Alexander Tushinsky

New - Investigating Hy-Vee’s massive data breach, Hudson Rock identified critical employees infected by infostealers, compromising Atlassian (Confluence and Jira) credentials. This likely enabled this Stormous group 53GB data heist. (tl;dr below) New Blog (4 minutes read) - https://lnkd.in/dPZYU_-f TL;DR: On June 23, 2025, Stormous breached Hy-Vee’s Atlassian accounts, stealing 53GB of sensitive data, including infrastructure diagrams and operational details. Hudson Rock’s research uncovered an infostealer infections Hy-Vee employee devices, exposing credentials that likely granted attackers access, fueling one of 2025’s boldest retail breaches.

37

Three things you can do TODAY to boost your K-12 cybersecurity posture (without needing a budget meeting): 🔐 Enforce MFA (at least for staff) – If you haven’t rolled it out yet, start with admins and office staff. It’s the easiest way to stop 90% of credential-based attacks. 📚 Run a 5-minute phishing test or training – Use a quick video or a fake phishing email to see who clicks. No shame—just awareness. Cybersecurity culture starts with tiny nudges. We’re excited to move from Fortiphish to CyberNut this summer! 🔄 Audit who has access to what – Over-permissioned accounts are low-hanging fruit for attackers. Teachers shouldn’t have server access. (Unless they moonlight in IT… in which case, let’s talk.) Cybersecurity isn’t a project. It’s a posture. And in K-12, every small move matters. #K12Cybersecurity #EdTechLeadership #SchoolSafety #CyberSmart #MFAEveryday

43

9 Comments

Hey GRC Peeps!👋 I got asked today about the "cyber audit process" Are you curious what a cyber audit 'looks' like? 🤔 I made you this fun little infographic to explain.⬇️ -------------------------- Lot of rinse and repeat, but the gist is 1️⃣ Plan and Scope (What/Who/Where are you auditing? people, process, facilities, tech stacks, etc. against what? PCI, HIPAA, FISMA, etc) 2️⃣ Execute Audit (Collect data from interviews, documentation, observation) 3️⃣ Analysis (You have raw data, now vet if controls are in place or not) 4️⃣ Report (Document and render opinions on your work, highlight priorities in executive summary) 5️⃣ Monitor and Maintain* (Help drive POAM and gap closing, while identifying upcoming audit needs) *This step is slightly outside of a standard audit process, but if the audit is internal, its best to do this step as well. 😉 If you want a high-resolution version of the graphic, I made it available for free as a digital download here: 🚨 https://lnkd.in/efwcHCFz -------------------- See its that simple! BONUS Tip, the real 🤑 is when you can apply risk knowledge to how 'bad' the gaps are to the business. ------------------- Repost ♻️ to share with aspiring #grc folks in your network Follow 👉🏼 Gerald Auger, Ph.D. for more content like this. ------------------- #grc #cyber #audit

418

29 Comments

CMMC Level 2 Assessment Objective: Privacy & Security Notices PRACTICE: Organizations must provide privacy and security notices consistent with applicable rules for controlled unclassified information (CUI). ASSESSMENT: System use notifications can be implemented using messages or warning banners displayed before individuals log in to organizational systems. Users may be required to click to agree to the displayed requirements of using the system each time they log on to the machine. This agreement can be used in the civil and/or criminal prosecution of an attacker that violates the terms. Be prepared! Your assessor could ask to 🔍 EXAMINE privacy and security policies and procedures addressing system use notification. 🗣 INTERVIEW system or network administrators. 📝 TEST mechanisms implementing system use notification. (CMMC Assessment Guide: Level 2 Version 2.13, page 34) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

64

Before you pay for another LOW-COST NIST Cybersecurity Framework Class or Consulting Engagement, READ THIS POST and BLOG!!! Full Blog: https://lnkd.in/gRWQBSHP The NIST Cybersecurity Framework (CSF) and the Digital Value Management System™ (DVMS) form a comprehensive approach that empowers organizations—regardless of size, scale, or complexity—to build a holistic, adaptive system for Digital Business Governance, Operational Resilience, and Performance Assurance. The strength of this dual approach lies in its capacity to unify strategic direction, risk management, cybersecurity, and continuous improvement into a coherent, systems-based model that is scalable and adaptable to the realities of modern digital enterprises. The NIST CSF provides a structured foundation for managing cybersecurity risk. It defines six core functions—Govern, Identify, Protect, Detect, Respond, and Recover—that serve as pillars for improving an organization’s cybersecurity posture. However, the NIST CSF is not a how-to guide; it outlines what needs to be done but leaves much of the implementation detail open to interpretation. This is where the DVMS enters the picture. The DVMS acts as a systems model overlay, bringing to life the conceptual power of the NIST CSF by operationalizing its components through governance, cultural integration, and organizational capability development. At the heart of DVMS is a shift in mindset from viewing cybersecurity as a technical or departmental issue to embracing it as a core organizational responsibility tied directly to business value. This shift is encapsulated in the concept of “strategy-risk”—the idea that strategy and risk are not separate functions but interwoven aspects of a unified objective: to create, protect, and deliver digital business value. By combining strategy and risk into a single concept, the DVMS helps organizations frame cybersecurity within the broader context of enterprise risk management and strategic governance. The result is an adaptive capability that evolves alongside internal changes and external threats, thereby fostering operational resilience. The DVMS framework is composed of multiple interconnected models and layers, including the CPD Model (Create, Protect, Deliver), the Z-X Model (seven minimal viable capabilities: govern, assure, plan, design, change, execute, innovate), and the 3D Knowledge Model (team knowledge, collaboration, strategic alignment). These models work in concert to help organizations identify gaps in capability, define priorities for action, and implement processes that drive both performance and resilience. By using these layered models, organizations can better understand how value is created, where it is at risk, and how to close the gaps between current and desired states of performance and protection.

162

15 Comments

2024 set in motion major changes for certificate lifespans and DCV. In this Root Causes Podcast lookback episode Jason Soroko and I discuss the Apple 47-day proposal, stepping down certificate term, public versus private CA use cases, DCV reuse periods, MPIC, WHOIS, and other topics. Audio: https://lnkd.in/gH3Z-adY Video: https://lnkd.in/gN_VpVPy #pki #security

29

“Security frameworks don’t fail. People fail to use them correctly.”   ↳ 78% of organizations compliant "on paper" still suffer breaches.   ↳ Standards like NIST, IEC 62443, and NCA OTCC-1 aren't flawed. Yet over 60% of their implementations stay stuck in PDFs, not practices. ⇨ Why read further?   - See common compliance errors clearly   - Learn from an authentic client scenario   - Turn frameworks into effective security actions Compliance without real-world capability is merely paperwork.    ↳ Especially in Operational Technology (OT), the gap isn't just technical it's deeply cultural. 📖 REAL-WORLD CLIENT STORY:    ↳ We recently partnered with a major manufacturing organization, responsible for multiple critical facilities. Their documentation for IEC 62443 compliance was outstanding:   ✅ Clearly defined OT network segmentation   ✅ Fully documented cybersecurity roles   ✅ Asset inventory marked as comprehensive But our on-site validation revealed something very different:    ⇨ Asset Inventory: Managed via quarterly Excel updates, creating significant blind spots between reviews.    ⇨ Network Segmentation: Logical on paper, but physically nonexistent, with IT and OT systems openly interconnected.    ⇨ Privileged Account Management: Shared passwords were common practice, significantly compromising accountability. ↳ The standard wasn't faulty the implementation was. 🛑 PROBLEM:    ↳ Many organizations mistakenly equate passing audits with real security. True security requires continuous testing, clear ownership, and constant refinement. 💡 INSIGHT:  ↳ Standards mark your start not your finish line.  Real security comes when frameworks become daily practices:   ⇨ Clearly map security controls to operational tasks.    ⇨ Regularly perform realistic security drills.    ⇨ Embed clear security accountability throughout the organization. 🔄 MINDSET SHIFT:    ↳ From: "We passed the audit." ⇨ To: "We confidently handle real-world incidents."   ↳ From: "The policy covers it." ⇨ To: "Our team actively practices security daily." ✅ KEY TAKEAWAYS:    ↳ Move from checklist compliance to actionable, daily security behaviors.    ↳ Validate controls through realistic exercises not just paper-based audits.    ↳ Develop a culture where compliance naturally follows from proactive security. 📩 Ready to turn standards into practical security?    ↳ DM me for our Frameworks-to-Action Toolkit, designed specifically to help OT and cyber leaders bridge the compliance-practice gap effectively. 👇 Join the discussion: Have you witnessed frameworks being misapplied? Share your insights! #CyberResilience #SecurityFrameworks #IEC62443 #NISTCSF #GRC #OTSecurity #CyberStrategy #OperationalSecurity #Leadership #SecurityCulture

414

21 Comments

Working in RMF, one thing becomes clear real quick: It’s not enough to document controls the system has to actually follow what’s written. You can have a clean SSP, detailed control summaries, and even pass an initial review... But if the technical implementation doesn’t match the documentation? You’re asking for audit findings, system drift, and non-compliance headaches. I’ve seen it too many times: AC-2 says inactive accounts are disabled in 30 days but old accounts are still active SC-28 says data at rest is encrypted but there’s no encryption in place CM-6 says STIGs are reviewed quarterly but nobody’s checked them in months Documentation is just one part of the job. The real work is making sure the system reflects what’s on paper and that it stays that way. Write what’s real. Implement what you write. Check often. And make sure your story and your system match. #RMF #Cybersecurity #GRC

25

7 Comments

K-12 Cybersecurity Insider | 8/25/2025 In this edition: * When SSO and MFA Aren't Enough: Hidden Credential Risk in K-12 * L.A. Schools Telehealth Vendor Waited 8 Months to Report Breach * If a 14-year-old could hack them, how weak was security for 400,000 confidential student records? * K12 SIX Announces 2025-26 Steering Committee Read more and sign up to get it delivered straight to your inbox: https://lnkd.in/enaKAHCb #edtech #edusec K12 SIX

26

1 Comment

An IT example of the DOGE craziness. A department moved Linux and Windows system administration from a 3rd party to a new group of FTEs. They are all on probation. The agency now have to fire all of their sys admins because… One of the follow on effects: The security audits are run and security vulnerabilities are identified. The problem is there are no sys admins to assess and approve the patches. The government is too big. This is not how you responsibly shrink it.

124

23 Comments

Kicking off the week reviewing how powerful a well-modeled system can be for reducing cyber risk. Developing and implementing specifications using modeling is where secure design truly begins.  Models like data flows, process diagrams, and system blueprints don’t just organize information ,they uncover risks, highlight dependencies, and help design security into every layer.  1. Clarity in design = fewer surprises in production.  2. Structured specs = stronger security posture. Secure systems aren’t born by accident ,they’re modeled, specified, and intentionally built. #SecureByDesign #SystemModeling #ThreatModeling #CyberExpert#Cybersecurity#MondayMotivation

71

4 Comments