Mehlam Shakir

The DVMS Institute is honored to partner with Navvia and participate in its NIST Cybersecurity Framework 2.0 Risk Assessment and Process Modeling Platform launch at the ISACA 2025 North American Conference in Orlando, FL, from May 21 to 23rd. Navvia's innovative solution integrates the key security outcomes from its NIST CSF 2.0 assessments with your IT Service Management (ITSM) processes. This practical solution helps you focus on the relevant security practices and the underpinning processes required to maintain and improve your security posture. Navvia is also a training partner of the DVMS Institute, offering its clients the only Accredited (APMG International), Assured (NCSC-GCHQ-UK), and Recognized (DHS-CISA-NICCS) NIST Cybersecurity Framework Digital Value Management System certification training programs that teach Leadership and Frontline Employees the skills to build a Holistic, Adaptive, and Culture-Powered Overlay System designed to enable Cyber Operational Resilience in complex, multi-vendor digital ecosystems. Looking forward to seeing you in Orlando

19

2 Comments

You might be feeling frustrated by the endless struggle of getting Sigma detection rules to work seamlessly in your open-source SIEM stack. It probably feels like every new rule demands manual conversions, special configs, and a ton of guesswork. It can be exhausting--and I��ve definitely been there. In this walkthrough I introduce how we can incorporate Velociraptor DFIR to solve our Sigma challenge. I share how I set up automated scans, tackled noisy detections, and fed alerts into my incident-response workflow (CoPilot). https://lnkd.in/gX5-X_mN

90

3 Comments

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

The CVE Program — as we know it — just almost expired. MITRE’s contract to run the Common Vulnerabilities and Exposures (CVE) Program was to end April 16, 2025. That’s the system we all rely on to coordinate software vulnerability disclosures. No #CVE means no standardized alerts, no shared language for tracking threats, and a whole lot of chaos for defenders. Over 2,800 CVEs are issued monthly. Without continuity, threat actors get a head start — and defenders are stuck making up names like “That-One-Unpatched-Thing-In-The-Corner.” #CVE #Cybersecurity #OTSecurity #MITRE #CISA #MaxAI #CyberIn60Seconds #Resilience #mikeechols Leslie EcholsChuck BrooksChloe BurkeLes McCollum II, MPS-CRMCalvin Nobles, Ph.D.Danyetta Fleming Magana, CISSP, F. ISRMLaszlo Gonc, CISSP, QTESean Cooper Robert CraneLester Lewis, MBA#CISAntonio "T" ScurlockRoy White, MBA, PMPHoward TsaiTamika McCree ElhilaliJeffrey M. Vinson, Sr CISSP, CCISO, CIPP, NSA IAM-IEMGuy WaltonGotham ArtistsMatthew DimmickTim CooganJohn B MooreDeborah PageAdam Mohamed#aws #informationsharing #mikeechols

37

3 Comments

What the DFIR analyst does during an IR engagement (not only equal to a firefighter or detective) is not the same as what the management should do in handling an incident or what the GRC should do in managing an incident. Why do some experts write a playbook to combine every aspect of DFIR for the technical team to follow? Why does the procurement write a tender to ask a service provider certified with CISM/CISSP or equipped with digital forensic tools to do the IR tasks like this?

69

Most security teams run on a dozen different tools. Crisis detection systems, notification feeds, GSOC dashboards, case management systems, travel risk management platforms, risk models, and site assessment systems. The list goes on. Each one needs location threat intelligence, but few actually have it. That's the problem we built our API to solve. Customers have been loving our API since it was first released, and the use cases keep expanding. Today we're making it official with a dedicated API page on our site that breaks down exactly how security teams integrate Base Operations into their existing tech stack. Here's what it enables: 𝗚𝗦𝗢𝗖 𝘁𝗵𝗿𝗲𝗮𝘁 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴. Feed BaseScore and detailed threat breakdowns directly into your operations center. Your analysts get standardized risk context for every location they monitor without switching tools. 𝗖𝘂𝘀𝘁𝗼𝗺 𝗿𝗶𝘀𝗸 𝗺𝗼𝗱𝗲𝗹𝗶𝗻𝗴. Our API provides BaseScore and 16 standardized threat categories at sub-mile granularity. So you can build crime and unrest threats directly into your risk model across every location. 𝗧𝗿𝗮𝘃𝗲𝗹 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗱𝘂𝘁𝘆 𝗼𝗳 𝗰𝗮𝗿𝗲. Connect local threat data to your travel management platform so you implement policies effectively and provide recommendations to your people. 𝗦𝗶𝘁𝗲 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗮𝗻𝗱 𝗽𝗼𝗿𝘁𝗳𝗼𝗹𝗶𝗼 𝗺𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴. Query and compare threat profiles for any location across 5,000+ cities using the same consistent methodology. Most teams complete integration in 5-30 days. No rebuilding your stack. No 12-month data engineering projects. One REST API that connects once and feeds local intelligence everywhere it's needed. Check out the full API page to explore endpoints, specs, and use cases: https://lnkd.in/endwHPcT

19

2 Comments

The Pennsylvania Supreme Court recently ruled that police can access someone's Google searches without a traditional warrant, finding no reasonable expectation of privacy in unprotected search queries. On this week's episode of the Shared Security Podcast, we discuss what a reverse keyword search warrant is and why this ruling could change our expectations for privacy with the technology we use! What do you think about this recent ruling? Let me know in the comments below!

31

6 Comments

Is Cyber Risk on the Rise? Next week, I'm doing a webcast for the RSA Conference to explore that question using 15 years of data on security incidents and losses. It draws from the upcoming 2025 Information Risk Insights Study (IRIS) from Cyentia Institute. Details and registration link below. Summary: Is cyber risk truly skyrocketing, as many believe? Are organizations more prone to breaches now than they were 10 years ago? Have the financial impacts of security incidents increased or decreased over time? Are these trends similar across organizations of all types and sizes? We’ll answer these questions together by analyzing a huge historical dataset of cyber events and losses. #cyberrisk #cyberresilience #cybersecurity March 26, 2025 | 10:00 AM PT | 1:00 PM ET Register: https://lnkd.in/ep3GKQ5w

46

6 Comments

Self-Healing IAM Systems - A Business Centric Framework 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   A self-healing IAM system enhances enterprise security by automating identity governance, mitigating operational risks, and ensuring adaptive security resilience.  By leveraging this framework organizations can create dynamic, self-correcting identity frameworks that reduce administrative overhead and improve security posture. Self-healing mechanisms ensure robust access management by automatically detecting and mitigating disruptions, policy misconfigurations, or security anomalies.   https://lnkd.in/ecm7Bz8V   Tune in now and let's check them out together 🎧🔍   #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessManagement #IAM

36

2 Comments