Jose Lagdameo Jr., MSCIA, CISSP, CCSP, CISM, CRISC

In cybersecurity, the work never happens in isolation. Periodic maturity reviews of your strategy are essential to ensure tools are delivering value, processes are optimized, and teams are empowered. This proactive approach helps identify areas for improvement and drives a resilient, forward-looking security posture. It’s about more than reacting—it’s about being ready for what’s next. #CISO #Cybersecurity #TeamEmpowerment

4

1 Comment

Technical skills gaps exacerbate challenges in IT. As technology evolves rapidly, the demand for specialized technical expertise often outpaces the supply of skilled professionals. This gap can lead to difficulties in implementing and maintaining complex systems, addressing cybersecurity threats, and leveraging emerging technologies effectively. Bridging these skills gaps requires ongoing training and development, strategic workforce planning, and fostering a culture that values continuous learning and adaptation to technological advancements. Would you agree? #TechSkills #SkillsGap #TechTrends #Innovation #Culture

5

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

"Human Risk Management" starts with detecting and measuring human #security behaviors and risks. The management comes in by educating and enabling the workforce to protect themselves and their organization against cyber attacks, building a positive security culture. While far from the only focus, AI has brought about fun new trends to consider. Good piece by Dan Lohrmann.

6

The LinkedIn Learning roadmap "𝐈𝐦𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐘𝐨𝐮𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐨𝐝𝐞𝐥𝐢𝐧𝐠 𝐒𝐤𝐢𝐥𝐥𝐬" includes courses to enhance security professionals' threat modeling capabilities.. 𝐎𝐯𝐞𝐫𝐯𝐢𝐞𝐰 This learning path is around the STRIDE threat modeling framework. Each course in the series delves into one of these categories, providing learners with the tools and knowledge to identify, analyze, and address these threats effectively. 𝐈𝐧𝐬𝐭𝐫𝐮𝐜𝐭𝐨𝐫 Adam Shostack guides the learning path. He brings extensive experience as a consultant and author and provides valuable insights and practical approaches throughout the courses. 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠 𝐨𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐬 The learning path establishes a robust foundation in threat modeling principles and practices. Using the STRIDE model to identify and analyze critical security vulnerabilities, participants will acquire comprehensive skills and practical experience applying threat modeling to secure products and services effectively. 𝐂𝐨𝐧𝐭𝐞𝐧𝐭𝐬 The program includes six courses that cover threat modeling, from foundational principles to specific threats. The first course introduces the principles of threat modeling. Subsequent courses explore specific aspects, such as identity spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each course provides techniques, security risks, and countermeasures to address cybersecurity challenges effectively. 𝐂𝐨𝐧𝐜𝐥𝐮𝐬𝐢𝐨𝐧 This learning path is crucial for diverse professionals who want to enhance their knowledge of threat modeling. It offers a structured approach to comprehending cybersecurity threats and the best practices for handling them. It is valuable for those in security architecture, software development, and IT security management roles who aspire to build or improve their threat modeling capabilities. #threatanalysis #threatmodeling #stride #security #cybersecurity

6

🔐 Cybersecurity and Supply Chain: The Dynamic Duo! NIST CSF GV.SC-09 🔐 Ever think about how your favorite superhero gadgets come together? Behind every great tech product is a supply chain, and keeping that chain secure is just as important as locking down your own organization. That’s where NIST CSF Subcategory GV.SC-09 steps in, making sure supply chain security practices are baked right into your cybersecurity and risk management programs. What does that mean? It’s like making sure your superhero tools (aka tech products and services) are secure from day one—and you don’t just set it and forget it. You’re constantly monitoring how things perform throughout their life cycle, keeping a sharp eye on any weak links or hidden villains. For the newbies, the NIST Cybersecurity Framework is your go-to guide for reducing risks and protecting your organization. GV.SC-09 helps you integrate supply chain security into your big-picture strategy—ensuring that your partners, vendors, and suppliers are as secure as you are. 🌐 In the world of cybersecurity, a strong supply chain equals a stronger defense. So, why not make it a key part of your risk management strategy? Because after all, teamwork makes the dream work! #Cybersecurity #NISTCSF #SupplyChainHeroes #RiskManagement #Teamwork

10

Great points and steps are covered and very informative.

15

6 Simple Steps to Eliminate SOC Analyst Burnout The current SOC model relies on a scarce resource: human analysts. These professionals are expensive, in high demand, and increasingly difficult to retain. Their work is not only highly technical and high-risk, but also soul-crushingly repetitive, dealing with a constant flood of alerts and incidents. As a result, SOC analysts often leave in search of better pay, the opportunity to move beyond the SOC into more rewarding roles, or simply to take much-needed breaks. This high churn rate puts the SOC in a vulnerable position, jeopardizing the overall effectiveness of cybersecurity operations. To keep your team resilient and maintain operational efficiency, it's essential to take proactive steps to reduce burnout and improve retention. Here are five strategies that can make a difference. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

2

💡 Highlights from the IANS Boston Information Security Forum On November 21st, I had the chance to attend the IANS Boston Information Security Forum — a day packed with insights, connections, and inspiration. The keynote, "The Fragility Factor: Lessons from Recent Cybersecurity Failures," by Tarah M. Wheeler, was packed with eye-opening insights. It was a great reminder of how quickly things can go sideways in cybersecurity and how we can better prepare for the unexpected. One of my favorite sessions was the "Executive Workshop for Senior Leaders: Preparing for the CISO Role." Jessica Hebenstreit and Russell Eubanks did a fantastic job breaking down the challenges (and opportunities!) of the CISO role, sharing real-world advice that's both practical and inspiring. As someone passionate about building impactful security programs, I left with fresh ideas and renewed focus. And of course, the best part of any forum — meeting and connecting with fellow cybersecurity leaders. Sharing stories, swapping ideas, and just chatting with others who are as passionate about resilience as I am made the whole experience even better. A big thanks to IANS and everyone who made it such a valuable and enjoyable day. Can't wait to put these insights into action — and keep the conversations going! #Cybersecurity #Leadership #IANSForum #Networking

81

2 Comments

Ransomware attacks are escalating at an alarming rate, with 24% of data breaches attributed to these sinister schemes. The anatomy of an attack often begins with a simple phishing scam or exploited software vulnerability, snowballing into catastrophic data encryption and extortion demands. To stay ahead, organizations must prioritize proactive defense measures, including robust backup systems, patch management, and employee education. By weaving cybersecurity into the fabric of business operations, leaders can mitigate risk and safeguard their digital landscape. #Ransomware #Cybersecurity #Breaches

9

CISA Details Red Team’s Activity Including TTPs & Network Defense A comprehensive Red Team Assessment (RTA) was conducted recently by the Cybersecurity and Infrastructure Security Agency (CISA) on a critical infrastructure organization in the United States. This assessment, which spanned approximately three months, aimed to evaluate the organization’s cybersecurity detection and response capabilities by simulating real-world threat actors. The CISA red team operated without prior knowledge of the organization’s technology assets and began by conducting open-source research on the target organization. Besides this, cybersecurity researchers discovered that their initial attempts at spearphishing were unsuccessful, but they eventually gained access through a web shell left from a previous Vulnerability Disclosure Program (VDP). Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

2

October is Cyber Security Awareness Month. Each week is dedicated to a specific topic that will help #SecureOurWorld This week is focused on password security. Weak passwords can allow cybercriminals to gain access to not only your accounts, but also to your sensitive information. Keep your accounts secure by using long, random, and unique passwords, preferably stored in a password manager. Find more details on good password hygiene below! https://lnkd.in/eMpR2g_a

6

Thanks to John Kindervag for sharing this insightful article debunking major misconceptions about Zero Trust.

5

CISO Tip: Align GRC with Business Goals 📊 Cyber Security GRC should act as a strategic business enabler, not just a compliance exercise. Align your governance, risk, and compliance (GRC) initiatives with business objectives to showcase the value of strong security. Recommendation: Regularly review business goals alongside risk assessments to ensure your security framework supports innovation while minimizing risk. Engage business leaders in GRC discussions to embed cybersecurity into the company’s DNA. Note: Dears Cyber Professionals, make this tips fruitful and insightful by interacting and commenting. #CISO #Cyber #Cybersecurity #GRC #Strategy #Governance #Risk #Compliance

18

What’s next after the CISO role? As cybersecurity evolves, the focus is shifting toward roles that integrate advanced technology and strategic leadership. The future may see the rise of Chief Risk Officers with a broader scope, or roles emphasizing cybersecurity in digital transformation and AI governance. Embracing these emerging responsibilities will be key to staying ahead in the rapidly changing landscape of security and risk management. How do you see the role of cybersecurity leaders evolving? #Cybersecurity #CISO #FutureOfWork #RiskManagement #DigitalTransformation #Leadership

9

CISO Tip: Leverage Threat Intelligence for Proactive Defense 🛡️ Effective Threat Intelligence (TI) is crucial for anticipating and preventing attacks. Use both tactical and strategic intelligence to stay ahead of threat actors targeting your industry. Best Practice: Integrate Threat Intelligence feeds into your SOC and Incident Response workflows. Utilize trusted sources like ISACs (Information Sharing and Analysis Centers) and regularly update your TI strategy to adapt to the evolving threat landscape. Collaborate with external partners for broader insights. Note: Dears Cyber Professionals, make this tips fruitful and insightful by interacting and commenting. #CISO #Cyber #Cybersecurity #CTIP #CTI #ThreatIntelligence

35

1 Comment

The Q3 2024 CyberRisk Collaborative report reveals top priorities. To future-proof your strategy: -Integrate risk management into decision-making, automate security controls, and foster cybersecurity awareness. -Invest in AI-driven threat detection, enhance cloud security measures, and develop incident response plans. Why? We can't deny AI/automation within our field anymore. We can discuss its benefits and cons all we want but the one thing we must do: take action. This means building strategies with AI in mind, and harmonizing cybersecurity with business ops, fueling resilience and innovation. #CyberRisk #Strategy #Automation

10

1 Comment

Charlotte IT and Security leaders! If securing OT is your responsibility, you dont want to miss this session. Todd Wiedman and I will be facilitating a great boardroom discussion where everyone can share their pain points and approaches for improving OT security. We hope you will join us! #evanta #otsecurity #cybersecurity #ciso

44

1 Comment