Cybersecurity Risk

Send us Fan Mail

Mission-Centric Cyber Risk Metrics Understanding what to measure in a mission-critical risk program is important, so today, I'll discuss a framework you can use.

1. Identify the system's environment (production, development, test, etc.) 2. System's criticality 3. Business Area ownership 4. Solution(s) being hosted on the identified systems 5. Top controls being violated 6. Vulnerabilities identified 7. Minimum Security Baselines non-conformance 8. Internal audit findings 9. Penetration test findings 10. Threat hunts.

These data points will assist your organization in understanding how much risk exposure your mission-supporting solutions may be exposed to. 

==========

The CISO role is all about the strategy, leadership, management, and communication of how potential threats will be assessed and solved. The CISO will absorb the big picture and dismantle it and restructure it to ensure it meets the initiatives of the department and the organization.

Let E|CE help your Small Business

• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/
• Youtube: https://bit.ly/3BGOtPA

#cybersecurity #cyberrisk #cyberriskmanagement #risk #riskmanagement #smallbusiness #smaillbusinesses #ceo #cio #ciso #ece #governance #cybergovernance #cybersecurity #chiefinformationsecurityofficer #ceos #chiefexecutiveofficer #cybersecurityawarenessmonth #cybersecuritystrategy #cybersecurityculture #cybersecurityawarenesstraining #cybersecuritythreats #cyberattacks #cybersecurityleadership #insiderthreats #insiderrisk #informationsecurity #businessstrategy #securitymanagement #leadership

Thanks.

Dr. Bill Souza

CEO | Founder

www.execcybered.com

Send us Fan Mail

Retail banking takes care of regular daily banking, for which most people know banks. This includes providing checking and saving services and issuing credit cards. Retail banking divisions may also be in charge of providing loans, mortgages, and other financings. Some other products and services may be offered under retail banking divisions: Lines of credit, Investment management and accounts, Insurance Retirement, and education accounts. Ask a simple, broad, and open-ended question; what do you perceive as your cybersecurity risk? This question probes for a direct answer to an intentional board and open-ended question. You don’t need to know or even judge the merit of any answer, but you do need to judge the organization’s ability to provide a sufficient answer. 

==========

The CISO role is all about the strategy, leadership, management, and communication of how potential threats will be assessed and solved. The CISO will absorb the big picture and dismantle it and restructure it to ensure it meets the initiatives of the department and the organization.

Let E|CE help your Small Business

• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/
• Youtube: https://bit.ly/3BGOtPA

#cybersecurity #cyberrisk #cyberriskmanagement #risk #riskmanagement #smallbusiness #smaillbusinesses #ceo #cio #ciso #ece #governance #cybergovernance #cybersecurity #chiefinformationsecurityofficer #ceos #chiefexecutiveofficer #cybersecurityawarenessmonth #cybersecuritystrategy #cybersecurityculture #cybersecurityawarenesstraining #cybersecuritythreats #cyberattacks #cybersecurityleadership #insiderthreats #insiderrisk #informationsecurity #businessstrategy #securitymanagement #leadership

Thanks.

Dr. Bill Souza

CEO | Founder

www.execcybered.com

Send us Fan Mail

Technologies and the methods used to hack into them continuously evolve. If you’re looking for an effective and efficient way to check the cybersecurity health of your organization, I suggest the following three checkups:

1. Vulnerability and Penetration: Test Once you know the mission-critical systems in your organization, I suggest performing these two cybersecurity tests on a continuous basis.
2. Vulnerability Scans & Software Updates Scanning: your mission-critical systems for vulnerabilities and then prioritizing and patching them is a critical practice to maintain cybersecurity hygiene.
3. Risk Assessments: A holistic approach will require that your team consider the results of your penetration test, vulnerability scans, and other vulnerability and threat information and develop an educated conclusion of the organization’s risks.

==========

The CISO role is all about the strategy, leadership, management, and communication of how potential threats will be assessed and solved. The CISO will absorb the big picture and dismantle it and restructure it to ensure it meets the initiatives of the department and the organization.

Let E|CE help your Small Business

• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/
• Youtube: https://bit.ly/3BGOtPA

#cybersecurity #cyberrisk #cyberriskmanagement #risk #riskmanagement #smallbusiness #smaillbusinesses #ceo #cio #ciso #ece #governance #cybergovernance #cybersecurity #chiefinformationsecurityofficer #ceos #chiefexecutiveofficer #cybersecurityawarenessmonth #cybersecuritystrategy #cybersecurityculture #cybersecurityawarenesstraining #cybersecuritythreats #cyberattacks #cybersecurityleadership #insiderthreats #insiderrisk #informationsecurity #businessstrategy #securitymanagement #leadership

Thanks.

Dr. Bill Souza

CEO | Founder

www.execcybered.com

Send us Fan Mail

Do you believe these are business challenges?

• Upskilling
• Low morale or quiet quitting
• Hiring and talent retention
• Keeping up with technology and tools

If so, why aren’t you considering cybersecurity as a core business challenge?

It takes 280 on average days to identify and contain a data breach, and the average cost is $3.86 million. Stolen or compromised employee credentials initiate the lion’s share of those breaches.

Small business advisory boards and panels must start pushing management to treat cybersecurity as a business risk.

========

#cybersecurity #cyberrisk #cyberriskmanagement #risk #riskmanagement #smallbusiness #smaillbusinesses #ceo #cio #ciso #ece #governance #cybergovernance

========

Let E|CE help your Small Business

*** Book a Call ***

https://booking.execcybered.com/#/customer/drbillsouzaexeccybered

• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/
• Youtube: https://bit.ly/3BGOtPA

Thanks.

Dr. Bill Souza

CEO | Founder

www.execcybered.com

Send us Fan Mail

Antivirus has become a necessary tool for preventing cyber incidents; while the market is crowded, you need to look for antivirus software that fits your organization’s needs. NIST has guidance that you can leverage; NIST 800-83 recommends key capabilities that an antivirus software must have:

• Scanning startup files and boot records
• Real-time scanning of emails and email attachments for malware
• Behavior monitoring of emails, browsers, and instant messaging software
• Scanning for known malware
• Disinfecting files
• Quarantining files
• Identifying common types of malware and attacker tools

NIST also recommends that organizations deploy antivirus software from a host and network-based perspective.

NIST 800-83: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final

========

Let E|CE help your Small Business

*** Book a Call ***

https://booking.execcybered.com/#/customer/drbillsouzaexeccybered

• Linkedin: https://www.linkedin.com/company/exceccybered/
• Twitter: https://twitter.com/DrBillSouza
• Instagram: https://www.instagram.com/drbillsouza/
• Youtube: https://bit.ly/3BGOtPA

Thanks.

Dr. Bill Souza

CEO | Founder

www.execcybered.com

Send us Fan Mail

Greater than Cybersecurity

When we realize that our cybersecurity challenges are complex and intertwined with conscious living people who view their actions in light of stories with emotions and ideas attached, one sees the need for many different perspectives. Therefore, the solution for your cybersecurity challenges will require knowledge beyond its discipline; it will involve communication, marketing, business, psychology, and sociology, among others. 

However, as an industry, we tend to become insular; as subject matter experts, we can’t know everything, so the first impulse is to specialize, narrowing our point of view to a defined subject. 

When cybersecurity reports are published depicting the most significant cybersecurity events of the year, they rarely focus on the critical narratives that accompanied those events or what actions, or lack thereof, led to those events.

It is not enough to assess what controls or tools are deployed in an organization. You need to understand the governance and management oversight of these controls and tools to ensure that they are effectively being used as prescribed; otherwise, you only see half of the story. 

Be critical, think critically, and have the right strategy in place. 

========

Let E|CE help your Small Business

*** Book a Call ***
https://booking.execcybered.com/#/customer/drbillsouzaexeccybered

Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/
Youtube: https://bit.ly/3BGOtPA

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Protective Technology
The last item I want to mention under the Protect function that supports the  attack surface reduction and limits the cyber events' impact on your systems is “protective technologies.” 

Remember, protecting your organization involves six critical cybersecurity categories:

• Access Control
• Awareness and Training
• Data Security
• Information Protection Processes and Procedures
• Maintenance 
• Protective Technologies

The restriction of removable media according to policy is a good first step. Restricting the use of USB drives and external hard drives are the first ones that come to mind; however, if we holistically see this category, we can include company or vendor-specific support equipment, such as tablets and laptops that are used in your data center to support diagnose or troubleshoot your equipment. 

Second, and perhaps most prevalent in small businesses or micro-businesses, is to ensure your systems are single function; therefore, avoiding, for example, hosting an email server and web servers on the same device. An attack on one device would cause an interruption of service for both services.

Lastly, you can implement mechanisms to achieve business resilience; technology will fail, so having technology and the right architecture in place will minimize the impact to your business, such as:
Implementing load balancing, which will distribute workload across various systems
Hot-swap, which allows you to make maintenance repairs while your system continues to function

These are a few strategies that will turn your business more resilient. 

========

*** Book a Call ***
https://booking.execcybered.com/#/customer/drbillsouzaexeccybered

*** FREE GUIDE ***
https://www.execcybered.com/asset-management

Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/
Youtube: https://bit.ly/3BGOtPA

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Ideally and preferably, your cybersecurity program should follow established policies, standards, and procedures. These documents will govern all organization members, including staff, vendors, volunteers, and anyone working on the organization’s behalf.

The first step towards information protection is to develop and maintain a baseline configuration for IT and OT systems if this applies to your organization that incorporates appropriate cybersecurity principles, such as least privilege. 

The baseline configurations are documented, formally reviewed, and agreed-upon sets of specifications for IT systems or configuration items within those systems. It serves as the basis for all future changes to the systems, and it is considered the stable version of any system. 

However, changes will occur over time, so a method is imperative to manage system changes. This task is part of a much larger discipline known as configuration management. Configuration management addresses the methods for controlling asset changes throughout the assets’ lifecycle. 

There are three roles your organization should consider in the change management process:
Configuration manager
Baseline manager
Verification manager

Once your organization establishes good baseline practices, the challenge is to keep track of all the changes required for the business; therefore, I suggest using a standard exception process to document the exceptions to the baseline while calculating the risk and requiring sign-offs. 

========

*** FREE GUIDE ***
https://www.execcybered.com/asset-management

Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/
Youtube: https://bit.ly/3BGOtPA

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Data Security
The third of the six critical cybersecurity categories I presented previously is “data security.” An organization's most valuable asset is data; hackers seek data sources to steal from businesses, governments, and non-profit organizations, including small and midsized companies. Data must be protected in transit and at rest. 

The NIST CSF addresses data security in its Protect function under its data security category (PR.DS). The first and second subcategories handle data in transit and data at rest, respectively. Organizations must implement security controls to address the integrity and confidentiality of the data. However, when putting this advice into practice, the challenge becomes how to protect against all the vulnerabilities; at the time of this recording, the Common Vulnerability Exposure (CVE) contains 183,630 CVE records.

One approach proposed by Scott Musman is to protect against the attack effects, which he classifies as the following categories:
Degradation
Interruption
Modification
Fabrication
Interception
Unauthorized use
The proposed concept is that regardless of the vulnerability of the 183,630, the impact will be one of the categories listed.

The other area that NIST CSF addresses under data security is environment segmentation, keeping the development and testing environments separate from the production environment. Not only by installing a DEV or TST system in production but also by avoiding the communication between these environments.

Last but not least, NIST CSF addresses hardware integrity. Not every company will need to implement this control, so I suggest adopting an ISO 27001 practice: create a spreadsheet with all the NIST CSF controls from the informative reference column and mark them as implemented or justify why it was not implemented. This practice will give you a good inventory of what you have implemented and a business justification for why not. 


========

*** FREE GUIDE ***
https://www.execcybered.com/asset-management

Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/
Youtube: https://bit.ly/3BGOtPA

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com

Send us Fan Mail

Securing and protecting your organization also takes a village to make happen, so cybersecurity awareness and training become very important; there’s so much technology can do to protect against phishing and its infinite variations, including the most efficient one, the Business Email Compromise (BEC); the FBI calls it “one of the most financially damaging online crimes.”

The NIST Framework addresses awareness and training in its Protect function under the category PR.AT, and it is also one of the top goals of the National Initiative for Cybersecurity Education (NICE). However, cybersecurity awareness has been a challenge for every organization because training individuals with several different skill levels and interest is complex.

The diffusion of innovation principle tells us that the adoption rate of an innovation or idea is compatible with the values, beliefs, and past experiences of individuals in the social system. So, are you connecting to your audience? 

Here is what the diffusion of innovation principle tells us as well; 

On the bell curve, all population sits in the standard deviation; you will always have high, low, and average performers. The first 2.5% will be innovators, the big idea people; the next 12 to 13% will be the early adopters; these individuals will be excited with a new idea, process, or product that aligns with their own values and beliefs; the next approximately 68% are the early majority, late majority, which is your average individuals, with the last about 16% being the lagging performers, these individuals will adopt the idea or process because they don’t have a choice.  

You need to gain the majority’s attention to achieve cybersecurity training penetration. To do that, you need to aim for your innovators and early adopters because most will not try something new if someone else hasn’t tried it. 

You need to understand your audience.

========

*** FREE GUIDE ***
https://www.execcybered.com/asset-management

Blog: https://www.execcybered.com/blog
Training: https://www.execcybered.com/iso27001foundationcourse
Linkedin: https://www.linkedin.com/company/exceccybered/
Twitter: https://twitter.com/DrBillSouza
Instagram: https://www.instagram.com/drbillsouza/
Youtube: https://bit.ly/3BGOtPA

Thanks.
Dr. Bill Souza
CEO | Founder
www.execcybered.com