Niloufer Tamboly

SEC Charges R.R. Donnelley & Sons Co. $2.1 Million Fine for Cybersecurity-Related Controls Violations On June 18th, 2024, the U.S. Securities and Exchange Commission announced that RR Donnelley, a global provider of business communication and marketing services, agreed to pay over $2.1 million to settle disclosure and internal control failure charges relating to cybersecurity incidents and alerts in late 2021. This SEC settlement with RRD highlights critical issues around cybersecurity and internal controls. Key findings include inadequate controls over material non-public information (MNPI), heightened insider trading risks, and violations of the Securities Exchange Act of 1934. Key Allegations: - Inadequate controls to prevent MNPI misuse - Insider trading risks due to poor monitoring - Regulatory violations and insufficient disclosure controls Inadequate Cybersecurity Response: - Between Nov 29 and Dec 23, 2021, RRD's internal intrusion system issued numerous alerts. - Alerts were reviewed by a third-party MSSP and escalated to internal cybersecurity personnel. - Despite escalations, RRD failed to take timely action, leading to unauthorized data exfiltration of 70 GB, including personal and financial information of 29 clients. - Issues identified included lack of prioritization, workflow for alerts, and inadequate auditing of the MSSP's performance. - Only after an external company alerted the CISO did the firm respond effectively. How AdvisorDefense Can Assist Registered Investment Advisors (RIAs): We offer a comprehensive suite of services tailored to help RIAs meet SEC regulations and bolster their cybersecurity defenses. Our mission is to empower RIAs with the necessary tools and expertise to navigate the cybersecurity landscape, ensuring compliance with regulatory requirements and protecting client information. By partnering with AdvisorDefense, RIAs can enhance their cybersecurity posture, ensure compliance, and protect their clients from evolving cyber threats. Protect your clients. Maintain your reputation. Ensure compliance. Contact us to learn more about how we can support your firm. https://lnkd.in/eVKtr3_x #Cybersecurity #SEC #Compliance #RIAs #AdvisorDefense #CyberRiskManagement #FinancialServices #RegulatoryCompliance #CyberThreats #CyberSecurityAwareness #CyberSecuritySolutions

10

1 Comment

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

When planning for your strategy and goals for 2025, it is always good to start with an assessment that assists you in identifying and prioritizing your gaps and then building out a roadmap. Infostream is offering this to our customers to help them build out their Cybersecurity Strategies. If you are interested in improving your cybersecurity posture in 2025, please reach out to us. #Infostream #Cybersecurity #Cyberassessment #AI #HPC #NIST #ISO #SecurityBestPractices

11

1 Comment

My RSA Conference book of the month review: Internal Policies for Artificial Intelligence Risk Management, by Charles Cresson Wood, JD,MBA,MSE,CISSP,CISM,CGEIT,CIPP,CISA.   This excellent book helps ensure AI is done in a manner that doesn’t introduce unneeded risk to your organization.   https://lnkd.in/g7GRcW9J

5

1 Comment

⚠ Areas of Overlap and Gaps between AICPA SOC2 Trust Services Criteria (TSC) and ISO 42001 - PART 2⚠ -Questions for Realistic Controls Cross Mapping- ❓ Scoping 1. What are the specific AI systems and components within the organization’s scope? 2. What are the boundaries and applicability of the AI management system within the organization? 3. What external and internal issues are relevant to the organization's AI systems? ❓TSCs Included in Scope 1. Which TSC criteria are relevant to the AI systems? (Security, Availability, Processing Integrity, Confidentiality, Privacy) 2. How do the TSC criteria map to the specific AI controls and requirements in ISO 42001? ❓Detailed Cross Mapping Questions 1. Governance and Accountability: ◾How does the organization’s governance structure ensure accountability for AI systems (ISO 42001, Clause 5.1 and AICPA TSC, Common Criteria)? ◾What roles and responsibilities are defined for AI systems, and how do they align with TSC criteria? 2. Risk Management: ◾How are AI risks identified, assessed, and mitigated (ISO 42001, Clause 6.1.2, 6.1.3 and AICPA TSC, Risk Assessment and Mitigation)? ◾How are AI impact assessments integrated into the risk management process? 3. Security and Confidentiality: ◾What controls are in place to ensure the security and confidentiality of AI systems (ISO 42001, Annex A controls and AICPA TSC, Security, Confidentiality)? ◾How is the integrity of AI data and systems maintained? 4. Monitoring and Evaluation: ◾What monitoring and evaluation processes are in place for AI systems (ISO 42001, Clause 9.1 and AICPA TSC, Monitoring of Controls)? ◾How are performance and effectiveness of AI systems measured and reported? 5. Ethics and Fairness: ◾What measures are in place to ensure ethical use and fairness of AI systems (ISO 42001, Annex A controls)? ◾How are bias and ethical considerations integrated into AI system development and deployment? 6. Documentation and Communication: ◾What documentation is maintained for AI systems (ISO 42001, Clause 7.5.1 and AICPA TSC, Information and Communication)? ◾How are AI policies, procedures, and impact assessments documented and communicated? For those of you who currently carry SOC2 attestation that are considering pursuing ISO42001 certification, please know that while the frameworks don't necessarily directly align, you will find ways to repurpose existing controls (administrative and technical) if you ask the right questions in context. As always, if you need help getting started, please reach out! A-LIGN #AICPA #SOC2 #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

14

4 Comments

We did something new (for us) in the latest edition of the Information Risk Insights Study (IRIS) that focuses on #ransomware - we projected financial losses. Normally, we restrict ourselves to known publicly-reported losses. But in this case, we felt that wouldn't do proper justice to the true impact of ransomware on the economy. But don’t worry—we didn't abandon our core principles and ride the trolley into the Neighborhood of Make-Believe. We took the data we had on ransomware losses over the last five years, fit a distribution, and then applied properly sampled values to incidents that had no loss info on public record. Using this method, we calculate the total financial losses from publicly known ransomware incidents over the last five years to be about $274 billion dollars. How does that fit with your intuition or analysis? Too high? Too low #cyberrisk #cyberattacks Read the full report, sponsored by CISA, here: https://lnkd.in/eWEnwj8n

91

7 Comments

Friends of LinkedIn, I have a question and I need your feedback... Is there a demand for conditioning your FSI teams on fraud scenarios? Fraud scenarios are rapidly evolving and I’m testing appetite in where there is value in creating structured simulations and/or training programs to: --> Enhance situational awareness across fraud --> Improve incident management --> Strengthen resilience under pressure What do you reckon friends? Would love to hear your thoughts! 😀

12

2 Comments

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

34 Comments

Who attended our threat briefing with KPMG covering Scattered Spider's cloud and on-premise TTPs?? What did you think? If you weren't able to join us for the briefing, ping me and I can share the recording! Crucial for the community to know the TTPs we have identified to hunt for in your IaaS, SaaS, CI-CD, IDP environments. TTPs are increasingly being copied and used by other threat actors. DM me to see our Scattered Spider battle-tested Cloud Detection and Response (CDR) platform live in action or for details on our no-cost CloudSec Health Check (will uncover activity other solutions like CSPMs and SIEMs consistently miss)

1

Most Organizations Not Prepared For Upcoming CISA Software Compliance Deadline A recent survey has revealed a concerning trend: a staggering 80% of organizations are not ready to meet the CISA's Secure Software Development Attestation Form deadline on June 11, 2024. This form, a critical component of Executive Order 14028, mandates software producers working with the U.S. government to confirm the deployment of key security practices. The implications of non-compliance are severe, ranging from legal and financial penalties to increased susceptibility to cyberattacks and reputational damage. Despite the urgency, 84% of companies have not implemented Software Bills of Materials (SBOMs) into their development process, a requirement made mandatory over three years ago. The survey, conducted at RSA Conference 2024, also highlights a lack of awareness, with 65% of security professionals admitting they have never heard of EO 14028. With software supply chain attacks impacting over 2,700 organizations in the U.S. last year alone, the need for immediate action has never been more critical. #Cybersecurity #CISA #Compliance #SoftwareDevelopment #RiskManagement

7

Elevate your cybersecurity strategy in 2024 with Deloitte's Annual Cyber Threat Trends Report. Uncover key insights on ransomware, emerging malware, and threat actors. Stay informed, stay secure. #CyberSecurity #AnnualCyberThreatTrends #DeloitteCTI #CyberRisk https://deloi.tt/3xewujX

4

𝗣𝗿𝗲𝗽𝗮𝗿𝗲𝗱𝗻𝗲𝘀𝘀 𝗶𝘀 𝗸𝗲𝘆 𝗶𝗻 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲. Try this 𝗙𝗶𝘃𝗲 𝐬𝐭𝐞𝐩 𝐜𝐨𝐧𝐭𝐚𝐢𝐧𝐦𝐞𝐧𝐭-𝐟𝐨𝐜𝐮𝐬𝐞𝐝 𝐚𝐩𝐩𝐫𝐨𝐚𝐜𝐡 provided by our Digital Forensics & Incident Response Team. It might just change how you handle cyber threats moving forward. 𝗦𝘁𝗲𝗽 𝟭: 𝗗𝗲𝘁𝗲𝗿𝗺𝗶𝗻𝗲 how critical systems' availability impacts your business operations. Identify any financial implications. 𝗦𝘁𝗲𝗽 𝟮: 𝗘𝘀𝘁𝗮𝗯𝗹𝗶𝘀𝗵 explicit guidelines on who has authority to make containment decisions and document all key decision points in your incident response plan. 𝗦𝘁𝗲𝗽 𝟯: 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 effective isolation strategies, such as isolating affected systems or using EDR solutions to minimize network traffic while allowing continued investigation. 𝗦𝘁𝗲𝗽 𝟰: 𝗠𝗮𝗶𝗻𝘁𝗮𝗶𝗻 comprehensive documentation throughout the process to ensure every decision and action is recorded for future audit and lessons learned evaluations. 𝗦𝘁𝗲𝗽 𝟱: 𝗥𝗲𝗴𝘂𝗹𝗮𝗿𝗹𝘆 𝗲𝘃𝗮𝗹𝘂𝗮𝘁𝗲 and update your incident response strategies based on post-incident reviews to continuously improve your containment effectiveness. 𝗣𝗿𝗼 𝘁𝗶𝗽 𝟭: Pre-define when to isolate or shut down systems to avoid improvisation during a crisis. 𝗣𝗿𝗼 𝘁𝗶𝗽 𝟮: Clearly delegate decision-making authority to avoid ambiguity during containment processes. 𝗣𝗿𝗼 𝘁𝗶𝗽 𝟯: Keep your documentation precise to streamline post-incident analysis and future incident handling improvements. You can't control the nature of every cyber threat, but you can manage your response by being prepared and organized. Watch the full video → https://lnkd.in/erfxushf ---  🛡 I'm a blue team leader and proudly work for SecurIT360, an MSSP focused on cyber protection at every level. Follow, connect and make it tough for bad guys to succeed.

1

Session A3 at the #APICybersecurity conference included excellent presentations on OT cyber-physical risk assessments & OT cybersecurity compliance audits. Both presenters made great points individually but I was disappointed that the panel didn't have an opportunity to discuss how these activities should be coordinated. Ideally, results from compliance gaps assessments should inform risk assessments, and the results from risk assessments should inform the roadmap to address high-risk gaps. At Armexa, we call this coordinated approach a "3D" cybersecurity assessment because it studies the system/facility from 3 viewpoints: 1. Validated system design review 2. Compliance gap assessment 3. Consequence-based risk assessment per ISA/IEC 62443-3-2 (e.g., #CyberPHA, #CyberHAZOP, or #CyberBowtie methodologies) The activities are coordinated and the results are integrated, giving management the "big picture" on which compliance gaps are most urgent to address (i.e., offer the greatest risk reduction). #API, #APICybersecurity, #OilandGas, #OilandGasCybersecurity, #OTCybersecurity, #OT, #Cybersecurity, #ISA62443

17

2 Comments

🔔 CMMC 2.0 Update: Get Ahead of the Curve 🔔 The CMMC 2.0 rule is on #track to be finalized by October 2024, with third-party assessments starting shortly after. If you're part of the Defense Industrial Base (#DIB), now is the time to ensure your organization is prepared for the new cybersecurity standards. Key Focus Areas: Security Audit: Conduct a thorough review of your current practices and map out any gaps to CMMC requirements. Early assessment is critical for a smooth certification process. Expertise: Many teams face resource constraints. Consider bringing in external support to assist with preparation and implementation. Documentation: Start organizing and updating your security policies and procedures to prevent delays during the assessment. Being #proactive now can save your organization from compliance #challenges and #secure DIB contracts. Not sure how to get started, let our #Federal Compliance experts at Concertium help guide you through a successful audit! #CMMC #Cybersecurity #Compliance #DefenseIndustry

4

Cybersecurity Snapshot: After Telecom Hacks, CISA Offers Security Tips for Cell Phone Users, While Banks Seek Clearer AI Regulations http://ow.ly/hKiE105WiMo

8

NIST Report on the 2024 Accordion Cipher Mode Workshop

3

The European Union's Digital Operational Resilience Act (DORA) mandates heightened focus on third-party risk, resilience, and testing for financial entities. The new regulations bring technical controls ambiguity, necessitating a comprehensive understanding of cybersecurity frameworks for compliance. Organizations need to prioritize aligning with DORA requirements, enhancing their resilience strategies, particularly in assessing and managing third-party risks and conducting regular testing. Stay ahead by proactively addressing technical control challenges to strengthen operational resilience and maintain regulatory conformity in the evolving cybersecurity landscape.

2