🍀 Tim O.

The SANS Institute SOC Survey 2025 uncovers how modern SOCs are staffed, structured, and run. It also highlights where teams are falling behind - with manual reporting, alert fatigue, tool sprawl, and limited visibility into budgets and business impact. Download the full report to uncover: ✅ Modern SOC org structures, staffing, and outsourcing trends ✅ Top technologies...and where they’re falling short ✅ How AI is actually being adopted in the SOC ✅ The real story behind SOC metrics and reporting Get the report here: https://lnkd.in/ekWR2UXT

32

1 Comment

The Cybersecurity and Infrastructure Security Agency issued a new draft guide for software bills of material (SBOMs) that makes several major updates to the minimum elements first published in 2021. #cybersecurity #infosec #ITsecurity

2

A recent CISA alert highlights a widespread supply chain compromise impacting the npm ecosystem, a critical component for many businesses. ([cisa.gov](https://lnkd.in/gmjKBPSD)) This incident underscores the importance of monitoring third-party dependencies to prevent potential security breaches. To mitigate such risks, regularly audit your software supply chain for vulnerabilities and ensure all third-party components are up-to-date. Read the full report here: ([cisa.gov](https://lnkd.in/gmjKBPSD)) How does your organization manage the security of its software supply chain? #CybersecurityTip #BusinessSecurity #TechLeadership

1

CISA Adds Four Vulnerabilities to KEV Catalog — Time to Act The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog, adding four security flaws after confirming evidence of active exploitation in the wild. Staying informed and responding quickly to KEV additions is critical to reducing exposure and protecting your organization. Highlighted in the update: - CVE-2025-68645 (CVSS score: 8.8) — A PHP remote file inclusion vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that could allow a What this means for security teams: - Treat KEV-listed vulnerabilities as high-priority. CISA adds entries based on observed exploitation, so rapid remediation is essential. - If you run Zimbra Collaboration Suite, prioritize verification, patching, or implementing vendor-recommended mitigations. - Inventory affected assets, apply patches or mitigations, and validate remediation through scans and tests. - Monitor logs and detection systems for indicators of compromise, and update IDS/IPS and EDR signatures. - Coordinate with incident response and business stakeholders to ensure continuity and communication. Next steps: 1. Review the full KEV update and CISA guidance. 2. Identify affected systems in your environment. 3. Apply patches or mitigations immediately, or implement compensating controls if patching isn’t possible. 4. Validate remediation and continue heightened monitoring. Read the full report and details here: https://lnkd.in/gWKuscKP Staying proactive, coordinated, and transparent is our best defense. If you need to prioritize actions across your estate, now is the moment to mobilize resources and reduce risk. #Cybersecurity #CISA #KEV #VulnerabilityManagement #Zimbra #ThreatIntel #PatchNow #Infosec #IncidentResponse #SecurityOps

1

Hacktivists exploited a ScadaBR vulnerability, prompting CISA's warning. This attack could disrupt critical infrastructure operations, causing significant operational downtime and potential physical damage. Defenders should immediately patch ScadaBR systems and monitor for any suspicious activity to prevent exploitation. 💥⚠️ #CyberNewsLive https://lnkd.in/grH-UT_s

1

What’s the relationship between threat modeling and risk management? It’s one of the most common questions asked and the answer often surprises people. Threat modeling isn’t just a subset of risk management, it often precedes it. In fact, we handle the majority of threats through good engineering long before formal risk quantification even starts. Risk becomes essential only when we hit edge cases: when threats are unavoidable, when costs get high, or when regulators demand it. Most of the time, we’re building bridges, not running insurance calculations. If you're still approaching security through the lens of “what's the risk?”, it might be time to zoom out. Start with threat modeling. Here's a helpful read from 😷 Adam Shostack on the topic. Check it out. https://lnkd.in/e8g3h32R

7

Not all audit reports are created equal. Fortune 1000 CISO Rick Orloff, CISSP, CAPI has reviewed thousands of them. In his experience, most reports fall short in the same three areas: 🔹 Scope: If the right risks aren't in scope, nothing else in the report matters. 🔹 Findings: Raw findings without context don't drive decisions — they create noise. 🔹 Management response: How an organization responds to findings reveals more about its security culture than the findings themselves. A weak audit report can erode stakeholder confidence, miss real risks, or worse, give a false sense of security.   Read the full blog to see how Rick evaluates reports — and what he wishes more teams would do differently. 🔗https://lnkd.in/epms9TSN

30

If NIST CSF is the strategy, NIST RMF is the process. The Risk Management Framework guides U.S. federal agencies and contractors on how to select, implement, and monitor specific security controls. If your organization works with U.S. government systems, this is the standard you need to know. 6clicks helps teams operationalize NIST RMF without the manual overhead. Learn more 👉 https://hubs.li/Q04fWKP-0 #6clicks #NISTRMF #RiskManagementFramework #CyberSecurity #GRC

26

4 Comments

"Assessors not supposed to be creating scope for you. They’re supposed to validate scope," said Fernando Machado, CISSP, CISM, CCA, CCP, Managing Principal and CISO at Cybersec Investments. He spent his session clarifying some persistent misconceptions around CMMC, including: ✅ Compliance = 110 requirements in NIST 800-171 and 320 assessment objectives in 171A. ✅ Waivers are not for you specifically as SMB, but for the entirety of a program. ✅ The DoD phased rollout only applies to primes. Subcontractors are seeing requirements flow down much sooner from their primes. Register to access the on-demand recording of this session and dozens more: https://lnkd.in/eGUdruEQ #CybersecuritySummit2026

13

Bomb threats, whether credible or not can cause serious disruption and put people at risk if handled improperly. The difference between chaos and control is preparation. We’re sharing an important Bomb Threat Guidance resource from CISA (Cybersecurity and Infrastructure Security Agency) to help organizations understand: - How to respond calmly and effectively to a threat - The importance of clear communication and reporting - Why planning and training matter before an incident occurs This guide is a valuable reference for security leaders, facility managers, and executive teams looking to strengthen their incident response posture. #LeadingHawaiitoaSaferPlace #SecurityAwareness #ThreatPreparedness #RiskManagement #CorporateSecurity #BusinessContinuity #CISA #SafetyFirst https://lnkd.in/gsCJh8-5

5

DFARS cybersecurity audits (DIBCAC) are already happening—months before CMMC is finalized. These audits aren’t about future readiness. They’re looking back to confirm contractors have: - Met DFARS 252.204-7012 - Accurately reported their NIST SP 800-171 score in SPRS - Used FedRAMP-authorized systems for CUI Many teams are getting ~90-day notices for a week-long on-site audit with documentation requests, evidence reviews, and staff interviews. If your DFARS compliance or SPRS score isn’t fully supported with evidence, the downside can be serious (contract risk, performance impacts, and more). Learn more: https://lnkd.in/gpj6htZU #CMMC #Defense #ITPartner #Compliance

1

You can't govern what you can't see together. Risk doesn't respect your org chart. Your CISO sees one dashboard. Your CCO sees another. Your auditor reconstructs a third from documents nobody's opened in months. Each holds a piece of the story. None holds the story. That isn't an information problem. That's an architecture problem. When risk data lives in silos: 1. Security in the SIEM 2. Compliance in the GRC tool 3.Audit in inboxes 4.Business in someone's head No one sees the threat until it's already crossed three boundaries. By then you're not detecting risk. You're documenting damage. Silos create blind spots, and blind spots create breaches. The fix isn't another dashboard or another integration. It's a unified plane where every action : across compliance, audit, IT, and business, produces evidence in the same shape, against the same intent, in real time. #GRC  #RiskManagement  #CISO  #IntentGovernance  #Synapse6.AI

4

1 Comment

WSUS vulnerability actively exploited with SYSTEM privileges. Hornetsecurity CISA issued an emergency directive. But most organizations take 60+ days to patch critical systems. SCYTHE validates compensating controls when you CAN'T patch immediately. Prove your mitigations work while you plan maintenance windows. Validation buys you time. Test pre-patch defenses: https://hubs.ly/Q03XQ12L0 #PatchManagement #VulnerabilityResponse #CompensatingControls

2

#DFIR teams do more than respond to breaches—they safeguard your organization’s future. If you’re overlooking DFIR, you could be exposing your organization to serious legal, financial, and operational risks. Learn how to change that: https://t.co/froPfPxDqo

26

As organizations plan for 2026, now is the time to take a closer look at incident response readiness. The 2025 Gartner® Market Guide for Digital Forensics and Incident Response (DFIR) Retainer Services provides crucial insights for security and risk management professionals seeking to understand the DFIR retainer market, evaluate trends, refine requirements, and identify market players. In This Market Guide, You Can Explore: — AI-Driven Acceleration — The Power of Proactive & Reactive Response — DFIR’s Rising Role in Resilience — Choosing the Right DFIR Partner 🔗 Access the 2025 Gartner® DFIR Market Guide: https://bit.ly/3NelL09

21