John Proffitt

Reading about the updated National Cybersecurity Strategy and its five pillars from Colleen Frye It’s crucial for us MSPs to understand these changes as they'll significantly influence our operations and cybersecurity measures. Check out the full breakdown to ensure your services align with these new federal standards. 💬 Let's chat about how we can leverage this strategy to enhance our cybersecurity approaches and lead the way in compliance. #MSP #CybersecurityStrategy #LeadershipInCybersecurity

2

⏮️ This recent webinar presented by Claroty Industry Principal, Healthcare, Ty Greenhalgh, HCISPP, and Ascension Director of Cybersecurity, Skip Sorrels, MSCIA, CISSP, offers new perspectives on #healthcare #cybersecurity and delves into the pervasive #cybersecurity challenges surrounding medical devices. Watch here: https://hubs.ly/Q02vVJ4r0

40

CISA is hosting a webinar on cybersecurity that would be relevant and useful for our members to join. Oregon Stakeholders Session: June 11th, 2024 1:00pm-2:00pm PT Location: Virtual via Microsoft Teams (Link sent upon registration) Registration Link: https://bit.ly/3Re27AM #cybersecurity #ransomware #oregon #publicschools #infosec #security #schools #learning #educationmatters

1

OMB's Cyber Budget Priorities Memo out: "Agency budget submissions should demonstrate how agencies are reducing risk by increasing maturity of information systems across the pillars outlined in the Cybersecurity and Infrastructure Security Agency’s (CISA) Zero Trust Maturity Model." https://lnkd.in/e2dvJU3k

22

4 Comments

I was looking for an open source alternative for a tool this morning and it led to a conversation with a fellow practitioner. Bottom line: the state of open source security tooling seems to be really bad now vs. when we entered the industry 10-20 years ago. It seems more and more tools are built for making a quick buck vs. building a personal brand and seeking the common good of making the internet a safer place. This is not ubiquitous, but it certainly seems to be the trend. When I first got into security, people were all about sharing, networking, and community. This led to wonderful careers where we enjoyed not only financial success, but even more so, relationships and the joy of leaving things better than we found them. I still give the vast majority of the code I write away, but it is becoming increasingly harder to find useful open source tooling. This conversation reminded me of a keynote I gave on a similar topic a few years back. It seems to apply as much today as it did then. https://lnkd.in/eTVBCka9

24

4 Comments

The Recall saga gets even worse. I guess Satya giving that interview and explaining Recall security as "lol trust me bro" isn't really holding up to testing. This company has a lot of trust rebuilding to do and it's doing the exact opposite by burning down what was left. "But let's put it this way: Microsoft is building a feature into Windows that is monitoring and logging a ton of data about you and the way you use your PC. Traditionally, we’d call this “spyware.” "Those who truly hate it will be able to turn it off, though the list of “at least you can uninstall it/turn it off!” things in Windows 11 is getting frustratingly long." "Even if Recall were locked down better, another problem is that Windows 11 has eroded its users' trust and patience over time by endlessly pushing Microsoft's other products and services and refusing to respect user choices once they've been made."

30

13 Comments

history4feed: creates a complete full text historical archive for an #RSS or #ATOM feed. ...and this one is not solely for those working #threatintelligence. https://lnkd.in/eK4Kgiug

8

1 Comment

Change Healthcare (and their parent) are HITRUST, EHNAC and SOC2 certified. I submit, once again, a heavy emphasis on compliance over cybersecurity or cyber risk management. Compliance is not cybersecurity. Period!

9

4 Comments

Who all will be at #RSAC this time? #Friends #colleagues and buddies DM to catch up and hear what interesting things we are doing at Ardent Privacy and would love to hear what you are working on ! For those who have not attended before do plan your meetings/schedule before , it is big conference. Here is link from #RSAC to get an idea.

7

Geisinger, a prominent healthcare system in Pennsylvania, has announced a data breach involving a former employee of Nuance, an IT services provider contracted by the organization. Geisinger is a non-profit organization that operates 134 care sites, ten hospitals, and the Geisinger Health Plan, serving a total of 1.2 million people. It employs 26,000 staff, including 1,600 doctors, and is considered one of Pennsylvania’s most important organizations. An announcement published earlier this week explains that in November 2023, Geisinger detected unauthorized access to its patients’ database by a former Nuance employee. Nuance was promptly informed and took action to block the former employee’s access to Geisinger’s systems holding patient records. “On Nov. 29, 2023, Geisinger discovered and immediately notified Nuance that a former Nuance employee had accessed certain Geisinger patient information two days after the employee had been terminated,” reads the announcement. “Upon learning this, Nuance permanently disconnected its former employee’s access to Geisinger’s records.” Subsequently, Nuance informed the law enforcement authorities accordingly, and the former employee was arrested and charged. According to the company’s investigation, the following information was compromised: Full name Phone number Date of birth Address Admit and discharge or transfer code Medical record number Race and gender Facility name abbreviation The exact data types exposed varies per person, depending on what services they got through Geisinger. This incident did not impact insurance information, credit card details, bank account number, Social Security Number (SSN), and other financial data. It is unclear how exactly the former employee attempted to exploit the stolen data, or if it has been disseminated already to cybercriminals, so potentially impacted people are advised to remain vigilant. Typically, sacked employees who access systems using non-revoked accounts/credentials do so out of spite, aiming to cause reputation and business damage. Geisinger suggests that people who are notified about the breach carefully review their statements and notify their health insurers immediately if they see entries they don’t recognize. Law firm Lynch Carpenter has already announced an investigation on the scope of the incident, exploring the potential for a class action lawsuit against Geisinger. #it #databreach #healthcare #privacy #cybercriminal ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

2

2 Comments

CVE, CWE, NVD—What's the Difference? 🕵️‍♂️🔍 🎯 CWE, CVE and NVD work together to provide a standardized and comprehensive approach to managing and addressing cybersecurity vulnerabilities.

47

Is your current MSP, Cybersecurity, or IT Support company preparing your company to be cyber resilient, or are they stuck in cyberdefense mode? Are they themselves cyber resilient? Are they (and you) following a trusted cybersecurity framework or just winging it? I would say change is coming…but it’s already here.

1

CISA lays out three specific approaches in it's guidance: zero trust, secure service edge (SSE), and secure access service edge (SASE). The guidance tackles remote access, virtual private network (VPN) deployment, remote access misconfiguration, threats and vulnerabilities associated with VPN and conventional remote access deployments.

1

Are all cybersecurity programs created equally? Not so much, according to EdScoop. If you know someone looking to get into #cybersecurity and #infosec, send them this link!

1

Don't leave your system's security to chance. Act now to patch high-profile vulnerabilities in Cisco and CrushFTP and protect your valuable data. 🔒💻 #cybersecurity #systemsecurity #datasecurity #patching #Cisco #CrushFTP #pinedacybersecurity #securityawareness #cybersecuritymakessensehere

6