Kalyani Pawar

You might be feeling frustrated by the endless struggle of getting Sigma detection rules to work seamlessly in your open-source SIEM stack. It probably feels like every new rule demands manual conversions, special configs, and a ton of guesswork. It can be exhausting--and I’ve definitely been there. In this walkthrough I introduce how we can incorporate Velociraptor DFIR to solve our Sigma challenge. I share how I set up automated scans, tackled noisy detections, and fed alerts into my incident-response workflow (CoPilot). https://lnkd.in/gX5-X_mN

89

3 Comments

Clorox is suing Cognizant for $380M. The reason? A 2023 cyberattack that crippled their operations, allegedly caused by poor help desk controls and a botched incident response. - This wasn’t just a breach. It disrupted supply chains, damaged customer trust, and is now turning into a legal battle with one vendor blaming the other. As security professionals, we often say: "Third-party risk is your risk." But too often, those warnings get ignored… until it’s too late. This case raises questions that CISOs and boards must be asking: - Are our vendors following the same standards we require internally? - How strong are our controls against social engineering, especially at the help desk? - Do we have contractual clarity around incident response ownership? Link to the full article is in the comments. #Cybersecurity #RiskManagement #GRC #InfoSec #CISOs

99

27 Comments

🧠 ISO 27001 or SOC 2 type 2? I Got Asked This Today by a 50-Person Company — a legit question Here’s what I told them: ISO 27001 = Global, structured, proactive. SOC 2 Type II = US-focused, trust-based, reactive (kind of). 🔐 ISO 27001 is a certification — it means your company has an Information Security Management System (ISMS) in place and audited. 🛡 SOC 2 Type II is an attestation — your auditor says “yes, they followed their controls over a period of time.” So: ✅ Global clients trust ISO 27001. ✅ US-based clients prefer SOC 2. ✅ Want both? That’s actually common — they complement each other. ✅ Early-stage? Start where your customer base lives. ISO builds security culture. SOC 2 proves behavior. Both open doors. Just depends which door you’re knocking on.

60

16 Comments

I generally agree with the saying, "Attackers need to be right once, while defenders need to be right all the time." However, I think it’s often misused and doesn’t apply to most situations where it’s invoked. The majority of breaches happen because of basic vulnerabilities that unskilled attackers easily find using automated tools. So, while the principle itself is valid, it becomes problematic when companies use it to justify being compromised by simple issues like web application vulnerabilities or misconfigurations. At that point, it stops being a reflection of the difficulty of defending systems and starts sounding like an excuse for gross negligence. For example, if an attacker brute-forces credentials and logs in to a web panel with no MFA/2FA, gaining access, this isn’t some inevitable failure of defence—it’s a failure to take even minimal steps to secure the system. Saying "attackers only have to be right once" in such cases isn’t a valid excuse; it’s a sign of negligence. Then you’ll often hear something like, "But it’s easier said than done—look at the size of our attack surface." And it’s like, okay, large attack surfaces do make security more challenging, but that’s why organisations should integrate attack surface management solutions and prioritise fundamental security hygiene. These aren’t insurmountable problems. Claiming that securing basic vulnerabilities is "too hard" doesn’t hold up when tools and strategies exist to address them. The reality is that most organisations lack basic security measures because they don’t prioritise them. There are rarely consequences until a breach happens and causes massive financial damage, and only then does cybersecurity become a "worthwhile" investment. This reactive pattern has persisted for decades. TL;DR: The saying "Attackers need to be right once, while defenders need to be right all the time" is true in principle, but in most cases where it’s used, it doesn’t mean much. It’s often just an excuse for failing to address simple, preventable vulnerabilities.

180

13 Comments

The Changing Era of DevOps to DevSecOps: Shifting Left with Security in Mind Introduction The DevOps revolution reshaped how we build and deploy software—speed, automation, and agility became the norm. But speed without security is a recipe for disaster. As attack surfaces grow and threats evolve, a new shift is underway: DevOps is transforming into DevSecOps, embedding security at every stage of the software development lifecycle. This shift isn’t just about tools—it’s about mindset, collaboration, and responsibility. ⸻ Why DevSecOps? Why Now? Traditional DevOps prioritized CI/CD efficiency, but security often came as an afterthought—leading to breaches, misconfigurations, and technical debt. DevSecOps addresses this gap by: • Integrating security early in the development pipeline (“shift left” approach) • Automating security checks through tools like SAST, DAST, SCA, and container scanning • Fostering collaboration between development, operations, and security teams The result? Software that’s not only fast to market but also resilient, secure, and compliant. ⸻ Key Pillars of DevSecOps 1. Security as Code Infrastructure and security policies are codified, versioned, and auditable—just like application code. 2. Automation First Automated testing, scanning, policy enforcement, and remediation make security seamless and scalable. 3. Continuous Monitoring & Feedback Loops Security doesn’t end at deployment. Runtime monitoring, threat detection, and logging ensure constant vigilance. 4. Developer Empowerment Equip developers with the tools and knowledge to write secure code from day one—security isn’t a blocker, it’s a shared responsibility. ⸻ Cultural Shift: Security Is Everyone’s Job DevSecOps isn’t just a toolchain—it’s a culture change. It breaks down silos and encourages cross-functional collaboration. Security teams evolve from gatekeepers to enablers, working alongside developers and ops to make secure development the default. If you wish to learn further you can connect with https://lnkd.in/ddtpvUuk If you wish to use devsecops tool directly DM me. We have our own tool that works as a one stop solution for all your devsecops needs. #devsecops #devops #sdlc #cloudcomputing #securebydesign

25

2 Comments

💭 SOC platforms are evolving. 💡 What if triaging didn’t just follow rules — what if it became a cognitive process? 💡 What if alerts could explain themselves, and the system could recommend what the risk looks like? Having an L3 analyst on standby 24/7 may not be as expensive as we once thought. 💡 What if repetitive graph-based investigations were handled by specialized agents, while humans stay in the loop for critical decisions? 💡 What if platforms priced based on outcomes, not data volume? The #AutonomousSOC wave is here — and it’s coming faster than we think. Exciting times ahead! 🚀 #platformization #CyberSecurity #SOC #AI #Innovation #AgenticAI #SIEM #XDR Disclaimer: This post reflects general industry trends and ideas, and is not related to any future roadmap or capabilities of my current employer.

34

2 Comments

A heartfelt plea to the AICPA... Please police SOC 2 reports better. You have an amazing process / product / offering - SOC 2 reports. These reports are one of the jewels of the compliance industry. These reports allow companies to explain their organization's cybersecurity program to the world while having a credible party (CPA firms) attest that the information in the report has been validated. However, in the last several years, low end audits have become much more cost effective. Were there bad SOC 2s 10 years ago? I'm sure. But they were not prolific. Now, with automation tools, it is easy to crank out many SOC 2s will minimal human oversight. Some of these reports are so obviously bad that any cybersecurity professional can point to them and call them out. What will be the consequence if things continue along this path? The popularity of SOC2s will diminish and another standards body / organization will take over. As this is happening the reputation of CPAs will be tarnished at least to some degree. What is the remedy? There are several possibilities. Some thoughts: 1) Pseudo-randomly assign which auditing firm evaluates other auditing firms reports. Today, I believe that you get to select who your auditor is. 2) Have CPA firms report statistics to the AICPA. If firms have hundreds of SOC 2s and zero exceptions then there is a good chance that they are not applying rigorous standards to the evaluation. (That is an example. Based on the data, I suspect it would be easy to figure out who the outliers for quality are.) Then, audit those firms that don't pass. 3) Create an AI evaluator for SOC 2 reports and have an organization submit a sample to the tool. Any auditing firm that does not meet a threshold is subject to a more rigorous audit. I bet those in this space could come up with other creative solutions that would not be administratively burdensome for the vast majority of firms that do a great job. I'm with Ayoub Fandi that blaming the automation vendors is foolish. They may be the proximate reason that low quality audits are front and center but they are just operating within the confines of the system. What say you, AICPA? #fciso

68

43 Comments

Exciting News: Launching Vulnerability Management Maturity Model (VMMM) v2 Over the past year, I’ve been working on modernizing the Vulnerability Management Maturity Model (VMMM): a framework that has helped countless organizations assess and improve their vulnerability management programs. Version 2 represents a major step forward: 🔹 Updated domains to reflect today’s realities 🔹 Clearer level definitions with practical examples for each stage 🔹 A companion guide to support consistent application across teams and industries Why does this matter? Vulnerability management is no longer just about patching faster — it’s about reducing exposure in a world of constant pressure, limited resources, and expanding attack surfaces. VMMM v2 provides leaders and practitioners with a structured way to measure where they are, define where they want to go, and take practical steps to get there. I’ll be sharing more details, including self-assessment tools in the coming weeks. https://lnkd.in/eunqyPBs #VulnerabilityManagement #CTEM #Cybersecurity #RiskManagement #VMMM

70

4 Comments

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

Mosi Platt, Sr. Security Compliance Engineer at Netflix, dropped some serious GRC wisdom on the Security & GRC Decoded podcast. Mosi’s been in the trenches for a while and led Security Governance at Elastic before Netflix. So when Mosi talks about making Security GRC an enabler, not a burden, I listen. Mosi said GRC shouldn’t slow the business down. It should fit right in. In this clip, he talks about 3 key ideas: 1. Security and compliance shouldn’t feel like extra work. It should plug right into the tools teams already use. 2. We’re drowning in security data. The challenge? Finding the signals in the noise. 3. Automate. But keep humans in control. I think we would all agree! 💡 Mosi summed it up perfectly: "For [GRC] operations, [we] want to have an integration with the project management system... So that people have a way they like to work [and] the system doesn't step on their toes... It fits right in." It’s really gratifying to hear Mosi talk about this, because it’s what we’re building at ComplianceCow: integrated SecurityGRC automations that fit into how teams already work. Check out the full podcast / video for more of Mosi’s GRC wisdom. I also discuss our entire conversation in a blog. You know where to find the links. :) #GRC #SecurityGRC 

21

1 Comment