Tran Cheung, MBA, CISSP, CCSP, CISA, PMP

SEC Charges R.R. Donnelley & Sons Co. $2.1 Million Fine for Cybersecurity-Related Controls Violations On June 18th, 2024, the U.S. Securities and Exchange Commission announced that RR Donnelley, a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. This SEC settlement with RRD highlights critical issues around cybersecurity and internal controls. Key findings include inadequate controls over material non-public information (MNPI), heightened insider trading risks, and violations of the Securities Exchange Act of 1934. Key Allegations: - Inadequate controls to prevent MNPI misuse - Insider trading risks due to poor monitoring - Regulatory violations and insufficient disclosure controls Inadequate Cybersecurity Response: - Between Nov 29 and Dec 23, 2021, RRD's internal intrusion system issued numerous alerts. - Alerts were reviewed by a third-party MSSP and escalated to internal cybersecurity personnel. - Despite escalations, RRD failed to take timely action, leading to unauthorized data exfiltration of 70 GB, including personal and financial information of 29 clients. - Issues identified included lack of prioritization, workflow for alerts, and inadequate auditing of the MSSP's performance. - Only after an external company alerted the CISO did the firm respond effectively. How AdvisorDefense Can Assist Registered Investment Advisors (RIAs): We offer a comprehensive suite of services tailored to help RIAs meet SEC regulations and bolster their cybersecurity defenses. Our mission is to empower RIAs with the necessary tools and expertise to navigate the cybersecurity landscape, ensuring compliance with regulatory requirements and protecting client information. By partnering with AdvisorDefense, RIAs can enhance their cybersecurity posture, ensure compliance, and protect their clients from evolving cyber threats. Protect your clients. Maintain your reputation. Ensure compliance. Contact us to learn more about how we can support your firm. https://lnkd.in/eVKtr3_x #Cybersecurity #SEC #Compliance #RIAs #AdvisorDefense #CyberRiskManagement #FinancialServices #RegulatoryCompliance #CyberThreats #CyberSecurityAwareness #CyberSecuritySolutions

10

1 Comment

Lehigh University understands the critical importance of robust cybersecurity defenses. They implemented Armis Centrix™ for VIPR Pro – Prioritization and Remediation to streamline their efforts and significantly improve their security posture. Learn how Armis Centrix™ helped Lehigh University: - Reduced cybersecurity risks by 40% through effective prioritization and remediation of vulnerabilities. - Enhanced visibility across their network, enabling them to identify and address threats faster. - Achieved faster response times to potential threats, minimizing potential damage. Read the full case study now: https://bit.ly/4755Ln5 #Armis #ArmisCentrix #VulnerabilityManagement #VulnerabilityPrioritization #Cybersecurity

15

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

We did something new (for us) in the latest edition of the Information Risk Insights Study (IRIS) that focuses on #ransomware - we projected financial losses. Normally, we restrict ourselves to known publicly-reported losses. But in this case, we felt that wouldn't do proper justice to the true impact of ransomware on the economy. But don’t worry—we didn't abandon our core principles and ride the trolley into the Neighborhood of Make-Believe. We took the data we had on ransomware losses over the last five years, fit a distribution, and then applied properly sampled values to incidents that had no loss info on public record. Using this method, we calculate the total financial losses from publicly known ransomware incidents over the last five years to be about $274 billion dollars. How does that fit with your intuition or analysis? Too high? Too low #cyberrisk #cyberattacks Read the full report, sponsored by CISA, here: https://lnkd.in/eWEnwj8n

91

7 Comments

Concerned about ransomware attacks? Here's what you need to know about the recent activities of the F Society ransomware group: 1. New victims: Learn about the latest targets, including prominent organizations like Bitfinex, Coinmoma, Rutgers University, and SBC Global Net. 2. Threatened leaks: Understand the group's tactics, including sharing sample data and demanding ransom payments within a strict timeframe. 3. Previous incidents: Discover the history of Bitfinex's security breaches and the efforts made by law enforcement to recover stolen funds. Read more: https://lnkd.in/drPscjEr #Ransomware #FSociety #CyberSecurity #hackernews

6

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

*WiCyS Delaware Valley EVENT ALERT!* Join us for Offensive Security War Stories on Tuesday, November 19th. This is a great event for security practitioners looking to improve their ethical hacking skills/knowledge and security leaders who want to understand the innerworkings of penetration testing and real-life tactics that can be used to compromise your organization. #wicys #cybersecurity #informationsecurity #penetrationtesting #ethicalhacking

10

1 Comment

Join us on Wednesday, May 29th at 8:30 AM to discover how CERT Ukraine and CISA work together to combat cyber threats! Limited tickets available - act fast! Link in bio for more details and to get tickets. #CERTUkraine #CISA #CyberDefense #Collaboration #CyberSecurity.

12

I'm excited to share a recent milestone in my journey—passing the NACD (National Association of Corporate Directors) Directorship Certification. This achievement isn't just a personal milestone but a testament to the vital role of continuous learning in leadership and cybersecurity governance. Having been on both sides of the boardroom table, I've seen firsthand how navigating the complexities of modern enterprises requires more than deep expertise in a single domain—it demands a broad, strategic understanding across multiple disciplines. Here are a few key points for those aspiring to board roles or looking to deepen their C-level impact: Broaden Your Horizons: Understand your business beyond the technical details. For those seeking a board seat, look behind simply having cyber experience and to what else you can contribute. Commit to Excellence: Pursue excellence in all you do. Hold yourself to high standards, learn from setbacks, and continuously seek ways to improve—even when things go right! Stay Curious: Keep ahead of industry trends, challenges, and innovations. Staying informed and proactive is crucial for making strategic decisions and fulfilling a director's duty of care. The path to a board role can be challenging but it is also rewarding and can have significant impact. For CISOs looking to improve their board interactions, focus on translating technical details into business impact to enhance your role as a strategic partner. Keep learning. Keep growing.

98

12 Comments

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

The latest National Association of State Chief Information Officers (NASCIO) report shows State cybersecurity budgets are on the rise, but are they growing fast enough to keep up with the evolving threat landscape? The report surveyed state CISOs from all 50 states and the District of Columbia, and focused on five areas: the expanding role of the state CISO, generative AI, inadequate cybersecurity budgets, growing cyber threats and building stronger cybersecurity workforces. “The attack surface is expanding, with the public sector’s reliance on information becoming increasingly central to the operation of government itself,” the report states. “The ability of government to deliver on its mission rests on data—and on the security of that data.” Yet many state IT leaders believe their 2024 budgets remain inadequate, particularly as they face challenges related to staffing shortages, an expanding attack surface, and the increasing threat of ransomware, driven by double-extortion attacks, where criminals both steal and encrypt data. This adds further pressure, making it crucial to bolster cybersecurity defenses while managing it all with limited resources. Are we adequately securing critical infrastructure, or are we heading towards failure? Dig deeper on this topic at: https://lnkd.in/edSkcMxw

35

7 Comments

Help Us Secure Our World this Cybersecurity Awareness Month - Middle Tennessee State University (MTSU) FAST FACTS According to the National Cybersecurity Alliance 2023 Oh Behave! report: 1. 84% of people considered online safety a priority. 2. Only 38% of people use unique passwords for all their accounts. 3. About a third of respondents began using a password manager after receiving cyber training. 4. 79% of respondents were familiar with multifactor authentication. 5. 70% of those who have heard of MFA security measure know how to use it. 6. Only 36% of people always install software updates when they become available. 7. 69% of people express confidence in their ability to identify phishing attempts. 8. 51% of Americans actively report cybercrimes, particularly instances of phishing. October is Cybersecurity Awareness Month, an international initiative that educates everyone about online safety and empowers individuals and businesses to protect their data from cybercrime. Even amidst large-scale data breaches and cyberattacks, Cybersecurity Awareness Month reminds everyone that there are simple, effective ways to keep yourself safe online, protect your personal data, and ultimately help secure our world. Middle Tennessee State University (MTSU) is proud to be a Champion and support this online safety and education initiative this October. The theme of Cybersecurity Awareness Month is Secure Our World! This initiative reminds us that there are simple actions we can take every day to protect ourselves, our families, and businesses from online threats. Cybersecurity Awareness Month focuses on the top four ways to stay safe online: 1. Use strong passwords and a password manager 2. Turn on multifactor authentication 3. Recognize and report phishing 4. Update software Cybersecurity Awareness Month is led by the Cybersecurity and Infrastructure Agency (CISA) and the National Cybersecurity Alliance. For more information about ways to keep you and your family safe online visit https://lnkd.in/gbVrwN7q and https://lnkd.in/guzwsh_8. #MiddleTennesseeStateUniversity #MTSU #ComputerScience #CybersecurityAwarenessMonth #SecureOurWorld

17

A few weeks ago, I wrote a post sharing research breaking down exposures across enterprise and cloud infrastructure. By volume, the majority of exposures affected Active Directory but the most critical exposures were found in cloud environments. (see https://lnkd.in/euvfKvGJ) I wanted to follow that up with a similar view comparing the distribution of critical exposures among different industries. Per the attached chart, about half of the industries shown follow the overall pattern of Cloud > Active Directory > IT/Network devices. But there’s quite a bit of variation and some sectors buck that trend entirely. For example, very few of the critical asset exposures affecting the Energy, Transportation, and Healthcare sectors are in the cloud. On the other hand, the share of critical exposures in cloud environments is much higher than average in the Agriculture and Manufacturing industries. I share this because the diversity and sprawl of the modern attack surface make it difficult to answer seemingly simple questions like "Where are our critical exposures?" And the fact that every industry's or organization's answers will vary makes answering it all the more difficult and important. If you'd like to see more on what we learned from analyzing exposures from tens of thousands of attack path assessments, download the full report from Cyentia Institute and XM Cyber here: https://lnkd.in/dPfqXG7y #exposuremanagement #vulnerabilitymanagement #cyberrisk

40

3 Comments

As the challenge to maintain a flat budget while providing quality protection continues, these actionable steps should be at the forefront of every CISO's mind in 2025. Let's dive into the 4th priority: 4: 🏁💎🔶Prioritize efforts in creating Robust IAM Solutions🔶💎🏁 Disclaimer: IAM is the next perimeter, list is long!!! 💎Centralize identity and access management under a unified platform. 💎Regularly update and patch IAM software to address vulnerabilities. 💎Monitor user behavior with advanced analytics to detect anomalies. 💎Implement just-in-time (JIT) access to minimize exposure risks. 💎Enforce real-time compliance through continuous policy validation. 💎Adopt zero-trust principles to verify all access requests. 💎Develop strong password policies and enforce organization-wide adoption. 💎Educate employees on IAM best practices and security awareness. 💎Enable multi-factor authentication (MFA) for all critical systems. 💎Implement single sign-on (SSO) for streamlined and secure access. 💎Conduct regular access reviews and audits to ensure least privilege. 💎Establish role-based access controls (RBAC) to standardize permissions. 💎Use privileged access management (PAM) tools for sensitive accounts. 💎Automate provisioning and deprovisioning to reduce manual errors- have a strong IGA 💎Integrate IAM with SIEM systems for enhanced monitoring and response. 💎Implement lifecycle management for identities, ensuring timely updates. 💎Train users on IAM best practices. 💎Ensure compliance with relevant IAM standards and regulations. CCing some of my network who collaborated on ideas and also for getting additional thoughts and feedback Vishwas Manral Sunil Arora Sam Pfanstiel, PhD Aradhna C. Arati Chavan Thien La Hemant Kurande Andy Weeks Gehan Dabare Pradeep S. Sandhu 👋☁️🔐

23

13 Comments

Companies that sell software to the federal government or provide IT services, particularly those involved in U.S. critical infrastructure, face evolving regulations. The Cybersecurity and Infrastructure Security Agency (CISA) introduced a "Common Form" for Secure Software Development Attestation, supporting the Office of Management and Budget’s 2022 guidance. This form allows agencies to verify that software producers follow the National Institute of Standards and Technology (NIST) SP 800-218 Secure Software Development Framework. Since June 2024, agencies have required attestation for "critical software," with a deadline for non-critical software on September 8, 2024. The lack of a unified Federal Acquisition Regulation (FAR) rule has resulted in inconsistent requirements across agencies. The General Services Administration (GSA) issued guidance to clarify the attestation process, but not all agencies have done the same, leading to confusion among contractors. Some agencies, including CISA, have directly requested attestations from companies whose software they use. Additionally, some contractors are asking their subcontractors for attestations, even though the Common Form does not mandate this. A FAR rule is under development to provide clarity. Meanwhile, companies should be prepared for requests for Secure Software Development Attestation and review their practices against NIST’s guidelines. Beyond the attestation process, CISA has called for significant changes in software development, emphasizing a shift in costs and liability toward developers. CISA Director Jen Easterly has asserted that the core issue is software quality, not just cybersecurity. The "Secure by Design" initiative has introduced new guidance and alerts on vulnerabilities, and CISA has partnered with the FBI and industry groups to enhance security practices. CISA also launched a voluntary pledge at the RSA Conference, with nearly 200 signers from various sectors. To navigate these changes, organizations should: * Align with the NIST Secure Software Development Framework and CISA’s Secure by Design pledge. The fragmented rollout of attestation requirements complicates compliance for government and commercial customers. * As secure development practices, including Software Bill of Materials (SBOMs), become more common in government contracts, they may also influence enterprise agreements. Non-compliance could lead to risks, especially given the federal government’s use of the False Claims Act to address cybersecurity issues. #cybersecurity #law #SBOM

5

1 Comment

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

🚨 Attention Cybersecurity Professionals in Boston, DC, and Georgia! 🚨 📅 Date: December 18th, 2024 🕖 Time: 7:45 AM - 9:00 AM (Eastern) 📍 Location: Virtual Meeting via Zoom (link sent upon registration) Join us for an exclusive Breakfast Club meeting where Jeffrey Wheatman, an experienced cyber risk leader, former Gartner analyst, and executive advisor, will share valuable insights on how to effectively communicate cyber risk to business leaders. As cybersecurity professionals, we know how crucial it is to translate technical risks into business language that resonates with C-suite executives. Jeffrey will offer 4 actionable tips on how to make your cyber risk communication more effective, ensuring that your message gets heard and acted upon. What to Expect: -4 tips for effective communication of cyber risks to non-technical stakeholders 📊 -Expert insights from a former Gartner analyst and thought leader 💡 -Opportunity to network with professionals across Boston, DC, and Georgia 🤝 This session is a must-attend for anyone looking to improve their cyber risk communication skills. RSVP today to secure your spot! 👉 https://lnkd.in/g3MJ2yA #CyberRisk #CISO #CyberSecurity #BusinessCommunication #CyberBreakfastClub #CyberLeadership #RiskManagement #Networking #BreakfastClub

6

At CMMC Day I presented on preparing for a CMMC Assessment and the importance of guiding the assessment team. One of the most valuable things an OSC can do is prepare and deliver a thorough In-Brief at the beginning of the assessment. The In-Brief provides context to the assessment team so they better understand your business, your environment, the type of CUI you handle, how CUI flows through your organization, who they will interact with during the assessment, and how you manage change.  It helps the assessment team better understand your documentation, what they will be hearing during interviews, and what they will be seeing during examinations.  With apologies to Pete Townshend, the assessment team really needs to know who are you!  #CMMC #CMMCDay2024

20

1 Comment