Chris Novak

Special thanks to the Long Island NY ISC2 Chapter for hosting me to speak at their Chapter Event. Another great opportunity to talk about Cyber Risk Quantification. Ask me about the Open Education Resources that are now available for download from CyberRiskModels.com. #ISC2, #cybersecurity, #CRQ, #CIO, #CISO, #Training, #riskquantification

5

Bipartisan legislation has been introduced in the U.S. House of Representatives to establish a public report for Members of Congress to evaluate manual operations of #criticalinfrastructure during cyber attacks. The urgency of this measure is underscored by the increasing potential damage of cyber-attacks on vital infrastructures such as the #electricgrid, #watersystems, and #pipelines, especially with the rising threats from adversarial nations like China, Russia, Iran, and North Korea, as well as state-affiliated groups. These cyber adversaries significantly threaten national and economic security. Introduced by U.S. Congressman Dan Crenshaw, a Republican from Texas and a member of the House Permanent Select Committee on Intelligence, along with Rep. Seth Magaziner from the House Committee on Homeland Security last week, the Contingency Plan for Critical Infrastructure Act has been referred to the Committee on Homeland Security, and in addition to the Committee on #Transportation and #Infrastructure, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned. https://lnkd.in/gSndMQ4c

9

Please watch and enjoy this informative episode of 3 Questions With, featuring Paul LaFlamme of Centrend, Inc. discussing cybersecurity, the cloud and more https://lnkd.in/eTkp6iYE #cybersecurity #dataprotection #cloudcomputing

9

1 Comment

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

“On June 13, 2024, the Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act (SB 2500 / HB 7787). The act will now move to Governor Daniel McKee for consideration. Assuming the act becomes law, it will go into effect on January 1, 2026.” https://gag.gl/Iw9AP9 Kiteworks helps organizations comply with data privacy regulations like GDPR and CCPA by enabling visibility into where customer data is stored, who has access to it, and what's being done with it. Please visit our website to learn more. #cybersecurity #kiteworks #cyberattack #databreach #dataprotection #datasecurity

2

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

1

Bob Zukis, as always, thank you and the Digital Directors Network team for being on top of these breaking (and obvious/inevitable) developments about C-suite responsibility and board oversight of cybersecurity. Senator Wyden's letter to the FTC and SEC underscores these responsibility and oversight failures. To me, some of the most striking comments are: 😷 "I write to request that your agencies investigate UnitedHealth Group’s (UHG) negligent cybersecurity practices, which caused substantial harm to consumers, investors, the health care industry, and U.S. national security." 😷 "This incident and the harm that it caused was, like so many other security breaches, completely preventable and the direct result of corporate negligence." 😷 "The consequences of UHG’s apparent decision to waive its MFA policy for servers running older software are now painfully clear. But UHG’s leadership should have known, long before the incident, that this was a bad idea." 😷 "While UHG has not yet made public the full details of this incident, UHG’s failure to require MFA is unlikely to be the company’s only cybersecurity lapse." 😷 "Such a failure to adopt a resilient technology architecture [cloud] demonstrates a total failure by the company to plan for and mitigate the clear, obvious risk posed by ransomware." 😷 "One likely reason for UHG’s negligence, and the company’s failure to adopt industry-standard cyber defenses, is that the company’s top cybersecurity official appears to be unqualified for the job. Steven Martin, UHG’s chief information security officer (CISO), had not worked in a fulltime cybersecurity role before he was elevated to the top cybersecurity position at UHG in June, 2023, after working in other roles at UHG and Change Healthcare." 😷 "Just as a heart surgeon should not be hired to perform brain surgery, the head of cybersecurity for the largest health care company in the world should not be someone’s first cybersecurity job." 😷 "Due to his apparent lack of prior experience in cybersecurity, it would be unfair to scapegoat Mr. Martin for UHG’s cybersecurity lapses. Instead, UHG’s CEO and the company’s board of directors should be held responsible for elevating someone without the necessary experience to such an important role in the company, as well as for the company’s failure to adopt basic cyber defenses." 😷 "One likely explanation for this board-level oversight failure is that none of the board members have any meaningful cybersecurity expertise." 😷 "The cyberattack against UHG could have been prevented had UHG followed industry best practices."

4

1 Comment

How do you arrest an AI? Interesting panel on AI and cyber risk here at #RSAC2024 with Jon Miller Theresa Payton ✪ Jason Clinton and Joseph S.

5

5 Comments

Join us on Wednesday, May 29th at 8:30 AM to discover the joint strategies used by CERT Ukraine and CISA for cyber defense! Don't miss out on this opportunity to learn from the experts. Link in bio for more details and to get tickets. #CyberDefense #CERTUkraine #CISA #CyberSecurity #EventAlert

10

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

2

Living in New England, with its long and gray winters, my vegetable garden is a delightful summer highlight,  and a significant source of stress relief and enjoyment. However, much like our enterprise’s information assets, the garden represents an attractive target for malicious actors. Alas, I have to defend myself against the neighborhood assortment of critters: rabbits, squirrels, birds, raccoons, and the occasional possum or woodchuck. These hungry and decidedly malicious creatures have a variety of Tactics, Techniques, and Procedures which must be thwarted through a collection of defense mechanisms that include physical, chemical, visual, and auditory. (I have not yet escalated to kinetic or electrical defense mechanisms, although I haven’t completely ruled them out). My garden security is a decidedly imperfect defense, and I accept a certain level of breach as acceptable. For example, I have a three-foot metal mesh fence surrounding it; this keeps the rabbits out, but not the birds or squirrels. I could do better with a more robust fence, but for me it wouldn’t be worth the investment. Plus, some of the more skilled and determined (but luckily infrequent) visitors – I’m looking at you, woodchucks – could breach pretty much any defense I could deploy. Fortunately for me, at worst a garden breach will result in disappointment and minor infrastructure damage. This decidedly not the case for our enterprise IT environments. Our businesses are fully dependent on IT to operate, and a successful attack can result in significant or even existential damages to an enterprise, as well as potential civil and even criminal charges. Information security leaders need to internalize this, and create an appropriate sense of urgency within their organizations. The stakes are too high, and our landscape is too dangerous not to rapidly adopt best practices – as defined and combined within Zero Trust – throughout the enterprise. This is going to take some work, and require more rigor in our enterprises. Frankly, it’s time to improve our enterprise security maturity, and to clearly define the set of processes surrounding it. For example, security teams should not accept a lack of visibility into what is running on their network – this is a prerequisite for enforcing the principle of least privilege, and thwarting attackers via effective access control policies. I fully understand the challenges that enterprises face, including technical debt, resources constraints, and decades of organically grown enterprise network complexity. However, a Zero Trust strategy provides a clear and effective path forward, and when executed well delivers rapid and incremental improvements to the enterprise. It’s time for security leaders to assert themselves, and demand that their organizations properly organize and deploy defensive mechanisms. We know how to do this effectively – Zero Trust provides us with this guidance – and now it’s time to execute.

23

3 Comments

While I am reposting this is that many of my connections have to adhere to 23 NYCRR 500 and it will be useful to them, publishing a template like this is also horrible to get it followed. I was talking with Deborah Nitka at dinner today, and she mentioned how she would examine compliance related documents, and it is clear that they basically just did a universal Cut and Paste on company name. Sharing a template like this can result not in people actually implementing a compliant program, but in creating a document that looks like they are. That is a major difference.

40

3 Comments

This is going to get interesting: https://lnkd.in/gTTaWP4G

5

1 Comment

Today is AI appreciation day.Repost to show the future AI overlords that you appreciated them in the past.  ;)https://lnkd.in/eCTcGRkX

2

The Florida Department of Health (FDOH) is currently managing a significant cybersecurity breach. Scott Schober, a cybersecurity expert, sheds light on the situation in an interview with Fox35’s Marie Edinger. Stay informed about the latest updates on this critical issue. #FDOH #VitalStatistics #health #cyberbreach #Ransomware #hacking

8

Do you know how many cybetattacks attempts America Latina & the Caribbean received in 2023? 🚨 200 Billion 🎯 Our #FortiGuardLabs team has released the 2023 FortiGuard Labs Report revealing a new era of advanced cybercrime: 🛡️50% of malware detections were distributed through Microsoft Office files 🛡️Double Pulsar represented 75% of all exploitation activity Download the key insights infographic: https://ftnt.net/60425zDMg

8

Is it material? Well, maybe. Good article from Tim Starks in CyberScoop: CDK hack shows SEC disclosure standards are unsettled; The early application of the regulatory agency’s new cybersecurity reporting rules reveal that materiality is in the eye of the beholder. As the damage from the ransomware attack on automotive software provider CDK Global has become clear over recent weeks, numerous auto dealers felt compelled to notify the Securities and Exchange Commission that the breach had harmed their operations. CDK's parent company, Brookfield Business Partners, which apparently paid nearly $25 million in ransom to attackers, does not feel the same way. In a press release issued July 3, the company said "we do not expect this incident to have a material impact on Brookfield Business Partners." Despite the attack's downstream effect on the U.S. auto industry, CDK and its parent company did not file with the SEC under its new rules for reporting breaches. https://lnkd.in/ec3RfdMX #cybersecurity #ransomware #regulations

3

The 2024 #election cycle is not only going to be nail-biting because of contentious politics, but also on the #cybersecurity front: https://lnkd.in/epkz7i6B

2