Sarah Lewis Cortes PhD CISSP CIPPE FIP CIPT CIPM CISA CRISC

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

In observance of National Critical Infrastructure Security and Resilience Month, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of the Director of National Intelligence, released guidance to assist #criticalinfrastructure owners and operators to detect and mitigate efforts by foreign intelligence entities to disrupt U.S. critical infrastructure. As a nation, continued #cyber and physical threats to critical infrastructure Americans rely on daily are being observed. U.S. adversaries and their foreign intelligence entities understand the importance of the critical infrastructure sectors and how degrading them could hinder the national response to events. “U.S. adversaries and their foreign intelligence entities (FIEs) a understand the importance of these sectors and how degrading them could hinder our national response in the event of crisis or war, given that harm to these sectors could cause panic, erode confidence in the government, and complicate leadership decision-making,” the agencies identified in a document titled ‘Safeguarding Our Critical Infrastructure: Vigilance Makes a Difference.’ #Threatlandscape #Cyberattacks #Cyberthreats #Adversarialattacks https://lnkd.in/gpZKTxAe

26

1 Comment

The IJIS Institute is committed to supporting justice and public safety agencies, along with their service providers, in navigating the complexities of compliance and modernization. In alignment with this mission, we are pleased to highlight a series of sample policy templates developed by the National Institute of Standards and Technology (NIST). These templates serve as invaluable tools for agencies striving to align with the Federal Bureau of Investigation (FBI)’s Criminal Justice Information Services (CJIS) Security Policy and the FBI’s broader modernization initiatives. To find all supporting documentation, go to: https://lnkd.in/eESbHsmk

12

Cyentia Institute's Risk Retina service offers the same excellent data and analysis from our IRIS research series (https://lnkd.in/eAjaW3gx) focused on a particular sector. The goal is to support organizations in data-driven #cyberrisk assessments and decisions. I'll share some highlight stats from the Risk Retina for the Financial Services sector we produced in 2022. It focuses on 7,950 cyber loss events experienced by financial firms over a 10-year period from 2012 through 2021. We've since updated this with more recent data, and one major change is a big increase in the typical loss magnitude. If you're interested in an updated Risk Retina for #financialservices or your own sector, here's more info: https://lnkd.in/dgaF_hP8 #cyberriskquantification

32

1 Comment

Cybersecurity for Smart Inverters webinar this session will focus on the final version of NIST IR 8498 Cybersecurity for Smart Inverters Webinar | NCCoE nccoe.nist.gov The National Cybersecurity Center of Excellence (NCCoE) is hosting a webinar on Cybersecurity for Smart Inverters. This session will focus on the final version of NIST IR 8498, which provides seven practical cybersecurity guidelines for small-scale solar inverter implementations. The webinar aims to share NIST’s recommendations with the community, emphasizing the importance of smart inverter manufacturers building products capable of implementing these guidelines. The event is scheduled for January 29, 2025, from 1:00 PM to 2:00 PM EST. #NIST #Cybersecurity #SmartInverter #InnovationNetwork

1

Heads up on this once in 5 years opportunity to sponsor Cyentia Institute research into the largest #cybersecurity incidents. See the call for sponsors for the 2025 "Xtreme" edition of the Information Risk Insights Study at the link below. #cyberrisk #cyberresilience #cyberattacks https://lnkd.in/etc6FjsY

39

2 Comments

5️⃣ Facts Friday: 1) The National Institute of Standards and Technology (NIST) launched a new program “intended to help improve understanding of AI’s capabilities and impacts.” https://lnkd.in/eAkwytgb + The program is called Assessing Risks and Impacts of AI (ARIA). + “ARIA will consider AI beyond the model and assess systems in context, including what happens when people interact with AI technology in realistic settings under regular use,” said NIST’s Reva Schwartz, who will lead the program. 2) “Chief AI officers have been named for the 24 CFO Act agencies, as well as dozens of smaller agencies,” according to an Office of Management and Budget spokesperson. https://lnkd.in/ecGKWhvH + The White House AI Executive Order required each agency to designate a Chief AI Officer “for coordinating their agency’s use of AI, promoting AI innovation in their agency, managing risks from their agency’s use of AI,” and more. 3) Thousands of internal company documents leaked from Google. https://lnkd.in/gCwaD-Dj + The documents suggest that Google may have used Chrome data to inform search rankings, despite prior company claims to the contrary. +  A Google spokesperson pushed back, saying that “we would caution against making inaccurate assumptions about Search based on out-of-context, outdated, or incomplete information.” 4) The Washington Post's CEO announced the paper’s new “Build It” plan, including intentions to integrate AI. https://lnkd.in/eEX-92ht + The paper’s CTO allegedly said that the paper needs “AI everywhere in our newsroom.” + In the past year, the Post lost $77 million. 5) OpenAI's Board created a Safety and Security Committee to make recommendations “on critical safety and security decisions for OpenAI projects and operations.” https://lnkd.in/dDHsmNVC + The Committee includes Aleksander Madry (Head of Preparedness), Lilian Weng (Head of Safety Systems), John Schulman (Head of Alignment Science), Matt Knight (Head of Security), and Jakub Pachocki (Chief Scientist). + The announcement also mentions that “OpenAI has recently begun training its next frontier model.” #AI #AIPolicy #FiveFactsFriday

5

Brilliant article Lee Parrish; thank you! Context is so very important here. While risk management has long been one of the top three oversight areas for directors, it is clear that cyber risk management is unique. Apologies in advance, CISOs, but too many of you and your team members still confuse simple terms like threat, vulnerability, and risk. Don't bother to ask the C-suite or board members. =#enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors

10

1 Comment

Public Safety Software News: Mark43 announces BriefAI and ReportAI Mark43 BriefAI, an AI-powered case summarization tool, rapidly distills the key facts of a case to accelerate investigations Mark43, the leading cloud-native public safety software provider, today announced Mark43 ReportAI and Mark43 BriefAI, two AI-powered tools to transform the efficiency, productivity, and accuracy of public safety operations. Public safety agencies nationwide face increasing staffing challenges and are being tasked with doing more with fewer resources. Report writing, while essential to public safety work, often pulls officers away from their focus on community safety. Investigations are often slowed by fragmented information sharing and the time-consuming task of reviewing lengthy case files to identify key facts and leads. With BriefAI and ReportAI, these challenges are transformed into opportunities for efficiency. By automating case summarization, investigators can quickly distill critical information, accelerating decision-making, assignment and improving case outcomes. ReportAI enhances the accuracy and quality of reports, freeing up valuable time for officers, and ultimately empowering first responders to focus on solving crimes and public safety. “Our vision is to completely transform public safety by delivering the most advanced, cloud-native platform that serves as the real-time operating system for every agency,” said Robert Hughes, CEO of Mark43. “Only Mark43 offers a cloud-native, modern integrated CAD and RMS, enabling first responders to operate with peak efficiency and effectiveness. With solutions like BriefAI and ReportAI, we are revolutionizing how agencies manage information, empowering officers to focus on what truly matters—protecting and building safer communities. This is a new era for public safety, and Mark43 is leading the way.” #publicsafety #publicsafetysoftware #publicsafetytechnology #technology #AI #AITechnology #reporting #lawenforcement #cloudnative #investigations #Mark43 #Computeraideddispatch #CAD #RMS #Recordsmanagementsystem #information #police1 #police1magazine Robert Hughes, Wendy Gilbert, Matthew Polega Read the full article here--> https://hubs.li/Q02T66JP0

26

Earlier this year, Cyentia Institute published a meta-study analyzing the top ATT&CK techniques reported across 20+ industry sources. NOT ONE OF THEM reported observing T1195.003 - Compromise Hardware Supply Chain. Hold on - my aid has an urgent message for me...oh my...they what?!...pagers exploding - really?...I see...got it...will do... Sorry for the interruption. As I was saying, T1195.003 was THE MOST REPORTED sub-technique in the entire study! Download it today from the compromised device of your choice: https://lnkd.in/eafNi5u3 #supplychain #cybersecurity #fud

91

6 Comments

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

🔔 Incident Response Readiness 🔔 - Cyber Security Readiness: 1/5 When San Joaquin County’s court systems went offline, it highlighted the need for a reliable incident response plan that keeps critical services up and running during an attack. Read Full Story: https://lnkd.in/d53JRStW ✅ Readiness Insight: Incident Response Simulations pressure-test your incident response plan, exposing gaps and improving response times by up to 30%. A well-prepared team is essential for minimizing disruptions. 🙋 Ask Your Team: Have we rehearsed our incident response plan under simulated attack conditions? Incident Response Simulation exercises can help ensure your organization is ready to act fast. ➡️ Reach out to us to schedule an incident response simulation exercise now! https://lnkd.in/griDnzt8 #incidentresponse #cyberattack #cyberincident #cybersecurity #securityawareness #readiness

4

Grateful to VMblog for the chance to share my insights on public safety cybersecurity predictions. Key topics include: - Emerging Threats - Cloud Adoption Trends - Funding Challenges - Framework Adoption Dive into the article for an in-depth look at these critical themes. Your thoughts and feedback are always welcome! #CyberSecurity #PublicSafety #CloudAdoption #Funding #FrameworkAdoption #CyberThreats

8

Check out new research from Center for Long-Term Cybersecurity! Three papers highlight topics like cyber and clean energy, protecting transnational dissidents, and prioritizing key cyber controls. #CyberCivilDefense https://lnkd.in/g-Cvscu6

7

It's time Cyentia Institute updated the Information Risk Insights Study "Xtreme" edition. I will be posting an official call for sponsors soon with more details, but reach out if you'd like to register your interest early. In a nutshell, we'll identify the costliest security incidents over the last several years to see what we learn about managing cyber risk. #infosec #cyberrisk #cyberresilience #cyberattacks

46

1 Comment