Dd Budiharto CISSP CISM

Another breach in the news: Kaiser ezperienced a data breach in April that impacts over 13 million residents. While Kaiser is seemingly unaware of any misuse of data, the breach will likely highlight areas where cybersecurity procedures must be improved. You can read more about the breach here: https://lnkd.in/g_ZzbFRP #DataBreach #CyberSecurity #DataProtection #SociumSolutions

14

Lately I’ve been learning about the NIST CSF & RMF Framework and wanted to share… 🔍 NIST CSF vs. RMF: What's the Difference? 🔒 **NIST CSF**: A flexible guide with best practices to manage cybersecurity risks, applicable to any organization. It focuses on five core functions: Identify, Protect, Detect, Respond, and Recover. 🛡️ **NIST RMF**: A detailed process for integrating security into the system lifecycle, mainly for federal systems. It emphasizes compliance and thorough risk assessment. Both enhance security but differ in scope and application. Which framework does your employer or business use for their needs? #Cybersecurity #NIST #CSF #RMF #InfoSec #RiskManagement

8

1 Comment

#ITGovernace Guru Dan Swanson's "Ultimate Guide to Compliance & Ethics" condenses the latest best practices on this critical subject into fewer than 100 pages, all designed to be accessible and easy to understand. Like all OCEG publications, it enhances understanding without oversimplifying, expertly maintaining a balance between clarity and complexity. https://lnkd.in/dbvNnEiJ

25

1 Comment

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

1

Attention North Eastern Oklahoma Professionals: Are you interested in a seminar on creating or maturing your cybersecurity, privacy, risk, or compliance programs? I'm planning to host a series of free workshops, offering springboard documentation and discussions on effective approaches. Contact me directly if you're interested! #PositiveDisruptor #PosDisruptor #DigitalDucks #ThinkDifferently #ProgramBuilding #Cybersecurity #TechnicalDocumentation #OrgChange #OrgCulture

2

Yesterday, a U.S. judge dismissed most of the SEC's lawsuit against SolarWinds and its CISO, stemming from the Russia-linked Sunburst cyberattack. The court ruled that claims made against them post-attack were based on "hindsight and speculation," while dismissing most pre-attack claims except one regarding the company's security controls. SolarWinds expressed satisfaction with the decision, calling the remaining claim "factually inaccurate." This case marks a significant moment, being one of the first instances where the SEC targeted a company for being a cyberattack victim without a simultaneous settlement. Much has been said in regard to this groundbreaking case – I am curious how the CISOs and cybersecurity professionals are reacting to this latest decision. Looking forward to reading your comments and continuing the discussion below. #SEC #SolarWinds #Cyberattack #Cybersecurity #CISO

36

3 Comments

It's of no surprise that NIST won an award for their efforts in developing CSF 2.0. NIST released it CSF 2.0 update in February 2024, a much need update to the CSF that included governance, regulatory compliance, risk management and an increased focus on supply chain risk management. NIST CSF is a well known framework and adopted by FISMA, U.S federal cyber regulation. As well as many industry sectors globally as a the controls framework for cybersecurity and cybersecurity risk management. That will be increasingly required by entities covered by the increasing amount of global cyber regulations. We were pleased to present CSF 2.0, U.S and EU cyber regulation, governance and the role internal audit plays in the oversight, assurance and attestation of cybersecuirty risk management, The Institute of Internal Auditors Inc. this week. Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner @ Veritas GRC National Institute of Standards and Technology (NIST) #csf2 #cybersecurity #cyberriskmanagement #cyberregulation

16

1 Comment

Enforcement is one of the 3 reasons businesses implement privacy and data security programs. How compliant is your business with privacy notice, consumer request and non-deeceptive practice privacy practices? #dataprivacy #cybersecurity #ccpa #privacy

1

1 Comment

I love audits! ❤️ This sounds crazy to most, but one of my main jobs is advising teams on how to meet the NIST/Compliance controls. The controls do a good job of setting expectations, but they don't describe "how" you should meet those controls. Much of what I do is translating those controls in to technical solutions and advising teams on how to implement them. I'm not a compliance guy. I've never worked in a GRC team. I'm the glue between GRC and engineering teams. De-mystifying the requirements (even the unpublished ones 😂 ). So when audits come around, they are like a test for me. They say in no uncertain terms whether I've adequately prepared the teams and company. When audits are clean and there are no surprises, it's such a satisfying feeling.

41

2 Comments

ICYMI: Office of Inspector General Report in Brief from the Alabama Medicaid Management Information Systems (MMISs) and Eligibility and Enrollment (E&E) systems security audit. The scope of the audit was limited to external facing systems and a phishing exercise (GoPhish). https://lnkd.in/emGaGWQa The OIG audit reports are always good to get a glimpse of the focus of these security audits. The response to recommendations can also be helpful for orgs struggling with some of the same issues (Starting on page 14). Key Takeaways 1) Vulnerability Management: Existing tools were not effective in detecting system flaws. 2) Software Development: Issues were not remediated prior to deploying on production systems. 3) Phishing was not successful (0 opened emails......) #healthcare #hipaa #cybersecurity #hhs #riskmanagement #risktolerance #riskassessment #criticalinfrastructure #hitrust #criticalcontrols #penetrationtesting #vulnerabilityassessment #vulnerabilitymanagement

2

I recently received a copy of Packt Publishing’s Unveiling the NIST Risk Management Framework: A practical guide to implementing RMF and managing risks in your organization by Thomas M. This guide breaks down using and implementing a risk management framework within your organization. Understanding the risks at the organizational and technical level are the first steps in managing and monitoring the vulnerabilities and threats of your organization. This book breaks down the NIST RMF in a manner that allows you to go step by step through the process. These steps allow you to build a risk aware organization from top to bottom.  NIST makes documents available at no charge, including the NIST SP 800-37 v2, which this book is based. The book breaks down this document and is an excellent accompanying guide to the document. Chapter 9 and 10 are particularly helpful with guidance for the RMF for cloud implementation and use case scenarios, respectively. For anyone that wants to understand how to implement a risk management framework within your organization, I highly recommend this book. Pick up your copy here: https://packt.link/689vW Kamalpreet Sahni

17

1 Comment

Let's talk about "risk management" methodologies and how "risk tolerance" is used to effectively manage human risks. Risk management isn't just something used by large enterprises. There are a number of "flexible" frameworks that can make it easier and more effective to know where to spend your "next security awareness dollar". Join us tomorrow at 1pm EDT in our next Live CSAF panel session: https://lnkd.in/dsDPXwFG #csaf #cybersecurityawarenessforum #ciso #humanriskmanagement #riskmanagement #cybersecurity

8

Board of directors can play an important role in protecting organizations from the increased risk of cyberattack. First and foremost, board members provide oversight and guidance. They should ensure that executives and their teams set a high standard for cybersecurity. They should then follow through on achieving them by ensuring that security is embedded by design. The board is the last line of defense in ensuring such initiatives get planned and funded.

23

1 Comment

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

The entire water industry is often considered among the least secure sectors in terms of cybersecurity. You do not need to be close to a dam to control it. Why? Because they are remotely managed over the Internet, allowing companies to save money by not requiring on-site operators. In sectors with traditional engineering cultures, people have difficulties understanding that their business is online, hence controllable from ANY part of the world. With only four employees overseeing US 2,500 dams, and a scant 5% federally regulated, the risk of catastrophic failures looms large. The majority of these structures, some labeled as "high-hazard," are antiquated and poorly maintained. Federal Energy Regulatory Commission (FERC) and other agencies are criticized for outdated cybersecurity standards and lack of sufficient resources. National security experts are urging Congress to mandate stringent cybersecurity measures to prevent potential disasters. No need to draw a picture of potential disasters - water contamination, data theft, system disruptions, energy disruption, deaths. In the EU, NIS2 Directive is coming in October 2024; energy producers are in the scope. Stay tuned. More about this in the next weeks. www.andsecure.ch https://lnkd.in/e6aaBh7p

11

Don't get trapped like most organizations and think that you can simply "copy and paste" from a framework and the results magically appear in your organization. As many of you know, I have a full e-learning library that focuses on IT Governance, COBIT, Digital Trust, and many other topics that offers practical advice, and not "copy/paste." Not long ago I published a very detailed premium course on the site about COBIT's perspective on problem management. As you might expect, I got a lot of feedback on this course and wanted to take a few key highlights to share with you about it. Over the next several months, I'll be recording more deep dives like this one focusing on the COBIT Framework. To be fully transparent, in order to see the full course you have to be a monthly subscriber to the site. For more information, go to e-learning.escoute.com. I hope you get some value from this one. #COBIT #ITGovernance #GEIT #ISACA #ProblemManagement #Assurance #Audit #Risk #DSS03 https://lnkd.in/gfWZzmsd

50

1 Comment

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3