Phoebe Lan

I’m so excited to be available to small and medium businesses looking to implement #privacybydesign and #securitybydesign as one of many SMEs who can be leveraged through Zatik Security's fractional security model. But #SMBs won’t be able to shift the insecure tech landscape *all* of us are operating in on their own. As this year’s #DBIR (available at verizon.com/dbir) stated in its introduction of the #supplychain #interconnection metric on page 13, “calculated a supply chain interconnection influence in 15% of the breaches [they] saw... [representing a] 68% year-over-year growth.” Then on page 14, just as Cybersecurity and Infrastructure Security Agency, 👑 Kymberlee Price, Joshua Corman, and countless others, including myself, have said: “As much as we can argue that the software developers are also victims when vulnerabilities are disclosed in their software and sure, they are), the incentives might not be aligned properly for those developers to handle this seemingly interminable task [of remediating every vulnerability]. These quality control failures can disproportionately affect the customers who use this software... This metric ultimately represents a failure of community resilience and a recognition of how organizations depend on each other.” The writers go on to say, “We recommend that organizations start looking at ways of making better choices so as not to reward the weakest links in the chain... we believe the only way through is to find ways to hold repeat offenders accountable and reward resilient software and services with our business.” The fact of the matter is, the only organizations capable of doing this across the supply chain are the Big Players (with BIG contracts) in highly regulated industries—especially Finance and TeleCom—who can *both*  1) hire the talent required to really dig in to the evidence of their vendors’ security posture, and   2) then throw the weight of those BIG contracts around to incentivize substantive improvement. Demand to see vulnerability scans. Demand to see FULL #pentest and #BCDR results, not whatever watered down summary they’re going to offer you. You’re the only ones who can. I sat on one side of that table (I wrote those summaries), and I’d *love* to sit on the other. If your company is serious about #supplychainsecurity, #securesoftwaredevelopment, and exceeding the minimum that is “compliant,” let’s talk. I believe in building better I know how to architect, implement, and communicate systems deserving of trust (and how to evaluate and determine systems undeserving of trust). The only way we can turn the tables on bad actors is together, by shifting all three points of the Technology Ecosystem Triangle—Supply, Demand, and Regulation/Oversight-- together. So in the wise words of Bender, let's gooo alreaddayyyy. 😎

18

Metrics and CISO Success-What to measure. When I became a CISO for the first time, I was hard pressed to get everyone to agree on a metric for the security team. The customer wanted one thing and my boss wanted another and the reality was sometimes very different. Those first few years I was yanked around a lot, partly from my own doing. I did not take much of a stand.  Until one day a breach happened and it made me snap back to several core measurements. I could make a very long list of metrics ….but I thought I would start with these. What else would you add? So, what metrics matter? Tactical metrics provide quantifiable benchmarks to assess the effectiveness of security initiatives. The time it takes to detect and respond to threats, the number of incidents resolved, and the rate of false positives in threat detection systems provide tangible data on a security team's operational efficacy. These metrics are crucial to monitor regularly, as they directly correlate with the ability to swiftly and accurately address potential threats. Strategic metrics such as risk scores and compliance rates help align the cybersecurity strategy with business objectives. For example, a CISO must measure compliance with industry standards and regulations to avoid penalties and protect the company's reputation. Understanding the risk exposure of various assets allows CISOs to prioritize resources effectively, ensuring that the most critical assets are protected. This strategic alignment between business goals and security protocols is vital for long-term success. Lastly, customer-centric metrics on data security, applicable threat intel, and ensuring the security of any digital transformation initiatives are increasingly important. Tactical Metrics Recommendations: Implement Real-time Monitoring and Alerts: Equip security systems with real-time monitoring to detect and respond to threats instantly, enhancing response rates and reducing damage. Regularly Review and Adjust Metrics: Continually update tactical metrics to stay aligned with the evolving threat landscape, ensuring relevancy and effectiveness. Strategic Metrics Recommendations: Integrate Cybersecurity with Business Risk Management: Align strategic metrics with overall business risk management to ensure cybersecurity efforts support core business goals. Use Predictive Analytics: Apply predictive analytics to anticipate future security issues and optimize resource allocation and strategic planning. Customer-Centric Metrics Recommendations: Regular Customer Feedback Loops: Implement regular customer feedback mechanisms to understand their security perceptions and guide improvements. Transparent Reporting on Security to Customers: Regularly share security updates and audit outcomes with customers to build trust and demonstrate a commitment to data protection. #CISO #CIO #CEO #Cybersecurity #CyberMetrics #cyberoperations

11

3 Comments

Security hot take: SWGs are obsolete. With limited insights, almost no context about applications or user interaction awareness, SWGs don’t offer enough value to SOCs and SIEM teams to justify their cost. Furthermore, SWGs are easily bypassed — both by adversaries and “creative” employees! What, then, should be the most forward-thinking approach to security today? Let us know your thoughts! Top 5 will get SquareX swag shipped to them! Entries end in 24 hours.

57

11 Comments

Are you applying to dozens, if not hundreds of security operations openings and not hearing back? Quinnlan Varcoe will be teaching Hacker in Heels Insiders how to stand out in a unique way, and form genuine connections with people who can give you the opportunity to start or advance your career in security operations. Join me and our impressive, niche community of women in cybersecurity as we talk all things security operations tonight. 📆 Tuesday, June 11 @ 4P PT / 5P MT / 6P CT / 7P ET EXTRA: Would you, or someone you know make an excellent guest mentor? I'm looking for someone for our July 9th call. Priority will be given to women of color and/or women who want to speak on a cybersecurity subject (as opposed to personal branding, confidence, etc.) Share your proposed topic in the comments, or tag a nominee! P.S.—We offer to pay all our guest mentors, because we believe all women should have the option to be compensated for their labor 💜 #womenincybersecurity #cybersecurity #securityoperations #secops

63

15 Comments

Meeting HIPAA compliance requirements can be daunting, but many #cybersecurity best practices that are likely already on your list can help move your organization towards #HIPAA #compliance. Read Madison Iler's blog to learn more: https://lnkd.in/gxcp8aK4

10

CISOs are concerned with the amount of personal liability they may be taking on in their roles. Does this resonate with you? Download Devo's new guide, “The Modern CISO: An Essential Guide for CISO Success,” to learn what actions CISOs like you are taking to protect themselves and how they are using new rules, such as the cybersecurity rules from the SEC, to advocate for what they need to do their jobs effectively. #CISO #CybersecurityLeadership

3

Lots of conversations about migrating to PQC and how to approach risk assessment and planning last week during RSA Conference. I found the below summary of the latest update to NSA's guidelines very helpful. They lay out an actual timeline and give clarifications for some earlier releases. Give it a read if you can spare two minutes: https://lnkd.in/gZKmjS8P #PQC #cryptoagility #codesigning #supplychain #CBOM #RSAC

32

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

From $8.3B to $200M: Why Lacework Is Examining a Sale to Wiz. The economic downturn has been cruel to many late-stage cyber startups, but none more so than cloud protection company Lacework, but waht does mean for the many others Snyk, Cybereason, Deep Instinct and many others. Where they over valued originally and hyped by the very VC's that invested in them. Snyk - $1.9B VC Funding, Lacework - $1.9B VC Funding, Cybereason - $835m VC funding, Deep Instinct - $330m VC funding. #Lacework in November 2021 raised $1.3 billion on an $8.3 billion valuation, making it the third-most valuable venture-backed #cybersecurity firm in the world. Less than 30 months later, the company is a shell of its former self, with huge C-suite turnover, headcount down 35% from its June 2022 peak, and now, a whopping 98% reduction in its valuation. Some BIG questions need to be asked !! https://lnkd.in/e86fZJCG For more information on open positions, we are working on globally with our Portfolio Clients then contact Andrew Robinson FREC, louise robinson or Rebecca Beauchamp call us on +44 (0)1923 312435. Why not follow Paradigm Recruitment on https://lnkd.in/gssS9BWN #paradigmrecruitment #hiring #careers #startup #recruitment #IPO #cybersecurity #cybercareers #cyberjobs #startupjobs #cloud #cloudsecurity #security #cloudsecurity #AI #Boiometrics #Analytics #MachineLearning #ThreatIntelligence #DarkWeb

15

You probably heard about BeyondTrust acquiring Entitle for ~$150 million. Here's the part you may not have heard: Co-founder Ron Nissim called his shot about IGA converging with PAM just over a year ago. I had the opportunity to interview Ron last year right before Entitle came out of stealth. One of the topics we talked about was the convergence of IGA and PAM use cases. At the time, he had a theory: "I have a theory that IGA and PAM are converging in the cloud. What's essentially been happening to us is that we've been solving a lot of [PAM] use cases. We can provide a lot of the things that customers need from PAM, like just-in-time, temporary access management." He may not have fully realized it then, but his theory was totally right. This early insight ended up being one of the main strategic drivers for BeyondTrust's acquisition of Entitle. Congratulations to the Entitle team! ___ Thanks again to Elizabeth Safran and Dean Pe’er for making this interview happen. The full discussion from February 2023 is available on my website if you want to revisit Entitle's journey from launch to acquisition.

109

17 Comments

📈 Tim Grieveson’s playbook in our new ebook is a game-changer for security pros. Leverage NIST, ISO, SOC2 for growth, not just compliance. Must-read! https://ow.ly/25Jy30sBPF1 #BitsightEbook #Compliance #Cybersecurity #VRM

1

🕸 The Security Data Fabric Shift Explained🕸 Last month, Zscaler acquired Avalor for $350M. A security data fabric and vulnerability management startup that only came out of stealth in April of 2023. This acquisition sparked tons of interest and funding activity in the security data management space. It also reignited the platform v. best-of-breed debate and hinted at what's to come for AI in security products. However, this acquisition had many question marks surrounding it. In this deep dive, I cover: ✅ What security data fabrics and security data ETL are ✅ The flurry of activity that happened immediately after the acquisition ✅ Why the acquisition makes sense for Zscaler ✅ What other vendors are doing with data fabrics including CrowdStrike, Microsoft, F5, and SentinelOne. ✅ The implications for the security industry, including incumbents, startups, and security teams I also explore the growing importance of data and AI in security and how this acquisition positions Zscaler well for the next 5-10 years. What are your thoughts on this acquisition and the security data management space? Let me know what you think in the comments section! 👇 🔗 Link for the full post in the comments! #cybersecurity #datasecurity #AI #acquisition #innovation #infosec

62

23 Comments

In May, I submitted 9 vulnerabilities to 2 programs on @Hacker0x01 📄 9 issues reported (4 High 2 Medium 3 low) 💲 4 issues Paid 📜 3 Duplicate 🔗 2 Pending program review Bug Type: Info-disclosure BAC Privilege Escalation #TogetherWeHitHarder

72

2 Comments

Almost a year to notify about the breach, just that, but don't worry, it's for your own good ! And don't forget to get their free credit monitoring as a compensation ! "Sav-Rx discloses data breach impacting 2.8 million Americans" ⚠ But NOW they took action, after this data has been leaked : Full name Date of birth Social Security Number (SSN) Email address Physical address Phone number Eligibility data Insurance identification number (Just more than enough to steal your identity, your finance, your life in society) So, they took action as follow : - They started to implement the basics of #cybersecurity ! YAY ! What a relief ! 💡 I really wonder what were they doing before ? As these were not implemented, state before the incident in 2023 : - No 24/7 security operations center - No multi-factor authentication on critical accounts (now they have, and they don't even enable it on ALL accounts, just the "critical" ones ! LOL common people ! ) - No network segmentation - No enhanced geo-blocking (aka geo fencing, aka conditional access) - No upgraded firewalls and switches (sure, why bothering) - No strengthened Linux security, - No BitLocker encryption (in the medical sector...) 🌨 Weather forecast : Another leak is coming, and it will most likely happen using a "non critical account", with a lateral move, and then escalation of privilege ! Then, maybe, they'll consider adding MFA on ALL accounts. 😆 But don't worry, you'll certainly get a credit monitoring extension by then ! connected=hacked #cybersecurity FAILURE https://lnkd.in/ecmcg6di

13

2 Comments

In case you missed this incredible webinar from Illumio, now is your chance! Watch as John Kindervag and Gary Barlet analyze the NSA's latest guidance on #ZeroTrustSegmentation page by page! https://lnkd.in/gvWw5NQq

6

Last year, 59% of surveyed enterprises reported delaying their application rollout due to API security issues. And this is a valid fear as over 34% of executives were not confident if their existing API inventory was complete. In an already dire situation, integrating more APIs can certainly be challenging. But it doesn’t have to be this way. API adoption was meant to accelerate business growth, not limit it. To ensure that you can securely ship new code to prod daily/weekly or as frequently as you’d like, we Levo.ai provide regular updates regarding any changes to your internal, external, and third-party APIs. Have a look ⬇️ #apis #apisecurity #appsec #cybersecurity #tech #businessgrowth

45

1 Comment

In my latest blog post, I discuss the role of weak fingerprinting signals in the context of bot and fraud detection. I use the example of language-related signals to illustrate how even signals that may look insignificant can be leveraged to detect inconsistencies introduced by bot frameworks and anti-detect browsers. https://lnkd.in/eZ2hcKeH

35

4 Comments

Are you on a quest to find a DSPM vendor that can drive the outcomes you’re looking for? Our team at Varonis put together a MASSIVE guide on all things DSPM that features a full breakdown of all the different types of DSPM solutions, red flags you need to look out for, and every question you should ask vendors to ensure the solution checks all your boxes. Dive into the details and download the full guide today 👉 https://hubs.ly/Q02tQ0_y0 If you have any questions or want to see how Varonis' Data Security Platform can meet your DSPM needs, let's connect! #DSPM #DataSecurity #BuyersGuide

7

This is exactly how Forescout and Vedere Labs mitigate risk for your unmanaged assets. first discover the asset, second gain the threat inteligence and research behind it , assess the asset and protect it via compensating controls. all in an automated worflow!

3