Jerry Geisler

The countdown is on! 🕒 Heading to the Cybersecurity and Privacy Professionals Conference on May 1–3 in Minneapolis. Ready to dive into dynamic discussions with industry leaders and peers about safeguarding higher education institutions. Don't let this opportunity pass – register now!  https://lnkd.in/dT9Fq8Jq #CybersecPrivacy24

68

5 Comments

John Mracek has exceptional insights and best practices to share at #Secure360. The cyber landscape is experiencing an increasing sophistication of threats along with rapid modernization of tech. Learn how model of shared accountability is ideal since no one can do it alone! #tech #cyber

32

1 Comment

Over the last few weeks, I've delivered keynotes and participated on various panels focusing on creating cyber resilient organizations. In order to do that effectively, you must understand the core mission of the organization to ensure you are focusing on what truly matters. Understanding the core mission is the north star. What do you see as the biggest challenges to building a cyber resilient organization? #cybersecurity #CyberResilience #RiskManagement

66

2 Comments

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

More than half of open-source projects contain code written in a memory-unsafe language, according to a report from the U.S.’s Cybersecurity and Infrastructure Security Agency. Memory-unsafe means the code allows for operations that can corrupt memory, leading to vulnerabilities like buffer overflows, use-after-free and memory leaks. #opensource #security

2

CMMC Certification vs. CMMC Compliance: What’s the Difference and Which One Do You Need? 🤔 Learn more: https://lnkd.in/dsF_Q88T #CMMC #cybersecurity #compliance #blog #Kiteworks

15

1 Comment

Open and transparent communication with the American public is crucial for upholding trust in the electoral process. State and local election officials play a pivotal role in engaging with the public and media on various election-related topics, ranging from dates and deadlines to security measures and result publication. A new guide has been developed to equip these officials with a robust framework and practical tools to establish and execute an effective year-round communications plan. #ElectionCommunication #Transparency #PublicTrust https://lnkd.in/e4pXMUfv

1

👩🏽‍💻How will this request for accountability shape future cybersecurity leaders, cybersecurity allocated resource budgets, internal audits intervals, development lifecycle practices, managed projects, funding for tools, improvement in tools and suppliers, etc? 📰🗞️🚨In a recent four page letter from U.S. Sen. Ron Wyden (D-OR) to the U.S. FTC and U.S. SEC request to investigate UnitedHealth Group’s (UHG) cybersecurity practices and hold senior leadership accountable. TL;DR “Due to his apparent lack of prior experience in cybersecurity, it would be unfair to scapegoat Mr. Martin for UHG’s cybersecurity lapses. Instead, UHG’s CEO and the company’s board of directors should be held responsible for elevating someone without the necessary experience to such an important role in the company, as well as for the company’s failure to adopt basic cyber defenses,” the senator wrote. Wyden is chairman of the Finance Committee, which has some jurisdiction over healthcare issues. In the letter, he urged the Federal Trade Commission (FTC) and U.S. Securities and Exchange Commission (SEC) to take action against UnitedHealth. Link to the article and pdf below: ⏬ https://lnkd.in/gv-ZSmGp

1

The 3rd party vendor/contractor ecosystem varies greatly in size and capabilities when it comes to cybersecurity. All organizations regardless of size has to raise their games when it comes to operating securely as they may be a vector into their customers or at minimum the information they hold on behalf of their customers. Cybersecurity and best practices regarding systems, information, and culture needs to improve. #CISO #CTO #cybersecurity #cybersecurityawareness #riskculture #cyberriskmanagement #bestpractices #threatvector #sizedoesntmatter #thirdpartyrisk

24

4 Comments

https://lnkd.in/e9Qu7J_f By me being an Cyber security analyst In your organization I can integrate the PCI DSS 4.0 requirements into your organization's cybersecurity framework to prevent incidents like the breach in Wichita by the LockBit ransomware gang. Here's how my work integrating the PCI DSS 4.0 into your organization will align with addressing such threats: Network Segmentation (Requirement 1): PCI DSS 4.0 emphasizes the importance of implementing network segmentation to reduce the scope of PCI DSS compliance and limit the lateral movement of attackers. Proper segmentation would have isolated sensitive payment card data from other systems, reducing the likelihood of ransomware spreading throughout the network. Secure Configuration (Requirement 2): Adhering to secure configuration standards outlined in PCI DSS 4.0 helps organizations reduce vulnerabilities that attackers exploit to gain unauthorized access. Configuring systems securely, including patch management and disabling unnecessary services, can prevent ransomware from exploiting known vulnerabilities. Access Control (Requirement 7): PCI DSS 4.0 requires implementing strong access controls to limit access to cardholder data based on business need-to-know. Proper access controls would have restricted unauthorized users, including ransomware actors, from accessing sensitive systems and data. Malware Protection (Requirement 5): PCI DSS 4.0 mandates the use of anti-malware software and regular scanning to protect systems against malicious software, including ransomware. Implementing robust malware protection measures could have detected and mitigated the LockBit ransomware before it caused significant damage. Incident Response (Requirement 12): PCI DSS 4.0 emphasizes the importance of having an incident response plan in place to address security incidents promptly and effectively. A well-defined incident response plan, including procedures for identifying, containing, and eradicating ransomware infections, would have helped mitigate the impact of the breach in Wichita. Integrating these PCI DSS 4.0 requirements into your organization's cybersecurity posture enhances its resilience against ransomware attacks and strengthens overall data security. By hiring me as your organization's cyber security analyst I can align your company with PCI DSS 4.0, not only protecting your organization's payment card data but also mitigating the risk of data breaches to your organization and maintaining trust with your organization's customers and stakeholders.

1

NIST NCCoE events are great forums bringing together industry, government, and academia to help protect critical infrastructure. It's great to see Faction taking the lead in decentralized private networking technology to conceal critical sensors, cameras, and other connected devices from adversaries!

1

Chairmen, Chairwomen, Directors on Boards and CEO's should all watch this United Health CEO's testimony from 5/1/24 on their Cybersecurity Incident. Ask: Do you have any certified CISSP or CISO qualified Board Members at the table, asking the hard questions and understanding the gaps? I would bet CEO Andrew Witty's board will change drastically with $22M ransom paid out of pocket and $872M in other costs and fees (plus inbound HIPAA fines). https://lnkd.in/gXsPtPxm

3

1 Comment

🔔 Cybersecurity and Infrastructure Security Agency's Justin Forbes  shares his thoughts about CISA's mission, cyber on hardware, and having a business while being a federal employee. 🔊 Take a listen to the latest episode of the Best8(a) Podcast! #cisa #govcon #podcast #cybersecurity #smallbusiness (All comments and opinions expressed in this podcast are personal and do not represent CISA or any government agency) https://lnkd.in/d8X_Qvr4

10

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

32

4 Comments

RMC is in the Industrial Cyber Buyer's Guide. Check us out! Two takeaway's when I reviewed this buyer's guide: 1. There are a lot of foreign-owned companies. RMC is a proud US-based company serving the DoD, other Federal agencies, US critical infrastructure, and Fortune 500 companies with a team of cleared and vetted risk management and industrial cyber experts 2. The majority of the companies in this buyer's guide are product / software companies. RMC is proud to focus on premier product-agnostic services. We want the best for our clients and we work hard to remain un-biased and serve their best interests. We don't push pin-point solutions, we recommend the best solution and focus on the whole of the challenge https://lnkd.in/gCiBYH-j

30

2 Comments