Rees Johnson

Holy Smokes! I have never answered SO many questions in a webinar before!!! If you are trying to navigate the Entrust CA distrust challenges, you can watch the recording and all the very rich Q&A covered here. https://lnkd.in/gaqbup7w

101

6 Comments

An epidemic of delayed revocations has infected the public CA community. @Tim Callan and @Jason Soroko track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes. Listen at @Sectigo here: https://lnkd.in/e6mZMV6Q

3

A SMB building a #SaaS product can you build the 6 CISA's Secure by Design components into your product as part of a #securebydesign foundation. Part 2/3: 3) reduce classes of vulnerabilities, and 4) applying security patches.   CISA's Secure by Design pledge has 6 reviewed components: 1.       Increase the use of MFA for users 2.       Reduce the use of default passwords 3.       Reduce classes of vulnerabilities 4.       Provide security patching 5.       Have a Vulnerability Disclosure Program 6.       Provide logging for your customers.   As you build your product you should focus on ways that you can reduce you exposure to entire classes of vulnerabilities. Since you are building for the web, the OWASP Injection Cheat Sheet is an invaluable resource for your developers. You can further harden your web presence by adopting frameworks with injection protection built in.   You can further reduce the impact of an issue in your web application by adopting a memory safe language as you build your product. If you are supporting a legacy codebase you can still meet CISA’s Secure by Design pledge by developing an internal memory safe roadmap. This describes your company’s plan to move to memory safe languages. These languages help reduce the impact to your systems at large if you do have an application issue.   As a SaaS vendor you have the advantage of being able to patch your systems on your own schedule. However, if you offer any client-side software as a part of your business you should have this software update by default. You can offer the ability to disable this behavior. However, if you do make sure you have the telemetry necessary to know which of your customers need to update. You also need to be able to contact these customers if there is a need to update. This released software should also have a clear end of life policy in place. This lets your customers know when you will no longer be supporting the software.   Please reach out if you have questions on implementing CISA’s recommendations in your product roadmap.

1

Ransomware isn't just an IT problem anymore. It's a full-blown business continuity crisis. The recent spike in ransomware-induced outages has shifted the conversation from a matter of "if" to a definitive "when." This change isn't just about technology or security measures; it's about leadership and the fundamental responsibilities of running a health system. Leadership in today's health systems means more than guiding growth and managing resources. It demands a proactive stance on ensuring operations can withstand and quickly recover from catastrophic downtime. The commitment to maintaining patient safety and care, even in the face of digital crises, is non-negotiable. The article "Rethinking Business Responsibility in Ransomware-focused Catastrophic Downtime Planning" dives deep into this issue, emphasizing the need for a shift in mindset among health system leaders. It's an insightful read that I not only agree with but also believe is crucial for today's healthcare leaders to absorb and act upon. We're in an era where digital resilience is as fundamental to healthcare as medical expertise. Ensuring that your organization can continue safely treating patients, even amidst a ransomware crisis, is a leadership role that cannot be understated. Read more about how we can redefine business responsibility in the face of increasing ransomware threats here: [URL] The future of healthcare depends on our ability to adapt and protect the very essence of our mission: patient care. Let's lead the charge in rethinking our approach to business responsibility. Check this out: https://lnkd.in/eCDu_QHf

2

In 2023, the manufacturing industry was the third-most represented industry in Arctic Wolf® Incident Response (IR) ransomware engagements, and fourth-most represented in IR business email compromise (BEC) engagements. (Link in comments) The median cost of a manufacturing ransomware attack responded to by Arctic Wolf Incident Response is now $500,000 USD. Can you ( Mr or Ms. Manufacturer) sustain downtime, interruptions, reputational damage, client data loss and more? We help many of the top local manufacturers in the area protect and defend their business from cyber threats by "making them a hard target" - putting in the defenses that will keep most of the "bad guys" moving on the next victim who hasn't locked their doors and windows.

5

1 Comment

💡 Security hardening with CIS benchmark is crucial for compliance standards (PCI, HIPAA, NIST, etc.) and protection against threats, but legacy vulnerability management tools are insufficient. In this webinar on July 10th at 11am PT, we will cover: 🔒 The importance of CIS benchmarks in hardening your host OS. ✔️ A real-world use case demonstrating how adversaries exploit misconfigurations in non-compliant hosts. 💻 A live demo of Falcon Exposure Management Security Configuration Assessment (SCA) showcasing real-time assessment and hardening of OS configurations across your enterprise. Register today: https://lnkd.in/gST9ZHZ8

8

Read the customer story to learn how eSentire MDR delivered superior visibility, correlation, and protection from cloud-specific threats, 24/7 detection, and expert support that enabled Venerable to stay ahead of cyber threats. DM us to discuss how eSentire can help your organization achieve comprehensive threat response, visibility improvement and endpoint protection. @eSentire

1

Read about our thoughts around FedRAMP and how best to achieve a successful journey to Readiness, ATO, or P-ATO. Key Takeaways - FedRAMP mandates a single system for assessing, authorizing, and staying on top of cloud security for federal use. - It's non-negotiable for cloud firms wanting to participate in U.S. government deals to have FedRAMP clearance. - The authorization journey lasts between 10 to 18 months and includes preparation, audit, corrections, and finally, approval. - Early engagement with FedRAMP, working with qualified advisors and skilled assessors, and being well-prepared can reduce friction and costs to complete the authorization process. - Securing FedRAMP compliance demonstrates dedication to strong security and opens doors in the government sector. #FedRAMP #itcompliance #cybersecurity #governance

3

Full Video: https://lnkd.in/gQfWJYcc Rebuilding Your Life: Cyberstalking Survival Guide Learn how to rebuild your life after experiencing cyberstalking or physical stalking. Discover the essential steps to protect your personal data and regain your peace of mind. Join us as we answer important questions on this topic. #CyberstalkingSurvival #RebuildingYourLife #PersonalSecurity #DataProtection #StalkingSurvivor #OnlineSafety #PrivacyTips #Empowerment #DigitalSafety #SelfProtection

2

Hope you can join us for a robust discussion on an important topic!

9

Episode 3 of ThreatTank delves into Attack Surface Management - uncovering what lies beneath and how to defend it. Learn about managing your digital assets, identifying vulnerabilities, and more.

3