Brian Rosario

c1secure's NIST Policy to Control Mapper uses an innovative approach to align policies with their corresponding NIST 800-53 control families. This alignment helps compliance teams manage and track the relationships between different policies and controls effectively. By organizing controls into specific families, the Policy to Control Mapper simplifies the compliance process, providing a clear and organized view of how various policies relate to each control, and enabling easier management and oversight through a user-friendly dashboard. Contact info@c1secure.com today to speak to us about our NIST Policy to Control Mapper! #security #compliance #NIST #c1secure #FedRAMP

8

Optimize your decision-making and resource allocation by accepting and recasting risks in Tenable Security Center. 👀 Watch now! ➡️ Learn more: https://lnkd.in/ePsC_KhU #Cybersecurity #RiskManagement #Tenable

11

Analyzing Phishing Email Headers: Protect Yourself from Online Scams Discover how to analyze phishing email headers in this informative video. Learn how to identify urgent or alarming language, generic greetings, suspicious links, and more. Stay safe from online scams and protect your personal information. #OnlineSafety #PhishingScams #EmailSecurity #CyberSecurity #ProtectYourself #StaySafeOnline #PhishingAwareness #OnlineScamPrevention #EmailFraud #InternetSafety

8

The Compliance Guy: The CMMC Security Stack Continuing the series on CMMC, I wanted to shed some light the dark corners of the CMMC Security Stack. In this video, I spend some time with my coworker and technical genius, Mike Hughes. I ask him to define the security stack, explain why Microsoft is such a good choice, discuss what licensing has to do with effective security, and finally to describe the hardening process. I hope you enjoy our conversation...

19

NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-43208 (CVSS score: N/A), concerns a case of unauthenticated remote code execution arising from an incomplete http://ow.ly/CsmU105tRoT #InceptusSecure #UnderOurProtection

1

On June 18, 2024, the SEC charged R.R. Donnelley & Sons Company (RRD) for failing to maintain adequate internal accounting controls and disclosure controls. These charges violate Section 13(b)(2)(B) of the Securities Exchange Act of 1934. RRD settled with a $2.125M civil penalty due to inadequate policies that led to a ransomware attack, resulting in data encryption, data exfiltration, and business disruptions. Two SEC Commissioners dissented about the SEC's approach. This action is the second time the SEC has used Section 13(b)(2)(B) to fault a company after a cyberattack. The first action against SolarWinds Corporation is under litigation in the Southern District of New York. The SEC's broad interpretation of its jurisdiction is being challenged. Two Commissioners criticized the SEC’s use of Section 13(b)(2)(B) to enforce cybersecurity policies. They argue that the SEC is overreaching by using unrelated statutes to mandate cybersecurity controls. The criticisms are like those against the FTC's use of Section 5 of the FTC Act to require cybersecurity measures not explicitly covered by the statute.  The SEC's actions have significant ramifications for companies dealing with cybersecurity breaches. The broad interpretation suggests that companies' information systems are assets, and unauthorized access could lead to SEC violations. This interpretation may regulate public companies' cybersecurity practices. The dissenters argue that internal accounting controls should not extend to broader administrative controls. The SolarWinds case challenges the SEC's interpretation of its jurisdiction under Section 13(b)(2)(B). The outcome may influence whether the SEC can penalize companies victimized by cybercrime. #cybersecurity #SEC #regulation

12

4 Comments

Well here it is. Kind of.... The SEC has passed a rule that requires Financial Institutions to report incidents impacting investor Personally Identifiable Information (PII) within 30 days of identifying a breach that was impactful to their information. If you are a large financial service firm you have 18 months to implement this. If you're on the smaller size you have 24 months to implement this. As always they mention the importance of policies and making sure that you have a strong incident response plan. #SEC #RegulatoryRequirements #CyberSecurity #BreachNotification https://lnkd.in/eBSJbUCH

22

4 Comments

Join ISACA LA & Noname Security for a webinar on May 14 from 5 pm to 6:15 pm. Alan Cota will take you on a journey through the fascinating world of Application Programming Interfaces (APIs) and show you the risks and intricacies of securing APIs. You will learn the challenges of API Security and how to avoid some of the common pitfalls. We will also understand why existing in-line solutions like API gateways and Web Application Firewalls (WAFs) can't solve the problem alone. Save the date. We will update here and on our website when details are available. #ISACA #ISACALA #APISecurity

8

Come see Shoshana Sugerman and Brian Robert Callahan, Ph.D., CISSP, CISM #today at 3:30 PM at the #nyscyber NYSCSC! They're the talk all the way in the bottom right corner! Rensselaer Polytechnic Institute #cybersecurity #cybersec #infosec #informationsecurity #security #conference #generativeai #ai #genai #artificialintelligence #RPI #RPI200

14

Great article on the convergence of Risk and Threat = the Cytellix vision/solutions for the past 8-years to leverage risk/compliance vectors in threat detection by providing continuous threat exposure management solutions. Thank you @Yasmine Abdillahi for writing this article. Cytellix®Comcast

11

This Kiteworks article is a good read for cybersecurity professionals who are interested in a comprehensive checklist for achieving compliance with the Cybersecurity Maturity Model Certification (CMMC) framework. It outlines the steps organizations need to take to meet the requirements of different CMMC levels, from basic cybersecurity hygiene to advanced practices.  Your Complete CMMC Compliance Checklist 👇👇 Get the checklist: https://lnkd.in/eEmiVs79 #cybersecurity #compliance #CMMC #NIST #CUI #blog

19

1 Comment

This week I had the privilege of participating in ISACA New York Metropolitan Chapter's "CTRL + ALT + SECURE: Your Guide to a Successful Cybersecurity Career" fireside chat, discussing pathways to kickstarting careers in Cybersecurity. It was enlightening to share insights and advice, but one common concern stood out to the panelists: the lack of a clear career path for Cybersecurity graduates. Many students are discouraged by the ambiguity surrounding job opportunities post-graduation. Reflecting on this, I'm left wondering: 1. How can we bridge the gap between academic Cybersecurity programs and industry demands? 2. What initiatives can we undertake to provide clearer guidance and mentorship for aspiring Cybersecurity professionals? 3. How can we collaborate as a community to create more accessible pathways into Cybersecurity careers? Let's start a conversation and work together to pave the way for the next generation of Cybersecurity leaders. #Cybersecurity #ISACA

43

5 Comments

🎯 Defining Organizational Context and Scope for ISO42001AIMS Certification🎯 Earning your ISO42001certification starts with understanding Clause 4, which guides defining your organizational context and scope. Below you'll find a loose roadmap to help compliance executives navigate this process. 🏢 1. Understand Your Organization's Context - Identify internal and external factors affecting your AI systems.  - Internal: Structure, roles, policies, resources.  - External: Social, legal, economic, regulatory environments. 💪🔍 - Conduct a SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) to gain a comprehensive understanding of your organization's position. 🤝 - Identify key stakeholders and their needs and expectations to ensure your AIMS aligns with their requirements. 📋 2. Define the Scope of AIMS - Specify the boundaries and applicability of your AIMS. 🤖 - Identify AI Systems: Determine which AI systems and processes to include in your AIMS scope. 🌐 - Consider Boundaries: Decide which departments, functions, or locations are covered by your AIMS. 📝 - Document Scope: Clearly communicate the defined scope within the organization to ensure everyone understands the extent of your AIMS. 👥 3. Establish Organizational Roles - Set responsibilities and authorities for AI governance. 🧑‍💼 - Define Responsibilities: Allocate specific tasks and duties for AI risk management and compliance. 👨‍💼👩‍💼 - Assign Authorities: Specify decision-making levels for AI deployment and risk response. 🏛️ - Accountability Structures: Create oversight committees or governance boards, whichever best aligns with your internal operations, to ensure accountability and proper governance. 🔗 4. Integrate with Other Management Systems - Align your AIMS with existing systems like quality and information security management. 🎯 - Align Objectives: Ensure AIMS objectives match and support the objectives of other management systems. ⚙️ - Harmonize Processes: Standardize processes across systems for consistency and efficiency. 🧩 - Leverage Frameworks: Use existing standards and frameworks to build a cohesive and integrated management system. ♾️ 5. Embrace Continual Improvement - Regularly review and update your AIMS to ensure its ongoing effectiveness and relevance. 📊 - Monitor and Measure: Implement metrics and KPIs to track AIMS performance and identify areas for improvement. 🔍 - Conduct Reviews: Regularly assess your AIMS through internal audits and management reviews to identify gaps and opportunities. 🔧 - Implement Improvements: Develop action plans to address identified gaps and enhance your AIMS continuously. 🙋‍♀️🙋‍♂️ If you need help getting started, please don't hesitate to reach out! #AI #AIMSCertification #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou A-LIGN

15

2 Comments

New framework just dropped. 🔥 ControlMap now supports the NYDFS Cybersecurity Regulation, allowing MSPs to customize cybersecurity programs for clients regulated by the New York State Department of Financial Services. Check out the details of this update here: https://lnkd.in/gsG6TWZG #Security #Compliance

3

Stay ahead of cyber threats with updated guidelines for safeguarding Controlled Unclassified Information (CUI). Let Jün Cyber help you achieve compliance with expert gap analysis, tailored plans, staff training, and continuous monitoring. 🛡️ Secure your data. Contact Jün Cyber today! www.juncyber.com #CyberSecurity #NIST800171 #CUISecurity #JunCyber #DataProtection

2

The financially motivated threat actor that Microsoft tracks as Storm-0539 pursues financial gain via payment card theft and gift card fraud. They gain access to target organizations to enumerate resources and target employees with access to gift cards or have permissions to issue them. In a single instance, Storm-0539 can extract tens of thousands of dollars by issuing new gift cards and sending them to dozens of email addresses. Today at #SLEUTHCON 2024, Microsoft Threat Intelligence experts delivered a talk on Storm-0539. Also known as Atlas Lion and active since late 2021, Storm-0539 operates out of Morocco and primarily targets the retail sector but have also affected other industries like telecommunication and technology. Storm-0539 carries out extensive reconnaissance of target organizations to craft convincing phishing lures and steal credentials and tokens for initial access. They make their social engineering operations particularly persuasive by using compromised legitimate emails, or by mimicking legitimate platforms used by target organizations. The actors register attacker-controlled devices for secondary authentication prompts and use compromised identities to phish more users in an affected organization. They also leverage their access to phish additional target organizations. Notably, the threat actor is well-versed in cloud technologies and leverages resources from target organizations’ cloud services for post-compromise activities. In addition to gift card fraud, Storm-0539 gathers significant information with each compromise, including legitimate emails, contact lists, and network configurations, and uses that information for future operations against the same organization. Storm-0539 has been observed to target the same organizations for multiple years, with notable surges in activity during holiday seasons. Storm-0539 demonstrates that payment-card focused attacks are a significant and evolving threat that organizations, especially retail, need to defend against. Security best practices like using multifactor authentication (MFA), disabling legacy authentication, following the principles of least privilege, and deploying identity protection solutions can help slow down actors like Storm-0539. Microsoft customers can use the threat intelligence reports in Microsoft Defender to get the latest information and protection and investigation guidance related to Storm-0539. Organizations can also refer to the FBI’s private industry notification on gift card fraud and Storm-0539. Learn more: https://msft.it/6042Yd1us

317

How do we leverage GRC Engineering? 🎯 There's two key areas: - Leveraging internally built engineering and automation - Leveraging tools and capabilities within the ecosystem ➡️ This unlocks speed, effectiveness, and reliability in a GRC program far beyond what's found in traditional manual processes. 💫 This requires a blend of domain expertise, leadership and soft skills, and a technical approach to transition GRC to an engineering/solutions first discipline. Let's grow towards this future together 🚀🚀🚀 ⬇ ⬇ ⬇ #grc #rungrc #grcengineering

20