Navroop Mitter

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

185

1 Comment

Interesting conversation with Kimberly Mentzell from Maryland Department of Commerce yesterday at Infosecurity Europe 2024 about #Security #privacy for #AI and our approach to help #compliance #security professionals to navigate #ai #assessments they need to deal with increasing adoption of AI tools. Ardent Privacy Brian Castleberry Shivraj Jadhav Tony Aggarwal Scott Suhy Ardent Privacy Tejas Joshi

22

2 Comments

When the Security Exchange Commission filed chargres against the CISO of SolarWinds it was (and remains) controversial. There are absolutely two sides to the discussion and while I had been sitting pretty close to the middle after all the recent news about Change Healthcare and their security practices I'm definitely leaning towards charges are a good thing. The problem (as I see it) is that for big companies unless their is real incentive to change they won't. You see it all the time, companies are fined what to me is a massive amount of money ($100M for example) but for them represents a rounding error on their quarterly earnings. Even more of an issue than the fact that it is a small amount of money relative to what they make in the quarter or year is that it is likely a small amount of money relative to what they made doing whatever they are being fined for. If I can break the rules (or law) and make a profit of $100M only to be fined $10M I'm coming out ahead - why bother following the law? The fact the Change Healthcare did not have #MFA enabled on absolutely everything they possibly could is mind-boggling to me. This is a company that has access to things like #PII, medical records, payment information, and all sorts of other information that people would not want out there. The first thing they should be concerned about is how they are protecting all that data and not how much money they can make and where they can cut corners. In an article from The Register, Tom Kellermann from Contrast Security discusses his take on the incident: "The cybersecurity practices that led up to the stunning Change Healthcare ransomware infection indicate 'egregious negligence' on the part of parent company UnitedHealth, according to Tom Kellermann, SVP of cyber strategy at Contrast Security." And the fact that the CEO decided to pay the ransom is even more problematic as they are discovering: "UnitedHealth paid a ransom as Witty confirmed in his testimony. This cost the healthcare giant $22 million – and then more ransomware fiends reportedly started leaking sensitive data and extorting UnitedHealth for even more money." So not only did they have crappy security that resulted in a massive breach impacting a significant number of people (including me) but they then paid the extortion demand only to have them come back for more money and leak information anyway. I don't know the right answer on whether the SEC should take CISO's to court over security failures in general. I do know in this case there needs to be significant and major repercussions to the execs at UnitedHealth Group and Change Healthcare because clearly the current batch are not competent to do their jobs.

2

1 Comment

The US mom accused of using explicit deepfakes to discredit her daughter's cheerleading competitors - what's the truth? Meanwhile, learn how robocalls are stealing MFA codes from boomers. Listen to the latest award-winning "Smashing Security" podcast now, with yours truly and Carole Theriault https://lnkd.in/eGRrJvfS #cybersecurity #podcast

15

Leaders in security. "We will only trust them once we build their resilience, allow for nuance, and inspire them to realize their inherent value.” BUILDING TRUST AND PREPARING LEADERS Just released in Security Journal Americas (SJA) Read the latest article I wrote alongside Daniel Hallak, Ph.D. and Wanda Townsend on seven strategies for building trust and reforming how we think about preparing a leader. #trust #leadership #wildtrustplatform #publication #justreleased #june #whole #intentional #leader #development 

19

2 Comments

CISOs, CIOs, CTOs, Heads of IT and GCs, as well as C-Suite Executives and Board Members, at Public - and Privately-owned U.S. companies. This is an invitation to a high-level panel/fireside chat and Q&A session designed to deliver encouraging news to CISOs, GCs, and senior staff responsible for protecting public companies and their management. In the webinar, we'll address the needs of Boards of Directors facing regulatory liability risks under the new SEC Cyber Rule and NY DFS Second Amendment. Led by a panel of current and former CISOs, BISOs, and industry-leading cyber attorneys, this session will cover practical, commercially oriented issues to support future business growth without jargon or "in the weeds" discussions. Discover how CISOs can enhance their organizational stature by working closely with GCs to access Board/C-suite delegates, enabling a risk-focused approach to regulatory compliance and significantly minimizing senior management's regulatory liability risk exposure. Key topics will include: * Building a team to meet daily interdisciplinary regulatory and business challenges, protecting the Board and C-suite, while also safeguarding CISOs by avoiding having a “target painted on your back”. * Needing to train on how to "speak senior management" to help meet the new regulatory compliance obligations related to cyber oversight by Boards via their C-suite delegates. * Ensuring the right technology underpinnings for required annual disclosures on Form 10-K, to address cyber risk management, strategy, and governance per the company's appetite/tolerance for this part of total enterprise risk. Don't miss this opportunity to stay ahead in the ever-evolving regulatory landscape. REGISTER TODAY: https://lnkd.in/eRG28EDA #CyberSecurity #CISO #ITLeaders #CyberCompliance #RegulatoryCompliance #BoardofDirectors #CyberRiskManagement #CIO #CTO #ITLeadership #VirtualWebinar #CyberAwareness #BusinessGrowth #CyberLaw #TechLeaders #CyberStrategy #RiskManagement #ThirdPartyRisk #CyberOversight #CyberGovernance #NewSECCyberRule #NYDFSSecondAmendment #NewCyberCorporateGovernance #NewCyberGovernance #CyberOversight #SECNewCyberOversight #NewBoardCyberOversight #CyberStrategy

21

🔍 Analyzing the Impact of Facial Recognition in the Justice System Our latest discussion on the Shared Security Podcast, sheds light on the contentious topic of facial recognition and its impact on those who are wrongly incarcerated. Co-host Kevin Johnson brings a critical perspective on the implications it has for innocent individuals. Don't miss out on this important conversation! Plus, we cover "broken" news on the recent 'regreSSHion' SSH vulnerability, and essential advice on disposing of old tech devices safely! Links below to watch and listen on your favorite podcast platform! 🎧

10

1 Comment

Looking forward to speaking with Joel Jacobs, Matthew Ebben, and Marc Woolward at 11:00am EDT this morning, about navigating Cyber Resilience -- touching on contemporary Trends, Challenges, & the Role of Dependencies. Thanks to our host, vArmour. Hope you can join us, or register and catch the recording later. #cyberthreat #cyberentropy #complexity #cyberdependency #vulnerability #cyberrisk #situationalawareness #riskawareness #riskmitigation #cyberresilience #ciso #cio #coo #boardofdirectors #bia #businessimpactanalyses

12

2 Comments

One of the most existential crises of our generation is the rise of supply chain risk, with growing geopolitical challenges and a splintered polar world driving that risk to unprecedented levels. What’s happening in the Black Sea, to the South China Sea, to Taiwan are just a few examples of this crisis in action, with ripple effects turning into a tsunami affecting the world’s critical supply chains. The result is tangible - $2.5 trillion+ in losses for companies around the world – and a massive amount that cannot be ignored.    Proud to be part of a company like Interos Inc who has built the largest supply chain database in the world to tackle this problem head on, with 11B+ relationships and 440+M businesses mapped, all wrapped in AI to give visibility, monitoring, managing and remediation for supply chain risk. When we look to secure our world for tomorrow, this is what it’s all about.   With the opportunity of a lifetime in front of Interos, it’s great to welcome Theodore Krantz Jr. to the company as CEO to open the next chapter of growth. Ted is an accomplished global CEO with a deep background in driving AI innovation, go-to-market and executive leadership. Thank you to Jennifer Bisceglie for building such an incredible company, and looking forward to what you two will accomplish together with you as Executive Vice Chair. Ready for great things from Interos going forward! https://lnkd.in/gX9_e_Zb

91

15 Comments

Are you breach ready? Check out the latest article featuring insights from Bob Palmer, and other industry experts! Read on to hear about proactive measures towards cybersecurity: https://bit.ly/4b8HGfx Be Breach Ready With ColorTokens Inc.! #internetsafetymonth #BeBreachReady #Cybersecurity #Microsegmentation

14

1 Comment

Join me on today's ActiveProspect Webinar, Prioritize Notice & Consent with innovative Chat & Text solutions. Episode 12 in our #FCC #TCPA 1:1 Consent topic series. Today Wed July 10th, at 11:00 AM PT/ 1:00 PM CT/ 2:00 PM ET. Register to watch live or listen to playback recording afterwords. As new lead-gen channels continue to emerge, is your company implementing the necessary compliance measures related to notice and consent language? Interested to learn more about innovative and integrated Customer Live Rep Web Chat, #AI Chat Bot services, Social Media Chat intergration and bridging to SMS text chat use in your Customer and Sales Lead Generation program? Join us for an insightful discussion. https://lnkd.in/gwgUYqjN 💡Advanced compliance strategies for texts, social media, SMS and Chat bot services for Customer and Sales Lead Generation 💡How the FCC and FTC are pressuring and monitoring phone carriers for compliance in text messages 💡Be ready for FCC TCPA 1:1 Consent requirements before January 2025 compliance deadline 💡The devastating costs of inaction, non-compliance, legal exposure. Speakers: 🎙Michael Peronto, Director of Professional Services, ActiveProspect 🎙Aru Anavekar, CEO, Botsplash 🎙Benjamin Farrar, Director of Privacy, Security, & Compliance, ActiveProspect #activeprospect #leads #marketing #sales #webinar #martech #compliance #leadgen #leadacquisition #fcc #tcpa #ai #chatbots #dataprivacy #notice #consent

17

4 Comments

Had an incredible experience today supporting the ITDRC team at a CISA/FEMA/DoHS preparedness workshop in Denver. If you're interested in joining me and volunteering your expertise during times of crisis, check out https://lnkd.in/dYVhMReM. By leveraging your IT experience and joining a team of skilled professionals, you can make a dramatic immediate difference for hundreds or thousands of people during a crisis by getting communities reconnected and providing first responders with the critical infrastructure needed to support their missions. There are many roles available from networking to logistics, planning and coordination, so even if you can't deploy on site for a disaster, there are still ways to help. And the more volunteers there are, the more flexible we can be in our response. In terms of what you can expect to get out of it, satisfaction from helping your fellow citizens, hands-on exposure to a variety of current comms technologies, experience operating in crisis modes, and exposure to a wide range of corporate, NGO and governmental agencies are all likely outcomes. So if you're looking for a way to make a difference during a crisis, please reach out to me or sign up directly at https://lnkd.in/dYVhMReM. Let's work together to provide our biggest impact when our communities need us the most. #volunteer #IT #disasterresponse #communityimpact #ITDRC

22

3 Comments

This move highlights ongoing concerns over cybersecurity law and the crucial need to protect data privacy in legislation. Civil society groups, including the Lawyers’ Committee, advocate for revisions to uphold these protections, emphasizing the balance between privacy rights and responsible data use in the digital era. #DataPrivacy #CybersecurityLaw #DataProtection

2

The White House calls for and commits to work toward baseline harmonized cybersecurity requirements. https://lnkd.in/eyU64yMe Decades-old “reasonable security” standards, as codified by FTC guidance and industry best practices, may soon become a fair bit more regulatory. They write, “we need Congress’s help to bring all the relevant agencies in the government together to develop a cross-sector framework for harmonization and reciprocity for baseline cybersecurity requirements.” #cyberlaw

27

Amy Bogac is one of my favorite people in infosec! Everyone needs to listen to her perspective on how we've allowed SaaS to condition business leaders into thinking that data recovery is equivalent to disaster recovery -- IR plans & TTX must prepare us for both because you can't always trust your data or the hardware it's stored on. Having to do things like restate your financials is not an indicator of successful recovery.

3

This guide addresses the importance of vulnerability management in enhancing security operations by identifying assets, mitigating threats, and ensuring compliance. It aims to assist security and risk management leaders in comprehending vulnerability assessment (VA) technologies within a broader exposure management framework. #vulnerabilities #Flashpoint #vulnerabilitymanagement #secops

4

Great news from NIST as they adapt digital identity guidelines for state and local benefits programs. This collaboration with the Digital Benefits Network and the Center for Democracy and Technology to refine digital identity measures is a step in the right direction. It's essential to ensure that as we enhance digital services, we also safeguard privacy and equity, particularly in public benefits administration. Looking forward to seeing how these guidelines will foster more secure and inclusive digital environments. https://bit.ly/3KYuH5J

22

Today, we announced our Series C funding and unveiled Zero Trust PAM to the world. Founded in Zero Trust principles and engineered to evaluate and govern every action—no matter how minor—PAM has been remade. Each command, query, or configuration change is evaluated in real time against dynamic policies that adapt to the context of the user, the sensitivity of the action, and the prevailing threat landscape. And that, my friends, is the future of PAM. It's a future we feel extremely bullish about. And we're not the only ones. With the support of our partners, StrongDM is taking Zero Trust PAM to a global scale with massive expansions in EMEA and APAC in 2024. First, thank you to our powerhouse investment partners Anchor Capital GP, Capital One Ventures, Cisco Investments, Frontline Ventures, Singtel Innov8, GV (Google Ventures), Sequoia Capital, and True Ventures. Now, let's get to work. May the best PAM win. Read about our Series C funding, global expansion plans, and Zero Trust PAM: https://bit.ly/4a813oy #ZeroTrust #PAM #identity #infosec #startups StrongDM

210

35 Comments