topic is "Hacking Tabletop Exercises" on CISO Series. It all starts at 1 PM ET/10 AM PT TOMORROW. Register and join us. https://lnkd.in/gpAv8SS5 #CISOseries #CISO #security #infosec #informationsecurity #cybersecurity

3

What does being a successful CISO look like? It's "constantly reading," staying "dialed in" to the community, and having critical "people and process conversations." It's also realizing that "threat intel doesn't just start and stop with our cybersecurity team" and having a solid resiliency strategy. Excellent insights from Drex DeFord's recent discussion with Teresa Tonthat, Steven Ramirez, Greg Garneau, Joy Poletti, and Shawna Hofer. https://lnkd.in/exp_6EGn #cybersecurityleadership #cybercommunity #cybersecuritystrategy #cisocommunity #itsecurity #cyberresiliency #itleadership

11

2 Comments

So much fun getting to chat with Alton Johnson, OSCP, OSCE about the origins of Vonahi Security and how it caught fire with MSPs. Check out my profile of him here. #msps #cybersecurity #pentesting https://lnkd.in/eReaEFYS

8

New on the OSTIF blog- some thoughts about reasons why projects put off getting an audit. Click through to read what points we've heard before, and why audits are still likely the answer to your security needs. https://lnkd.in/eAe7z8eM Is there an argument you feel was missed or wasn't discussed enough in the blog? Let me know below- let's talk audits!

9

Just in time for October Cybersecurity Month - check out SeeMetrics newly updated boards for all people in the security org! From GRC to vuln management to product to CISO, each one can see real-time relevant metrics for what's needed. This month's webinar w/ CEO Shirley Salzman below:

2

Looking for a way to stay cool? Grab a popsicle and catch up on the latest issue of the AuthZ newsletter. If you’re an #identity or #authorization enthusiast, this weekly digest is a must read. Subscribe and share!

2

Listening to a great talk on single point of failure supply chain by Tarah Wheeler at the IANS Boston security forum. Great talk and a great introduction to the discussion led later today on this issue. If you are here and want to continue this massively important issue join my session on supply chain at 1:05 PM. I believe this is one of the biggest problems in cybersecurity today. What can you do about it? What are you doing about it? Tarah is bringing up some great points. Have you implemented her suggestions? What have been your challenges? Have you considered the wide variety of sources of supply chain attacks? Software updates are not the only thing you need to worry about. What tools exist to help you defend against these attacks? This was a great introduction to today’s discussion and I hope it helps people consider the severity of this issue. Come to learn and share how you are dealing with supply chain attacks with your peers.

8

I had a wonderful conversation with Myke Lyons, the CISO of Cribl. He candidly weighed in on security leaders' biggest concerns right now: "We’re trying to build technologies that might be using and leveraging LLMs to help our customers get better, and then maybe last, but not least, as a security person, I know there’s a lot of value in LLMs and there’s a lot of value in GenAI, and I have to think about how I can use it. And it’s keeping me up at night." https://lnkd.in/ePdXY_fX

5

1 Comment

Move on over HIPAA, there is a new bill working its way through the Washington red tape machine called "Health Infrastructure Security and Accountability Act". Since pretty much all of our health and personal data has already been leaked by inadequate data collectors, some lawmakers decided it was time to act. They are 20 years too late but it's election season so they need to pull out all the stops. HISAA (sounds 'gangsta' doesn't it) has civil penalties for all those health data grabbers out there who don't comply (and get caught) with HISAA requirements. These include: No knowledge – Minimum of $500 Reasonable cause – Minimum of $5,000 Willful neglect (Corrected) – Minimum of $50,000 Willful neglect (Uncorrected) – Minimum of $250,000 Yes, one "reasonable cause" will cost them a month's mortgage payment (4 bedroom, 2 bath, detached garage), which will be passed down to you, the patient, in one form or another. You can compare this bill to the ole SOX Act but for health care. The bill includes checklists, audits, stress test (pen test sorta) and someplace where the CEO has to sign off on the compliance thingy. Health care organizations have 3 years to figure out ways around the bill before they need to worry, once this bill is passed (if it is passed). $800 million of taxpayer cash will be given to Medicare safe providers to help them figure out how data security works. Then there is another $500 million of TaxO'Cash to " incentivize all hospitals" to adopt data security. I've attached a two page summary of HISAA so you too can gasp in horror at how our government thinks. Happy Halloween https://lnkd.in/gmyyCxhe

9

1 Comment

New blog post: Improving Cybersecurity Taxonomies Describing Impact and Cyber Harms Against Organizations I’ve introduced a new MISP taxonomy and shared insights into the critical role of impact description in effective information sharing. https://lnkd.in/eUJb-svP #CyberSecurity #MISP #taxonomies #taxonomy MISP Project (@[email protected] ) CIRCL (Computer Incident Response Center Luxembourg)

41

1 Comment

Heading out to Las Vegas next week for SentinelOne's OneCon conference? Don’t miss the opportunity to hear from GuidePoint Security Mid Atlantic's very own Matt Casey, MS, CISSP as he dives into the topic of Fortifying Cyber Resilience through the integration of SentinelOne and Expel MDR. Matt’s expertise will shed light on enhancing your organization’s cyber resilience strategy in today’s threat landscape. If you are interested in registering for this conference please feel free to message me directly! #OneCon2024 #Cybersecurity #SentinelOne #Expel #GuidePointSecurity

57

Less opportunistic, more targeted: Experts detail how Black Basta ransomware group has been retooling for strategic attacks in what looks suspiciously like state-aligned "coordination and intent beyond mere chance."  https://lnkd.in/eQvspHCh Yelisey Bohuslavskiy

3

What are your thoughts about the future of #AI for #cybersecurity? Read the latest from Greg McDonough and share your thoughts. #RSAC https://lnkd.in/e8zZWWxr

4

Join us tomorrow night, Thursday, December 19th, 2024, at 6:30 PM at the Intrust IT offices for the December #CiNPA Security SIG meeting. Education, networking, food And CPEs. Get the details and register at the link below. #cybersecurity #infosec #cybercrime #cyberwar #IT #technology #community

7

Big day for #PQC and the evolution of #cybersecurity! QuSecure is proud of our #leadership role in advancing #crypto agility with our #quantum resilient software solution QuProtect. To assist organizations in getting started, contact QuSecure as we are offering organizations the following four opportunities: 1. For CISOs: A free road mapping session with QuSecure, the award-winning company in crypto agility with more implementations than anyone to date. 2. For Boards and Executive Team Members: A half-day briefing with Accenture and QuSecure. Learn what others are doing and how to apply what they have learned to your organization. 3. For Organizations Ready to Test Crypto Agility: A #free #POC addressing your choice of Crypto Agility across applications, networks, and routers. 4. For Anyone Looking to Learn More: QuSecure is teaming with PayPal for a webinar on “Protecting Blockchain & Crypto Against Quantum & AI” on Wednesday, August 14, at 1 pm PT/4 pm ET.

8