Allen P.

I’m so excited to be available to small and medium businesses looking to implement #privacybydesign and #securitybydesign as one of many SMEs who can be leveraged through Zatik Security's fractional security model. But #SMBs won’t be able to shift the insecure tech landscape *all* of us are operating in on their own. As this year’s #DBIR (available at verizon.com/dbir) stated in its introduction of the #supplychain #interconnection metric on page 13, “calculated a supply chain interconnection influence in 15% of the breaches [they] saw... [representing a] 68% year-over-year growth.” Then on page 14, just as Cybersecurity and Infrastructure Security Agency, 👑 Kymberlee Price, Joshua Corman, and countless others, including myself, have said: “As much as we can argue that the software developers are also victims when vulnerabilities are disclosed in their software and sure, they are), the incentives might not be aligned properly for those developers to handle this seemingly interminable task [of remediating every vulnerability]. These quality control failures can disproportionately affect the customers who use this software... This metric ultimately represents a failure of community resilience and a recognition of how organizations depend on each other.” The writers go on to say, “We recommend that organizations start looking at ways of making better choices so as not to reward the weakest links in the chain... we believe the only way through is to find ways to hold repeat offenders accountable and reward resilient software and services with our business.” The fact of the matter is, the only organizations capable of doing this across the supply chain are the Big Players (with BIG contracts) in highly regulated industries—especially Finance and TeleCom—who can *both*  1) hire the talent required to really dig in to the evidence of their vendors’ security posture, and   2) then throw the weight of those BIG contracts around to incentivize substantive improvement. Demand to see vulnerability scans. Demand to see FULL #pentest and #BCDR results, not whatever watered down summary they’re going to offer you. You’re the only ones who can. I sat on one side of that table (I wrote those summaries), and I’d *love* to sit on the other. If your company is serious about #supplychainsecurity, #securesoftwaredevelopment, and exceeding the minimum that is “compliant,” let’s talk. I believe in building better I know how to architect, implement, and communicate systems deserving of trust (and how to evaluate and determine systems undeserving of trust). The only way we can turn the tables on bad actors is together, by shifting all three points of the Technology Ecosystem Triangle—Supply, Demand, and Regulation/Oversight-- together. So in the wise words of Bender, let's gooo alreaddayyyy. 😎

18

Power up ⚡ your vulnerability remediation cycle with the platform designed to zap 21st century headaches. We're talkin' saving time spent patching, automating your work, and getting back on CISA's good side. Here's how Vicarius helps: 🔹 See everything in one place: Forget siloed data and endless spreadsheets. Vicarius provides a single source of truth for all your vulnerability data. 🔹 Prioritise like a pro: Vicarius goes beyond just severity scoring. It uses real-time context to prioritise vulnerabilities that matter most to your organisation. 🔹 Patch smarter, not harder: Integrate patching for Windows, Linux, Mac, and third-party applications – all from the same platform. 🔹 Automate the mundane: Free yourself from repetitive tasks. Vicarius automates patching, threat mitigation, and even vulnerability scans. Try vRx today, risk-free, pain-free. (Seriously, why wait? ) #vulnerabilitymanagement #cybersecurity #CISA #automatedsecurity #patching

2

Meeting HIPAA compliance requirements can be daunting, but many #cybersecurity best practices that are likely already on your list can help move your organization towards #HIPAA #compliance. Read Madison Iler's blog to learn more: https://lnkd.in/gxcp8aK4

10

Meet Danielle M. Gagnon and Andrew Kraut from our P0 Labs Team at Booth 35 at Health-ISAC Spring America's Summit! P0 Labs are some of the best out there when it comes to identifying cloud threat actors and their TTPs! Human and machine identities are both your Achilles heel and your canary in the coal mine for cloud threats. Learn how our threat-informed approach seamlessly stitches your identities with your fragmented IaaS, PaaS, SaaS, CI/CD environments, and security controls. Discover how we can immediately improve: - Time to detect and respond (minutes vs hours/ days/ weeks) - Containment completeness (100% vs partial) - Least privilege adherence (Most aren't actually doing this right) - Log alert volume reduction (by 500 to 1 on average) Learn how Permiso can help you evolve your security strategy and architecture towards coveted Just-In-Time (JIT) access, Infrastructure as Code (IaC), Policy as Code (PaC), and more. Stop by our booth to meet Danielle and Andrew. Can't make it to the Summit? DM me to connect virtually!

5

Good summary from analysts at RSA: “IAM is evolving to help deliver efficiency for B2E and revenue for B2C. Both of those spheres now have large attack surfaces for adversarial activity, which is being exploited due to visibility and automated remediation issues. Enter stage left detection, protection and remediation tools that are identity-centric - aka ITDR, NHI/workload.” #iam #rsac

14

#APIs have become a critical component of delivering modern applications, and as their number continues to grow, so too do the challenges and vulnerabilities they expose, including: 🔐 Increased risk of security exposure 🔐 Less mature security defenses 🔐 Easy-to-deploy “shadow” APIs that are built hastily and left indefinitely Given the growing dependence on APIs, it is important for businesses to consider their options when it comes to security solutions. In my latest Vercara blog post, I break down the importance of API security and the most important areas a buyer should factor in when deciding on a solution. Learn more at the link below to better understand all the options, so you can make an informed decision to minimize your organization’s risk and maintain a comprehensive API security audit checklist.

11

3 Comments

CISOs are concerned with the amount of personal liability they may be taking on in their roles. Does this resonate with you? Download Devo's new guide, “The Modern CISO: An Essential Guide for CISO Success,” to learn what actions CISOs like you are taking to protect themselves and how they are using new rules, such as the cybersecurity rules from the SEC, to advocate for what they need to do their jobs effectively. #CISO #CybersecurityLeadership

3

Lots of conversations about migrating to PQC and how to approach risk assessment and planning last week during RSA Conference. I found the below summary of the latest update to NSA's guidelines very helpful. They lay out an actual timeline and give clarifications for some earlier releases. Give it a read if you can spare two minutes: https://lnkd.in/gZKmjS8P #PQC #cryptoagility #codesigning #supplychain #CBOM #RSAC

32

So get me straight here... You've got three boardrooms to talk about monitoring Continuous and Live Threat Intel, Threat Exposure (Asset/Validated Vuln), AND Third Party Risk at the Orlando MES conference? Your definitely up to something! No wonder Gartner Peer Insights has you as their top rated company! Best company, Best solution, Best Support, Best ROI, I've ever been aligned with, bar none. I feel like a kid with my hand in the cookie jar every day :) Come learn on how we are make knowing "whats out there" before the hacker infiltrates, helping you spend less time on reactionary cyber monitoring. See you soon! #thechannelcompany #orlandomes #Continuousthreatexposuremanagement #attacksurfacemanagement #cyberthreatintelligence #cybersecurity #cyberprevention #thirdpartyriskassessment #risk #assessment

45

2 Comments

Known Exploited Vulnerabilities Remain Unmitigated Past Deadlines: - Critical severity KEVS took nearly 4.5 months (137 median days) - High severity vulnerabilities take more than 9 months (238 median days) - Medium severity vulnerabilities take nearly 1.5 years (517 median days) https://lnkd.in/g_RExD96

1

Security systems use various indicators to try and identify malicious activity - the origin of the connection is one such indicators. In a recent trend attackers are taking advantage of proxy networks that utilize a variety of residential IPs and appear like regular users logging in from the home office. This technique is embedded in various phishing kits and services, extending the toolbox for online scammers. Beware and implement phishing resistant MFA for your users! https://lnkd.in/e6txiz3Z #phishing #digitalidentity #mfa

7

Going to RSA ? Looking to attend a session that you can put into action super quickly after the show? ( prove to the boss that the travel expenses were worth it!) 😁 You have to join Tim Wainwright's insightful discussion on benchmarking cybersecurity resilience. Learn to measure your security posture against peers with data-driven insights mapping to top threat actors and TTPs in MITRE ATT&CK. 📊 Security Risk Advisors #levellingup #RSA #Benchmarking #ThreatIntelligence Book a meeting if you would like learn how to flip the burden of perfection on to the attackers! https://lnkd.in/e3CmBrtr

1

Tired of your Pen Tests surfacing IAM risks? Find & fix misconfigurations and identify vulnerabilities first with Identity Security Insights. Detect hidden paths to privilege and new privilege risks with continuous monitoring. Secure your total identity fabric with ease. Effortless deployment inside an hour, full dashboard in less than 24 🔎 Start your complimentary identity security assessment today.  https://lnkd.in/gHfgCyeu #IdentitySecurityInsights #IdentitySecurity #PathstoPrivilege #PenTesting

11

Tired of your Pen Tests surfacing IAM risks? Find & fix misconfigurations and identify vulnerabilities first with Identity Security Insights. Detect hidden paths to privilege and new privilege risks with continuous monitoring. Secure your total identity fabric with ease. Effortless deployment inside an hour, full dashboard in less than 24 🔎 Start your complimentary identity security assessment today.  https://lnkd.in/gHfgCyeu #IdentitySecurityInsights #IdentitySecurity #PathstoPrivilege #PenTesting

2

Old ransomware prevention methods just don’t work like they used to. Watch our on-demand webinar to learn about the modern methods that criminals rely on to carry out their attacks and get practical tips for stopping #ransomware attacks before they begin. https://lnkd.in/gmq2eCkt

11

If you’re at the Health-ISAC Spring America's Summit, stop by Booth 35 to discuss strategies for mitigating the rise in identity-based attacks. IdPs alone aren’t enough to secure your identity and cloud control plane. Learn about Permiso's threat-informed approach, which carves out identity sessions of access and activity across all your cloud environments for all your human and machine (NHI) identities.

1

Explore the balance between perfection and reasonableness in the world of cybersecurity strategy in this blog post from Alex Cox, Director of the LastPass Threat Intelligence, Mitigation and Escalations (TIME) team.

4