CISO Workflows

Frank Raimondi, VP of Channel Development at IGI Cyber Labs
IGI CyberLabs has a product called Nodeware which does continuous vulnerability assessment.
PenLogic – regular penetration test – once a quarter deep dive heavy one and a monthly light test.
CEO buyer’s journey
Security velocity
Risk scoring is part of security velocity
Improve your cyber-hygiene – all small businesses
Security 101 is inventory 101
Cysurance – warranty and liability company
It’s good that insurance companies are trying to be more objective about the real risk metrics. Get the scoring and get the data about how risky they are. This feeds into the evaluation data which is used for underwriting.
FTC Safeguards policy impact
Operational security issues – MSPs that post all their personnel information publicly.
The impact of customer contracts and compliance. Squeeze between cost and staying in business in terms of insurance and customer contract requirements.

Vulnerability management that every business decision maker needs to know about - Part 1

Felicia King and Dan Moyer of QPC Security talk about vulnerability management, patch management and all the things that business owners are generally not understanding adequately. As a result of that, you're being underserved, misled, and in some cases were lied to and ripped off.
Ultimately, many business owners are refusing to pay for what they need for adequate risk management because they don't understand what they need. In today's episode Felicia and Dan fill that gap. 
Announced on October 6, 2021, the US Department of Justice Civil Cyber-Fraud Initiative is applying the false claims act to those who:
fail to follow required cybersecurity standards
knowingly provide deficient cybersecurity products or services
misrepresent their cybersecurity practices or protocols
violate obligations to monitor and report cybersecurity incidents and breaches
Just let that sink in for a second. So, is your IT service provider really meeting that standard? I sincerely doubt it.
01:23 The difference between vulnerability management and patch management 
Holistic vulnerability management includes, but is certainly not limited to: 
Software bill of materials analysis 
Supply chain risk management 
Third-party risk management 
End-of-life software 
Asset inventory up to date 
Lifecycle management 
Continuous vulnerability assessment 
Frequency penetration tests 
Tabletop exercises 
Procurement policy 
04:38 Cybersecurity insurance applications aren’t asking JUST about patch management 
When did you have your last penetration test? 
Do you have continuous vulnerability assessment in place? 
How long are you going to go without having the patches applied in the environment? 
If you think adequate patch management can be done for $50/mo/server, you are hallucinating.
So, what’s included in patch and vulnerability management?  
05:34 Patch management 
Patches are the building blocks that are improving the software that lives on the hardware. Without software, you can't interact with the piece of hardware unless it's purely mechanical, and even then there's still improvements of usage.  
How do you manage and protect those tools of your business from threat factors? 
09:20 Third-party patches & vulnerabilities 
IT service provider proposals are telling business owners that they can patch their servers and their endpoints and automate Windows updates and some third-party patches. What are those third party applications? What about all your custom business line applications? Do you actually want your critical SQL server to have its SQL instance updated using automation? How much money does it cost you if that workload is down?
10:27 Asset management 
Do you know what you have in your environment? Do you have accurate asset management and vulnerability assessments? Simply stated:  
“You can’t secure what you don’t have an accurate inventory for.” 
It is a regulatory requirement and cybersecurity insurance requirement to adequately document and understand software dependencies in your environment. That requires a proper inventory of your hardware, software, and subcomponents of the software. This is frequently referred to as SBOM - software bill of materials. And if you think your software vendor is going to provide that information, please go ask them for that information. You will probably get a blank stare. IS security engineers can figure it out on their own.
18:48 Implementing proper procurement policies 
Does your procurement policy support your vulnerability management strategy? Does your software acquisition and implementation policy (if you even have one) support your cybersecurity insurance and regulatory requirements?
When business decision makers put pressure on an IT service provider or internal IT to implement new software without proper security protocols, vetting, and process documentation, vulnerabilities are nearly always introduced into your environment. Sometimes that comes directly from their insecure software. Sometimes it comes from the tools and connectivity they use to remote into your systems or things like API connectors that your IT is supposed to just blindly trust the software vendor to secure their software with zero validation or proof. A proper CISO on your team or through your ITSP will be able to directly vet the vendor and software itself.
You are required by cybersecurity insurance and Federal regulatory guidance to do so. It is also in your business's best interest to do so.
Be very careful looking for just certifications for someone who says they are a CISO. The majority of CISOs do not have technical chops. They are often compliance managers that cannot do the technical work. Those people have limited usefulness and will not be able to 
All of the vCISOs at QPC are hardcore technical because we understand the essential nature of that skillset being a mandatory requirement to deliver effective CISO services.
20:24 Privileged access management and privileged password management 
How do you know who has access to remote access to your systems? How many people will have access to your systems? Today, there are many IT service providers who are not disclosing their outsourced Helpdesks that are giving full administrative-level access to a customer’s back end to all those workers at the virtual live Helpdesk. Most ITSPs also fail to disclose the totality of the quantity of people that will end up with admin access to some or all of your systems.
Ask yourself. If you have 25 office personnel, why would it take 30 remote people to have admin access to your systems in order to provide competent support? Do you think it is actually possible to have a high security environment and magically keep 30 people fully up-to-speed on the exact correct configurations required in your environment and what the interaction effects are? It's not possible and will never happen. 
24:27 A procurement policy can keep a business' IT costs stable 
The number one thing that business owners complain about is the cost of maintenance. With a procurement policy in place and by working with their IT service provider and procuring anything that they do not have a full understanding of the total cost of ownership for – costs can be managed. 
Does your procurement policy support your business strategy and needs? 
34:22 Understanding the cost and time of device and software procurement 
There's also a lot of other risks that the vast majority people don't think about; they tend to only think about the budgetary risk. However, getting the strategic input from a CISO or CIO to develop an understanding of the minimum pricing floor and how that affects the total cost of ownership, can save a business not only money but time.  
SaaS can get you closer to a flat-rate cost but you may have inherited additional risk and vulnerabilities, depending on how the new technology interconnects with your systems. Additional risk factors are:
counterparty risk
structural increase in cost of doing business risk
accessibility risk (redundant access is then required and cannot be fully mitigated)
external software vendor attack vector risk that cannot be mitigated through Layer3 ACLs
takedown/contract risk
37:33 Cloud vs on-prem security 
It's still a fallacy that having your systems in the cloud is better and cheaper, incorrectly thinking they can have as good security in the cloud as they can on premise. Going to SaaS can provide a lower and more predictable TCO if the counterparty risk you accept is worth it. But picking up your servers and hosting them on someone else's infrastructure will never be less expensive. IaaS cost savings are a fallacy for the majority of businesses. The exception being massive companies with heavy DevOps needs for spinning up and down workloads quickly. Most of those items are being migrated to Kubernetes and OpenShift.
46:48 IT/IS is not a utility 
The electricity company, the water utility, garbage pickup, fire and safety, ISP – they are monopolies and uni-taskers. Whereas IT is far more complex. People tend to think that if it’s a utility, therefore it’s a commodity, and if it’s a commodity it doesn’t matter which service provider I choose. 
Business decision makers are trying to manage budget risk without understanding their requirements. They also want to have budgetary control while abdicating their involvement upon outsourcing their IT to an ITSP.  
An IT service provider can be a partner to success and can help businesses develop better business strategies IF there is regular and open communication.  
 
This is part 1 of a 2-part series on vulnerability management. Listen to Part 2 at https://qpcsecurity.podbean.com/e/vulnerability-management-with-felicia-and-dan-part-2. To learn more about QPC Security, visit us at https://www.qpcsecurity.com/
This is another resource for vulnerability management information.
https://land.fortmesa.com/vulnerability-management-101
 

The REAL reason you cannot afford to have a cybersecurity incident

I have been thinking for months about the latest challenges faced by organizations with regards to the increased cybersecurity risks, what is at stake, how unprepared they are, and how the cyber insurance companies are responding to the changing landscape.
As I have had conversations with business decisions makers, they often think that they have little to risk. Many businesses feel that they are not under much if any regulatory framework that requires them to take action. It seems that each week I see another cybersecurity insurance risk assessment questionnaire that nearly every organization will fail. Compliance frameworks are incomplete and horrifically confusing.
There is no compliance framework that will get you the fundamentals. There is no security control framework that tells you how to have effective network layer security. The gap between guidance and successful execution is wide.
It occurs to me that the only real defense for small and medium businesses are organizations like QPC which have virtual information security officers and full remediation services on offer backed by ongoing management. There are plenty of penetration testers or those that will sell you MDR services. Execution of fundamentals is where it is at. There is little value in pursuing the frameworks until you have addressed the fundamentals. After you have the fundamentals in place, then review your status against frameworks and you will probably find that many items have already been addressed.
Regardless, I'm always on the hunt for helping the SMB organization leader. It occurs to me that no matter what data you think you have a risk or don't at risk, there is one thing you don't have which is at risk. Listen to the show to find out the real reason you cannot afford to have a cybersecurity incident.
Updated on 8/8/2021I saw this great article today on this topic and decided to include it.
The Disturbing Facts About Small Businesses That Get Hacked
I will warn that their documented risk mitigations measures are H.S.
 
And check out this excellent article on more reasons why you cannot afford to be hacked.
10 Terrifying Cybersecurity Stats | Cybersecurity | CompTIA

What is involved in a secure endpoint strategy?

Overview of the secure endpoint strategy
The CIA you care about – confidentiality, integrity, and availability of the data on and accessed by your technology systems
You need strategies effective a protecting against the efforts of nation state actors and large criminal enterprises
Your bank account, identity, business, and mental health are at stake
What security posture strategy works now?
Who do you partner with and vet or assess them?
It is not about simply selecting the technology. It is much more about the partner who services you.
Zero-trust posture coupled with the proper services
 
Welcome to "Breakfast Bytes," your go-to podcast for insightful discussions on hot tech topics. In this episode, hosted by Felicia King, we take a deep dive into the critical world of endpoint protection. With an increased shift of our lives online, protecting our data is more important than ever. But how much do we understand about endpoint protection and the steps needed to safeguard our data?
We kick off with a discussion about our technology usage and the assumptions behind it. We delve into concepts like the 'CIA Triad,' the backbone of all data security strategies representing Confidentiality, Integrity, and Availability. We also explore the daunting facets of cybersecurity, such as hack attempts, nation-state actors, criminal enterprises, and the lack of regulation, illuminating the challenges individuals or small businesses face in combating such overwhelming threats.
The episode then shifts gears to emphasize the significance of teaming up with a top-notch security architect to stay secure. We discuss the differences between a Security Operations Center (SOC) and a Network Operations Center (NOC), and why understanding these differences is vital when choosing an IT service provider. We further discuss why consumer-grade technologies may not be sufficient and why businesses should consider enterprise-level solutions. Special emphasis is put on endpoint protection platforms that maintain a zero-trust posture and the advantages they offer.
We also delve into the key components of Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) technologies, spending time exploring how your endpoint's data is monitored by a 24/7 staffed data center. In addition, we provide crucial questions you should ask your IT service provider, particularly about administrative access. The perils of vendor agnosticism and outsourcing to under-protected NOCs are highlighted, as is the crucial need to evaluate endpoint protection critically and the importance of timely system patching.
This episode aims to empower listeners with the knowledge they need to strengthen their data protection strategy and avoid leaving their data 'naked on the interstate'. Listen in and equip yourself with the information you need to protect your data more efficiently and effectively.