Yogita Parulekar

Ashish Popli is speaking the truth! How does security stop being an impediment and start being an enabler? Blueprints – make it fast and easy for devs to get their job done. Guardrails – sand off the foot guns. Get specialist teams involved when it matters. Check out his podcast with Nancy Wang if you haven't seen it yet!

6

1 Comment

Some CISO are in view of having dedicated OT SOC while some are in view of extending IT SOC . let's break down the considerations for having a dedicated OT SOC versus extending the capabilities of an existing IT SOC 1. **Cost**: - *Dedicated OT SOC**: Higher initial setup costs due to the need for specialized tools, training, and personnel. - *Extending IT SOC**: Lower initial costs as it leverages existing infrastructure and resources, but ongoing maintenance costs may increase. 2. **Resource and Skill Sets**: - *Dedicated OT SOC**: Requires personnel with deep knowledge of industrial protocols, OT systems, and control systems security. Specialized training and experience are crucial. - *Extending IT SOC**: Relies on leveraging existing IT security resources. Additional training may be required to understand OT environments and protocols. 3. **ROI (Return on Investment)**: - *Dedicated OT SOC**: Potentially higher ROI due to specialized focus, leading to better risk mitigation in OT environments. - *Extending IT SOC**: Lower upfront investment but may have limitations in addressing unique challenges and risks in OT environments, potentially affecting ROI in the long term. 4. **Challenges**: - *Dedicated OT SOC**: Integration with existing IT systems and processes may be challenging. Ensuring alignment with organizational objectives and culture can also be a hurdle. - *Extending IT SOC**: Adapting to the unique requirements of OT environments, such as legacy systems, proprietary protocols, and operational constraints, poses challenges. 5. **Technical Feasibility and Integration with OT Systems**: - *Dedicated OT SOC**: Requires deep integration with OT systems and protocols, which may be technically complex but provides tailored monitoring and response capabilities. - *Extending IT SOC**: Integration may be less complex initially, but ensuring compatibility with diverse OT systems and protocols can be a technical challenge. 6. **Security Monitoring Tools**: - *Dedicated OT SOC**: Utilizes specialized tools designed for OT environments, offering granular visibility and control over OT assets. - *Extending IT SOC**: May need to adapt existing security monitoring tools or invest in new ones that can handle OT-specific requirements. 7. **Regulatory Compliance**: - *Dedicated OT SOC**: Helps ensure compliance with industry-specific regulations and standards governing critical infrastructure and industrial control systems. - *Extending IT SOC**: Compliance may be more challenging due to the need to address OT-specific regulations and standards. 8. **SOC Use Cases**: - *Dedicated OT SOC**: Tailored use cases for detecting and responding to OT-specific threats, such as unauthorized access to control systems, process anomalies, and equipment failures. - *Extending IT SOC**: May need to develop or adapt use cases to address OT security concerns, which may not cover all OT-specific scenarios.

42

10 Comments

The Modern CISO: An Essential Guide for CISO Success Dive into this resource curated by our esteemed partners at Devo, spotlighting insights from our very own CISO, Aaron Shaha. Don't miss out on this opportunity to enhance your cybersecurity knowledge and strategies. Download the guide here. https://lnkd.in/ed5bWPGp #SEC #CISO #AI #CyberLiability #Devo

19

1 Comment

You know what I really missed at the recent Accel Cybersecurity Conference in Bangalore? I truly missed Demand Side Talks. 𝗪𝗵𝗮𝘁 𝗮𝗿𝗲 𝗗𝗲𝗺𝗮𝗻𝗱 𝗦𝗶𝗱𝗲 𝗧𝗮𝗹𝗸𝘀? Demand side talks are when buyers share more about what are they trying to accomplish, what success looks like for the buyer and user and the org itself. 𝗪𝗵𝘆 𝗱𝗶𝗱 𝗜 𝗺𝗶𝘀𝘀𝗲𝗱 𝘁𝗵𝗶𝘀 𝗸𝗶𝗻𝗱 𝗼𝗳 𝘁𝗮𝗹𝗸𝘀? Unlike a 100% technical security conference, the Accel Cybersecurity Summit was geared for security product founders plus buyers. While there were selected talks there were also a few invited speakers. This is how I saw the event. Leaning more towards an industry event as opposed to being purely technical like a NULLCON The following kind of talks/tracks for next time will make this conference super valuable 𝗥𝗲𝗮𝗹 𝘄𝗼𝗿𝗹𝗱 𝗰𝗮𝘀𝗲 𝘀𝘁𝘂𝗱𝗶𝗲𝘀 𝗼𝗳 𝘀𝘂𝗰𝗰𝗲𝘀𝘀𝗳𝘂𝗹 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝘀 • What did they had to overcome internally to implement • How long did it take for success criteria being met • How did the product vendor navigate the sale 𝗖𝗮𝗻𝗱𝗶𝗱 𝗧𝗮𝗹𝗸𝘀 𝗳𝗿𝗼𝗺 𝗖𝗫𝗢𝘀 𝘄𝗵𝗲𝗿𝗲 𝗽𝗿𝗼𝗱𝘂𝗰𝘁 𝗮𝗱𝗼𝗽𝘁𝗶𝗼𝗻/𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗳𝗮𝗶𝗹𝗲𝗱 • Even if Jobs To Be Done alignment was in place • Products implemented due to regulations didn't work • What other non-functional factors became reasons for failure 𝗖𝗜𝗦𝗢 𝗣𝗮𝗻𝗲𝗹𝘀 𝘀𝗵𝗮𝗿𝗶𝗻𝗴 𝗮𝗴𝗴𝗿𝗲𝗴𝗮𝘁𝗲𝘀 𝗮𝗻𝗱 𝗱𝗶𝘀𝗰𝘂𝘀𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝗻𝘂𝗺𝗯𝗲𝗿𝘀 • Typical split in the security budget they have • Field notes on which kind of spend works • Notes on kind of spend that always fails Currently a lot of what we know and believe comes from analysts • Usually a very US 🇺🇸 centric enterprise view not useful for most orgs • Very category focussed which assumes that integration isn't tough • Incentives that don't necessarily align with operational security As more and more security teams are under pressure to reduce costs all the time, this kind of discussion will empower the next gen of cybersecurity managers. This conference is an excellent opportunity for all of us in the ecosystem to come together and learn from each other, skills, tactics and strategies not found elsewhere. Looking forward to the next one. #cybersecurity #cloudsecurity #conference --- After spending 2 decades offering specialist application and cloud security guidance I firmly believe security needs to be made effortless. Follow along as I learn how to build a company in cloud security 🔔

36

7 Comments

Hi Everyone! I'll be hosting a panel discussion on "The Advent of AI: Adapting to Emerging Threats and Balancing The Offensive and Defensive" at BSidesGoa this weekend! If you're attending the conference, be sure to stop by for this insightful discussion. It would be great to catch up and chat about AI in cybersecurity! Cyware Security BSides Goa #BSidesGoa #AI #Cybersecurity

50

1 Comment

This analysis uncovers the rise of DeathGrip, a Ransomware-as-a-Service (RaaS) platform providing access to powerful ransomware builders like LockBit 3.0 and Yashma/Chaos. The ease of acquiring these tools empowers individuals with limited technical expertise to carry out complex ransomware attacks, lowering the barriers for extortion-driven cybercriminals. The availability of such tools contributes to the widespread commercialization of ransomware across different proficiency levels. Stay informed about this evolving threat landscape: https://lnkd.in/gP8McXjU

4

2 Comments

🎙️ CISO Series Interview out now! Hear Saket Modi break down how CISOs can effectively manage cyber risk by leveraging AI-driven tools like SAFE X. He shares key strategies for quantifying risk in financial terms, streamlining decision-making, and staying ahead of the ever-evolving threat landscape. 🎥 You don’t want to miss this! Watch the interview here: https://lnkd.in/g-SHBZ_j #CyberRisk #CISO #AI #CyberSecurity #CISOSeries #CyberRiskManagement

74

2 Comments

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

187

2 Comments