Candice Moschell, CISSP

Protiviti's Alex Meyer will join a Fastpath webinar on “Security Gotchas - Fix Them First or Fix.” Learn about common pitfalls and best practices to build a rock-solid security posture and future-proof your business.

4

As a recovering software engineer, I'm excited to present "The Privacy and Security Risks of 'Citizen Development'" at the Greater #Cincinnati ISACA Chapter May 7th, 2024. While no-code and low-code tools can supercharge your #software development efforts, they bring #privacy and #security risks that must be addressed. Security and delicious ribs, how can you beat that? Get the details and register at the link below. Hope to see you there! #citizendevelopment #cybercrime #cyberwar #infosec #softwaresecurity #code #lowcode #nocode #SBOM #cybersecurity #ISACA

11

Analyzing Phishing Email Headers: Protect Yourself from Online Scams Discover how to analyze phishing email headers in this informative video. Learn how to identify urgent or alarming language, generic greetings, suspicious links, and more. Stay safe from online scams and protect your personal information. #OnlineSafety #PhishingScams #EmailSecurity #CyberSecurity #ProtectYourself #StaySafeOnline #PhishingAwareness #OnlineScamPrevention #EmailFraud #InternetSafety

8

Hopefully you a process to frequently assess your organization's cyber risks. ⚠️ If you don't currently have process in place, and you should, here's 6 Types of Risk Assessment methodologies and their use case. 📝 Feel free to reach out if we can point you in the right direction🤝 #cybersecurity #nonprofit #riskassessment

1

So, you want to be CISO. This will be a reoccurring post of the job requirements of a current CISO.  We will cover: Education Experience Leadership Skills Technical Expertise Risk Management Skills Communication Skills Regulatory Compliance Knowledge Continuous Learning Certifications Part 1. Let’s cover education today.  The minimum requirement for a CISO is a bachelor’s degree, preferably in a technical program (Computer Science, Engineering, or Informational Technology).  Showing that you have a bachelor’s degree in business administration will not get you the job, brutal but true.  The larger the company you want to work for generally has either a Masters or even a PhD requirement.  Some companies will substitute a long leadership career where you have shown constant upwards movement for higher levels of education. The key is that you must show that you have the educational background to be able to communicate and learn new technologies on a constant basis.  The Cybersecurity field is ever changing, it is accelerating with new technologies, such as ML and AI and will not stop changing.  If you do not show that you are capable of learning and mastering constantly new technologies then this is not the job for you. What may be of interest is that an MBA has a long way to go with acquiring the position.  CISO’s must not only understand the technical side, why buy what, but also managing a budget that can be very tight to what the organization needs. How much can I spend on what and what should we do first. You will be expected to attend technical conferences to understand what the next “Big” thing is and how it may fit into your organization. Network with fellow CISO’s to understand what they are doing in your vertical and how they are managing their budget. This life of a CISO is no easy and never will be.  If you have the wherewithal to meet the requirements above, I encourage you to go for it.

5

Keep it as simple as possible. Scoping for a CMMC audit can feel daunting, but a good chunk of the work is all about preparation and continuous, incremental improvement. Here are a few things you can do now: 1. Start Small and Build Out - Don't try to implement everything at once. 2. Proper Scoping - Avoid the mistake of putting your whole company in scope. 9 times out of 10, your whole company won't be in scope. 3. Operationalize - Make sure the team knows their responsibilities and that the environment is configured as prescribed in your System Security Plan (SSP). 4. Documentation - Keep your CMMC documents up-to-date, dust-free, and ready. They're your friend and guide for your day-to-day CUI activities. 5. Stay Ahead - With CMMC 2.0 upon us, prepare now. At SecureStrux, we learned through our own experiences during our Level II assessment and can apply what we have learned as consultants to help others. We know what it takes to secure an enclave for CUI and the processes, procedures, and documentation required. If you need a team that can bring real-world experience to the CMMC certification process, please don't hesitate to reach out!

17

Just in - CISA publishes Encrypted DNS Implementation Guidance for Federal Agencies to enhance cybersecurity and protect sensitive data. Stay ahead of the curve with this important resource: https://lnkd.in/eMeN-uxt #cybersecurity #CISA #encryptedDNS

2

Cybersecurity assessments of safety equipment and communications are extremely important. I’ve tried to align detailed requirements from ISA/IEC 62443 with the SANS ICS 5 Cybersecurity Critical Controls. Please let me know your thoughts and insights on this topic. https://lnkd.in/gyezspbv

29

3 Comments

Gearing up for an ISACA certification exam and looking for efficient and effective ways to prepare? Biruk Worku shares five tips in this @ISACA newsletter article. Read on and set yourself up for success! https://lnkd.in/gxtmPVEn

69

1 Comment

My book 📚 "Incident Response with Threat Intelligence" is also included in this promotion 🤓

65

7 Comments

As I previously posted, I’m struggling with PCI 4.0 Targeted Risk Analysis(TRA) process on frequency. The frequency on certain activities like vulnerability scanning and user access reviews are already determined by Corporate Policy, not a TRA. And some of these are “influenced” by other regulatory requirements such as SOX - must conduct quarterly user access reviews. Maybe a TRA would be a better approach to determining frequency, but I already have standards. What does the TRA contribute to an existing standard? One could argue that the TRA supports that standard but in reality I think it leads us to a foregone conclusion that quarterly is sufficient. I may end up with some type of TRA word salad that validates whatever frequency that the Company standards dictate. I’m still working on it, version 5. But I think having supporting Corporate Standards allows me to examine the risks of not complying with the aligned standards is the best approach to produce a TRA. Unless I go to version 6, which is unknown at this time.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile is in the public comment phase. If you have an interest in cyber IR and you haven't read rev. 3, it's well worth a look. https://lnkd.in/g8bQ_5Bp #dfir #nist Nearshore Cyber

9

In February of this year, the National Institute of Standards and Technology (NIST) published a major update to their Cybersecurity Framework (CSF) document. Amongst the various changes was an increased emphasis for organizations to strengthen IAM, PAM and cloud security practices. Check out our most recent blog post to learn more about the updates in NIST CSF 2.0 and the steps your team can take to adhere with these revised standards. https://lnkd.in/gnZC-Xya

8

New blog on CMMCAudit. This one is real basic, but has a few tidbits that might be interesting for you experienced cybersecurity folks. Some excerpts from the article... Assessments are priced by the complexity of your environment: having physical facilities, lots of users, or development labs can increase the price significantly. The sales team will normally offer a fixed-price quote and should be able to explain timing as well as what to expect. What is a red flag that you aren't ready? No one on the team has done it before. Book learning is way different than real life. Passing a certification test is nice, but it doesn’t compare to the experience of building and maintaining an information system that meets all 320 objectives (110 requirements). Having someone on your team who has experienced a formal assessment on either side (assessor or assess-e) is the best indication you will pass. #CMMC

45

10 Comments

#PenTesting should sit in internal audit. Our #cybersecurity specialist explains why – and how to set up this arrangement. https://bit.ly/4c1lB3T

17

1 Comment