Mike Fitzpatrick

The addition of the Govern function in NIST CSF 2.0 addresses the rise of risk management and governance as an essential task for IT and security teams. While it has existed in previous versions, this elevation to a core function places it in a position of necessary prominence for any organization looking to proactively assess, mitigate, and transfer their cyber risk through risk-driven cybersecurity strategies.

12

🚨 Updated Microsoft 365 Mappings to MITRE ATT&CK🚨  Microsoft 365 (M365) to ATT&CK mapping S serve as a foundation for implementing a threat-informed defense strategy in your M365 Software as a Service (SaaS) environment. The mappings connect ATT&CK techniques with four core M365 product areas: ✅ Microsoft 365 Defender ✅ Microsoft Entra ID ✅ Exchange Online Protection ✅ Microsoft Purview The resources illustrate how M365 security capabilities can protect against, detect, and respond to real-world threats. Understanding how the implementation of M365 security capabilities can mitigate adversary techniques is a valuable tool for organizations to improve their threat-informed defense strategies and enhance their overall security posture. Get the mappings here: https://lnkd.in/ecFMd6d2 Read blog to learn what’s next on our mappings roadmap: https://lnkd.in/ecxcSjuV #Microsoft365 #M365 #ThreatInformedDefense

20

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana W. for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

214

19 Comments

📕 Quantum Ready: 🔑 The Enterprise Guide to Post-Quantum Cryptographic Readiness Author: Walt Powell CISSP, CISM Lead Field CISO CDW Category: Encryption          Publisher: CRC Press   🚨 Are you ready for the day your encryption fails silently?   Quantum Ready is not just a warning; it’s a field guide for the era of quantum disruption. As quantum computing accelerates toward the threshold where today’s encryption becomes obsolete, organizations must prepare now or risk a catastrophic breakdown in digital trust.   Written by one of the world’s first Field CISOs, this book delivers a strategic, vendor-neutral roadmap for CISOs, security architects, and IT leaders responsible for protecting long-term data and infrastructure.   It introduces the Q-Ready Framework, a comprehensive five-phase approach to discovering, prioritizing, migrating, validating, and sustaining quantum-safe cryptography across the enterprise.   In this hands-on guide, you’ll learn how to:   ✅ Identify where vulnerable cryptography lives in your environment ✅ Evaluate business impact using real-world risk models like Mosca’s equation ✅ Design migration and testing plans tailored to your infrastructure ✅ Replace RSA, ECC, and other algorithms with NIST-approved quantum-safe alternatives ✅ Apply post-quantum cryptography to TLS, VPNs, code signing, and IoT ✅  Build crypto-agility into your systems, teams, and governance   With practical checklists, actionable advice, and insights from hundreds of field engagements, Quantum Ready goes beyond theory and into the trenches.   Whether you’re already on your migration journey or just beginning to assess the threat, this book will prepare you to lead with confidence through one of the biggest shifts in cybersecurity history.   ⏰ The clock is ticking.   Read now, and be the reason your organization is still trusted tomorrow. 📚📔📕📙📓📒📗📘 Lance Scoular 🔹️ The Savvy Navigator 🧭🌐 #amazoninfluencer #book #ad #amazonbooks #fromtheauthorsmouth #Quantum #Ready  #Enterprise #Guide #PostQuantum #Cryptographic #Readiness   https://lnkd.in/gqBepeXQ

54

13 Comments

Elements For Good Cyber Hygiene (Infographic) Good cyber hygiene is built on several key elements, crucial for both individuals and organizations to navigate the evolving cyber threat landscape. Taking proactive basic steps helps minimize vulnerabilities and enhance preparedness against cyber threats. For more on Cyber Hygiene please see: Cyber Hygiene By Chuck Brooks https://lnkd.in/dpYC8gyD #cybersecurity #cyberhygiene #riskmanagement

97

17 Comments

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

Most cybersecurity updates fail before the first slide. Why? Because boards don’t care about tools. They care about outcomes. Joe Cozzupoli @ Cosive gives his 2 cents. Boards don’t want acronyms, heat maps, or a rainbow of red amber green. They want to knowwww..... What does this mean for the business? If your board pack is a dashboard, you’re reporting. If it’s a one pager with scenarios, impact, cost and a clear recommendation. The job isn’t to describe risk. It’s to frame decisions. Strong cyber leaders don’t hide behind data. They give context. They give options. They give an opinion. Cyber risk isn’t technical. It’s commercial. And the board expects you to treat it that way. Take a listen to this interview and PLEASE don't forget to subscribe and follow the show for the latest episodes. 💜 #Vanta

27

2 Comments