Paul Gerlach

Are you looking to automate compliance to make it go away? As we continue to develop and extend the de.iterate assurance program we of course introduce more automation of evidence creation, collection, and decision making. Not to replace human interaction but to complement it. Some of the reasons why blindly automating compliance, and why relying on it is risky are covered in our recent blog post. #compliance #compliancenerds #ISO27001 #ISO27701 #ISO42001 #cybersecurity #risk #riskmanagement de.iterate #privacy

21

1 Comment

This past weekend, Patelco Credit Union made the incredibly difficult decision to shut down most of their operations. The customers still don't have access to their accounts and as of Monday afternoon, the HQ branch tellers were still on pen and paper! They’ve had to set up a "Security Incident Updates & Information Center" and after 3 days admit they experienced a ransomware attack. Imagine the pressure on Patelco's leadership. Taking critical systems offline, leaving customers without access, and ultimately admitting failure. These are not easy choices, but the most difficult part, retaining customers, is yet to come. This incident underscores how crucial preparedness is in cybersecurity. We simply cannot eliminate Cyber attacks. The best-prepared amongst us can only reduce the probability of material impact on the business. Having the controls in place including an actual Incident Response plan (other than shutting everything down) allows institutions to react efficiently when a breach occurs. I talk about breach prevention, Incident Response plans etc. every day, but this breach hits particularly close to home. I’ve been a long-time customer of Patelco, but not for much longer. While Patelco's situation is unfortunate, their best efforts in communicating the incident is commendable. Let's hope they recover quickly. No organization is immune to cyberattacks. Are you prepared? #cybersecurity #ransomware #dataprivacy #patelco #incidentresponse

40

3 Comments

Coalition, Inc. Cyber Risk Awareness Security Report! Could you not want a better summary to highlight the real risks? 🚨"Technology has become ingrained in modern business, and so has cyber risk. Cyber risk is now the most significant concern for business leaders globally." ⭐🔦A warning that continues to be echoed from every corner of the security landscape. In addition, the coming #digitalliabilities explosion where due diligence is under the microscope. Gerry Kennedy, Ivan Savov, FARPI, #cyberrisk #digitalpremisesliabilities #compliancerisks #businessrisk #boardofdirectors #boardroom #executives 🚨"Cyber claims originated in the inbox. More than half of all claims were business email compromise (BEC) or funds transfer fraud (FTF), highlighting the importance of email security as a key aspect of cyber risk management." ⭐🔦As perimeter security strengthens and is heavily focused upon with weak #securityawarenesstraining and weakening information security governing policies to risk manage current and evolving #securitythreats, attacks are directed to the weakest links in the organisation's security system—that is, the human element domain and all vectors surrounding it. Many organisations are not doing enough to strengthen #emailsecurity and continue to rely upon existing controls or poor continuous monitoring and evaluations of current controls. This problem is not expected to be resolved any time soon as security continues to be an emotional factor among IT teams, holding blind relationships with failing strategies and solution providers. 🚨"Businesses using select boundary devices were at greater risk. Firewalls, virtual private networks, and other devices can help reduce cyber risk. However, boundary devices with known vulnerabilities increased the likelihood of a business experiencing a cyber claim." ⭐🔦IT-driven organisation's security can result in the above, where #securityrisk is not well understood at the governance level and #informationsecuritymanagementsystems maturity capabilities are slowly maturing but not at the level for true #cyberriskmanagement. Until #cyberrisk becomes #businessrisk and #boardofdirector becomes cyber risk aware and takes responsibility and accountability for the organisation's #digitaltransformation program, this problem will continue to plague such organisations. Resolving cyber risks requires responsible action from top-level management. #businesssectors #government #ngo #privatesector #publicsector #financialsector #healthsector #insurancesector 

6

Just kicked off my CISM certification journey and wow, what a ride already! Only three days in, and I'm diving deep into risk management. I never thought I'd be so happy to see a skill listed as advanced — feels like I’m getting interrogated by a Textbook Tyrant with a penchant for trick questions! 💼📚 Super pumped to keep pushing forward and unlock new levels of expertise. Let’s go! 🎯 #CISM #RiskManagement #CyberSecurity #LearningJourney

13

2 Comments

Ditch the audit mentality for PCI DSS assessments. If your assessor acts like an auditor, it's time to say goodbye 👋 Payment security evangelist Andrew Henwood reveals why a collaborative approach is better 👇 #pcidss #paymentsecurity #infosec

8

Love golf and making a difference? We would love to have you join us for our charity golf event in Wheaton, IL on June 27th! If you don't love golfing, or are not a golfer (like me), we are still looking to add a drink ticket sponsor to the roster. Click on the link below to join us for a fantastic cause on a beautiful course! https://lnkd.in/gH6YwTJh Please join us for fun, networking, and a good cause – The Cyber Helpline USA. We are all aware about the $Millions that cyber criminals extort from businesses. Surprisingly, the crimes against individuals is 10x. We continue to speak with individuals that need help we cannot provide. We are sponsoring a fundraiser to help victims of Cybercrime by growing and establishing The Cyber Helpline in the US - https://lnkd.in/gGairhmR. It will be at Cantingy in Wheaton, IL on June 27 with shotgun start at 9am.   The statistics from IC3 are staggering for last year’s report: $12.5 (up from 10.3) Billion in losses for over 880,00 (up from 650,00) victims Victims over 60 years old suffered the most with an average of loss of $33,641 IC3 receives over 2000 cases per day and does not offer individual assistance  Law enforcement is chasing the criminals, but the victims still need our help. Please join us. Your participation will enable us to grow the US support infrastructure by adding more volunteers and help more victims.  

12

1 Comment

SEC Charges R.R. Donnelley & Sons Co. $2.1 Million Fine for Cybersecurity-Related Controls Violations On June 18th, 2024, the U.S. Securities and Exchange Commission announced that RR Donnelley, a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. This SEC settlement with RRD highlights critical issues around cybersecurity and internal controls. Key findings include inadequate controls over material non-public information (MNPI), heightened insider trading risks, and violations of the Securities Exchange Act of 1934. Key Allegations: - Inadequate controls to prevent MNPI misuse - Insider trading risks due to poor monitoring - Regulatory violations and insufficient disclosure controls Inadequate Cybersecurity Response: - Between Nov 29 and Dec 23, 2021, RRD's internal intrusion system issued numerous alerts. - Alerts were reviewed by a third-party MSSP and escalated to internal cybersecurity personnel. - Despite escalations, RRD failed to take timely action, leading to unauthorized data exfiltration of 70 GB, including personal and financial information of 29 clients. - Issues identified included lack of prioritization, workflow for alerts, and inadequate auditing of the MSSP's performance. - Only after an external company alerted the CISO did the firm respond effectively. How AdvisorDefense Can Assist Registered Investment Advisors (RIAs): We offer a comprehensive suite of services tailored to help RIAs meet SEC regulations and bolster their cybersecurity defenses. Our mission is to empower RIAs with the necessary tools and expertise to navigate the cybersecurity landscape, ensuring compliance with regulatory requirements and protecting client information. By partnering with AdvisorDefense, RIAs can enhance their cybersecurity posture, ensure compliance, and protect their clients from evolving cyber threats. Protect your clients. Maintain your reputation. Ensure compliance. Contact us to learn more about how we can support your firm. https://lnkd.in/eVKtr3_x #Cybersecurity #SEC #Compliance #RIAs #AdvisorDefense #CyberRiskManagement #FinancialServices #RegulatoryCompliance #CyberThreats #CyberSecurityAwareness #CyberSecuritySolutions

10

Customers are the heartbeat of your business. Keep their data safe and sound to keep your bottom line healthy. Strengthen your relationship with your clients through enhanced protection. Need help getting started with PCI compliance? We’re here to help. https://lnkd.in/gJ2EsiUC #OmegaTecks #Cybersecurity #KansasCity #ITSupportKansasCity #PCICompliance #CustomerData

4

As we discussed in a previous CSAF panel session, Human Risk Management can be viewed as an umbrella concept that includes Security Awareness Training and Education. In tomorrow's Live Cyber Security Awareness Forum, join our community of cyber security professionals as we look at the metrics that can be applied within a Human Risk Management program. We'll look at questions around which KPIs might be considered, how targets can be chosen and who should be responsible for these metrics. https://lnkd.in/gnBJy5AM #csaf #cybersecurityawarenessforum #ciso #cybersecurity #humanriskmanagement #securityawareness

7

Cybersecurity threats are often abstract until they hit close to home. This week, Wichita fell victim to a LockBit ransomware attack, impacting critical city services. Residents can't pay bills and fines with credit cards, everything is cash and city operations are hampered. This incident underscores the crucial role we play in cybersecurity. Reactive measures like breach response and backups are no longer sufficient. We need a proactive, prevention-first approach that leverages advanced AI to combat malicious actors. I'm proud to work for Deep Instinct, a company at the forefront of this movement, championing preventative cybersecurity solutions. Let's keep spreading the message: prevention is key in the fight against cybercrime. #cybersecurity #ransomware #prevention #deeplearning

20

3 Comments

The recent CDK ransomware attack that impacted car dealerships nationwide highlights a growing concern for businesses: cybersecurity threats are no longer rare events but daily challenges. As a CISO, ensuring that executives and board members are not only aware of these risks but also equipped to address them is crucial. Clear, concise communication that ties cybersecurity efforts to business goals is essential for fostering a secure organizational environment. Here are a couple of the questions every CISO should consider to bridge the communication gap with the board and secure essential support: How do I justify my cybersecurity budget? Demonstrate the return on investment by showcasing how safeguarding critical data and infrastructure protects the organization's financial health. How do I celebrate security achievements? Highlighting and celebrating security successes boosts morale, fosters a culture of awareness, and reassures stakeholders of the organization's commitment to data protection. Remember, communication isn't just about presenting problems—it's about showcasing achievements and aligning cybersecurity efforts with the organization's strategic objectives. More on these key questions here: https://lnkd.in/e8Z4bQKQ #Communication #CISOsConnect #Cybersecurity #Ransomware

12

1 Comment

The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and HHS warned in a joint cybersecurity advisory (CSA) that healthcare organizations should harden their systems to protect against Black Basta ransomware. Black Basta threat actors use tried-and-true techniques such as spear phishing and exploiting known vulnerabilities to gain initial access. These actors have been observed exploiting a ConnectWise ScreenConnect vulnerability involving authentication bypass (CVE-2024-1709)

24

1 Comment

Lots of chatter about Encrypted DNS, with many of our clients reaching out to us for guidance. I thought I'd share this great article released by CISA. Within the article you will find a link to an "Encrypted Domain Name System Implementation Guide". The guide is for federal civilian agencies to meet requirements related to encryption of DNS traffic and enhance the cybersecurity posture of their IT networks to align to the Office of Management and Budget (OMB) Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles and the National Cybersecurity Strategy. https://lnkd.in/ewjzfM-j

13

At what threshold should cloud/SAAS providers be considered critical infrastructure? Should cloud service providers have something like NERC-CIP that governs their security levels when they reach a certain level of importance/concentration? We've had a couple of incidents that are really concerning...Okta, MS Exchange Online, and now Snowflake (though what actually happened is still unclear)...all have been targeted because they are acting as foundational fabric to a large part of the commercial world. Clearly threat actors are seeing the consolidation of information and processing as a very desirable target. At what point do some of these services become of such importance that they reach National Security importance? Should they? Links to referenced incidents below: https://lnkd.in/eqq5Qe_4 https://lnkd.in/ehP5thEF https://lnkd.in/eV-kuWmA

21

1 Comment