Gary Chan

Cybersecurity is fundamentally a human skill. It's not just for IT experts or executives; everyone plays a role in maintaining our shared network's safety. We protect what we value—our homes, families, and communities. Applying the same care to the systems that connect us strengthens our habits around technology and as people. Lead by example. Being more secure is about being more aware, intentional, and ultimately, more human. #CyberSecurity #HumanSkills #DigitalSafety #OnlineSecurity #TechHabits

7

7 Comments

🎯 HIPAA security rule: The 3 Safeguards You MUST Know 🛡️ Administrative Train your team. Define roles. Document everything. No guesswork — just audit-ready clarity. 🏥 Physical Lock it down. Secure devices, workstations, and access points. If it’s not protected, it’s vulnerable. 💻 Technical Encrypt. Authenticate. Monitor. Your systems should be smarter than the threats. ✅ Want to make sure your practice checks every box? Grab your FREE HIPAA Compliance Checklist now: 🔗 https://lnkd.in/g7PSzeSv #hospitals #healthcare #doctors #cybersecurity #compliance

11

SOC Meets Waymo What Happens When Security Stops Needing Hands on the Wheel For years, SOC teams have been told the same story: automate more, hire smarter analysts, tune alerts, reduce fatigue. And for years, the SOC has still looked the same at 2:17 a.m., alerts stacking up, humans in the loop, and response speed limited by who’s awake and how fast they can decide. That’s starting to change. Not because analysts got better. 
Not because tools got prettier dashboards. But because parts of the SOC are no longer waiting for humans to drive. Think about what Waymo represents. Not a faster driver. Not a better steering wheel. A system that can see, decide, and act within defined boundaries, without asking a human to touch the controls every time the road curves. That’s the moment the SOC is entering right now. The Human Driven SOC Has a Ceiling Traditional SOCs are human‑driven systems with machine assistance. Tools detect. Humans decide. Humans act. That model worked when: * environments were smaller
 * attackers were slower
 * incidents unfolded over hours or days
 None of that is true anymore. Today’s attacks are: * automated
 * probabilistic
 * designed to move faster than human workflows
 We respond with runbooks, paging trees, and escalation policies that assume time exists. Often, it doesn’t. The bottleneck is no longer detection. 
It’s decision latency. And no amount of “better alerting” fixes that. Cyberscript IT Solutions Pvt. Ltd. Cybersecurity and Infrastructure Security Agency Health Sector Coordinating Council - Cybersecurity

2

1 Comment

Why your CMMC assessment tool shouldn't live in the cloud Hook: reframe the default. Every compliance vendor is a SaaS company — and for most software, that's right. But not for this data. Every compliance vendor today is a SaaS company. Login screens, dashboards, "sync across devices," multi-tenant databases. And for most software, that's the right call. But think about what a CMMC Level 2 readiness assessment actually contains: → A detailed map of which NIST 800-171 controls you've implemented → Every control you haven't → Evidence references, system names, configuration notes → A live SPRS score calculation → Your POA&M — literally a prioritized list of your gaps In other words: a blueprint for attacking you, helpfully organized by domain. Putting that in someone else's cloud is a choice. It should be a considered one. Over the next few posts I'll walk through how we built the CRS CMMC Level 2 Readiness Assessment Tool as a single-file, local-first application — and why the engineering decisions that follow from "no cloud" make it materially harder to steal your data, even if your network gets breached. #CMMC #NIST800171 #Cybersecurity #DefenseIndustrialBase

6

Lately I’ve been thinking about Security Metrics and how we need to reframe the conversation and provide decision clarity for executive leaders… Most security updates today are: ▶️ Operationally detailed. ▶️ Strategically thin. ▶️ Activity driven They’re full of: ⏺️ Vulnerability counts ⏺️ Patch percentages ⏺️ Tool performance metrics Instead of reporting: “97% of critical vulnerabilities patched.” We should report: “We reduced revenue-impacting cyber risk by 35% across our most critical business systems.” This change prevents reporting what security teams are doing and starts reporting what the enterprise can withstand. → Are we reducing enterprise risk in a measurable way? → Are we prepared to operate through disruption? → Is cyber investment protecting growth and shareholder value? If reporting can’t answer those, it’s not executive intelligence, it’s operational noise. 🚀 #Cybersecurity #CyberRisk #RiskManagement #OperationalResilience #BusinessContinuity #ExecutiveLeadership #ModernCISO #EnterpriseRisk #DigitalLeadership #Resilience

37

7 Comments

I asked my buddy Grok the following - in terms of risk calculation does cyber risk act on a bell curve or is it more like a spike? I'll summarize the response. If you want to geek out, click the link at the bottom. Could you imagine if you went through all of the time and treasure to calculate your risk and make important decisions only to find out at an inopportune time that you used the wrong model? Form Grok: Cyber risk doesn't follow a neat bell curve. It's more like a sharp spike of everyday minor incidents with a dangerously long, heavy tail of rare but catastrophic events that happen far more often than Gaussian models predict. The popular FAIR model (Factor Analysis of Information Risk) is excellent for breaking down risk into quantifiable factors and running Monte Carlo simulations, but don't put too much solace in it alone: it often relies on lognormal or similar distributions for severity that can still underestimate those extreme tails where real-world cyber losses (think massive breaches or ransomware shutdowns) behave more like power-law/heavy-tailed phenomena. Bottom line for risk pros: use FAIR as a strong starting framework, but layer in tail-focused methods (extreme value theory, Pareto tails, etc.) and stress testing to avoid dangerously understating black-swan-level exposures. Stay vigilant, cyber catastrophes aren't as "six-sigma rare" as bell-curve thinking suggests. Or just comment #easybutton below and I can show you the way. #CyberRisk #RiskQuantification #FAIR #TailRisk The entire response if you want to geek out is at: https://lnkd.in/eUkpxnww. But the summary is

13

🔥🔥Hot Take Tuesday 🔥🔥 Security Third-Party Risk Management is one of the most overhyped, lowest-ROI functions in cybersecurity. 📜 We’ve built teams around questionnaires, third party "scoring", SOC reviews, and vendor scorecards, but what are we really getting? 🧻 Sanitized, legal-approved answers 🔬 Narrowly scoped and inconsistent assessments 👉 Point-in-time attestations 🤥 Little operational truth - Oh the lies!!! And when a critical SaaS provider has weak controls… what’s the leverage? Terminate them? Force redesign? Usually not. Fourth-party risk? Even more abstract. At scale, all of this becomes risk theater. 🎭 Meanwhile, we have internal attack surface threats growing, exposure management fights for budget, identity sprawl expands. We’ve confused activity with impact... lots of busy work going on. I’m not saying vendor risk doesn’t matter, I’m saying the current model is broken. Until we measure real exposure, integrate technical telemetry, and tie vendor risk to exploit paths, we’re optimizing paperwork and not protection. The ROI just doesn’t work. How many CISOs agree but won’t say it? What are your thoughts on TPRM? I'll drop an even bigger doozy next week relating to this topic. #StayTuned #CyberSecurity #CISO #ThirdPartyRisk #RiskManagement #NoBSecurity #CISOHotTakes #ModernCISO

215

39 Comments

Most cybersecurity updates fail before the first slide. Why? Because boards don’t care about tools. They care about outcomes. Joe Cozzupoli @ Cosive gives his 2 cents. Boards don’t want acronyms, heat maps, or a rainbow of red amber green. They want to knowwww..... What does this mean for the business? If your board pack is a dashboard, you’re reporting. If it’s a one pager with scenarios, impact, cost and a clear recommendation. The job isn’t to describe risk. It’s to frame decisions. Strong cyber leaders don’t hide behind data. They give context. They give options. They give an opinion. Cyber risk isn’t technical. It’s commercial. And the board expects you to treat it that way. Take a listen to this interview and PLEASE don't forget to subscribe and follow the show for the latest episodes. 💜 #Vanta

27

2 Comments

Registry of AI Agents Gone Rogue Quick list of about a dozen or so actual examples organizations faced when AI Agents went rogue. Practical use is to provide risk scenarios that back "the why" behind addressing these risks. A quicker use is morbid curiosity where for example in the first case an Agent tried to solve a problem and determined that the best route forward was to delete a large data volume, an action never requested. And it did so by searching the large set of information at hand which included a key for wide permissions. Ouch. https://lnkd.in/gJVpbTjK

44

6 Comments

Most businesses don’t fail audits because they ignore security. They fail because they didn’t know what they were missing. A proper Gap Analysis reveals: Where your policies are incomplete Which controls are misaligned What documentation is missing How to fix it, fast We run gap assessments for CMMC, HIPAA, SOC 2, and more—with AI-assisted reporting.

Your pen test passed technical review. Your examiner still issued an MRA. Here's why: Technical soundness and regulatory compliance aren't the same measurement. Examiners automatically escalate three specific gaps to MRA status regardless of your CVSS scores or vulnerability counts. If you can't prove your compliance-required controls actually work, findings escalate. I'm reviewing documentation for institutions preparing for upcoming exams. I'll tell you exactly what would trigger an MRA in your current testing and what documentation closes the gap before your examiner arrives. Limited slots available - link in comments What would your examiner escalate if they reviewed your documentation tomorrow? #CyberSecurity #PenetrationTesting #RegulatoryCompliance #FFIEC #BankingCompliance

1

1 Comment

Can you list all the risks that using AI opens your organisation up to? No, me neither because they keep evolving. Check out this post for some you've not thought about, and forward this to your colleagues who think your existing cybersecurity is will have everything covered.

20

2 Comments

VulnCheck reports that in the first half of 2025, 32.1% of exploited vulnerabilities were zero‑days or one‑days, up from 23.6% in 2024, highlighting that threat actors are attacking faster than patch cycles. #CyberResilience #ZeroDay #ThreatDetection #VulnerabilityManagement #CISOLeadership https://lnkd.in/eaYYYgeD

7

The 9 disciplines every compliance framework tests. Here is the thesis. CMMC, FedRAMP Rev5, and FedRAMP 20x really boils down to the same core operational disciplines. The wording differs. The cadence differs. The evidence format differs. The work is the same. We manage 15+ compliant environments across FedRAMP Rev5, 20X, CMMC, and IL5. We have delivered over 500 ConMon packages. We've lived the pain before we built a platform to help ourselves. Every month, for every client: export scan results from multiple scanners, normalize into one schema, figure out what is new vs remediated vs reopened, reconcile cloud inventory against the spreadsheet, open change tickets that have no linkage to the POA&M items they remediate, chase email approvals, assemble the ConMon package by hand. Then the audit hits. An assessor asks you to trace a change to the POA&M item it remediated. You cannot connect the thread cleanly. The 9 disciplines: 1. Change Management 2. User Access Management 3. Vulnerability Management 4. Continuous Monitoring 5. OSCAL-Based Documentation 6. Asset Inventory 7. Deviation Management 8. Compliance Reporting 9. Incident Response Plus the five Rev5 Balance improvements that bridge Rev5 to 20x: MAS, SCN, ADS, VDR, CCM. We started with an ITSM built on Halo and transformed it into a GRC-ITSM. One platform. One data model. Three frameworks. Assets, issues, changes, approvals, deviations, scans, and reports live in the same system. The relationships between them are not maintained manually. They are the data model. The workflow is the evidence. Starting Monday, we are running a series covering each discipline across CMMC, FedRAMP Rev5, and FedRAMP 20x and also each Rev5 Balance improvement. Each post links to the full article on the site. Post linked in the first comment. Compliance is a byproduct of operations, not a separate workstream.

10

5 Comments

The Patching Era is officially over. Last week, Anthropic’s Project Glasswing proved what many of us have feared: AI can now discover and chain vulnerabilities at a velocity that makes human-speed remediation mathematically insolvent. If discovery is O(n^2) but your patching pipeline is throughput-limited and O(n), your "Security Debt" isn't just growing—it’s a systemic failure in the making. I recently led a discussion at FS-ISAC on why we must pivot from an Additive Past to a Subtractive Future. The consensus among peers was clear: we are no longer "bracing" for a volume of bugs; we are "comprehending" a structural shift in how we defend the stack. The Core Realization: Vulnerabilities are just sparks. Your architecture determines whether those sparks become a fire. In the Post-Patching Era, we stop counting bugs and start erasing paths. We move from the "Hero Culture" of reactive firefighting to the Science of Silence. Key Metrics for the New Normal: ·      Path Erasure Rate (PER): A leading metric that measures structural risk removal and the reduction of attacker optionality. ·      Non-Conductivity: Engineering environments where exploits "spark" but cannot travel, rendering even 27-year-old zero-days inert. I have shared my full FS-ISAC presentation, "Welcome to the Post-Patching Era," on my site. This isn't just a slide deck; it’s a blueprint for achieving Deterministic Defense. https://lnkd.in/egMZZ3T9 #CyberSecurity #CISO #SubtractiveSecurity #InfoSec #PostPatching #ScienceofSilence

36

12 Comments

If you haven't been paying attention to security while developing and maintaining your IT services or product, you might want to consider the impact of security debt. The concept of 'security debt' parallels technical debt. It's the accumulated security weaknesses resulting from past shortcuts or deferred security work. Security debt accrues interest: vulnerabilities multiply, remediation becomes more expensive, and business risk increases. Organizations should systematically inventory, prioritize, and retire security debt. Ignoring security debt doesn't eliminate it; it compounds it. Strategic security debt management prevents crisis-driven remediation.

3

I follow all the Top Security Vendors and work to monitor their Annual Reports to track Trends so i recently Attended the MANDIANT - Security Trends 2025 Report Review..... Financial is STILL at the Top of the Hacker... but followed Closely by the Healthcare industry while Gov’t has moved UP a couple of notches to No 4. Note that the Top-Rated Security Company – MANDIANT – strongly suggests that your Company take 2 areas *very Seriously* - #1 - TVM/ Patching your systems and then #2 – Hardening your Systems (and Network). Not sure what these are exactly….? Contact the CyberSecurity A-Team… Most Attackers are using many Cloud-Native functions and Apps – so BREACHES TODAY ARE CLOUD-BASED. Note that Non-Profits *continue* to be on the List of Targets. Hackers are very aware that Non-Profits are Rich with Donations…. But Poor in Technology and (security) Talent. Have Doubts or Concerns that your Non-Profit Security Team or Infrastructure are Vulnerable to Hackers / Attacks…? Contact the CyberSecurity A-Team – they have several cyber Staff that specialize in Non-Profits having helped several Groups – Holy-Trinity Church, Booker T. Wash H.S., Salvation Army, etc. I’m adding a few Key Statistics / Slides in the Comments – including the List of Targets Industries, Attack Vectors, and Malware Classes by Machine-Type. #MandiantSecurity #HackerAttack-Trends #HealthcareIndustry #CyberSecurity-A-Team #M-Trends-Report-2025 xx

2

2 Comments

HIPAA is on the verge of its most significant security update in nearly 25 years—and the timeline is still uncertain. The Department of Health and Human Services’ Office for Civil Rights set a May target to finalize its proposed HIPAA Security Rule overhaul, but it is unclear whether that deadline will be met. If adopted, the rule would introduce some of the most substantial changes since the original Security Rule, including a major shift for covered entities and business associates: the long-standing distinction between “required” and “addressable” implementation specifications would disappear. Controls such as encryption and strong authentication would become mandatory in almost all cases, with only narrow exceptions. Now is the time for healthcare leaders to assess readiness, close gaps, and prepare for a more prescriptive security baseline. https://hubs.ly/Q04hdmxp0

3

1 Comment