Seema Kumar

The SoCal CISO Summit is only 3 weeks away! Don't miss this all-star lineup with Emily O'Carroll, Jonathan Chow, and Arthur Lessard, discussing "The Imperatives of PAM" on May 21st. Organizations have suffered relentlessly from cyberattacks, each week it seems there are new headlines highlighting ransomware attacks or data breaches. With the sensitivity of privileged accounts, unpatched vulnerabilities, and an extensive remote workforce, privileged access management (PAM) is essential to securing your most critical systems and data. Join this panel session to discuss: -Why PAM plays a crucial role in mitigating cyberattacks -Gaining executive buy-in on effective solutions -Having a proactive approach to implementation and configuration Qualified InfoSec leaders, register below! #evantaciso #socalciso #informationsecurity

55

4 Comments

Imagine diving deep into threat intelligence to uncover insights on potential threats targeting your industry, company, or even your colleagues. With Investigations Management, you can seamlessly manage and share these findings without leaving Ignite! 🕵️‍♂️💼 Investigations Management serves as your personal case management system for Flashpoint intelligence. It allows you to assign tasks, control access to sensitive information, and keep a close watch on threat actors or groups—all within the Ignite platform. 📊🔒 - Keep all your investigations organized in one place, ensuring no detail gets overlooked. - Assign tasks related to threat analysis or response directly within Investigations Management, keeping your team aligned and productive. - Safeguard sensitive data with controlled access settings, ensuring confidentiality at all times. - Stay updated on ongoing investigations and monitor threat actors or groups proactively. - Seamlessly integrate Flashpoint intelligence updates into your workflow, leveraging the latest insights effortlessly. - Collaborate effectively with your team, sharing insights and recommendations to strengthen your security posture. Empower your team to stay ahead of potential threats while optimizing your workflow within Ignite. It's your ultimate tool for proactive threat management and intelligence sharing. 🔍🛡️ #threatintelligence #investigations #Flashpoint #intelligence #risks #security

5

Supplements company is coming along well. Website is almost finished, labels finalized, all of the ingredients are ordered. Should be ready to go for at least samples at BlackHat / DEF CON - and *maybe* be ready to order by then. Some cool things, we have licensed some key ingredients that are proprietary (the ingredients are full labeled for transparency - no "proprietary blends") and have a lot of backed research behind them. The pre-workout has S7 - which research has shown through multiple studies to boost nitric oxide (it's one of the best) for vasodilation (the pump and oxygen flow). SantEnergy Nu - a high-quality plant extract from Santa Herba which the research studies show metabolism & energy boosters, antioxidant, and weight regulation/loss booster. zumXR Extended and Delayed which are the only patented delivery system for caffeine release in the body so you don't get a crash and consistent energy use through the day. About a year and a half of research and trial and error to get to this perfection blend of various ingredients. Everyone that's tried it has said so far it's the best pre-workout they've ever taken. I'm really excited about the addition of GABA - we're one of the only ones out there that leverage it which increases natural IGF-1 production if used as a pre-workout 6 fold. GABA also hits the GABA receptors which has an effect of added energy and focus. Lots of other stuff. Coming soon! Citrulline Malate (fermented) – 5000 GABA - 750 (natural IGF-1 production, energy, focus) Beta-Alanine – 3000 (helps regulate acid in muscles and prevent fatigue) Taurine – 2000 (reduces muscle fatigue / increase performance) L-Tyrosine -- 2500 (focus and concentration) Caffeine Anhydrous 200 ZumXR Caffeine Extended – 65 ZumXR Caffeine Delayed – 60 S7 (Pump/Bloodflow) - 50 ZumXR Santenergy Nu – 400 Sodium Chloride – 20 (salt/hydration) Bioperine – 10 (strength, increase endurance, decrease fat mass, and protects lean muscle) Malic Acid – 115 (energy metabolism, improved cardiac function, alleviate sports fatigue, promote regeneration) Yohimbe Extract – 100 (some folks have sensitivity here, note its the extract, very small dosage, and coupled with betaine HCL for digestion, tolerated very well and a good for blood flow and energy kick) Alpha GPC - 300 (recover faster, builds muscle, and improves strength, focus, increases IGF-1) Magnesium Malate – 200 (Magnesium + Malic Acid - bioavailable magnesium for energy production) Silicon Dioxide - 100 (anti-caking) Betaine HCL – 2500 (absorption and digestion) S7(R) - https://lnkd.in/gPQyDTe3 SantEnergy Nu (TM) - https://lnkd.in/grZvzDBV zumXR Extended (R) - https://www.zumxr.com/ zumXR Delayed (R) - https://www.zumxr.com/ https://lnkd.in/gsHvRrsV

67

10 Comments

🚀 We're thrilled to welcome our newest partners to the Wiz Integration WIN platform! Illumio - Facilitates proactive mapping of misconfigurations and vulnerabilities to cloud object metadata, application deployments, and traffic flow telemetry data. This enables Zero Trust Segmentation policies, minimizing the attack surface and automatically containing potential breaches. Learn more: [JSB](https://lnkd.in/dNzCrZMQ) Harness - The first certify CI/CD platform to integrate with Wiz CLI, enabling developers/DevOps teams to prioritize and remediate vulnerabilities within the pipeline. Traceable - Provides a bidirectional flow of information where Wiz Issues are pulled into Traceable, and Traceable runtime events are pushed to Wiz cloud events. This empowers Infosec teams to assess and prioritize combined risks for applications and APIs in the cloud. DevOcean - Pulls Wiz Issues and vulnerabilities into DevOcean to automatically identify owners and streamline cross-tool, cross-team workflows for frictionless remediation, reducing costs and risk exposure. FireTail.io - Integrates Wiz inventory to run real-time checks on API Gateway resources in Firetail, combining infrastructure information with application-layer context for enhanced API security posture management. Panaseer - Uses data from Wiz and other tools to continuously monitor your security posture, prioritizing and actioning high-risk vulnerabilities to improve organizational security. Polarity - Connects to internal and external datasets to provide quick access to critical information from Wiz, helping analysts triage vulnerabilities, assets, and issues across platforms for better context. Tarsal - Sends Wiz audit logs to your chosen analytics destination in one click, providing visibility on Wiz activity in your SIEM, XDR, or storage locations to detect anomalous behavior. shockwave.cloud - Populates Shockwave with exposed resources discovered by Wiz's agentless scanning and inventory, focusing on DNS-related records to pair with DNS scans for comprehensive protection. Wabbi - Pulls the Wiz vulnerabilities findings into Wabbi and tracks them within the SDLC, associating incoming vulnerabilities with Wiz Projects to align with Wabbi Projects for continuous security. Welcome to the WIN! Together, we are enhancing cloud security and simplifying risk management. Let's win together! 🌐 💫 Special thanks to Daphna Dayan Annam Iyer and Shashank Golla for their exceptional contributions! #CloudSecurity #Wiz

420

26 Comments

Amplify detection capabilities with Recorded Future's Validated Sigma Rules, crafted by our research team to minimize false positives. Watch to see how to easily search, implement, and configure Sigma Rules without ever leaving Splunk.

2

#AIGovernance is the hot topic of our age. #data and #AI are powerful combination but it may become liability very quickly. Join us on May 30th in person or virtually. #AIgovernance #datagovernance #privacymatters #NIST #IAPP

6

As we get back from the craziness of RSAC, I'm getting ready for the next big event on the horizon. The CISO Village Summit by Team8 is back with 100 CISOs and security leaders joining me this June in California! The magic of the Summit is more than that of a regular conference; our 300-strong community is a place of genuine curiosity, innovation, and collaboration, offering a forum for professional and personal growth alongside the industry's best. Throughout this exclusive five-day event, don't miss the chance to engage in meaningful discussions with industry leaders on: * The changing threat landscape * AI’s impact on cybersecurity’s challenges and solutions * Socio-economics and geopolitical tensions filtering into cybersecurity policy * The complex CISO-CEO relationship * And more. Spots are limited and closing fast— so apply now to not miss out! https://lnkd.in/gKj-jvS5 Team8 #Team8CISOVillage #Cybersecurity

171

9 Comments

Worried that engineers in your organization copy production databases to their development environment? I'm excited to share the new Sentra 101 video! Check it out to learn how Sentra helps organizations institute security controls that stay with the data no matter where it goes.

26

1 Comment

Another cool feature from Huntress Managed #EDR - Active Remediation. This powerful feature allows you to pre-authorize Huntress to take action on your behalf without requiring your manual review and approval.

19

When James called me in late 2020 to join him at Elisity, I was equally excited and terrified because I knew we were embarking on a challenging journey. As we worked together to raise $26M in Series A funding in June 2021, we encountered our fair share of obstacles – from navigating a competitive market to refining our value proposition. But with each challenge, we learned valuable lessons that shaped our approach and strengthened our resolve. Finding a product-market fit in 2022 was a pivotal moment for Elisity. It required us to listen closely to our customers, iterate rapidly, and adapt to their evolving needs. The process wasn’t always smooth, but it taught us the importance of staying agile, receptive, and customer-centric. These lessons served us well as we successfully scaled our product-market fit in 2023 despite the headwinds of an uncertain economic landscape. Today, as we announce our $37M Series B funding led by Stephen Ward at Insight Partners, I am grateful for the incredible team that made this possible. Their resilience, creativity, and unwavering commitment to our mission have driven our success. This funding is not just a financial milestone; it’s a testament to the trust our customers place in us and our product’s impact on their lives. From healthcare providers protecting patient data to critical infrastructure operators securing their systems, Elisity empowers organizations to stay ahead of cyber threats and build a more resilient digital future. We’re proud to be their partner on this journey and remain dedicated to delivering innovative solutions that meet their evolving needs. We wouldn’t be here without our seed-round investment from Brian Long and Andrew Smyth at Atlantic Bridge and Series A from Michael Goguen at Two Bear Capital and Spencer Tall and Michael Feiertag at AllegisCyber Capital. Or our early customers, who were our north stars like Michael Elmore and Jeff Binkley at GSK, Nathan Phoenix at Southern Illinois Healthcare, and Max Everett at Shaw Industries. I’m grateful for our fantastic leadership team: James Winebrenner, Brent Colwell, Brian Thompson, Pete Doolittle, Piotr Kupisiewicz, and Marty Overman (in the order of initiation). While there are too many others to mention individually, I want to express my heartfelt thanks to the Elisity team and everyone who has contributed to our success. Your hard work and dedication have been instrumental in bringing us to this milestone moment. The best is yet to come for Elisity, and we want you to be a part of it. If you’re looking for a partner to help you stay ahead of cyber threats, request a demo and see firsthand how Elisity can empower your organization. And if you’re a marketing superstar looking to make a real impact, join our killer team and help us write the next chapter of our success story.

190

29 Comments

Bookmark this talk. Every security leader eventually gets pulled into layoffs and often they are expected to hold everything together. This talk by Kane N. has spectacular advise on how do it all end to end without being an asshat.

17

A shrewd move by Trinsic, and just in time. I predict huge success, kudos all around. IMO it takes them officially out of the SSI game, at least as a direct creator or driver of it. Riley Hughes has been clear, they’ve given every chance they could before needing to pivot to greener pastures, and this appears to be an excellent pivot. My POV: SSI will still happen, but indirectly as a result of other things gaining traction beforehand, such as organizational identity, GLEIF’s vLEI, EU ID, etc. As a platform of platforms, Trinsic will still be positioned well to provide verification services for those services as they come along, enabling Trinsic to still help facilitate true SSI when the world is finally ready for it, and thrive in the meantime. Shrewd indeed. Bravo, Riley, Michael, and the rest of the Trinsic team!

32

4 Comments

The potential exposure of secrets due to these findings is very significant and long-term, and the implications for secure coding practices are clear - you should NEVER hard-code secrets in code, not even once, not even if you overwrite it immediately after comitting it. It might continue to lurk in the underlying filter where malicious actors will find it.

15

18 months ago, a security startup's funding was a competitive advantage. However, the recent acquisition talks between Wiz and Lacework prove that the value of your product now trumps the size of your war-chest. Check out the details of this $150-200 million deal in TechCrunch's latest article. #startup #cybersecurity #funding #acquisition

10

As compliance executives, you're often caught in urgent tasks, leaving little room for strategic thinking. This week, I've stepped back to spend time with my three children, reminding me of Stephen Covey's principle: "Sharpen the saw." Covey's habit emphasizes renewing ourselves to maintain effectiveness, crucial when governing complex AI management systems. Here's why stepping back is essential: 1. Gaining Clarity Stepping away from daily tasks gives us fresh perspective. This break allows me to refocus on what truly matters. It's easy to get lost in minutiae, but taking a break helps us see the bigger picture. Actionable Insight: Schedule regular retreats. Reflect on your AI management system goals. What do you want to create? What values guide you? This aligns with ISO 42001 clause 4.1 on understanding context, and 6.2 on AI objectives. 2. Enhancing Objectivity Distance brings objectivity. When we're too close to our work, it's hard to see flaws. Time away helps us evaluate strategies critically. Actionable Insight: Encourage a culture where team members review their work objectively. Foster an environment valuing personal renewal. This supports clause 9.2 on internal audits and 10.2 on corrective action. 3. Focusing on What's Important This break reminds me that what's most important isn't always urgent. For you, this means building a responsible AIMS rather than getting bogged down in every immediate issue. The tyranny of the urgent is just that…tyranny. Actionable Insight: Prioritize tasks aligning with long-term goals. Delegate or defer less critical tasks. Regularly review priorities. This relates to clause 5.1 on leadership and 6.1 on addressing risks and opportunities. 4. Renewing Energy and Creativity Time away rejuvenates us, leading to renewed energy and creativity. This renewal is critical for tackling complex compliance issues and innovative problem-solving in AI management. Actionable Insight: Integrate recharging activities into your routine. Find what renews your energy and practice regularly. This supports clause 7.1 on resources and 7.2 on competence. This week away is reaffirming the importance of stepping back. It's helping me rethink priorities and refocus on creating what matters most. I encourage you all to take time for renewal. It benefits you, your systems, and your teams. By taking time to sharpen our saw, we can: 1. Better understand our organization's context and stakeholder needs (clauses 4.1 and 4.2). 2. More effectively lead and commit to the AI management system (clause 5.1). 3. Improve our planning for risks and opportunities (clause 6.1). 4. Enhance our resources and competencies (clauses 7.1 and 7.2). 5. Strengthen our operational planning and control (clause 8.1). 6. Conduct more insightful performance evaluations (clause 9). 7. Drive continuous improvement (clause 10). If you'd like to discuss further, please don't hesitate to reach out…next week…😊 A-LIGN #iso42001 #TheBusinessofCompliance

16

Discipline. Focus. Obsessive attention to delivering value to customers by getting them into production at light speed. Solving their business problems at massive scale. The list of reasons that gold standard investors want to be a part of Traceable’s story is long. A lot of companies in security solutions are struggling to score a financial lifeline or find a viable exit path - it is rough out here. But, Traceable is clearly here for the long haul. Results always bear out the truth - and our results are truly speaking for themselves. Proud and humbled to be a part of this incredible management team and company.

30

1 Comment

Re: James' comment on "blind spots", if IT and security teams famously don't always communicate well, I would argue the visibility & communication gap between engineering and security is often greater.....and that is one of the core industry challenges we're tackling at Pangea. We want to make it easy for developers, engineering leaders, appsec, and security leaders to speak the same common language and have visibility into the functionality, configuration, and performance of critical security functionality like authorization and audit logging in their applications.

1

I recently posted about the importance of using FIDO2 Security Keys (e.g., yubikey) for improving security and making it easier on your users. Today NIST put out a supplemental white paper allowing the use of Passkeys (for AAL2 not 3). They are called synchable authenticators, because unlike hardware keys, the private keys can be synced across multiple devices using cloud services (like iCloud, 1Password etc). Previously, this was against NIST 800-63 guidelines- only hardware-based keys were allowed before. They rightly state that in order to use synchable authenticators, certain protections should be in place such as controlled device enrollment, device assurance, and ensuring the keys are protected locally using a PIN/password or biometrics. While there are certainly trade offs to using passkeys over hardware keys, this is a huge step forward for lowering the barrier of entry for FIDO2 adoption. #LetThereBePassKeys

6

1 Comment

One of the very powerful ways to communicate the need for budget is to provide a concise story. There is no way better to do this than through risk scenario based story telling. Need help with budget justification? We live for these dialogues. Going it alone? Make it personal.

2