Matt Lee, CISSP, CCSP, CFR, PNPT

I was cleaning up and organizing a few notes this AM and came across a comment I wrote down while working with a member of our sales team on SOC services earlier this year. "Logs don't tell the full story." It got me thinking about logs, and reflecting on a quick weekend vacation to Colorado last summer... - Logs tell us what has been. - Logs can't prevent problems in themselves. - Logs if unresolved / unmanaged are messy. - Logs can create problems. - Logs don't tell the full story. Bonus: Take a moment to learn a bit about forest bathing and how getting back to nature can help your health and mindset. https://lnkd.in/gtUnq9pu

6

1 Comment

I have enjoyed learning about Wazah and walking through the process of inspecting and hardening my cloud servers. I want to gain some experience with other SIEM's such as Graylog, but the setup is a lot more involved. Is there an easier way to get it up and running on a cloud server? #wazuh #graylog

9

6 Comments

🖨 Fun test of our disaster recovery plan last night: one of our team mates had a run in with some coffee and zapped their workstation ⚡ Recovery plan zipped into action and we got him a replacement computer that took less than an hour to configure. I spent more time driving over in the car 😂 That's one of the benefits of using cloud tools for collaboration. As a software developer: 1️⃣ he synced his code repositories 2️⃣ setup VS Code 3️⃣ and the rest of his design work, documentation, and file stored is all in the cloud PS. Big shout out to PostHog for the awesome hat and for truly changing how we develop our product 🦔 If your #Startup is struggling to learn fast enough about how users engage with your products, check out the #PostHog newsletter. That's the place to start 👉 https://lnkd.in/egYVd7uU PPS. Yes that is the computer form Ready Play One 😎

22

Cyber criminals will keep attempting again and again. The need to safeguard digital infrastructure could not be more critical, this is not a matter of 'if' but a matter of 'when'. #cybersecurity #cyberattacks #digitalinfrastructure

2

320 is an important number. Why? Say your team spends just 5 minutes and 20 seconds every day going through the Level 2 CMMC Assessment Guide. You will read the whole thing 3 times in 3 months. I’ve written about this before: https://lnkd.in/dhyffJcX. And while you’re reading, take a couple of days and apply your knowledge to a tabletop exercise. Go through every single artifact or piece of evidence. Review how your team will answer questions assessors may have. That way, everybody on the team is ready. Remember, as assessors, we are looking for real muscle memory. It’s not enough to check the box or have a policy sitting in a filing cabinet somewhere. You need to demonstrate that you have been fulfilling all 320 CMMC requirements, as an integrated part of your operations. As always, we here at MNS Group are happy to answer any questions. So get reading! #DoD #CMMC #contractors #cybersecurity #assessment

50

MSPs: Listen up! 👇 These are the questions your clients are wondering about. Are you prepared to answer them meaningfully? From a Business owner friend of mine: "[redacted] is touting that they have received a SOC-2 Type-I report for [redacted]. As a practical matter, do you view these credentials as meaningful? I know they provide some level of comfort beyond 'trust us' on data security, but I have never dug into whether they are particularly notable." • Are you ready to answer these types of questions? • And are you getting PAID to answer them? This is where your vCISO service provides huge value. But you have to have a vCISO service. And it has to have time built in for these meaningful conversations. Otherwise you're: • Throwing money away, or worse... • Giving bare minimum effort and souring the relationship I've been doing this for decades, and I've developed the systems and methodologies for delivering vCISO at scale. And I'm ready to use them to help you absolutely crush your revenue goals. So, whether you're looking to add that next million in ARR with vCISO, or simply recapture it from the clutches of inefficiency... Drop a comment or a DM with the word "Meaningful" and get your journey to the next revenue level started.

12

12 Comments

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments

What I am following in Tech News this week... ☑ The City of Wichita shut down its IT networks after a ransomware attack (Bleeping Computer) ☑ Cisco is integrating its XDR platform with Splunk; Duo is reducing the number of authentication sessions to cut down on MFA fatigue (CRN) ☑ OpenAI is sharing its deepfake detector technology with disinformation researchers (The New York Times) ☑ Investors are surveying financial reports from Nuclear Energy companies in the wake of the AI Data Center boom (Investor's Business Daily) My Brief Thoughts: ✅ Cities and Counties need to persuade constituents that cybersecurity investments and insurance are indispensable to the delivery of services. ✅ Cisco's cybersecurity portfolio and financing tools are improving rapidly. ✅ Internet hygiene and competence need to be taught to consumers. The stakes are high. ✅ Where are we going to get the energy to support these massive data center projects? Fossil fuels and renewables, in my opinion. What are you reading about this week? 🤔

15

5 Comments

Defense Industrial Base (DIB) CMMC Tip Five Steps to Make Your Company More Cyber Secure  1. Educate people on cyber threats. Most cyber incidents start because of user error. Educate people about the importance of setting strong passwords, recognizing malicious links, and installing the latest security patches. Helpful materials and training videos are available through Project Spectrum.  2. Implement access controls. Limit information systems access to authorized users and the specific actions that they need to perform.  3. Authenticate users. Use multi-factor authentication tools to verify the identities of users, processes and devices.  4. Monitor your physical space. Escort visitors and monitor visitor activity, maintain audit logs, and manage physical devices like USB keys.  5. Update security protections. Make sure to download the latest security patches when new releases are available. Always double check to make sure they are coming from a trusted source.  https://lnkd.in/eMhfCPAv

5

1 Comment

How confident are you in the resilience of your password security policies? And is #MFA a vital component of your #accesscontrol strategy?

1

CMMC Level 2 Assessment Objective: Role Separation PRACTICE: Organizations must separate user functionality from system management functionality. ASSESSMENT: System management functionality includes functions necessary to administer databases, network components, workstations, or servers, and it typically requires privileged user access. The separation of user functionality from system management functionality is physical or logical. Organizations need to prevent users and user services from accessing system management functionality on IT components. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST separation of user functionality from system management functionality. (CMMC Assessment Guide: Level 2 Version 2.11, page 212) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

46

Are you tired of trying to understand endless jargon and regulations around CMMC? It takes a lot to get through, even for most experts. Look no further – my comprehensive 'CMMC Desktop Reference Guide' breaks down the requirements and outlines clear steps for compliance. With this guide in hand, you can confidently secure your spot at the front of the pack – and potentially add millions to your bottom line. https://lnkd.in/g4_veZz8 #CMMC #security #business #compliance

3

Addressing the Critical Challenge of Cybersecurity in Our Schools A ransomware attack occurred this morning on Rockford Schools and is a stark reminder of the vulnerabilities that exist within educational institutions. This incident, where sensitive data was compromised, underscores the urgent need for robust cybersecurity measures. https://lnkd.in/eYz9xnUu In our digital age, it is imperative that educational facilities not only equip themselves with the tools to protect data but also foster a culture of cyber awareness among staff and students. We must prioritize investments in technology that safeguards our institutions against such threats. As professionals in the field of IT and cybersecurity, we need to ask ourselves: -How can we better support schools in implementing effective cybersecurity strategies? -What steps can we take to enhance awareness and educate our educators and students about the risks and precautions? Let’s use this incident as a call to action to strengthen our cybersecurity frameworks and ensure a safe educational environment for all. Your thoughts and experiences on this are invaluable—let's discuss how we can make a difference. #CyberSecurity #Education #DataProtection #Ransomware

3

smb signing vs smb encryption ask Questions for all the folks out there: 1. How many folks are using both? 2. What is the performance hit you experienced? Can you quantify smb s vs smb e? 3. Let's hypothetically say you have smb signing enabled did you hit any road blocks when you turned on smb encryption? DM me. Help a fool out =) #cybersecurity #blueteam #redteam #bitcointeam

1

3 Comments

Ever feel like you’re in a Wild West shootout when it comes to managing Endpoint Detection and Response (EDR) alerts? Well, saddle up, because it might be high time to reconsider how you’re protecting your endpoints. Here are some nuggets of wisdom to consider on this trail... Full-Time Wrangler: EDR is a round-the-clock job, partner. If your posse doesn’t have at least one full-time hand to manage those pesky EDR alerts, you might want to consider a managed detection and response solution. Staking Your Claim: Define the scope of your EDR solution as clearly as the Texas sky. Determine which endpoints will be monitored, what types of security events and data will be collected, and the methodology for data analysis and reporting. High Noon Showdown Plan: Develop a comprehensive incident response plan detailing roles, responsibilities, and procedures. Include steps for endpoint isolation, evidence collection, and communication strategies for both your internal gang and external stakeholders. Educating the Townsfolk: Educate end-users on security awareness, threat identification, incident reporting, and protecting sensitive data. Remember, knowledge is as valuable as gold in these parts. Joining Forces: Ensure your EDR solution integrates well with other security systems like SIEM and threat intelligence feeds. This gives you a holistic view of your security posture, like a hawk soaring over the plains. These factors are as crucial as having a trusty steed in a cattle drive. Selecting the right EDR solution is as important as choosing the right trail to ride. Need a guide to help navigate these challenges? Let’s connect and explore tailored solutions for enhancing your cybersecurity posture. Reach out here on LinkedIn or drop a comment below. Let’s secure your frontier together. #cybersecurity #EDR #endpointsecurity

5

1 Comment