Janet Torres, MBA, CISA

As identity management becomes a more critical component of cybersecurity, there is a growing need for identity teams to align more closely with the CISO. The integration of these teams ensures a unified approach to managing access controls and mitigating identity-related threats, which are increasingly being exploited. Centralizing leadership under the CISO allows for more streamlined communication and faster decision-making when responding to serious risks. #CybersecurityLeadership #IdentityManagement #CISO

20

2 Comments

I am honored to be awarded Outstanding Leader by orangslices.ai for 2025. I am not sure who nominated me but I am proud to be part of a cohort of winners such as Melvin Brown II, James Saunders, Venu Ayala, Steven Hernandez Beth Anne Killoran and others. These peers all exemplify the following characteristics: Exemplify Open Communication Whether through speaking at events, sharing on open platforms such as LinkedIn, or writing executive insight pieces that offer advice and insight, the engaged leader shares their thought leadership and is open to making public what they know to serve the greater good. Evidence of Mission Focus An engaged leader understands their mission focus is not turned inward to their specific organization but instead looks outward, to their stakeholders. This means taking and receiving lessons learned from others serving the same or similar communities. It means finding ways to engage stakeholders, vendors, and potential partners, to drive collaborative solutions with the users’ needs in focus. Execution as a Good Partner Engaged leaders prefer not to do a power dance, across tables or in the public eye. Being open, transparent, and authentic in who they are and what they want to achieve, these leaders demonstrate they are good and reliable partners. Being a good partner, these leaders are clear in what they say, understand their role and the roles of those around them, and they execute according to that. Engage with the Community Whether through industry days, networking opportunities, written content or collaboration in working groups, the engaged leader is part of the discussion, attending events, and being accessible and available. The expression “a rising tide lifts many boats” reminds everyone of something engaged leaders know – that there are opportunities for everyone and we do better when we work together. Whether it is as a mentor, an advisor, a board member, or a panellist, these leaders are familiar names and faces. Encourage Inclusivity Leaders who see the bigger picture are often surrounded by people who represent that bigger picture. Engaged leaders surround themselves with people who support and challenge them, with people who come from diverse backgrounds and with varied experiences. Engaged leaders encourage discussion, not for its own sake, but because they want the ideas brought forth from their diverse and inclusive team. Exemplify Innovation Whether it is through technology, culture, mission or approach, leaders that succeed do not stand still. Innovation signifies life, implies thought and forward movement, and is critical as the world becomes increasingly complex and challenging. Engaged leaders understand this, ask for big ideas and seek solutions that are focused on driving their organizations forward. #engagefedgov

172

59 Comments

FAIR-MAM One Year Out: What Have We Learned about Material Cyber Risk? 🤔 Beyond the narrow issue of reporting to the SEC or other regulators, the FAIR Materiality Assessment Model is an open financial loss model customizable to any organization’s cost structure to help report financial risk internally and inform cybersecurity investment and management decisions for a full range of custom cyber risk scenarios. FAIR-MAM is also the driver behind the FAIR Institute’s informational website How Material Is that Hack? that analyzes breaches, including those disclosed in an SEC Form 8-K, and estimates their ultimate losses. For the most part, companies have been very good about reporting an incident on a Form 8-K. In fact, the SEC noted in a statement in May that many 8-Ks are being filed despite no estimation of materiality. The SEC encourages companies to continue to be forthcoming but to word their 8-Ks in such a way as to not confuse investors. Generally, public companies are filing 8-Ks after a breach whether they think the hack will be material or not. https://lnkd.in/gqXirgXQ

1

1 Comment

Good article in Politico today on the status of the AI regulatory discussion going on in #California. Great quote from Sen. Umberg, "if we don’t have a regulatory scheme that both encourages entrepreneurship, encourages development and also discourages risks that are not in society’s interest, that other regions and other countries will take the lead." Much of the policy world woke up to the huge impact some of these 40 bills will have on the national (international) discussion in March of this year. Now we are going to see which bills make it through Committee. Silicon Valley Leadership Group had a great framework to think about how these bills are organized: 🔎 Transparency - Informing when AI is used 🚸 Guardrails - Limiting risk when AI is used 🔬 Opportunity - Leveraging AI as a solution It will be exciting to track over the next few weeks which of these bills end up coming out of Committee and seeing more of what the shape of regulation will look like for California, and the country. https://lnkd.in/gxYBMr5m

18

1 Comment

SoCal CISO Community, please join me in welcoming your newest Governing Body member, Julie Harris, CISO at PulteGroup! Tomorrow at 2pm PST, you can find Julie and many other CISOs from your community convening for the final CISO Townhall of 2024. Join virtually tomorrow to discuss: -Enhancing cloud security and cost-effectiveness across diverse cloud environments through managed security services -Leveraging AI innovations while addressing global regulatory and data privacy standards to strengthen security strategy -Sharing best practices for implementing effective cloud security operations across a global footprint to ensure resilience and compliance Register now at My.Evanta.com! #socalciso #evantaciso #aisecurity #cloudsecurity

24

1 Comment

🥳Join DAMA Rocky Mountain Chapter for our Q3 2024 event, From AI Basics to Cybercrime: How Deepfakes Pose a Threat to Companies. We are excited to welcome Laura H., of Kaiser Permanente, as a featured speaker.🎤 𝐁𝐢𝐨𝐠𝐫𝐚𝐩𝐡𝐲 Laura is the Director of the Systems Assurance Team at Kaiser Permanente. She is a seasoned cybersecurity professional with a remarkable career spanning over 23 years. With extensive military service, including 9 years in the Army and 15 years in the Air Force Reserves, Laura concurrently serves as a cyber officer in the Air Force Reserves at the 860th Operations Support Squadron as a flight commander. Laura's experience in cybersecurity extends across various sectors, from government contracting and federal civilian roles to private and publicly traded companies. She is committed to the advancement of the cybersecurity field through her active involvement in the cybersecurity community. Laura is the founding and current President of the Northern Colorado ISSA chapter, and a current Director on the ISSA International Board of Directors, where she demonstrates her passion and advocates for cybersecurity awareness. She is an avid speaker with over 7 years conducting presentations at universities and conferences nationwide on topics like Artificial Intelligence (AI), Deepfakes, cloud security, cyber espionage and social engineering. 𝐀𝐛𝐬𝐭𝐫𝐚𝐜𝐭 Artificial Intelligence (AI) is revolutionizing countless industries with its advanced capabilities. However, alongside its benefits, AI also presents significant risks, particularly in the realm of cybersecurity. This presentation will provide an overview of AI basics, explore its positive application in cyber tools, and delve into the emerging threat of deepfakes used for financial fraud. 𝐖𝐡𝐞𝐧: Friday, July 19th from 2:30 pm to 5:30 pm 𝐋𝐨𝐜𝐚𝐭𝐢𝐨𝐧: Denver Elks Lodge #17 𝐀𝐝𝐝𝐫𝐞𝐬𝐬: 2475 West 26th Ave; Denver, CO 80211 Price: Log-in to receive membership pricing! Professional Members: Always Complimentary & Free! Guest Members: First In-Person event $0, In-Person $20, Virtual $10 Non-members: In-Person $25, Virtual $15 Event details 𝐇𝐄𝐑𝐄: https://lnkd.in/gzkS3cNZ Event Registration 𝐇𝐄𝐑𝐄: https://lnkd.in/gjp8ihfR If you enjoy this content please engage with and/or comment on the post, repost to your network AND follow DAMA RMC by clicking on the 🔔 on the profile to get a notification for all new posts! #datastrategy #dataquality #datagovernance #datamanagement #masterdata #dataintegration #datamodeling #dataethics #dataarchitecture #datastorage #dataanalytics #datawarehousing #metadatamanagement #bigdata #datascience #businessintelligence #datasecurity #networking #damarmc #damarockymountainchapter #AI #deepfakes

4

John Mracek has exceptional insights and best practices to share at #Secure360. The cyber landscape is experiencing an increasing sophistication of threats along with rapid modernization of tech. Learn how model of shared accountability is ideal since no one can do it alone! #tech #cyber

32

1 Comment

Thrilled about the Silicon Valley Cyber Security Summit happening on October 25, 2024! Looking forward to connecting with Bay Area CISOs. Key topics include: 🔹Cybersecurity Readiness: Strategies to evaluate and enhance your organization's defenses. 🔹Emerging Threats: Insights into the latest risks and proactive mitigation strategies. 🔹Cloud Security: The importance of securing hybrid and multi-cloud environments. Join for a day of valuable discussions and networking! See you there!

17

When it comes to information and cybersecurity, the specter of malicious insiders looms large. While external threats often dominate the headlines, many business leaders and risk professionals try not to think about malicious insiders but shudder when they do. Malicious insiders pose a unique threat when it comes to risk, compliance and information security within organizations.

27

1 Comment

Cybersecurity and privacy are broken. I rarely advocate for new regulation, but enough is enough. The US Federal government must do more to hold corporations, their boards, and their executives (not just CISOs) accountable to how they secure PII. The ARPA is a step forward in that direction, but it doesn't go anywhere near far enough. I fully support the message Charles Henderson laid out in the post below. What are your thoughts? Do you think regulation is needed, or would it just make things worse?

31

Thank you for sharing the CSO Online article and your key takeaways, Itzik. The growing prevalence of non-human identities (NHIs) in enterprise environments presents significant security challenges that many organizations still grapple with. The proliferation of non-human identities (NHIs) in enterprise environments creates a vast and often overlooked attack surface. As we increasingly rely on machine-to-machine interactions, adapting our security strategies is crucial. Key takeaways: • NHIs often outnumber human identities by 45 to 1 in many enterprises • Traditional security measures struggle to keep pace with NHI growth • Implementing true zero trust for NHIs remains a significant challenge While the path forward isn't simple, there are actionable steps we can take: 1. Differentiate NHI policies from human policies 2. Implement more stringent authentication for NHIs 3. Regularly rotate credentials and closely monitor access patterns 4. Segment networks to isolate high-risk NHIs 5. Apply the Principle of Least Privilege (PoLP) rigorously As security professionals, we must evolve our thinking to address this growing threat landscape. What strategies have you found effective in managing NHI security risks? #CyberSecurity #NonHumanIdentities #EnterpriseIT #ZeroTrust #CyberSecurityStrategy

1

Completely agree, Mario. Elevating the conversation beyond technical metrics is key. Our communication goal is to clearly demonstrate how cybersecurity efforts directly protect the organization’s bottom line, reputation, and long-term resilience. By translating risks into business terms that resonate with board members, we can show how security investments reduce exposure and ensure business continuity. Providing a clear picture of both current posture and potential risks enables more informed decision-making and ensures cybersecurity remains a top priority at the highest levels. #Cybersecurity #BoardReporting #BusinessContinuity #RiskManagement #Leadership

10

1 Comment

Is your #cybersecurity mindset driven by ambitions or by threats? In our first in a series of #CyberSecurityAwarenessMonth blogs, Nana Ahwoi identifies several strategic steps organizations should consider when it comes to their cyber programs.

20

Cybersecurity is no longer just a cost—it's a value driver. As an Advisor at NightDragon, we explore how a proactive security strategy can transform cybersecurity into a business enabler, building trust and driving innovation. Integrating security into the core of an organization's growth strategy ensures that trust becomes a competitive advantage. Grateful to be part of this conversation and to see the evolution firsthand. Read my full insights below. #Cybersecurity #BusinessValue #Leadership #NightDragon

25

Full video: https://lnkd.in/ghSJgDgV Transferable Skills: Boosting Cybersecurity Communication Discover how transferable soft skills enhance your effectiveness in cybersecurity. Learn to explain complex concepts simply and gain stakeholder trust, drawing parallels from the food industry's compliance challenges to succeed in governance, risk, and compliance (GRC). #CybersecuritySkills #SoftSkills #Communication #StakeholderEngagement #GRC #Compliance #TechnicalCommunication #DigitalTrust #ProfessionalDevelopment #IndustryInsights

3

Results from our latest survey show that while AI implementations are proliferating, AI security and governance controls are lagging big time. This concerning statistic is likely not limited to AI implementations. As with any security program, organizations that lag on foundational security are often ill-prepared to address threats and attacks that can impact their Gen AI applications. https://lnkd.in/gM4XRKEk

19

In the fourth quarter of 2023, Kroll Cyber Risk noticed a rise in engagements involving #Akira #ransomware, a trend that has continued into 2024. Our deep dive into the ransomware focuses on understanding its intrusion pattern and steps to take for detecting the ransomware, as well as advice for defending against it. Learn more about the #vulnerability here: http://ms.spr.ly/6044YGy4a

5