Robert Sheng

🎤 Friendly PSA: make sure your app doesn't send reset password emails to unverified email addresses. 📨 "Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email address." 🧠 This is also a good reminder to turn on that MFA for your accounts. As GitLab states: "Additionally, users who have two-factor authentication enabled are vulnerable to password reset but not account takeover as their second authentication factor is required to login." https://lnkd.in/gAv5WKkj #hack #mfa #cisa #passwords #security #auth #wristband

8

ZTNA is key to zero trust, but it overlooks unique SaaS security challenges. How does AppOmni ZTPM extend zero trust beyond the network to secure SaaS apps and data?

40

2 Comments

How is your organization coming along with automating development tasks? No matter where you are in your journey, from monolithic applications to #microservices Red Hat and NGINX can help you reduce complexity and increase efficiency. Read the solution brief!

1

Many Splunk users work with multivalue fields and need to ensure that data from them is complete and accurate. Take a look at how to use common search commands and functions to become an expert in working with these fields on Splunk Lantern.

62

1 Comment

Let's not assume that employees don't care about security. Maybe they don't believe that training can protect them or their agencies. What's the efficacy of your security awareness training? How effective is it, on average? How much should we rely on humans (human, all too human) to prevent attacks? Maybe the 20% that skip training are making the right call. If your organization's anti-phishing, endpoint, and identity protection tools can't catch an attack, what makes you think an overworked employee can be reliable, even if they care and have been trained? Isn't it high time we took a hard look at "the human firewall"? What about avoiding eyestrain? What about relieving stress? What about cutting email volume to manageable levels? Why do we still depend so heavily on email anyway? Computing is scalable. Human capacities are not. Let's stop pretending they are. #phishing #securityawarenesstraining https://lnkd.in/gbXrSgNg

6

4 Comments

PCI DSS v4.0.1 was released yesterday. If you are a merchant looking to make sense of the most recent changes check out my recent article on this topic here: https://lnkd.in/gS5vH_vE

10

Seeing Kernel exploits added to the CISA KEV is interesting because a lot of the time we see more web-based stuff... this one is important though: https://lnkd.in/gZTuJ5Bs. What's also interesting is the latest EPSS scores still show this scoring very low, despite evidence of active exploitation. Definitely worth a look. #cybersecurity. #KEV #vulnerability

18

An AI-native SOC can significantly increase operational efficiency, improve security posture, and potentially save your Security Operations $27M annually. Download our white paper to learn more.

8

How to lessen the impact of complying with DFARS CUI requirements (DFARS 252.204.7012) or the CMMC program assessment you may be required to meet. Yes, the costs will be high esp. for an SMB. The answer is a business answer and not a cybersecurity answer at all. When I study P&L statements and balance sheets with my financial review team (these days that means by myself :p), I see large expenses that are spread out across months and quarters. This is how to avoid that large lump payment that hurts. The same for the DFARS and CMMC preparations. Spread out your workload across 12-18 months. Pay for services as you need them in small affordable amounts. For example, make a $30k CMMC preparation a $1600/Month expense over 18 months. There is another secret benefit to this approach - most compliance experts will tell you that it takes that long anyway if you are to truly implement a proper and passable cybersecurity program. So many of the answers to managing a cybersecurity program can be found in the daily business practices you already are doing. I have been studying how to lessen the burden on SMB's to achieve compliance and have some controversial ideas that I have been slowly unwinding here. They include: 1. [Executive Leadership] CEO emotional intelligence (EQ) - no this is not an attack but a concept for executive leadership if you have read anything about it [Subtopic Executive Coaching] 2. [Team Building] Team Transparency and commitment. 3. [Project Management] Use of tools like OKR's to keep the 18-month program on track and accountable to each other (another sign of EQ). Trust is good but verification is better. 4. [IT Planning and Management] Putting together the right mix of tools (yes you might choose to buy some software for parts of this) that will help you cover a majority of the security controls and requirements without overlap. 5. [Board Room Discussion] Consideration of your IT architecture and migrations to platforms that will ease the compliance burden. 6. [HR} Find a compliance SME that your team can work with over the 18 months and beyond. Get the right consultant on the bus and get the wrong consultant off the bus. Food for thought. #CW #ceomindset #CMMC #cybersecurity #DFARS

2

1 Comment

Traditional perimeters are dead. Adapt to the new reality of cloud security with a zero trust architecture.

2

Every security framework emphasizes the criticality of an asset inventory, and this is especially true for successful vulnerability management. In this video, Brian Contos highlights 5 ways an asset inventory is foundational to the efficacy of any vulnerability management program.

14

Time is money for small businesses. Maximize your team's efficiency with Copilot for Microsoft 365. Our article explores four ways to automate tasks, improve communication & more. #productivitytips #computertips #pctips #itsupport #utah

1

From Forrester: The Total Economic Impact of #Cisco Secure Firewall. On average, organizations reported a 195% return on investment. 💵 Read this report to discover the time, labor, and money you can save with this solution. 📈 Reach out to Titanium Technologies to learn more.

1

If you’ve spent enough time parsing through vulnerability scanner results, you know just how much noise you need to sift through. This is why we’ve created Perceptive. Your organization can reduce risk by prioritizing vulnerability remediation using expected financial loss. This means you’ll reduce uncertainty, inform decisions, and spend more efficiently. https://perceptive.pro/

3