Lance Mueller, CISO, CISSP, CISM

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Hmmm how do I leverage the NIST CSF 2.0 www.ncsecourse.com for Compliance and Reporting "How can an organization enhance its cybersecurity governance framework according to the NIST CSF 2.0's Govern function? Include recommendations for establishing roles, responsibilities, policies, and procedures to manage cybersecurity risk effectively." #NISTCSF ICTTF - Cyber Security Community, Academy and Events

2

3 Comments

How to Protect Your Organization from Cyberattacks with Better Pen Testing

5

Complete the survey today! https://lnkd.in/g_ybetGm The Security Benchmark Report showcases our profession's organizations and serves to examine the maturity of a company’s security program. 🔐

1

I encourage all my LinkedIn connections, followers, and readers of my posts to follow the DVMS Institute as the Institute is about to launch some significant "VALUE ADD" updates to its Accredited NIST Cybersecurity Professional Certification Training Programs. Click here to Follow the DVMS Institute https://lnkd.in/gxZsKUQc Also, stay tuned for the release of the Institute’s third publication! This publication centers around the Institute’s NIST Cybersecurity Framework Digital Value Management Overlay System (DVMS). At the heart of the DVMS’s power are the people within organizations learning to see and think in systems so they can be part of a culture capable of thriving safely in today’s and tomorrow’s global digital economy. The DVMS is neither a framework nor a method; it is an overlay that acts like a lens through which organizations can gain a new perspective on digital risk, revealing gaps and empowering proactive strategies. It’s not a one-size-fits-all solution but an adaptable and scalable guide for organizations of any size, from agile startups to established giants. Click here to Follow the DVMS Institute https://lnkd.in/gxZsKUQc

18

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

47

8 Comments

As I previously posted, I’m struggling with PCI 4.0 Targeted Risk Analysis(TRA) process on frequency. The frequency on certain activities like vulnerability scanning and user access reviews are already determined by Corporate Policy, not a TRA. And some of these are “influenced” by other regulatory requirements such as SOX - must conduct quarterly user access reviews. Maybe a TRA would be a better approach to determining frequency, but I already have standards. What does the TRA contribute to an existing standard? One could argue that the TRA supports that standard but in reality I think it leads us to a foregone conclusion that quarterly is sufficient. I may end up with some type of TRA word salad that validates whatever frequency that the Company standards dictate. I’m still working on it, version 5. But I think having supporting Corporate Standards allows me to examine the risks of not complying with the aligned standards is the best approach to produce a TRA. Unless I go to version 6, which is unknown at this time.

Register Today by visiting - https://lnkd.in/ggyN2zaN Are you looking to become CERTIFIED in the Fundamentals of the NIST Cybersecurity Framework (NIST-CSF) PLUS have access to: - A Practitioner Guide to Adapting the NIST Cybersecurity Framework. This accredited publication provides detailed guidance on how to build a DVMS NIST Cybersecurity Framework Overlay System capable of assuring digital business performance, resilience, and trust. - Chapter 1 of the DVMS Professional NIST-CSF 800-53 Accredited Practitioner Certification Course - A NIST-CSF 2.0. bridge course that shares with candidates the key differences between NISTCSF 1.1. and 2.0. and the reasoning behind those changes. - 15% off the purchase of any DVMS Professional NIST Cybersecurity Framework follow-on courses purchased within 2024 This NIST-CSF course is accredited by APMG International, Assured by the National Cybersecurity Center in the UK, and recognized as qualified NIST Cybersecurity Training by DHS-CISA in the USA. This course does not teach theory. It teaches candidates "HOW TO" build a NIST-CSF cybersecurity risk management system capable of protecting organizational digital business performance, resilience, and trust with its clients. In the video below, Guidehouse Security, Dr. Joseph Baugh shares his story on how this NIST Cybersecurity Framework Training enabled him to help a large energy company become compliant with TSA's Directive for Pipeline Security. https://lnkd.in/ghi2FpVC -

14

1 Comment

Traditional SAST tools miss critical logic flaws in modern applications. StarcSec offers a deeper dive: 1. Uncover Logic Vulnerabilities: Advanced testing techniques like symbolic execution and taint analysis expose hidden security risks. 2. Reduced Risk & Improved Posture: Address critical logic issues before attackers exploit them, gaining a more comprehensive security view. 3. Enhanced Developer Efficiency: Focus on real problems, not chasing false positives. StarcSec empowers you to build secure applications with confidence. #StarcSec #ASPM #ApplicationSecurity

1

DoD is already in progress to update DFARS 252.204-7012 to align it with the CMMC audit program. How elegant would it be to simply put a single sentence into DFARS 7012 and the CMMC Final Rule that says : "For contracts with an award date prior to xx/xx/2026, the requirements within 800-171 rev 2 shall apply; after xx/xx/2026, the requirements within 800-171 rev 3 shall apply."

56

6 Comments

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

99

9 Comments