Christopher Key

Worried that engineers in your organization copy production databases to their development environment? I'm excited to share the new Sentra 101 video! Check it out to learn how Sentra helps organizations institute security controls that stay with the data no matter where it goes.

26

1 Comment

Exciting to analyze the latest insights from the Boeing Ransomware incident. We're seeing notable trends emerge that underscore the evolving landscape of cybersecurity threats for manufacturers. Firstly, the myth that manufacturers are immune to cyberattacks is crumbling. Many have believed they aren't prime targets due to limited personal data holdings, but recent events prove otherwise. Ransomware isn't solely about PII—it's about halting operations until demands are met, hitting manufacturers hard. Secondly, the ransom amounts demanded are soaring. The ransomware industry has matured, with negotiations becoming more complex and costly. A $200 million demand might seem steep, but for Boeing—a company with a substantial market cap (157 Billion in 2023) —it's a calculated fraction, albeit a painful one. Thirdly, Boeing's resolute stance against paying the ransom is commendable. Companies are increasingly refusing to yield to extortion, despite facing fallout like data leaks and disruptions to relationships with customers and partners. These trends underscore the urgent need for heightened cybersecurity measures and resilience strategies across industries. Let's stay vigilant and adaptive in the face of evolving threats. #Cybersecurity #RansomwareProtection #Boeing #Drip7 #Cybersecuritytraining

12

1 Comment

I spent most of my week this week at RSA Conference which might be the largest gathering in the world for people interested in technology security. I literally walked the entire tradeshow floor at the Moscone Center, talked to people at 20-30 different booths, and also chatted up many attendees in Tidelift's own booth. TL;DR: !@#$%, there are a lot of companies you've never heard of building software doodads to address security issues you didn't know even existed. 😩 With all the loud booths, flashy demos, free socks, and bouncy happy fun balls from companies trying to get you to buy a software solution that improves your application security, it is easy to forget that there are also ways to improve software security that involve *supporting the work of actual humans.* Today, in The New Stack, Tidelift co-founder and general counsel Luis Villa makes the case that we need stronger public investment in our shared open source software infrastructure, just like the investments we make in airports, highways, and the electrical grid. 🛫 🛣 ⚡ From the article: "Modern governments were created in part to fund public goods like health services, transportation and energy infrastructure, yet open source software is the only public good in the world that still relies on volunteer labor to keep it safe and secure. The reality on the ground today is that unpaid developers are still the norm for open source projects, and these developers are being tasked with an ever-increasing amount of work to ensure the security of the software we all rely on as threats become more pervasive. That status quo is not sustainable, and the problem becomes more dire by the day." Read the whole article here: https://lnkd.in/gXFsqwY9

11

1 Comment

One of the great benefits of being a specialist focused on investing in security is the CEO mind-meld effect. We can almost always bring the right people to the table that just "get it." Often, we've seen the same problem... It's surprising just how surprised CEOs are that we can add value almost immediately. Many startup CEOs refer to us as strategic investors. That's the value of our team and network at GALLOS Technologies. Joshua Burch Dean Jones Jack Pearson Daniel Clarke Chris Martin Jason Rance #cybersecurity #vc #venturecapital #cyber #ai #autonomous systems #UAVs #intelligence #defensetech https://lnkd.in/e7wvUgmj

37

1 Comment

As we near the U.S. elections in November 2024, it's clear that the battleground extends beyond politics to the digital sphere. Cyabra's recent study reveals a concerning surge in fake social media accounts, including a significant number of bots aimed at manipulating public opinion. The use of bots to amplify content and create false consensus is a growing threat that demands our vigilance. I'm thrilled to be included in this important article from Techopedia. Misinformation, especially through advanced bots and generative AI, poses a serious challenge. Researchers have noted a staggering tenfold increase in fake accounts during March and April alone. To combat this issue, it's imperative to verify sources, diversify news intake, and report suspicious accounts actively. In this crucial time, each of us plays a vital role in upholding the integrity of our democratic processes. Let's embrace this responsibility and work together to ensure that truth prevails. Stay informed, stay skeptical, and let's safeguard our elections. Read more about the study here: https://lnkd.in/epmTtuup

11

During a recent Vercara webinar, we conducted a poll with attendees on how they currently analyze their DNS query data and the challenges they face. A large subset (38%) reported insufficient expertise to interpret #DNS data as their biggest challenge when leveraging data for security and performance enhancements.  One of our leading principles here at Vercara is that you can leave your security concerns to us so that you and your organization can focus on what you do best. We’re the security experts who understand how to keep networks up and running, you’re the experts on selling insurance, managing assets, or supporting patients. Focus on what you do best, and we’ve got your back on the security side! That said, organizations should have a baseline understanding of DNS, so they know why and how to support and manage it. If you want to learn more about best practices for DNS management and ways to revolutionize your #security posture, be sure to check out the latest webinar by Vercara’s Director of Product Management- DNS, Enrique Somoza, where he shares techniques for collecting and analyzing DNS query data, effective tools for detecting and mitigating potential security threats, and much more.  

19

1 Comment

GenAI: A New Headache for SaaS Security Teams: The introduction of Open AI’s ChatGPT was a defining moment for the software industry, touching off a GenAI race with its November 2022 release. SaaS vendors are now rushing to upgrade tools with enhanced productivity capabilities that are driven by generative AI. Among a wide range of uses, GenAI tools make it easier for developers to build software, assist sales teams in mundane email writing, https://lnkd.in/gsFPktfs

1

"In late 2023, BlackBerry analysts identified a spear-phishing campaign by threat group FIN7 that targeted a large automotive manufacturer based in the United States. FIN7 identified employees at the company who worked in the IT department and had higher levels of administrative rights. They used the lure of a free IP scanning tool to run their well-known Anunak backdoor and gain an initial foothold utilizing living off the land binaries, scripts, and libraries (lolbas). We also found evidence that this attack was part of a wider campaign by FIN7. In this blog, we’ll examine the mechanisms behind this attack, and discuss active steps you can take to prevent your organization falling victim to phishing attacks." To read the complete article see:

1

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

31

1 Comment

This Kiteworks article discusses the Dropbox Sign data breach and its implications, highlighting the increasing risks of software supply chain attacks. The breach is part of a worrying trend, with the Verizon 2024 Data Breach Investigations Report (DBIR) noting a 68% rise in supply chain-related breaches. This incident underscores the critical need for organizations to enhance their supply chain security measures. Mitigating the Risk of Software Supply Chain Attacks: Insights From the Dropbox Sign Breach 👉 Read more: https://gag.gl/7dQE4m #Dropbox #supplychain #databreach #cybersecurity #thirdpartyrisk

18

Trying to understand how AI and Analytics can help your Agency? Check this out!

2

How many of your high-value data sources are you monitoring automatically with an enterprise SIEM tool? If you are an organization with, say, 1000 employees, you should have at least 50 unique data sources (integrations like 365, aws, okta, ndr..). Anything less and it will take months instead of minutes to detect or respond to breaches. Almost all major breaches were due to a complete lack of monitoring coverage, missing events detectable for years. Below is an example of how adequately deployed SIEM/XDR would look from an integration point of view. In addition to the usual cloud, endpoint, and NDR, all other identity, accounting, IOT, SCADA data sources are also auto-inspected. I've seen compromised hospital machines go undetected for years and root SSH access to backup servers from the foyer camera. Onboarding data sources into a SIEM means you've inherited an automated analyst who works 24/7 across all your digital assets. In the image below, at least 50% of the escalations metric are prevented breaches, months in advance. #cybersecurity

16

2 Comments

Infostealers are all over your feed? might stay this way for a while, take a chance to learn about them with a super easy & fun webinar we did a while back

13

Tactics over tools. Boy, I say that a whole lot. It's one of the core value props for PowerPSA Consulting But just had another reminder of it this morning. Look at the picture - which would you choose? On the left is the marketed version of a "top of the line" chicken waterer and deicer. about $140 bucks. It's what we bought when we got our first 6 chickens 2 years ago. Since then: - Found the chickens kick crap in it all the time. - Filling is an absolute pain; takes 15 minutes. - On really cold days, the edges freeze out. - Rusted out and unusable after 2 years. On the right, I present the $5 bucket (with a $35 deicer dropped in). $40 total. - High enough that stuff doesn't get kicked in... - If it does, settles to the bottom; fresh water! - Filling? 5 seconds to spray from the pump. - Open water all winter - even in -20 temps. - No rust. if it ever breaks, only $5 bucks. 🤦‍♂️ Got tricked by the marketing... How often do we as MSPs get caught up thinking a shiny tool is going to solve our problems? We'd probably be better served getting our processes and systems aligned so that the tools we *are* using are maximized, and new tools actually have the intended effect. So, take it from me (and the chickens)... Tactics over tools. #cybersecfarmers

33

11 Comments

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

It was a pleasure talking with Thomas for The Cyber Security Recruiter Podcast! We had a great discussion and I thoroughly enjoyed the opportunity to share some of my thoughts on transitioning from the military, professional development, and the cybersecurity industry. I certainly don't tote my journey as THE way, but some grit and proactivity will always help individuals on their professional journey. I truly enjoyed the chat with Thomas, and hope it provides some helpful insights for the professional community. #Cybersecurity #Podcast #Leadership #ProfessionalDevelopment #CareerGrowth #CybersecurityRecruiting

3

1 Comment