Ron Sharon

Do you need to be CMMC Level 2 compliant, but are having trouble translating the cybersecurity gobbligook into real actions that your IT team can take? We are having a live webinar on June 27, 2024 at 2pm EST to demonstrate the Kieri Compliance Documentation. This is a full-featured program for CMMC Level 2 and NIST SP 800-171 compliance which includes policies, procedures, system security plan, user agreements, record-keeping databases, account request form, self-assessment form, and other vital resources needed to be compliant. Monthly Q&As and over 50 hours of video training included. Kieri Solutions uses this program to efficiently manage our CMMC Level 2 compliance. We passed a DoD assessment for CMMC Level 2 and NIST SP 800-171 compliance with a perfect 110 score using this governance program. We have over a hundred clients using the KCD to manage their compliance and prepare for CMMC Level 2 assessment themselves. 𝐃𝐨𝐞𝐬 𝐭𝐡𝐢𝐬 𝐬𝐨𝐮𝐧𝐝 𝐥𝐢𝐤𝐞 𝐲𝐨𝐮? 🔸 You are frustrated with your policies and procedures… 🔸 You don’t know how to perform some CMMC requirements, or how to answer assessment objectives like “define non-essential functions”… 🔸 Your documentation is out of date… 🔸 You bought compliance templates elsewhere and they are too complex to get through… 🔸 You are paying a huge monthly fee to a GRC website and you’re still stuck filling in blanks… 🔸 You don’t have a record keeping system that makes it easy to gather the info you need for assessment… 🔸 Your users are asking how to mark CUI and you don’t know how to help them… If so, please join us for this webinar. We will be showing the program that we use to reach and maintain a "110" score. https://lnkd.in/eRjbVFrD Kieri Solutions - Authorized C3PAO

35

6 Comments

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

32

4 Comments

Are you looking for a strategy to protect your organization from attackers like Midnight Blizzard? Here are two steps you can follow.

2

Had an incredible experience today supporting the ITDRC team at a CISA/FEMA/DoHS preparedness workshop in Denver. If you're interested in joining me and volunteering your expertise during times of crisis, check out https://lnkd.in/dYVhMReM. By leveraging your IT experience and joining a team of skilled professionals, you can make a dramatic immediate difference for hundreds or thousands of people during a crisis by getting communities reconnected and providing first responders with the critical infrastructure needed to support their missions. There are many roles available from networking to logistics, planning and coordination, so even if you can't deploy on site for a disaster, there are still ways to help. And the more volunteers there are, the more flexible we can be in our response. In terms of what you can expect to get out of it, satisfaction from helping your fellow citizens, hands-on exposure to a variety of current comms technologies, experience operating in crisis modes, and exposure to a wide range of corporate, NGO and governmental agencies are all likely outcomes. So if you're looking for a way to make a difference during a crisis, please reach out to me or sign up directly at https://lnkd.in/dYVhMReM. Let's work together to provide our biggest impact when our communities need us the most. #volunteer #IT #disasterresponse #communityimpact #ITDRC

21

3 Comments

Everyone’s really hung up on the materiality and reporting aspects of the SEC requirements around cyber risk management, and rightfully so. But I’m more concerned about “proper” cyber risk management. It’s not enough for organizations to just follow basic control frameworks. they need to think about the larger business impact of their cyber risk management policies. When they adhere only to the basic frameworks, they’re getting systematic identification, assessment, and mitigation of threats, yes, but they may not be thinking in a holistic way about how the framework fits in with their specific business. With proper cyber risk management, however, organizations can move beyond the basic controls, and look at things like threats, vulnerabilities, impact, probability, and underlying resulting residual risk - and then determine if they have the right number of controls to mitigate all those risks. In other words, they’re zooming out to look at the full picture of their business, and prioritizing risk management policies based on business-focused outcomes - not just applying a potentially ill-fitting framework to check a box. Most organizations are off to a great start: they’re meeting their basic cyber risk management requirements by following control frameworks. But to truly protect themselves, they need to upgrade their approach to a more robust risk management approach… one that takes into account overarching business impacts.

19

4 Comments

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

Bad systems and organizations inevitably produce bad leaders. This is especially true in cybersecurity, where incompetent security leaders perpetuate exposed and insecure companies. Organizational psychology often fosters a blind faith in employees' expertise, which blindsides companies before, during, and after cyber incidents. When a company suffers repeated cyber incidents and its CISO and security team fail to address basic security measures, the pattern is clear: further incidents, wasted resources, and possibly, the company’s demise. If a company fails to adapt swiftly to the Internet's demands, echoing Jim Gosler's insights, it will repeat past mistakes. The adage "if you do what you've always done, you'll get what you've always got" rings true. AI and silver bullets are not solutions… The priority must be to prevent access and exfiltration. The first line of defense is where a company connects to the Internet. Access here privides a foothold. When connections, domains, subdomains, DNS records and servers are insecure, they become prime targets for cybercriminals. We must halt the spread of emotional contagion and the acceptance of insecurity being imposed on the world's digital users. The bar for cybersecurity negligence, both internally and externally, must be raised. As tech giants reap billions, their negligence costs the global economy trillions. This model, whether by default or design, is unsustainable. The persistent insecurity of digital infrastructure is unacceptable. Incompetent leaders must be held accountable, and organizations must prioritize robust cybersecurity measures. Companies must re-evaluate their defenses, starting with their Internet connections and DNS security. The financial and reputational damages from cyber incidents are immense, but the societal impact, especially on vulnerable sectors like education, is even more critical. An urgent national and international call to action is needed. Governments, regulatory bodies, and organizations must work together to implement stringent cybersecurity standards and greatly improve their often lacking knowledge. By doing so, we can try to safeguard the digital realm and protect billions of users from the devastating repercussions of cyber negligence. The future of global cybersecurity depends on our collective commitment to preventing and addressing these threats head-on. #WhitethornShield FBI Cyber Division Federal Bureau of Investigation (FBI) The White House GCHQ National Cybersecurity Coordination Center (NCSCC) #InternetSecurity #DNS #PKI

32

1 Comment

Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile is in the public comment phase. If you have an interest in cyber IR and you haven't read rev. 3, it's well worth a look. https://lnkd.in/g8bQ_5Bp #dfir #nist Nearshore Cyber

9

Did you know the average employee received over 180 malware or phishing emails in 2023? Not too surprising as Mimecast Cloud Integrated identified 3.4M risky emails that passed through Microsoft and into employee inboxes. Does your organization have the extra layer of protection you need to stay secure? Not sure? Start your free threat scan today and we’ll show you your company’s risk landscape and identify areas to improve defense.

29

With the latest and greatest #ransomware infection impacting CDK Global and its huge dealer network, I feel like it's a good time to re-share this piece I wrote from 5 years ago. I could have written this today...seems that nothing is changing on this front. #CISO #infosec #CEO #CIO

7

2 Comments

Adoption of a subset of NIST SP800-172 safeguards is a requirement for organizations serving the DIB seeking a Matueity Level 3 CMMC certification. Keep in mind these safeguards are in addition to the full adoption of the 110 safeguards identified in NIST SP800-171. The train is coming! Start your preparation now or… #cmmc

15

If any of these paint points look familiar to you when managing your PCI DSS compliance requirements, you don't want to miss our webinar tomorrow where we show you how we have made these issues a thing of the past when leveraging the Morrisec Risk Platform (MRP). We have poured decades of knowledge and experience gained working on both the client side and consulting with hundreds of organisations into this platform. The benefits are unbelievable, from providing greater returns on your cybersecurity investment, to real-time board visibility of your current security posture, to streamlining your processes and giving time back to your teams so they can focus on more valuable work securing your business. Can't wait to see you tomorrow!!! 😆 https://lnkd.in/gDxwrMMT #cyber #infosec #riskmanagement #compliance

9

Protecting organizational digital value requires an overlay system capable of managing the seven business capabilities required to deliver Trusted, Resilient and Auditable digital outcomes. These digital business capabilities include the ability to Govern, Assure, Plan, Design, Excute, Change and Innovate digital services. This is exactly the problem the DVMS Institute NIST Cybersecurity Framework Digital Value Management Overlay System ( DVMS) was designed to solve. The Institutes Accredited Publications and Certification Training Courses can teach you how. To learn more please visit www.dvmsinstitute.com to watch the explainer videos at the bottom on the home page

10

2 Comments

More than half of open-source projects contain code written in a memory-unsafe language, according to a report from the U.S.’s Cybersecurity and Infrastructure Security Agency. Memory-unsafe means the code allows for operations that can corrupt memory, leading to vulnerabilities like buffer overflows, use-after-free and memory leaks. #opensource #security

2

Analyzing Phishing Email Headers: Protect Yourself from Online Scams Discover how to analyze phishing email headers in this informative video. Learn how to identify urgent or alarming language, generic greetings, suspicious links, and more. Stay safe from online scams and protect your personal information. #OnlineSafety #PhishingScams #EmailSecurity #CyberSecurity #ProtectYourself #StaySafeOnline #PhishingAwareness #OnlineScamPrevention #EmailFraud #InternetSafety

8