Andrew Hay

NIST Releases the C-SCRM Due Diligence Assessment Quick-Start Guide for Public Comment https://lnkd.in/dYxE3Uu6

12

From the @Acronis blog: Key changes to NIST Cybersecurity Framework: https://hubs.ly/Q02tknzG0

1

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

2

GSA announced last week that, "Starting June 8, 2024, GSA will begin collecting Common [#SSDF Attestation] Forms for new contracts (including micro-purchases) and the exercise of contract options, that include the use of software, regardless of whether or not the software is considered critical." This is a major update because it means all vendors dealing with GSA or a GSA contracts must comply in June and NOT in September, like originally thought. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT 

16

2 Comments

This is very interesting... seems to be a riff on an analysis technique that we described in an article titled "Beyond Timelines - Anchors in Relative Time" ten years ago in Digital Forensics Magazine. The technique has been applied to extremely high-profile and high-stakes cases since then.

11

2 Comments

CISA (Cybersecurity and Infrastructure Security Agency) has proposed new reporting requirements for significant cyber events across critical infrastructure sectors, including healthcare. These requirements aim to enhance cybersecurity measures but have raised concerns within the medical community. MGMA (Medical Group Management Association) has suggested that instead of adding duplicative reporting requirements, CISA should collaborate closely with HHS (Department of Health and Human Services) to streamline existing regulations under HIPAA. They also expressed concerns about the proposed size-based threshold, which could impose reporting obligations on smaller physician offices with revenues as low as $9 million annually. Do you agree that collaboration between CISA and HHS could streamline regulatory burdens? #HealthcareSecurity #CISA #CybersecurityReporting

5

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

Heads up on this once in 5 years opportunity to sponsor Cyentia Institute research into the largest #cybersecurity incidents. See the call for sponsors for the 2025 "Xtreme" edition of the Information Risk Insights Study at the link below. #cyberrisk #cyberresilience #cyberattacks https://lnkd.in/etc6FjsY

39

2 Comments

K12 SIX Releases Applicant Guidance for FCC K-12 Cybersecurity Pilot Program Investments Given the current cybersecurity posture of the K-12 sector—including the scarcity of K-12 IT staff with cybersecurity experience —such an open-ended pilot program may feel like both a blessing and a curse. Which eligible services would make the most impact? What time and expertise are required from K-12 staff to successfully implement any given solution? What will come of cybersecurity investments after the conclusion of the pilot program? https://lnkd.in/e4ir2QDY K12 SIX

62

4 Comments

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

As the threat landscape in modern computing continues to evolve, the Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with several other federal agencies, recently published "Modern Approaches To Network Access Security" to provide updated guidance on best practices regarding network access, including remote access to critical resources. The guidance is directed at all organizations, no matter their size, and focuses on three recommended security solutions, Zero Trust (ZT), Secure Service Edge (SSE), and Secure Access Service Edge (SASE), to enable better visibility to activity and more granular and dependable access controls. As noted in the summary, "this guidance helps organizations to better understand the vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, as well as the inherent business risk posed to an organization’s network by remote access misconfiguration." We highly recommend reviewing that guidance for anyone who supports networks and remote access platforms, and contact us today if you are ready to learn more about how Gemini Tech Partners can work with you to evaluate your current security posture and provide guidance on next steps to help ensure you put processes in place that are strategically aligned with your overall business goals. Get more detail from Dark Reading (which includes a link to the CISA published guidance) at: https://lnkd.in/eDWva3gy #ITsecurity #networksecurity #cybersecurity #vpn #zerotrust #accesscontrol #ztna #sase

1

More reading for comments and analysis for the future. The new revisions also help us understand the interpretation of the existing revisions we are helping companies with. Exciting times. We don't get into cybersecurity because it is boring. We love change.

7

Vinson Protect adds NIST Cybersecurity Framework v2.0! You all asked for it - now it's live! You can now add the National Institute of Standards and Technology (NIST) Cybersecurity Framework v2.0 to your Vinson Protect organization! Building upon the K12 SIX Essential Cybersecurity Protections, Center for Internet Security Critical Security Controls, and ClassLink's Cybersecurity Rubric, the CSF adds another lens through which to evaluate your schools' cybersecurity preparations. https://lnkd.in/gJryspY6 Are you curious about Vinson Protect? Why not join the 100+ schools that are using the application? The application allows schools to create audits, security reports, and security plans, track incidents, and manage/delegate tasks to team members. And it's completely free for schools to use! Check it out and sign up for your account --> https://vinsonprotect.com #vinsonprotect #nistcsfv2 #edtech #cybersecurity

7

The latest from OODA Loop Contributor Emilio Iasiello: In June 2024, the Office of the National Cyber Director (ONCD) released its report Summary of the 2023 Cybersecurity Regulatory Harmonization Request for Information, a government effort whose purpose is to find a path forward to creating a comprehensive framework to strengthen cybersecurity resilience across all sectors; simplify oversight and responsibilities of cyber regulators; and reduce administrative burden and cost on those organizations regulated.  The RFI adhered to Strategic Objective 1.1 of the 2023 National Cybersecurity Strategy, “Establish Cybersecurity Requirements to Support National Security and Public Safety.”  Eighty-six organizations responded to the RFI, representing the critical infrastructure sectors, as well as state and local government associations, academia, and non-profit and professional organizations.  The report found three major outcomes from those that responded to the survey:  1) lack of harmonization and reciprocity impacted cybersecurity outcomes while inflicting high compliance costs; 2) regulatory harmonization had challenges that extended to all sectors and organizations of all sizes and crossed jurisdictions; and 3) it was well within the U.S. government’s ability to address these existing challenges.   https://lnkd.in/eqU486u9

4

1 Comment