Razi R.

Before you pay for another LOW-COST NIST Cybersecurity Framework Class or Consulting Engagement, READ THIS POST and BLOG!!! Full Blog: https://lnkd.in/gRWQBSHP The NIST Cybersecurity Framework (CSF) and the Digital Value Management System™ (DVMS) form a comprehensive approach that empowers organizations—regardless of size, scale, or complexity—to build a holistic, adaptive system for Digital Business Governance, Operational Resilience, and Performance Assurance. The strength of this dual approach lies in its capacity to unify strategic direction, risk management, cybersecurity, and continuous improvement into a coherent, systems-based model that is scalable and adaptable to the realities of modern digital enterprises. The NIST CSF provides a structured foundation for managing cybersecurity risk. It defines six core functions—Govern, Identify, Protect, Detect, Respond, and Recover—that serve as pillars for improving an organization’s cybersecurity posture. However, the NIST CSF is not a how-to guide; it outlines what needs to be done but leaves much of the implementation detail open to interpretation. This is where the DVMS enters the picture. The DVMS acts as a systems model overlay, bringing to life the conceptual power of the NIST CSF by operationalizing its components through governance, cultural integration, and organizational capability development. At the heart of DVMS is a shift in mindset from viewing cybersecurity as a technical or departmental issue to embracing it as a core organizational responsibility tied directly to business value. This shift is encapsulated in the concept of “strategy-risk”—the idea that strategy and risk are not separate functions but interwoven aspects of a unified objective: to create, protect, and deliver digital business value. By combining strategy and risk into a single concept, the DVMS helps organizations frame cybersecurity within the broader context of enterprise risk management and strategic governance. The result is an adaptive capability that evolves alongside internal changes and external threats, thereby fostering operational resilience. The DVMS framework is composed of multiple interconnected models and layers, including the CPD Model (Create, Protect, Deliver), the Z-X Model (seven minimal viable capabilities: govern, assure, plan, design, change, execute, innovate), and the 3D Knowledge Model (team knowledge, collaboration, strategic alignment). These models work in concert to help organizations identify gaps in capability, define priorities for action, and implement processes that drive both performance and resilience. By using these layered models, organizations can better understand how value is created, where it is at risk, and how to close the gaps between current and desired states of performance and protection.

162

15 Comments

Are #cybersecurity incidents growing more costly? Cyentia Institute's recent Information Risk Insights Study points to a 15-fold increase in the cost of #incidents and #databreaches over the last 15 years. The chart on the left shows the distribution of known/reported financial losses from incidents across the time period of study. The typical (median) incident costs about $600K, while more extreme (95th percentile) losses swell to $32M. Note that the chart uses a log scale, so the tail of large losses is a lot longer than it appears. The chart on the right trends the escalating costs of cyber events over time. Median losses from a security incident have absolutely exploded over the last 15 years, rising 15-fold from $190K to almost $3 million! The cost of extreme events has also risen substantially (~5x). So, yeah—cyber events are definitely growing more costly. That said, this picture looks a lot different among different types and sizes of organizations. How are cyber losses trending for orgs like yours? Download the full IRIS 2025 to find out! Link in the comments.

102

15 Comments

Vulnerability Assessments CIP-010-r3 Requires paper or active vulnerability assessment 95% doing paper assessments because of fragility of control system networks Introducing a network based Digital Twin as a way to do vulnerability scanning Including an AI reasoning agent as an adversary simulation Purely offline. -Brian Proctor Frenos Brian Proctor EnergySec

55

Happy 4th for all and few thoughts before the holiday 🎉 Most security teams don’t struggle to detect threats - they struggle to understand them fast enough to act. That’s where data enrichment becomes essential. In a typical SOC, analysts are inundated with logs, alerts, and event notifications. But raw data alone rarely tells the full story. Without context - who triggered the alert, what system was affected, whether it’s tied to a known threat - every alert becomes a manual investigation. Enrichment bridges that gap by layering critical context onto raw signals, helping teams move from noise to insight in seconds instead of hours. Data enrichment enhances raw security signals - logs, alerts, and incident reports - with context from internal and external sources. This includes threat intelligence, geolocation, asset inventories, vulnerability data, and user profiles. By enriching alerts, analysts gain a clearer picture of the “who, what, where, and how” behind an event, accelerating triage and response. For example, an IDS (Intrusion Detection System) alert showing traffic from an unfamiliar IP isn’t actionable without knowing if it’s a known threat, a customer, or part of a botnet. HOW DOES ENRICHMENT ACCELERATE RESPONSE? ⬛Prioritization Enriched data highlights critical assets, known threat actors, and unusual access patterns - helping analysts focus on what matters most. ⬛Faster, Confident Decisions Analysts can view full incident context in one place instead of jumping between tools, streamlining investigation and reducing uncertainty. ⬛Supports Automation Enriched alerts power SOAR playbooks, enabling automatic actions like isolating endpoints when a threat is confirmed. REDUCING ALERT FATIGUE Alert fatigue is a major operational issue. Analysts spend an average of 2.7 hours per day manually triaging alerts - with 27% spending more than 4 hours daily. This manual load slows detection and burns out teams. Enrichment helps by eliminating repetitive lookups and surfacing actionable insights early in the process. WHERE DOES ENRICHMENT COME FROM? Effective enrichment draws from: - Threat Intelligence Feeds (malicious IPs, domains, hashes) - Geolocation Data (IP origin, risk regions) - Asset Inventories (importance, ownership, patch level) - Vulnerability Databases (CVEs, exploitability) - User and Entity Behavior (roles, baseline activity) This context turns isolated alerts into actionable intelligence. FINAL THOUGHTS Speed matters in security. In a modern SOC, enrichment isn’t just a best practice - it’s an essential part of a modern cybersecurity strategy. 👉I’d love to hear - how much has enrichment reduced triage and investigation time for your team?

30

1 Comment

Good morning! Here is this week's ICS Advisory, Other CERT, & Vendor vulnerability advisories weekly summary for 24 – 28 February 2025. Attached are this week's CISA ICS Advisory summary slides. Link to Weekly Summary Slides: https://lnkd.in/dXGGFb4b This past week, CISA released 3 new CISA ICS Advisories for the following vendors: Schneider Electric, Dario Health, and Rockwell Automation. Also released one updates for Contec Health. Based on the new CISA advisories, Critical Manufacturing, Energy, Commercial Facilities, and Healthcare and Public Health are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 15 new ICS Advisories for Century Systems Co., Ltd. [LTE Wireless Modem], PLANEX COMMUNICATIONS INC. [Wireless Router], SMA Solar Technology AG [Sunny Portal - PV monitoring], Siemens [Teamcenter], Delta Electronics [CNCSoft-G2], Eaton [Electrical power monitoring system, Eaton Network-M2], Hitachi Energy [Process Communication Unit,Customer service and asset maintenance software, protection and control IEDs, Gateway Station, HVDC control and protection system], GE Vernova [IED engineering ToolSuite], Pepperl+Fuchs SE [HMI - Windows IoT Enterprise OS], Moxa [Industrial Ethernet switches] products. For a more comprehensive understanding, you can view the summary details of other CERT & Vendor product advisories identified last week (24 – 28 February 2025) and read the vendor advisory using the links provided at: https://lnkd.in/d4MXyuXn CISA added 4 new CVEs to the Known Exploited Vulnerability (KEV) Catalog this past week. No CVE matched on the CISA Known Exploited Vulnerability (KEV) this week. Visit the ICS[AP] CISA KEV Catalog Dashboards: https://lnkd.in/emzXBbBw View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides and Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week! #CISA #ot #ics #otcybersecurity #otsecurity #icscybersecurity  #cybersecurity #cybersecuritythreats #cybersecurityawareness #industrialautomation #IoT #IIoT #buildingautomation #healthcare #publichealth #medicalsecurity #manufacturing #chemical #energy #dams #hydroelectric #hydro #Nuclear #oilandgas #oilgas #oilandgasindustry #solar #renewables #SCADA #transportationsystems #waterandwastewater #waterinfrastructure #rail #maritime   Disclaimer: The ideas, views, and opinions expressed in my LinkedIn posts and profiles represent my views, not those of my current or previous employers or LinkedIn.

39

So much of NIST 800-53 is dated and academic. One such area is in the SA-8 controls. These are "Security and Privacy Engineering Principles". While generally useful, they're extremely abstract, dated, and academic. As an example... SA-8(9): Trusted Components "The principle of trusted components states that a component is trustworthy to at least a level commensurate with the security dependencies it supports (i.e., how much it is trusted to perform its security functions by other components). This principle enables the composition of components such that trustworthiness is not inadvertently diminished and the trust is not consequently misplaced. Ultimately, this principle demands some metric by which the trust in a component and the trustworthiness of a component can be measured on the same abstract scale. The principle of trusted components is particularly relevant when considering systems and components in which there are complex chains of trust dependencies. A trust dependency is also referred to as a trust relationship and there may be chains of trust relationships." "The principle of trusted components also applies to a compound component that consists of subcomponents (e.g., a subsystem), which may have varying levels of trustworthiness. The conservative assumption is that the trustworthiness of a compound component is that of its least trustworthy subcomponent. It may be possible to provide a security engineering rationale that the trustworthiness of a particular compound component is greater than the conservative assumption. However, any such rationale reflects logical reasoning based on a clear statement of the trustworthiness objectives as well as relevant and credible evidence. The trustworthiness of a compound component is not the same as increased application of defense-in-depth layering within the component or a replication of components. Defense-in-depth techniques do not increase the trustworthiness of the whole above that of the least trustworthy component. " One has to kind of laugh at this control. It's so painfully academic and circular dependent logic. I'm sure it made sense 10 years ago, but this could easily be replaced with ZeroTrust and clarified with practical guidance. Curious what Dr. Chase Cunningham thinks about ZeroTrust and NIST 800-53. Any reason this hasn't been folded in to the "Security and Privacy Engineering Principles"? 🤓 🤓 🤓

25

20 Comments

“Security frameworks don’t fail. People fail to use them correctly.”   ↳ 78% of organizations compliant "on paper" still suffer breaches.   ↳ Standards like NIST, IEC 62443, and NCA OTCC-1 aren't flawed. Yet over 60% of their implementations stay stuck in PDFs, not practices. ⇨ Why read further?   - See common compliance errors clearly   - Learn from an authentic client scenario   - Turn frameworks into effective security actions Compliance without real-world capability is merely paperwork.    ↳ Especially in Operational Technology (OT), the gap isn't just technical it's deeply cultural. 📖 REAL-WORLD CLIENT STORY:    ↳ We recently partnered with a major manufacturing organization, responsible for multiple critical facilities. Their documentation for IEC 62443 compliance was outstanding:   ✅ Clearly defined OT network segmentation   ✅ Fully documented cybersecurity roles   ✅ Asset inventory marked as comprehensive But our on-site validation revealed something very different:    ⇨ Asset Inventory: Managed via quarterly Excel updates, creating significant blind spots between reviews.    ⇨ Network Segmentation: Logical on paper, but physically nonexistent, with IT and OT systems openly interconnected.    ⇨ Privileged Account Management: Shared passwords were common practice, significantly compromising accountability. ↳ The standard wasn't faulty the implementation was. 🛑 PROBLEM:    ↳ Many organizations mistakenly equate passing audits with real security. True security requires continuous testing, clear ownership, and constant refinement. 💡 INSIGHT:  ↳ Standards mark your start not your finish line.  Real security comes when frameworks become daily practices:   ⇨ Clearly map security controls to operational tasks.    ⇨ Regularly perform realistic security drills.    ⇨ Embed clear security accountability throughout the organization. 🔄 MINDSET SHIFT:    ↳ From: "We passed the audit." ⇨ To: "We confidently handle real-world incidents."   ↳ From: "The policy covers it." ⇨ To: "Our team actively practices security daily." ✅ KEY TAKEAWAYS:    ↳ Move from checklist compliance to actionable, daily security behaviors.    ↳ Validate controls through realistic exercises not just paper-based audits.    ↳ Develop a culture where compliance naturally follows from proactive security. 📩 Ready to turn standards into practical security?    ↳ DM me for our Frameworks-to-Action Toolkit, designed specifically to help OT and cyber leaders bridge the compliance-practice gap effectively. 👇 Join the discussion: Have you witnessed frameworks being misapplied? Share your insights! #CyberResilience #SecurityFrameworks #IEC62443 #NISTCSF #GRC #OTSecurity #CyberStrategy #OperationalSecurity #Leadership #SecurityCulture

414

21 Comments

New - Investigating Hy-Vee’s massive data breach, Hudson Rock identified critical employees infected by infostealers, compromising Atlassian (Confluence and Jira) credentials. This likely enabled this Stormous group 53GB data heist. (tl;dr below) New Blog (4 minutes read) - https://lnkd.in/dPZYU_-f TL;DR: On June 23, 2025, Stormous breached Hy-Vee’s Atlassian accounts, stealing 53GB of sensitive data, including infrastructure diagrams and operational details. Hudson Rock’s research uncovered an infostealer infections Hy-Vee employee devices, exposing credentials that likely granted attackers access, fueling one of 2025’s boldest retail breaches.

37

Your risk acceptance workflow shouldn't look like your CI/CD pipeline - automated and continuous. It's like we want to go from the department of No to the department of Absolutely! Some fun examples: "Container scanning will slow down deployments" = Auto-accept ✅  "We can't scope IAM roles during hypergrowth" = Auto-accept ✅  "Everyone needs admin access to ship features" = Auto-accept ✅  "Security requirements are blocking velocity" = Auto-accept ✅  "The auditor won't check that deep anyway" = Auto-accept ✅ "We'll implement least privilege after Series B" = Auto-accept ✅  "Infrastructure is too ephemeral to secure" = Auto-accept ✅ Your risk register isn't supposed to remain a collection of signed-off high-risks. What if you: - Actually assessed impact (beyond "high because PII") - Wrote realistic remediation plans (beyond "Add this to your backlog") - Work with the techstack to integrate guardrails (no "IaC scanning is slowing down things") - Record violations to highlight need for further action (add checks to the CI/CD pipeline) - Built remediation into sprint planning (that means being friends with the product team) If your risk acceptance rate matches your deployment frequency, you're doing risk management wrong. #grcengineering

65

11 Comments

NIST has released a pub on crypto agility for public comment. Trusted Cyber Annex has annotated that draft pub to expedite your review. Learn more about this work and download the annotated PDF (free! link in the comments!)

15

2 Comments

Legacy SOC vs Modern SOC: Evolving Cyber Defense Strategies 🚀 The transformation from legacy SOCs to modern SOCs is revolutionizing cybersecurity operations! 🔍📊 Key shifts include: ✅ From alert-based to threat-focused processes ✅ Leveraging automation via SOAR for scalability ✅ Emphasizing threat hunting and proactive intelligence Adopt modern SOC practices for deeper testing, seamless third-party integrations, and robust threat intelligence creation! 🌐🔐 Credits: CyberSkillsHub Cybersecurity Training #CyberSecurity #SOC #ModernSOC #ThreatHunting #Automation #SOAR #CyberDefense #ThreatIntelligence

32