Caroline Wong

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 Comment

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

“Storm Watch” wasn’t just the title. It was the reality we unpacked. At RSAC Conference 2025, I joined Brett Leatherman, John Carlin, and Tim Maurer for a standing-room-only session moderated by Marc Raimondi, where we discussed the intensifying threat landscape, including the surge in Typhoon-class cyber campaigns linked to China. 📈 China’s operations are increasingly sophisticated and persistent. Their playbook includes zero-day exploitation, large-scale CVE scanning, and long-term embedding in critical infrastructure, with objectives spanning geopolitical positioning, economic influence, and disruption readiness. 🔧 OT and ICS environments remain highly exposed. Remote access vulnerabilities and outdated systems create easy entry points. The "air gap" mindset is no longer viable. Security leaders must extend Zero Trust architectures to operational technology. 🤝 Threat intelligence sharing is improving, but still not fast enough. Progress has been made in public-private collaboration, but intelligence needs to be real-time, contextualized, and actionable across sectors. 📊 Scenario planning must become operational. We discussed the move toward living tabletop exercises - simulations that test not only SOC readiness but also enterprise-level continuity, crisis response, boardroom decision-making, and extend to your ecosystem of providers. ✅ What now? Fight AI with AI. Attackers are automating discovery and deception. CISOs, CTOs, and CIOs must accelerate adoption of AI-driven detection, response, and decision support - not to replace teams, but to enable them to act faster and smarter. We closed the session with a clear message: Leaders who invest now in AI-driven security, resilient architecture, and operational readiness won’t just mitigate risk. They’ll position their organizations to lead through uncertainty. Palo Alto Networks

168

8 Comments

In another significant move, the Multi-State Information Sharing and Analysis Center (MS-ISAC) has lost its federal funding due to redundancy with other services provided by the Cybersecurity and Infrastructure Security Agency (CISA). This decision is expected to save taxpayers approximately $10 million annually. While cost savings are always welcome, the impact on state and local cybersecurity operations cannot be overstated. Federal Funding Cut: MS-ISAC's loss of federal funding means state and local governments must now rely more heavily on CISA's services. This shift requires a strategic approach to ensure continued cybersecurity resilience. Cost Savings: While the $10 million annual savings seems like a clear benefit, it's crucial to balance this with the potential risks of losing specialized support that MS-ISAC provided to over 18,000 entities. It also adds strain to CISA, which has seen 130 positions cut this year so far. Impact on States: State and local officials valued MS-ISAC's resources, including intelligence briefings, incident response support, and penetration testing. The loss of these services will create gaps in their cybersecurity posture. It is not clear if CISA will be able to perform all functions of MS-ISAC, but it seems unlikely. State officials have expressed concerns over the loss of MS-ISAC's services, emphasizing their importance in safeguarding elections and overall cybersecurity. State and local governments should fully utilize CISA's security advisers and services for cybersecurity and physical security assessments. The loss of MS-ISAC's federal funding is a wake-up call for state and local governments to immediately reassess their cybersecurity strategies and be prepared to fill in any gaps: likely on their own. Read more at StateScoop: https://lnkd.in/ehhAT6nZ

18

1 Comment

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

Is Cyber Risk on the Rise? Next week, I'm doing a webcast for the RSA Conference to explore that question using 15 years of data on security incidents and losses. It draws from the upcoming 2025 Information Risk Insights Study (IRIS) from Cyentia Institute. Details and registration link below. Summary: Is cyber risk truly skyrocketing, as many believe? Are organizations more prone to breaches now than they were 10 years ago? Have the financial impacts of security incidents increased or decreased over time? Are these trends similar across organizations of all types and sizes? We’ll answer these questions together by analyzing a huge historical dataset of cyber events and losses. #cyberrisk #cyberresilience #cybersecurity March 26, 2025 | 10:00 AM PT | 1:00 PM ET Register: https://lnkd.in/ep3GKQ5w

46

6 Comments

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

For those of you navigating CRA & RED-DA compliance… this one’s worth a read. For many years product security compliance was treated like a checklist exercise something to rush through right before launch. CRA and RED-DA changed that. Today, compliance isn’t optional, and treating it as a one-off task is a recipe for delays, lost trust, and missed opportunities. My colleague David Nosibor shares how the PSCOPE Maturity Framework can flip the script turning regulatory compliance into a continuous operational capability that drives performance, scalability, and trust. Instead of chasing PDFs and scrambling for evidence, PSCOPE builds shared language, measurement, and maturity across governance, automation, supply chain, and monitoring. I strongly believe that this is exactly the kind of shift our ecosystem needs. https://lnkd.in/eBudy-wk #CyberSecurity #CRA #RED #Compliance #ProductSecurity #PSCOPE #ContinuousCompliance #CyberResilience #IoT #Regulations #CyberPass

20

1 Comment

Cyber Attack Impacting Oregon Environmental Department The Oregon Department of Environmental Quality has reported a cyber attack that is affecting communications and operations including vehicle inspections. Some services will be shuttered through the weekend. #Oregon #cyber #cybersecurity #cyberattack #government https://lnkd.in/exc6as2w

14

3 Comments

Dumping LSASS or using AD brute-force tools like PlusBrute to access credentials is common, but these techniques carry a risk of triggering detections. Lately, the Rapid7 team has observed threat actors taking a quieter path: installing FTK Imager, a legitimate forensic tool, to collect registry hives and other credential-rich artifacts. In some cases, they’re even creating antivirus exceptions to ensure uninterrupted access. This approach lets attackers gather valuable credential data while avoiding techniques that might set off alerts. 👇 Here’s more on what our Responders are seeing: https://lnkd.in/eShdv_s8

136

4 Comments