Ashish Garg

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Over time there has been a shift in how organizations have handled security risk management owing to evolving security challenges influenced by emerging and evolving threats. For instance the risk of cyber-crime is growing rampant as organizations adopt modernized digitalized applications and software to navigate business operations. Similarly crimes associated with terrorism have evolved over time as organized crimes revolutionize themselves. This has called for a shift in the way organizations handle business where security has been perceived to be an important component of doing successful business and ought to be adopted in every business function as opposed to have it run in isolation. This shift is termed as the paradigm shift. Over time some experts have differed in approaches with some inferring that in order to protect a company and its assets the very first step is to perform a threat and vulnerability analysis, the outcome of the analysis leads to the implementation by security team of the physical protection systems. This approach is referred to the security approach. The security approach is specific, narrow focus on threats and vulnerabilities. It’s an exclusive approach in which activities have usually been confined to security professionals. On the other hand some experts have taken a contemporary approach that states that security planning starts with a detailed analysis of potential areas of loss, their probability, their impact scale should loss occur and affect business goals and assets. This approach is referred to the risk approach. The risk approach takes into account organizational context and objectives, assets and how they are used, it identifies threats to assets and the success of the mission. It quantifies the potential impact of those threats, identifies and addresses vulnerabilities, and establishes a framework to manage risks to as low as reasonably practicable. It’s an inclusive approach designed to involve the business risk management decision making with specialist advice provided by security professionals who lead or own the process. The risk approach has been ideal in security management and has been adopted by many organizations aiming to merge security risks and vulnerabilities to their cultures for mitigation ensuring they achieve desired business gains. The risk approach is advocated and adopted in ISO 31000 standard guidelines, where organization protection is characterized by the risk source. ISO 31000 aims to establish the risks that have the potential to impact on the organization’s goals and providing guidance on what can be done about them from their negative or positive effect point of view. Which begs the question for organizations and security professionals – Which approach are you currently adopting within your organization and does it match the current threat spectrum ? #securityriskmanagement #continouslearning #upskilling  

44

9 Comments

#OSINT framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources. Some of the sites included might require registration or offer more data for $$$, but you should be able to get at least a portion of the available information for no cost. #osintforgood #investigations All credits to-->  Twitter: @jnordine

11

Are current remediation efforts enough? We measured the percent change in the number of open vulnerabilities each month for each firm. Taken together, these monthly measures reveal whether security exposures are piling up... Read the full report: https://lnkd.in/e4EAeQ6v

1

Drawing upon a comprehensive survey of almost 400 corporate DFIR professionals, the fourth annual State of Enterprise #DFIR report examines the evolving contributions and experiences of DFIR professionals within corporate environments. Get it today: https://ow.ly/ENaK50RkeWH

16

Clause 7 of ISO 42001 focuses on providing essential support for an AI management system. Here are my thoughts on the key requirements and how to approach them. 1. Provide Resources (7.1) ⚠ Determine and provide necessary resources for the establishment, implementation, maintenance, and continual improvement of the AI management system. ✅ To comply, conduct a thorough assessment of the resources needed, including human, financial, technological, and data resources, and ensure they are adequately allocated and managed. 2. Ensure Competence (7.2) ⚠Identify the necessary competencies required for roles affecting AI performance. ⚠Ensure personnel are competent through appropriate education, training, or experience. ✅To meet these requirements, develop and implement a training and development plan for employees, ensuring continuous learning and upskilling in AI-related competencies. 3. Raise Awareness (7.3) ⚠Ensure that personnel are aware of the AI policy, their contribution to the effectiveness of the AI management system, and the implications of not conforming to system requirements. ✅Promote awareness through regular communication, training sessions, and documentation to keep all relevant personnel informed about AI policies and their roles. 4. Manage Communication (7.4) ⚠Determine the internal and external communications relevant to the AI management system, including what, when, with whom, and how to communicate. ✅Establish clear communication protocols and channels to ensure effective and timely information sharing within the organization and with external stakeholders. 5. Document Information (7.5) ⚠Ensure that documented information required by the AI management system is controlled, including creation, updating, distribution, access, and protection. ✅Implement a robust document management system that ensures accuracy, availability, and security of all AI-related documentation. 💡 Key Takeaways 1. Providing adequate resources is fundamental to support the AI management system and its continual improvement. 2. Ensuring competence through education and training enhances the effectiveness of AI initiatives and compliance. 3. Raising awareness and effective communication are crucial for the successful implementation of AI policies and procedures. 4. Proper documentation management ensures that all necessary information is available, accurate, and protected. 🚀 Next Steps ✅Conduct a comprehensive resource assessment and allocate the necessary resources to support AI initiatives. ✅Develop and implement a continuous training and development plan to ensure personnel competencies. ✅Establish clear communication protocols to facilitate effective information flow within the organization and with external stakeholders. ✅Implement a document management system that ensures the control, accuracy, and security of AI-related documentation. If you need help, please reach out! #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou A-LIGN

8

This Kiteworks article provides valuable insights into the NSA's approach to enhancing Zero Trust maturity within the data pillar, emphasizing the critical importance of safeguarding data in today's cybersecurity landscape. Understanding the value and risks associated with data is paramount, and the emphasis on implementing data-centric security controls aligns well with best practices in cybersecurity. Overall, this article serves as a comprehensive resource for organizations seeking to strengthen their cybersecurity posture in an increasingly interconnected digital environment. NSA’s Advancing Zero Trust Maturity Throughout the Data Pillar: A Comprehensive Guide 👉 Learn more: https://gag.gl/qQPSz9 #cybersecurity #zerotrust #NSA #blog

17

The Cybersecurity and Infrastructure Security Agency developed this guidance to provide an overview of swatting and recommended practices for preventing and responding to swatting incidents. https://lnkd.in/ghHJictr #cybersecurity #swatting #prevention #prevent #response #guidance #lawenforcement #police #resource #electionsecurity #hoax #recommendations #lessons #highthreat #threat #threats #security #nationalsecurity #homelandsecurity #tool #risk

2

Good Incident Response (IR) programs include seven core components that make responding to an incident smoother and more cost-effective. Does your IR strategy sufficiently address each of these areas? #IncidentResponse #Cyberattack #FortifiedHealthSecurity

22

As organizations leverage on existing best practices and innovations to tackle security threats, there is still some confusion when it comes to defining and applying security risk management (SRM) and security risk assessment ( SRA). Both SRM and SRA have distinct roles in the broader process of managing security risks within an organization. Here are the different characteristics of each: ➡️ Security risk Management (SRM) 1. Definition – SRM is the process of identifying, assessing, prioritizing, and responding to risks in a way that minimizes their impact on an organization's objectives. 2. Goal - The main purpose of SRM is to develop strategies and actions to address and mitigate identified risks. It involves implementing measures to reduce the likelihood of risks occurring or their impact if they do occur. As well as optimizing on opportunities attributed to some of the risks. 3. Activities – SRM activities include risk mitigation strategies such as risk transfer, risk avoidance, risk acceptance etc and monitoring and review of risk response mechanisms. It aims to control and optimize risks in line with an organization's risk appetite. 4. Output - The output of SRM is a set of risk treatment plans or actions that outline how risks will be managed or mitigated. It involves implementing controls and measures to address risks effectively to an acceptable level across the organization. 5. Cycle – SRM takes the form of an overall program consisting of a framework that aims to function across and include everyone in the whole organization. 6. Scheduling – SRM is ongoing with regular intervals of review to refresh data and evaluate the efficacy of the mitigation action plans. 7. Alignment – SRM is aligned to the organizational goals and objectives. ✅ Security risk Assessment (SRA) 1.Definition – SRA is the process of identifying, analyzing, and evaluating potential risks that may affect an organization's ability to achieve its objectives. 2. Goal - The main purpose of SRA is to understand the nature and extent of risks faced by an organization. It involves identifying potential risks, assessing their likelihood and impact, and prioritizing them based on their significance. 3. Activities – SRA involves activities such as risk identification, risk analysis, risk evaluation, and risk categorization. It helps organizations to understand the potential threats and opportunities they face. 4. Output - The output of SRA is a combination of collected data that lists identified risks along with their likelihood, impact, and priority. 5. Cycle – SRA takes the form of a single phase under the security risk management program. 6, Scheduling – SRA is conducted on a need to basis. Complimentary SRAs can also be carried out as long as they align to and are guided by the SRM program. 7. Alignment – SRA process is aligned to the SRM program in terms of its principles and framework. #securityriskmanagement #securityriskassessment

385

162 Comments

“Third-party risk teams need more teeth… and that’s not on them.” TPRM has a huge PR problem. The function is so commonly written off as "deadweight" in infosec. Not much attention is paid to it beyond what is required for compliance. Companies invest way more in the security within their perimeters than outside, even when so many breach attack vectors start from vendors, suppliers, and external libraries. It’s understandable. TPRM teams aren’t frequently empowered to make business-impacting decisions today because leaders don’t believe that they can effectively predict which vendors / libraries are going to cause the next breach. Third-party risk assessments today are not effective enough to do that. I started on this journey because I think this is *the biggest* strategy-to-reality misalignment across all of cybersecurity. 🙇‍♂️ Thanks Lucas Moody for working with us to transform third-party risk into an impactful and important part of infosec strategy! 💪

66

7 Comments

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

12

1 Comment

This Kiteworks article is a good read for cybersecurity professionals who want to learn more about a roadmap for Department of Defense (DoD) contractors to achieve compliance with the Cybersecurity Maturity Model Certification (CMMC) 2.0. The article outlines the steps and strategies contractors need to take to meet the updated CMMC requirements, emphasizing the importance of understanding the new framework and preparing for the certification process. Your Ultimate Guide for CMMC 2.0 Compliance Get the CMMC Roadmap: https://lnkd.in/evfK7SC8 #CMMC #compliance #cybersecurity #blog #NIST

16

critical vulnerability in OpenSSH, designated CVE-2024-6387 named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. Don't panic, but please patch before the exploit goes public: https://lnkd.in/gFTk9Jva There's also a possible workaround, Set LoginGraceTime to 0 in /etc/ssh/sshd_config. This makes sshd vulnerable to a denial of service (the exhaustion of all MaxStartups connections), but it makes it safe from this vulnerability. https://lnkd.in/gsMus-Ru

9

4 Comments

Cybercriminals often exploit known vulnerabilities, so prioritizing and patching the most critical ones can significantly reduce the attack surface and make it harder for them to gain a foothold.   Hence, prioritizing cybersecurity exposures is crucial for effectively managing and mitigating risks to an organization's digital assets, data, and operations. With the increasing frequency and sophistication of cyber threats, it's essential for businesses to allocate their resources wisely and focus on addressing the most significant vulnerabilities and risks.

4

The countdown is on! 🕒 Heading to the Cybersecurity and Privacy Professionals Conference on May 1–3 in Minneapolis. Ready to dive into dynamic discussions with industry leaders and peers about safeguarding higher education institutions. Don't let this opportunity pass – register now!  https://lnkd.in/dT9Fq8Jq #CybersecPrivacy24

68

5 Comments

The key to Digital Trust is building a CULTURE capable of mitigating digital risk to protect organizational DIGITAL VALUE. The DVMS Institute NIST Cybersecurity Framework Overlay System assures that every digital service created is protected and delivered in alignment with an organizational cybersecurity risk management plan. Creating and Delivering DIGTIAL TRUST requires more than theory. It requires a culture plus an underpinning overlay system capable of assuring the digital business performance, resilience, and trust government regulators and operational stakeholders expect. https://lnkd.in/g_mQWH4T

11