Chris Koehnecke

This recent ransomware attack on an Arkansas water treatment facility highlights a growing concern for critical infrastructure security. I shared some thoughts on what this breach means for the future of cybersecurity in the water sector and how we can better defend these essential services. Check out my full commentary and the detailed coverage below! 👇 #CyberSecurity #CriticalInfrastructure #Ransomware #WaterSecurity

31

1 Comment

A #technology outage can have profound downstream impacts. How can companies enhance their capabilities to prevent, prepare and respond to the next disruption? Be sure to join our upcoming webinar on Sept. 13! Link to register:

3

Hot on the heels of National Cybersecurity Awareness Month is National Critical Infrastructure Security and Resiliency Month. There is no better way to leverage awareness with action in preparedness! Grateful to be able to actively participate in the eco-system! #criticalinfrastructure, #cybersecurity, #cyberresilience

4

1 Comment

The Cybersecurity and Infrastructure Security Agency (CISA) has recently published guidance on implementing Encrypted DNS to enhance security for federal agencies. This proactive step aims to protect sensitive information and mitigate DNS-based threats. Stay informed by reading the full article here: https://lnkd.in/d3Ncqctk 🛡️💻 #CyberSecurity #CISA #EncryptedDNS #DataProtection

1

Mark Lance, the VP of DFIR & Threat Intelligence at GuidePoint Security, highlighted the alarming simplicity with which criminals can initiate #cyberattacks during his discussion with KTBC Fox 7 Austin. Responding to a concerning case of a Texan operating a website to facilitate #cyberattacks, Lance stressed the urgent need for strong #cybersecurity practices. Discover more about this situation and learn how to safeguard your organization against #ransomware threats. https://okt.to/oa4ujU

11

1 Comment

Recent third-party incidents have had a major impact on enterprises of all sizes and from all sectors. This is an important event to attend to learn how to mitigate this risk.

6

Highly likely that these will be included in the CMEP IP (AML) going forward...

2

If you can make please take sometime to learn more about OT Cybersecurity.

1

Folks, Our confirmed attendance is at a record level. Clearly the message and mission has hit an major inflection point! Don't miss out on the secrets of CMMC compliance. The is will be both entertaining and serious, with a lot of can you believe this was happening in a organization stories. And how to solve the toughest part of your CMMC certification processes. https://lnkd.in/gcw49xQe #CMMC #CybersecurityCompliance #DoD #DefenseContracting #XDR #CyberSecurity #ThreatDetection #IncidentResponse #DataProtection #ComplianceDeadline #GovCon #DefenseIndustry #CMMCCertification #CyberReadiness #SecurityStandards #FederalContracting #RiskManagement #CyberDefense #DataVisibility

3

Follow up on the recent NPD data breach, which exposed 𝟮.𝟳 𝙗𝙞𝙡𝙡𝙞𝙤𝙣 𝙎𝙤𝙘𝙞𝙖𝙡 𝙎𝙚𝙘𝙪𝙧𝙞𝙩𝙮 𝙉𝙪𝙢𝙗𝙚𝙧𝙨. There are several web sites that you can go to to check if you data was compromised. (check the comments for a link to one of them). 𝗥𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀 𝗼𝗻 𝗻𝗲𝘅𝘁 𝘀𝘁𝗲𝗽𝘀: • 𝗖𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗳𝗿𝗲𝗲𝘇𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗰𝗿𝗲𝗱𝗶𝘁 𝗳𝗶𝗹𝗲. This will reduce the risk to an attacker making unauthorized account additions to your profile. To freeze the file, you'll want to create accounts if you haven't yet already with Transunion, Experian, and Equifax. • 𝗥𝗲𝘃𝗶𝗲𝘄 𝘆𝗼𝘂𝗿 𝗖𝗿𝗲𝗱𝗶𝘁 𝗙𝗶𝗹𝗲 𝗳𝗼𝗿 𝗱𝗶𝘀𝗰𝗿𝗲𝗽𝗮𝗻𝗰𝗶𝗲𝘀: Ensure that there is no information listed that you are not already familiar with, clean up as needed. Dispute any anomalies and remove them from the file. • 𝗥𝗲𝗴𝘂𝗹𝗮𝗿𝗹𝘆 𝗿𝗲𝘃𝗶𝗲𝘄 𝗮𝗻𝗱 𝗖𝗹𝗼𝘀𝗲𝗹𝘆 𝗺𝗼𝗻𝗶𝘁𝗼𝗿: Review any changes to your file that would be indicators of a compromise. 𝗖𝗵𝗲𝗰𝗸 𝘁𝗵𝗲 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀 𝗳𝗼𝗿 𝗮𝗱𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗵𝗲𝗹𝗽𝗳𝘂𝗹 𝗹𝗶𝗻𝗸𝘀!

6

10 Comments

Is your organization struggling to understand how to approach 3.10.6, Alternate Work Sites? What is allowed and what an assessor may be looking for? In this CMMC Churns, we dive into 3.10.6, Enforce safeguarding measures for CUI at alternate work sites. In the requirement deep dive, we will look at the requirement, assessment objectives, the requirements relationships to other requirements, and evidentiary objects we would expect to see as assessors. Interestingly, there are four primary use cases (working at home; in public spaces & travelling; in a hotel room; and at a client location) that an organization can use to define its safeguarding requirements to be followed by staff when working outside of their offices. We also look at considerations your business should ponder when developing safeguarding measures. For example & remember, Alexa & Siri are not authorized listeners to CUI conversations… ================================================= Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: [email protected] ================================================= #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors https://lnkd.in/e28F-A86

18

2 Comments

Great news from NIST as they adapt digital identity guidelines for state and local benefits programs. This collaboration with the Digital Benefits Network and the Center for Democracy and Technology to refine digital identity measures is a step in the right direction. It's essential to ensure that as we enhance digital services, we also safeguard privacy and equity, particularly in public benefits administration. Looking forward to seeing how these guidelines will foster more secure and inclusive digital environments. https://bit.ly/3KYuH5J

22

💲 Prepare NOW for the $200M K12 Cybersecurity Pilot Program 💲 In case you missed it, the FCC released the specifications and eligible services for the $200M K12 cybersecurity pilot program. We will have much more to share with you in the coming months as we approach the expected application window opening later this year. In advance of this opening, there are things you can do NOW to prepare for what the application will require. First, you can download the *DRAFT* version of the FCC Form 484 (https://lnkd.in/gbU_XDcX). This ONLINE ONLY form will be released later this year so that schools can apply to be part of the pilot program. This is the first part of the application, where applicants must provide general information about the school seeking support, including applicants’ experience with cybersecurity matters, whether they expect to implement cybersecurity recommended best practices and their current or expected use of free or low-cost federal resources.  Applicants will also be required to provide information about their proposed Pilot project, including a description of the goals and objectives to be achieved, the services and equipment to be purchased (and associated costs), and the cybersecurity risks the proposed Pilot project will prevent or address. But how can you gather this information? Vinson Protect CAN HELP! We have built a free audit tool (https://vinsonprotect.com) for you to use to audit your school’s preparation against various industry standards (including the K12 SIX Essential Cybersecurity Protections, Center for Internet Security's CISv8 Controls, and the ClassLink Cybersecurity Rubric) specifically called out in the pilot program announcement). This audit will help identify weaknesses and opportunities for improvement in your school preparedness program. It will give you a status report and security plan to help draft your proposal goals and objectives. Please let us know if you have any questions or want assistance getting started. #vinsonprotect #k12 #cybersecurity

28

1 Comment

Folks, As a CMMC Registered Practitioner supporting 100 organizations in the DoD supply chain, I want to personally invite you to a webinar like no other. We will be discussing the CMMC final rule and how to supercharge the most challenging aspects of CMMC compliance with XDR technology. Register at the link below, to learn how to achieve 50% compliance over the most challenging aspects of CMMC compliance immediately. https://lnkd.in/gcw49xQe #CMMC #CybersecurityCompliance #DoD #DefenseContracting #XDR #CyberSecurity #ThreatDetection #IncidentResponse #DataProtection #ComplianceDeadline #GovCon #DefenseIndustry #CMMCCertification #CyberReadiness #SecurityStandards #FederalContracting #RiskManagement #CyberDefense #DataVisibility

4

Having an Incident Response (IR) plan is critical to an organization during a breach and becoming required by more standards and compliance frameworks. How do you know if your IR plan is complete? Here are some thoughts about what should be in an IR plan. https://lnkd.in/e_uN9TYa #IRplan #incidentresponse #cybersecurity

3

Coalition, Inc. Cyber Risk Awareness Security Report! Could you not want a better summary to highlight the real risks? 🚨"Technology has become ingrained in modern business, and so has cyber risk. Cyber risk is now the most significant concern for business leaders globally." ⭐🔦A warning that continues to be echoed from every corner of the security landscape. In addition, the coming #digitalliabilities explosion where due diligence is under the microscope. Gerry Kennedy, Ivan Savov, FARPI, #cyberrisk #digitalpremisesliabilities #compliancerisks #businessrisk #boardofdirectors #boardroom #executives 🚨"Cyber claims originated in the inbox. More than half of all claims were business email compromise (BEC) or funds transfer fraud (FTF), highlighting the importance of email security as a key aspect of cyber risk management." ⭐🔦As perimeter security strengthens and is heavily focused upon with weak #securityawarenesstraining and weakening information security governing policies to risk manage current and evolving #securitythreats, attacks are directed to the weakest links in the organisation's security system—that is, the human element domain and all vectors surrounding it. Many organisations are not doing enough to strengthen #emailsecurity and continue to rely upon existing controls or poor continuous monitoring and evaluations of current controls. This problem is not expected to be resolved any time soon as security continues to be an emotional factor among IT teams, holding blind relationships with failing strategies and solution providers. 🚨"Businesses using select boundary devices were at greater risk. Firewalls, virtual private networks, and other devices can help reduce cyber risk. However, boundary devices with known vulnerabilities increased the likelihood of a business experiencing a cyber claim." ⭐🔦IT-driven organisation's security can result in the above, where #securityrisk is not well understood at the governance level and #informationsecuritymanagementsystems maturity capabilities are slowly maturing but not at the level for true #cyberriskmanagement. Until #cyberrisk becomes #businessrisk and #boardofdirector becomes cyber risk aware and takes responsibility and accountability for the organisation's #digitaltransformation program, this problem will continue to plague such organisations. Resolving cyber risks requires responsible action from top-level management. #businesssectors #government #ngo #privatesector #publicsector #financialsector #healthsector #insurancesector 

6