Comment

RSA Conference 2023 - Well Worth it and Timely

Welcome to the 2023 RSA Conference! I never missed one from 2007 until Covid, and this is my first year back, I have got to say I'm impressed with how well it has adapted to the current situation. This year's conference is great so far, and it is excellent to be back in-person after so long. The hallway track is fantastic this year.

Today, Monday, April 24th, I attended Carahsoft's Public Sector Day, which was designed to showcase solutions for the Federal and State verticals. Carahsoft did an incredible job in setting up for this conference. They had an impressive panel discussion on the current state of cybersecurity in the GOV/ED space, which was both informative and enlightening.

Initially, I wasn't planning on attending the full conference, but I found myself drawn in by the fantastic presentations and engaging speakers. If you haven't made it to RSA yet, I highly recommend attending next year. For connections and content it is competitive and worth it. For

Although I haven't visited the expo hall yet, I've attended several networking events on Sunday and Monday, and I must say, the energy has been incredible. The market has faced numerous challenges, but the positive vibe at this conference is contagious, and I'm feeling more hopeful than ever about the future of cybersecurity.

I'm excited to head over to the show floor tomorrow, and I can't wait to see what's in store for me there. With ~40,000 attendees, over 400 exhibitors and more than 700 sessions, the RSA Conference promises to be one of the most comprehensive cybersecurity events this year.

One thing I've always appreciated about RSA is the mentorship aspect. It's an opportunity to connect with peers, learn from industry leaders, and share experiences. If you're new to the industry or looking to develop your cybersecurity career, RSA is an excellent place to start. If you’re an industry veteran? It’s like old home week or a reunion.

In addition to the many fantastic sessions and events, RSA also offers an incredible opportunity to explore and learn about the latest technology and solutions on the show floor. From cutting-edge startups to established industry players, the expo hall offers a wealth of knowledge and resources for all attendees.

I highly recommend that anyone interested in cybersecurity attend RSA at least once in their lifetime. The experience is invaluable, and the knowledge gained can make a real difference in your career. The connections? Even better.

Whatever your role or position in the industry, I'd like to remind everyone to mentor and be mentored. Sharing knowledge and experiences is essential in our field. It's a way to give back to the community and help those just starting in their careers. if you’re just starting out, ask for mentorship. Then pass it on.

Watch your 6 - what does that mean? Keep an eye on your surroundings and being aware of potential threats. As cybersecurity professionals, we must always be vigilant and take proactive steps to protect our networks and systems.

I hope you've enjoyed this year's RSA Conference as much as I have. Remember to stay well, and I look forward to seeing you all again next year.

Comment

Comment

RSA Conference

RSA is back, and WE are back at RSA. We will be posting some great highlights from the show. Stay tuned for more on RSA 2023!

Reach out if you’d like to meet in person out here. Looking forward to seeing you all!

davycinco@twitter

linkedin.com/daveglenn

Comment

Comment

Healthcare Cybersecurity Maturity and HIPAA Compliance

Many people incorrectly equate HIPAA compliance with cybersecurity. While HIPAA compliance is a key requirement  for healthcare,  it is not enough to protect your organization from cyber risk. Many organizations that are technically compliant continue to suffer debilitating cybersecurity events. Here are 3 areas you can focus on to ensure a strong cybersecurity posture that aligns with HIPAA compliance: 

3 Areas of Focus for Healthcare Cybersecurity Maturity and HIPAA Compliance

Cyber Risk Gap Analysis and Prioritization and Risk Management (RM)

Conducting a security risk gap analysis to establish a baseline is a critical first step in working towards cybersecurity and risk management maturity. This process involves objectively analyzing your current state against a framework to understand your security and risk posture. Once you have that baseline, and by understanding the potential business impact, you can prioritize measures specific to your organization to achieve your desired state and meet compliance requirements. Measuring potential impact on your organization and only then prioritizing remediation activities ensures that you get the best value and protection for your resource, time, and financial investment. This allows you to fix the highest priority items first, based upon your unique requirements.  

Cloud and Transformational Security (CTS)

Healthcare organizations rely on cloud connected components more than ever, and cloud architectures are becoming increasingly complex, often incorporating  hybrid or multi-cloud environments. This reliance on the cloud opens cybersecurity risks that HIPAA compliance alone cannot address. When it comes to cloud-based devices or software, a well-executed cloud risk strategy, when properly executed, prevents oversight and provides assurance that privacy and security risks to critical data and systems are mitigated. 

Vendor Risk Management (VRM)

In order to comply with HIPAA regulation, healthcare organizations must have third-party vendors complete a security risk assessment when protected health information (PHI) is involved. As a result the vendor and the organization are aware of security gaps that must have a remediation plan before they work together. In order to proactively manage risks to the business between annual assessments, vendor management needs to be treated as a continuous program. Creating a formal vendor risk management program establishes a consistent system to manage and measure vendor posture and impact. 

Using an automated system for internal risk management systems

Creating a system for assessing cybersecurity risk, detecting gaps, and prioritizing corrective action can be a complex process. While many organizations have succeeded in establishing robust internal risk management systems, the journey to success can be extremely costly, time consuming, and frustrating. Leveraging a platform and automatic improvement model can provide a proven process to help healthcare providers and systems not only comply with regulatory mandates, but simultaneously build a strategy that aligns business objectives and technology infrastructure. 

Creating a centralized repository for all of your risk data, a dashboard for fast executive visibility as well as a proven process for delivering sustainable ongoing security and compliance maturity is important. This type of system can shorten the cycle from annual or semi-annual assessments to real-time continuous visibility into your current remediation progress, new risks that may have appeared, and potential new priorities. This integrated approach conserves valuable time and resources (very often in short supply) while maximizing the effectiveness of your data security plan.

Enabling organizations to quantify impact, continuously measure current  risk posture and develop a more efficient process, while effectively managing the remediation process builds a model to significantly enhance the level of commitment and communication quality between business and technology decision makers and leaders within organizations and could help to remove the “analysis paralysis” that results in inaction, ineffective strategy, and inadequate response so often found after regulatory cyber risk assessments. 

Tags: cybersecurity, healthcare, HIPAA

Comment

Comment

Personal OpSec - random notes

Hey. Happy Thursday. Really good version of Tom Ryan’s Security Mindset Clubhouse room last night. Talked a ton about personal OpSec. A few links and tips below. The team talked about various strategies to protect security and identity including:

  • There’s the obvious like not texting or emailing stuff like SSN, Pictures of ID or SS card, using as few identifiers as possible

  • Using services you have already shared data with instead of signing up for a new service to give more personal information to - like VISA, MC, AMEX… OR using the credit bureaus (Experian, Transunion, Equifax

  • Using a “standard” fake birthday when signing up for websites

  • Using a paid service like “Delete Me” to keep your personal data posted on the web to a minimum / remove personal data sold by brokers. How We Work - DeleteMe (joindeleteme.com) (Thanks Eric)

  • Making sure your family members know “the rules” about posting pictures of you on social

    • Mixed discussion of letting that happen at all

    • Stay out of pictures altogether if you can help it (Thanks Jane)

  • Elixabeth has shared in the past how she works with younger relatives to put together a fake persona for them when they join social. That way they start out NOT exposing their real contact info, but keeps consistent track of the data used.

  • Much discussion about using “standard” fakes for mother’s maiden and other key identifiers when setting up a non-financial account if you HAVE to use that info.

  • Using a fake email service like Nada (thanks Dave M) to individualize setup emails, or one time use (to sign up for whitepapers, etc) nada - Disposable Temp Email (getnada.com)

  • Reading stuff from Michael Bazzell, listening to his podcast, or usign his free workbooks on data removal and credit freeze IntelTechniques by Michael Bazzell (Very useful website.. thanks again Dave)

All in all, I highly recommend joining the Law, Tech and Infosec https://www.clubhouse.com/club/law-tech-infosec club (and Tuesday 11:30am PT / 2:30pm ET discussion) as well as the Security Mindset https://www.clubhouse.com/club/security-mindset club (and Wednesday 3:00pm PT/6:00pm ET discussion rooms to see for yourself.)

Watch your 6… See you there.

Comment

Comment

BlackHat 2021, DefCon 29 and Usenix 30th Security Symposium

Another summer has almost passed, and I missed the Vegas pilgrimage. What with masks and shots, sick people and crazy people… I am still not 100% down with travel. Don’t get me wrong, some crazy part of me really misses waking up in a hotel room wondering where I am and what is on my calendar for the day, but sadly it’s not really fully back to “normal” (which my sister says “is just a setting on the dryer”). All that said, my plan is to be there next year.

I’ve heard mixed reviews. The consensus was that it was lightly attended, and that there were many more “innovation vendors” than main stream big guys. But maybe that’s a good thing. I’ve always enjoyed the outside ring of vendors at shows like RSA, and think that we need more of those in the industry.

Consolidation continues on, and companies are recognizing that there is a balance to the idea that workers that have a less rigid onsite work schedule can be happier and more productive. Then there a great number of people that have not used the time wisely and have instead used this for an excuse to slack. Whichever you are, I hope you’re finding ways to be successful in the new normal.

But I digress.. Thanks to my good friend Tom Ryan, I have this killer list to share with you. Here are slides, talks and videos of some of the best of this year’s Vegas security fest. Check em out. Some great stuff here:

DefCon 29 Videos: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20video%20and%20slides/

DefCon 29 Slides: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20presentations/

BlackHat 2021 (Slides accessible within each talk's link): https://www.blackhat.com/us-21/briefings/schedule/index.html

30th Usenix Security Symposium (papers and presentations): https://www.usenix.org/conference/usenixsecurity21/technical-sessions

Do you have any training links to share? Information that might be useful? Post below please! I’m interested.

Comment

Comment

What is SecurityJabber all about?

Welcome back friends. What is SecurityJabber all about you ask? Glad you asked. SecurityJabber is a forum for interviews and discussion of current cybersecurity topics. I interview great guests, discuss what’s going on in Cybersecurity, and sponsor a host of discussions both online and in real life.

I’ve now been in technology for almost 30-years, and in cybersecurity for 20+. I guess that makes me old. I’ve learned a ton and met a lot of great people. I’m hoping to share some of what I’ve learned with you, and spark some great discussions. I look forward to hanging out and getting to know you!

Comment

Comment

Back for real this time --- 2020 year in review

Wow. What a crazy whirlwind of a last 18-months. COVID-19, a 2020 none of us could have imagined. (Although I’ve been introduced to some creative fiction that came really close.)

We are LONG past 2020 now, but this post was sitting in drafts and I thought I would subject you to it anyway.

Unprecedented ransomware attacks including a blitz against healthcare organizations that escalated quickly. I was hosting a series of healthcare focused roundtables at the time, and on several of the sessions we went from an average of 10-20 attendees to over 100. Nedless to say, people were paying attention. And for the first time, many media outlets reported that a ransomware attack led directly to the death of a patient. The story was that ransomware intended for a nearby university crippled a German hospital. As a result, a patient headed for Duesseldorf University Clinic was redirected to a hospital in Wuppertal, a 32-kilometer (20-mile) drive. This delayed Doctors giving her treatment for an hour, and she died… Since then, the argument has been presented that she had complications that meant she likely would have died anyway, but this STILL brought a ton of attention to the issues of ransomware and how it could impact patient safety. This attention has resulted in board members and executives paying attention to not just compliance, but good security hygiene. This is good news and should be celebrated.

The FBI’s Internet Crime Report for 2020 was released in March 2021, and had some startling statistics. They received over 790,000 (791.790 if you’re actually counting) complaints of internet crime (more than $300,000 more than in 2019), and reported losses of more than $4.2bn. They received an average of over 2,000 complaints per day, and 5.6 million total complaints since inception. It’s an interesting read.

So 2021 was when we were all supposed to go back to “normal” whatever that is.

From a contested election, to riots and racial violence these truly are troubled times. So what’s in store in the rest of 2021? I, for one, hope we pay attention to our better angels and feed the beast that embraces positivity and forward progress. Let’s see what happens!

Now that we are in

Comment

Comment

SO... Here's RSA 2020 (and we're back...)

Ok everyone. After a crazy hiatus (more about that later), we are relaunching and plan to be better than ever. Life gets ahead of you sometimes, then you have an event… like a virus (and this is no Melissa) that slaps you and says “HEY DUDE” LIFE. Welcome to 2020, and COVID-19. Engineered? Maybe. Scary? Heck yes. Gonna stop us from having a great RSA? No Freaking Way.

So despite the prevalence of masks on people that usually don’t even wash their hands when leaving a restroom (GROSS, you know who you are…), and companies like IBM, AT&T Security and Verizon dropping out of the conference, the show must go on. Oh and IBM? People DO get fired for buying you now. AT&T, you don’t scale, and Verizon, you’re a great phone services company, but we don’t care about your security offerings anyway. (Opinions expressed here are my own, NOT my company, but you can have them if you want em.)

Things we are excited about in no particular order…

If you know me the way some of you do you will swear I’m saying this under duress, but Microsoft. YES that Micro$oft. Indirectly this company has payed my bills for the last three decades. And I’ve had a fascination with them since elementary school at KSDA just up the road from Redmond. They’re no longer just a killer tech marketing company, they’re actually investing real money in cyber security. To the tune of >$1bn year. That’s more than 10 of my favorite boutique favorites combined. And they’re focusing on some thingsthat matter. Like Mobile

Phishing… No, I’m serious. People are missing the point of something as simple as DMARC. And despite all the vendor consolidation out there, I heard the story of “don’ beat em, join em from the Valimail CEO, Alex Garcia-Tobar. And it made a ton of sense

I’m late for my next happy hour….talk to you in a minute. Stay safe and for God’s sake, cover your mouth when you sneeze.

Comment

Comment

Episode 37: With Guests from Blacksands

Security Jabber - Episode 37 - Segment 1

Security Jabber - Episode 37 - Segment 2

Security Jabber - Episode 37 - Segment 3

Guest Interview with Blacksands

About Blacksands:
Danati blacksands began with the development of a cutting edge Collaborative Ecosystem for Advanced Engineering and Research & Development targeting the Automotive Industry.  As development progressed, we realized that the risk to companies losing Billions in intellectual property was extremely high.  New engine development can exceed $1 Billion and much of this work was vulnerable to cyber theft.  Network Security and especially Cloud based Network Security was completely inadequate.

Therefore, we halted development on the Ecosystem and sought a security solution.  We needed to not only know, definitively, who was connected but also control these connections dynamically.  We needed to have system that were simple to use and impervious to the constant barrage of cyber-warfare.  When none was to be found we asked a few fundamental questions:

  • Why are we perpetually on the defense in cyber-security?
  • Why are we connecting to the entire world and then trying to filter out the bad entities?
  • Could we create a solution that is pro-active instead of re-active?
  • Can we make our connections invisible to the rest of the world?

In development of blacksands we discovered answers to these questions and much more.  Traditional network security operates on the ‘Trust but Verify’ principle – connect to everyone and filter out the bad.  blacksands inverts this with its ‘Verify then Trust’ process – connecting only to the appropriate entities, never to the world.

Comment

Comment

EPISODE 32: SEGMENT 2 – Mining and Exchanging Cryptocurrencies

Security Jabber, Episode 32, Part 2

On this week's podcast, we have special guest Zachary Sarakun on to talk about cryptocurrencies. In segment one, we discuss the basics of cryptocurrencies and their current trends in the market.

During the second segment, we dive into mining cryptocurrencies such as Bitcoin and Ethereum. The team also discusses the real question around mining, "Is it worth it?"

Special Guest: Zachary Sarakun, Security Analyst at CBI
"Zachary brings high energy, dedication to craft, and excellent interpersonal skills to CBI’s Strategic Programs team. Zachary’s technical aptitude and ease of learning are beneficial to any team he works with or project he works on. Utilizing community groups, online sources, podcasts, and interpersonal sources, Zachary stays updated with best practices and regulations within the Information Security industry.

Links

Comment

Comment

Episode 32: Segment 1 – Intro to Cryptocurrencies

Security Jabber, Episode 32, Part 1

On this week's podcast, we have special guest Zachary Sarakun on to talk about cryptocurrencies. In segment one, we discuss the basics of cryptocurrencies and their current trends in the market.

During the second segment, we dive into mining cryptocurrencies such as Bitcoin and Ethereum. The team also discusses the real question around mining, "Is it worth it?"

Special Guest: Zachary Sarakun, Security Analyst at CBI
"Zachary brings high energy, dedication to craft, and excellent interpersonal skills to CBI’s Strategic Programs team. Zachary’s technical aptitude and ease of learning are beneficial to any team he works with or project he works on. Utilizing community groups, online sources, podcasts, and interpersonal sources, Zachary stays updated with best practices and regulations within the Information Security industry.

Links

Comment