Mark Tomallo

CISA has published a draft of the new CISA SBOM Minimum Elements! The 2021 NTIA Minimum Elements were an important step to help create a common specification of what should be in an SBOM. CISA is proposing an updated, clarified version that can be aligned with existing tools and support use cases. They are actively seeking feedback, so please share, review, and send them your thoughts! https://lnkd.in/eRm_zxT2

201

13 Comments

Your #EDR Healthcheck doesn’t end with findings — it drives measurable outcomes. ✔️ Maximize ROI: Benchmark performance before renewals or migrations. ⚡ Accelerate response: Correlate attacks with logs for faster tuning. 🧾 Prove compliance: Map real evidence to SOC 2, NIST, and CIS frameworks. That’s how leading teams transform EDR validation into business value. 🔗 Turn validation into outcomes: https://lnkd.in/g--XVzre #EndpointSecurity #OffensiveSecurity #pentesting

14

📢 Ohio HB96 FY26 Cybersecurity Audit Guide! Thanks to Kirk Herath and Marnie Fredrickson for leading a really nice webinar yesterday on the cybersecurity program requirements outlined in HB96 - and thanks as always to CyberOhio for their tireless work to keep these requirements top-of-mind for all of us. You can find the slides, as well as a recording of the webinar, here: https://lnkd.in/ghCJT_-F The most exciting part of the webinar was the Auditor's Office announcement of the 2026 Ohio Compliance Supplement (OCS). This document is available here: https://lnkd.in/grQ-Gqux If you skip to page 197 of the PDF (page 78 of Section 2), you'll find step 2A-21, where all the details are found regarding how to prepare your district for the auditors' visit for your FY26 audit. So what will the auditors ask you? You can read the supplement, but the TL;DR version is below 👇 Cybersecurity and Ransomware Incidents 1. Did any cybersecurity or ransomware incidents (as defined in Ohio Rev. Code § 9.64) occur during the audit period? 2. If such incidents are identified, were the reporting requirements met to both (1) OCIC and (2) the Ohio Auditor of State? Ransomware Payments 3. If a ransomware incident was identified, and if disbursements were made, were they approved by the legislative authority? Cybersecurity Program 4. Did the legislative authority adopt the required cybersecurity program by the required implementation dates (July 1, 2026, for schools)? 5. Was this program based on either the NIST Cybersecurity Framework or the CIS Critical Security Controls? 6. With respect to the size and complexity of the entity, does the entity's cybersecurity program appear to be tailored to the entity’s unique environmental needs based upon the auditor’s knowledge of the client? 7. If the program contains training requirements, were those training requirements met? There is considerable discussion of item 6 in the supplement. This control determines whether the district created the program itself or copied a generic template. The supplement provides specific examples, including the presence of a learning management system, the types of data that must be protected (PII, HIPAA, etc.), and password management policies. It's safe to say that simply copying a cybersecurity program from ChatGPT will not be looked upon favorably by the auditor. But the good news is that the webinar materials provide significant detail on who should be involved in creating your cybersecurity program. And the even better news? Vinson and Vinson Protect are here to help your district comply with these requirements. We have developed a partnership program specifically for Ohio schools seeking help in developing their cyber program. Learn more 👉 https://lnkd.in/gtJcYtaR #vinson #vinsonprotect #hb96 #cyberohio #letsdothis

21

🔐 Strategic Insight. Security Leadership. Business Alignment. As cybersecurity leaders, it's not just about controls—it's about translating risk into informed strategy. The CISM mindset empowers you to drive governance, align with business objectives, and create value through effective security programs. #cism #cybersecurity #itsecurity #governance #cyberthreats

186

Interlock ransomware is actively targeting critical infrastructure across North America and Europe. Attackers gain initial access through deceptive ClickFix techniques, deploy credential-stealing malware like Lumma and Berserk, and leverage tools such as Cobalt Strike and AnyDesk for lateral movement. Once inside, they encrypt data and threaten victims with double extortion, causing widespread disruption. Our latest blog provides an in-depth analysis, MITRE ATT&CK mapping, and actionable recommendations for defending against Interlock ransomware attacks. Read more here: https://hubs.li/Q03yq6YD0 #InterlockRansomware #ThreatIntelligence #Cybersecurity #Ransomware #PicusSecurity

22

🔒 The CISO's Guide to Predictive Security: 3 Ways to Stay Ahead of Evolving Risks Blind spots in unmanaged assets account for 92% of ransomware entry points, allowing attackers to move laterally in just 27 minutes. Learn how to eliminate risks with unified visibility, prioritized exposures, and faster responses using Agentic AI and automation. 👉 Read the full guide: https://bit.ly/3HpSNbv #ReliaQuest #MakeSecurityPossible #AgenticAI #CyberSecurity

18

CMMC compliance is a business imperative – not a box to check. With Cybersecurity Maturity Model Certification requirements already appearing in contracts and full enforcement coming fast, defense contractors who delay may face more than high costs. They risk legal exposure, lost revenue and being shut out of future opportunities. With insight from #DoD #CIO Katie Arrington, #cybersecurity #risk and #compliance company CyberRx, and #Tech CEO Emile Sayegh, read my latest Forbes column to learn what leaders need to know about CMMC 2.0, the costs of certification and noncompliance, and why early action is your best competitive advantage. https://lnkd.in/e6t7Rm83 Ola Sage Israel Briggs Greg Smith Matt Grinstead Rachel Bamgbose #CMMC #CMMCCompliance #Cybersecurity #LeadershipStrategy #DefenseContracting #RiskManagement #GovCon

31

2 Comments

NSA, CISA, EPA, FBI, and allied cyber agencies published prescriptive guidance for building and maintaining an OT asset inventory and taxonomy—the foundation for a modern, defensible OT architecture. If you already run RedSeal, you can fulfill most of the guidance quickly by modeling your hybrid networks, auto-grouping assets into OT zones, validating segmentation, and continuously monitoring drift. If you don't there are manual processes outlined in the guidance.  #redseal #cybersecurity #OTsecurity #CTEM https://lnkd.in/gYdnbntX

24

1 Comment

“PCI SSC has seen comments…” 👀 -Assessor Newsletter, June 2025 A few weeks ago, I raised a flag about FAQ 1597 and the related infographic, where the language suggested that acceptance of lower-risk vulnerabilities wasn’t on the table. That post gained great traction and sparked important conversations in the community. Well, the PCI Security Standards Council has now responded. In their June 2025 Assessor Newsletter, they stated: ✅ Clarification (main bullet points summarized): - “Addressed” ≠ “Resolved.” - Examples of "addressed" where not an exhaustive list. - Low-risk vulnerabilities can be accepted—if justified by a Targeted Risk Analysis (TRA). - Addressing a vulnerability may mean fixing it, compensating for it, disabling it, or accepting the risk. - The TRA must be reviewed annually to ensure it still reflects the environment and risk tolerance. This clarification is welcome—but also tacit acknowledgment that feedback from assessors and the broader community (yes, some of those comments they saw were from you all) helped make it happen. 📌 Next step for the Council: Update FAQ 1597 and the DSS itself at some point to reflect this broader interpretation. The ambiguity in the official text still risks confusion and audit inconsistencies. As of this posting date, the only place this clarification exists is within the assessor newsletter. 🤨 One nitpick I will call out though— the Council called out that their original definition of “addressed” wasn’t all inclusive. However, words matter. For a reminder, this was the definition: Addressed - the entity determines whether to resolve the vulnerability or to mitigate the risk by addressing the vulnerability in another way (e.g., with a compensating control or by disabling a vulnerable service) So to be clear, their definition says resolve OR mitigate. How were we to infer that acceptance is acceptable!?! 🤷‍♂️ If you’re a QSA or manage PCI in your organization, this is a significant development. It gives you back the flexibility to treat low-risk issues rationally, as long as your TRA process is strong. Thank you to Viviana Wesley for letting me know about the publication within the newsletter! #PCIDSS #CyberSecurity #QSA #VulnerabilityManagement #GRC #PCICompliance #InfoSec #AssessorLife

214

19 Comments

What happens when you pair the high-level guidance of NIST CSF with the real-world tactics of MITRE ATT&CK? You get a strategy that not only aligns to regulatory frameworks, but actively identifies, responds to, and mitigates OT threats in real time. In this new blog post, we break down how to layer these two models for a more resilient OT security posture, without overcomplicating your operations. Learn more here: https://rok.auto/45Bjeob #OTSecurity #IndustrialCybersecurity #NIST #MITREATTACK

53

2 Comments