Daniel Gorecki

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile is in the public comment phase. If you have an interest in cyber IR and you haven't read rev. 3, it's well worth a look. https://lnkd.in/g8bQ_5Bp #dfir #nist Nearshore Cyber

9

So another ransomware advisory, with a hint to check your administrator groups for a new user called "itadm" https://lnkd.in/gvFFPpsA - question for all - do you actively monitor and immediately notify when a new user is added to any global administrator groups? Examples (in a Microsoft tenant) would include: 'Account Operators'; 'Administrators'; 'Domain Admins'; 'Backup Operators'; 'Domain Controllers'; 'Enterprise Admins'; 'Enterprise Read-only Domain Controllers'; 'Group Policy Creator Owners'; 'Incoming Forest Trust Builders'; 'Microsoft Exchange Servers'; 'Network Configuration Operators'; 'Print Operators'; 'Read-only Domain Controllers'; 'Replicator'; 'Schema Admins';'Server Operators' This article might help: https://lnkd.in/gDaD7x3X

14

1 Comment

For the last 6 months or so, I have been struggling with market definitions in identity and access management. I used to understand markets such as identity governance and administration and access management; I understood what the feature boundaries were; I could map vendors to those markets. But honestly, lately, I feel like those maps and those boundaries aren’t as accurate as they once were. So, in some regards, this post is my attempt to work through ways of defining what IAM looks like in the modern era, what parts should enterprises be willing to pay for, which are table stakes, and where is this all going. There is change in the air; people are willing to consider new solutions and new architectures. What follows is a reframing of the enterprise identity space, one not based on "classical" market definitions, instead one based on capabilities, and it starts with identifying the four major components to new world of identity: * Policy * Orchestration * Execution * Data Read the rest at Weave Identity https://lnkd.in/eu78FS5d

117

48 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

47

8 Comments

https://lnkd.in/ePufpVtQ "The guidelines emphasize a range of steps, including understanding the dependencies of AI vendors that operators might be working with and inventorying AI use cases. They also encourage critical infrastructure owners to create procedures for reporting AI security risks and continually testing AI systems for vulnerabilities." Cybersecurity and Infrastructure Security Agency #AI #ArtificialIntelligence #Cybersecurity

1

Many of you have questions about ISO42001, and many don't even know where to begin. It's a lot...a lot to take in, a lot to think through, a lot to consider. To help you build momentum, A-LIGN has published a new ISO42001 Frequently Ask Questions (FAQs) blog, so if you're not sure where to start on your journey, this is the place! https://lnkd.in/e3yV93kh #iso42001 #iso27001 #ethicalAI #resonsibleAI #AIGovernance #TheBusinessofCompliance #ComplianceAlignedtoYou

62

1 Comment

🚀 Navigating ISO42001 AIMS Controls: Your Roadmap to Controls Implementation 🚀 As compliance executives, implementing ISO42001 AIMS controls can be a daunting task. Below are my thoughts on how to incrementally select, design, and then implement controls for your AIMS. 1️⃣ Identify Standards & Conduct Risk Assessments: Start by understanding the specific ISO42001 requirements applicable to your AI systems. Conduct a detailed risk assessment to uncover potential vulnerabilities and threats. For instance, if your AI handles sensitive data, focus on controls that address data privacy and security risks. 2️⃣ Design Tailored Solutions: Design controls that are tailored to the risks you’ve identified. Ensure these controls not only comply with legal and ethical standards but are also practical for your daily operations. Engage stakeholders from various departments—like IT, legal, and operations—to gather a variety of insights that ensure comprehensive coverage. For example, if your risk assessment highlights a potential for data breaches, you might design an AI control that includes both encryption of data at rest and rigorous access controls. 3️⃣ Implement Controls "Smoothly": Integrate these controls seamlessly into your existing business and IT processes. Before full implementation, pilot these controls in a controlled/dev environment to iron out any issues. Comprehensive training for all users is critical to ensure smooth adoption. For example, after introducing a new AI monitoring tool, conduct training sessions to help your staff understand how to use the tool effectively and recognize signs of system anomalies. 4️⃣ Monitor, Document, and Adjust: Maintain detailed documentation of all AI controls, their implementation processes, and their effectiveness. Regular monitoring is vital — set up dashboards that track compliance in real-time and alert you to any deviations if you aren’t using a platform like Vanta or Drata. Regularly review and refine your new controls to adapt to new technological developments or changes in regulatory requirements. For instance, if a new data protection regulation is passed, review your AI data handling controls to ensure they remain compliant across geographies. 🌐 Interested in a deeper dive or specific examples tailored to your industry? Connect with me for a personalized discussion on optimizing your ISO42001 AIMS implementation!  #AICompliance #AIManagement #ISO42001 #Cybersecurity A-LIGN #iso42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

5

This breach at #GlobeLife serves as a reminder that security isn't a one-time setup — it's a continuous process. Regular audits of access permissions and user identity management are essential. Orgs have to continuously evaluate their security posture to address vulnerabilities before they are exploited.

3

#Microsoft #Recall feature called #Recalled as a #default feature on new #PCs. Recall is only coming to #new Copilot Plus PCs -- Windows Recall isn't coming as an update to a PC you already have. If you do plan on buying a Copilot Plus PC and don't want Recall, other sites have published guides on how to #disable the feature. The #TLDR version: Go to Windows settings, select Privacy & Security, go to Recall & Snapshots and use these settings to #toggle off the feature or delete any data that's already been collected. #dataprivacy #datasecurity #AIeverywhereeverything

23

6 Comments

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

💡 Where can I access the PKI maturity assessment tools? Are you looking to enhance your PKI maturity and drive your organization to new heights of security excellence? 🔍 Discover the PKI Maturity Assessment Tools 🔍 Head over to the Tools section in the PKI MM documentation to access resources, including: 📋 PKI Maturity Assessment Tools 📚 Step-by-Step Guidance for Conducting Assessments 📝 Templates for Reporting Assessment Results These tools are crafted to help you evaluate your PKI maturity, pinpoint areas for improvement, and stay ahead of the curve with the latest best practices and industry standards. 🌐✨ 🔄 Why Wait? Take the First Step Towards PKI Excellence Today! 🔄 Tools are regularly updated to ensure you have the most current and effective resources at your fingertips. Stay tuned because we are preparing interesting updates to tools! Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

12

1 Comment

  “ControlCase, the global IT Certification and Compliance leader, has placed their AI-Powered Accelerated Evidence Review into General Availability following a highly successful limited release.”   Overview: The AI-powered Automatic Evidence Review within Compliance HubTM automatically reviews evidence uploaded by the client for 7 questions on the ControlCase Questionnaire: 54, 76, 82, 83, 86, 92 and 94. These 7 questions are mapped to PCI, SOC 2, and ISO and are specific to policies and procedures documentation. When a client uploads document evidence to their Compliance HubTM portal and they choose the AI tool, they receive immediate AI-generated feedback on the uploaded artifacts. The tool pre-screens documents to identify areas needing further review and highlights that feedback to the client and the human assessor. The solution guides what could be accepted by the Assessor for the uploaded evidence.  Benefit - Increased Efficiency: Speeds up the document review process, reducing assessment time. Allows quicker turnaround for compliance.  Benefit - Enhanced Accuracy: Reduces human error by automating routine checks. Ensures consistent application of major standards.  Feedback: The tool provides a mechanism for the customer to give feedback on AI Recommendations by clicking Thumbs Up/Thumbs Down. Questions: Please contact Rupesh Tanksali rtanksali@controlcase.com for any questions.    

109

1 Comment

Compliance is dead. Long live compliance. Let's understand something: as practiced today, security audits are designed to accomplish one thing - the piece of paper that says you've completed an audit. Well, that, and making the audit firms rich. But wait, you say, what about all the "findings" audits expose that have to be "remediated," which in turn reduces our risk exposure? Have you read your audit scoping statement and all the sundry disclaimers? You didn't actually think any real-world audits covered your entire enterprise or were based on your actual current control posture, did you? Let's also not forget the lifeblood of the traditional audit process: the manual data call, the screenshot, and the word of a control owner. Are you stitching together all your various audits from all the different scopes and time frames to try completing the puzzle that's meant to represent your overall security posture? Right, because nothing is more relevant to your ability to defend your environment from real-time threats than manually collected control artifacts from last year. Pro tip: bad guys don't care about checkboxes. They care even less about the ones from last year or the year before. The cyber audit and compliance emperor isn't wearing any clothes - and he never has. The sooner we realize the futility of this entire manual audit model, the sooner we can make compliance actually mean something, maybe for the first time ever. Evolving to what I've termed the Converged Continuous Compliance vision of a real-time, data-driven, fully automated audit and compliance lifecycle, is the path to compliance integrity, compliance confidence, compliance agility, and compliance reporting accountability. If you want to learn how to make this vision your reality, check out qmulos.com, the only firm actually delivering true, end-to-end, real-time compliance automation at the enterprise scale - on-prem, cloud, hybrid, and everything in-between. Come see us next week at Gartner Security & Risk Management conference at the National Harbor in DC, booth 901. #compliance #security #cybersecurity #securitystrategy #ciso #audit

13

Understanding CISA's Proposed Cyber Incident Reporting Rules What incidents to report and when. CISA proposes defining a cyber incident as “an occurrence that actually jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually jeopardizes, without lawful authority, an information system.” CISA proposes to define a covered cyber incident, meaning one that must be reported under the new rules, as one that meets any of the following substantiality thresholds: 1) A substantial loss of confidentiality, integrity, or availability of a covered entity’s information system or network. 2) A serious impact on the safety and resiliency of a covered entity’s operational systems and processes. 3) A disruption of a covered entity’s ability to engage in business or industrial operations, or deliver goods or services. 4) Unauthorized access to a covered entity’s information system or network, or any nonpublic information contained therein, that is facilitated through or caused by either a compromise of a cloud service provider, managed service provider, other third-party data hosting provider, or a supply chain compromise. CISA notes that these conditions apply regardless of the cause of the incident, which might include the compromise of a cloud service provider, managed service provider, or other third-party data hosting provider, a supply chain compromise, a denial-of-service attack, a ransomware attack, or exploitation of a zero-day vulnerability. It’s important to note that an incident needs to meet only one of the four prongs, not all four of the prongs, for it to qualify as a substantial cyber incident. Moreover, CISA proposes to include all types of systems, networks, or technologies, not just those deemed critical, in determining whether a substantial incident has occurred. #cisa #breach #cybersecurity Cynthia Brumfield

5

Final Determination prohibiting Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based anti-virus software and cybersecurity company, from directly or indirectly providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons. The prohibition also applies to Kaspersky Lab, Inc.’s affiliates, subsidiaries and parent companies. - [Bureau of Industry and Security](https://lnkd.in/e7gJ3RP3) - [Kaspersky Lab, Inc. Prohibition | Home](https://lnkd.in/e5SEENgu) - [public-inspection federal register PDF](https://lnkd.in/ejqnNF5m)

1

1 Comment

I get a lot of questions about the overlap of requirements between ISO27001 and ISO42001. And while it’s easy to say “there is significant overlap”, the reality is a little more complex than that. Today I hope to share a little about a topic that Kim Lucy taught me, the ISO Management System High Level Structure (HLS). The HLS provides a standardized framework and core requirements for all ISO management system standards, ensuring consistency and easy integration. By adopting the HLS, organizations can seamlessly integrate their ISO 42001 AI management system with existing management systems like ISO 27001 (information security), ISO 9001 (quality), and ISO 27701 (privacy). It enables a holistic approach to managing AI systems, addressing risks and opportunities across multiple disciplines. It streamlines processes, reduces duplication of efforts, and fosters synergy among different management systems. Integrating an AIMS with other standards using the HLS offers significant benefits for both the management system and integrated audits: 1. Aligned objectives and processes: The HLS promotes a unified approach to setting objectives, planning, and implementing processes across various management systems, ensuring that the organization's efforts are coordinated and focused on achieving its goals. 2. Comprehensive risk management: By integrating AI risk management with other risk management processes, organizations can establish a robust framework that addresses risks holistically, considering the interplay between AI and other critical areas such as information security, privacy, and quality. 3. Efficient resource utilization: The HLS helps organizations optimize their resources by eliminating redundancies and leveraging common elements across different management systems. This leads to improved efficiency and cost-effectiveness in managing AI systems alongside other organizational processes. 4. Consistent documentation and reporting: The standardized structure and requirements of the HLS facilitate consistent documentation and reporting practices across integrated management systems. This enhances transparency, facilitates communication with stakeholders, and simplifies compliance monitoring. For integrated audits, the HLS allows auditors to plan and conduct audits based on a common structure, saving time and costs associated with multiple audits. It enables a comprehensive assessment of the overall effectiveness of the integrated system, identifying areas for improvement and ensuring the organization's adherence to best practices across multiple domains. By leveraging the HLS, you can navigate the complexities of AI governance with greater ease, ensuring responsible development and use of AI systems while maintaining compliance with other critical standards. 📊💡 Need help getting started. Please reach out! #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou A-LIGN

31

5 Comments