The Cadmus Group的动态

???Happy October and Welcome to Cybersecurity Awareness Month! ????? In a significant move towards enhancing digital security, the National Institute of Standards and Technology (NIST) has released a draft of its updated Digital Identity Guidelines, SP 800-63-4, proposing essential changes to outdated password policies. Key updates include: Elimination of mandatory password resets: Regular changes can weaken security when users resort to simpler passwords. Removal of restrictive character requirements: When passwords are strong and random, these rules often do more harm than good. Abolition of security questions: These methods have proven to be insecure and ineffective. New allowance for spaces in passwords: This is one of my favorite updates! Research indicates that a significant percentage of users—around 65%—don’t follow best practices for creating strong, complex passwords. Allowing spaces can help create more memorable yet secure passwords. These changes aim to streamline password management and bolster security for both organizations and users. As we navigate the complexities of cybersecurity, it's crucial that we adopt practices that genuinely protect our digital identities. NIST is inviting public comments on these guidelines until October 7th. Let's work together to shape the future of cybersecurity! For those interested in providing feedback, please comment here: [email protected]. #CybersecurityAwarenessMonth #NIST #DigitalIdentity #PasswordSecurity #Cybersecurity

As cyber-attacks rise across the US, state CISOs face a stark reality: their cybersecurity budgets aren’t keeping up with the growing risks. A recent survey by Deloitte and NASCIO shows that nearly 40% of state CISOs believe their budgets fall short, with many lacking a dedicated cybersecurity budget altogether. This lack of funding has been identified as a top barrier to addressing cybersecurity challenges, impacting efforts to secure sensitive data and protect state infrastructure. What’s driving this concern? The expanding responsibilities of CISOs, particularly in data privacy, have intensified the need for better funding. By 2024, 86% of CISOs will be responsible for managing state data privacy, a significant increase from just 60% two years ago. And while AI and generative AI are seen as future tools for security operations, only a small percentage are confident in handling AI-enabled threats today. The top threat? Third-party breaches. With over 73% of CISOs citing these incidents as their biggest concern, it’s clear that cybersecurity budgets need to be revisited to address these critical issues. The findings highlight the urgent need for stronger cybersecurity funding and more robust strategies to address emerging threats like AI-enabled attacks. #Cybersecurity #PublicSector #StateCISOs #ThirdPartyRisk #AIAttacks #GRC #CloudSecurity #CyberBudget

Cybersecurity insight, maybe it won't surprise you that this reports main conclusions are that companies, especially SMEs are challenged and need to really step up on awareness training? But what might be new to us in the Nordics is, that the report concluded that we are falling behind the rest of Europe, or at least that we need to upgrade cybersecurity measures more than the rest of Europe, when it comes to combating fraud this is also my own experience, we have been celebrating our digital leading role far too long, if we are not to be taken over or worse, lose the trust in the digital world , now is the the time, to get back to work. For reference, here is a part of the conclusion from the report: "However, it appears that there is an even greater need for upgrading cybersecurity measures among countries in the Baltic Sea Region compared to the EU countries in general. It appears from our findings that the security activities and awareness generally – even if there are differences between the countries – are at a lower level. Further, it is our conclusion that this situation is a barrier for the digitalization process." Falch, M. ., Olesen, H. ., Skouby, K. E. ., Tadayoni, R. ., & Williams, I. . (2023). Cybersecurity Strategies for SMEs in the Nordic Baltic Region. Journal of Cyber Security and Mobility, 11(06), 727–754 https://lnkd.in/dg__VCvW

NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise?: The Network and Information Security (NIS) 2 Directive is possibly one of the most significant pieces of cybersecurity regulation to ever hit Europe. The 27 EU Member States have until 17 October 2024 to adopt and publish the standards necessary to comply with NIS2, which brings increased requirements to strengthen security conditions and report more regularly, with shorter deadlines, on cyber-attacks. The scope of the NIS2 directive has been dramatically broadened: in some countries, the … More → The post NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise? appeared first on Help Net Security.

The recent changes in the European Union’s NIS2 directive highlight the growing importance of cybersecurity governance and its role in safeguarding critical infrastructure. NIS2 expands the scope of organizations required to implement stringent cybersecurity measures and report incidents in a timely manner. This raises an important question: What would a similar framework look like in the Philippines? The Philippine National Cybersecurity Plan (NCSP) 2023-2028 already emphasizes the importance of protecting critical information infrastructure and fostering cybersecurity resilience across sectors. However, there’s still room to strengthen regulatory frameworks and enforcement mechanisms to meet the evolving landscape of cyber threats. If the Philippines were to adopt policies similar to the EU’s NIS2, it could mean: ?? Expanding the scope of regulated entities beyond critical infrastructure ??? Strengthening incident reporting requirements and timelines ?? Promoting greater public-private collaboration on cybersecurity initiatives ?? Requiring companies to invest in robust cybersecurity governance frameworks With the rapid pace of digital transformation in the Philippines, now is the time to consider how a more comprehensive regulatory approach could protect our national interests and enhance corporate accountability in the digital era. How prepared is your organization to align with such global cybersecurity governance trends? #Cybersecurity #NIS2 #Governance #DigitalTransformation #Philippines #NCSP #Regulation #Resilience

It's no secret: regulations are playing catch-up to cyber threats. That means CISOs are spending half their time on compliance, not building defenses you need. Clear, actionable regulations will keep you focused on the real fight: securing your digital future. #SkillsGap #Cybersecurity #CloseTheGap

?? Building on #ModernPolling’s tremendous success at the General Election, we're thrilled to announce that Modern Democracy has achieved a double milestone in cybersecurity!?? ? We have secured two major accreditations, solidifying our commitment to providing the highest level of data protection.? ? Receiving the #ISO27001:2022 and Cyber Essentials Plus certifications illustrates our commitment to cyber security, the safeguarding of data, and maintaining only the highest standards of information security.?? ? These are the significant steps we are taking to protect our systems, data and most importantly, our customers.??? ? The General Election has come and gone, but cyber security remains as critical as ever. This achievement will assure our customers that we are committed to staying vigilant as we continue to do everything in our power to support and deliver continuous improvement.???? ? Read more on Modern Democracy’s latest achievement: https://lnkd.in/gfaKKnb7 ? #CyberSecurity #CyberEssentialsPlus #ModernDemocracy #GeneralElection??

On Tuesday, the 4th of June, the Office of the National Cyber Director at The White House has made a significant recommendation regarding cybersecurity regulation. In August 2023, they initiated a conversation with various industry stakeholders by releasing a request for information to enhance their understanding of the cybersecurity regulatory landscape. The response was impressive, with 86 submissions from a wide array of entities, including nonprofits, trade associations, and research organizations, representing 11 out of 16 critical infrastructure sectors. The resounding conclusion drawn from this outreach is the pressing need for improved uniformity and harmonization in cybersecurity regulations. Click the link below to read the publication. How does your organization relate and respond to these challenges? https://lnkd.in/gZSqBw_z #Cybersecurity #Regulation #NationalCyberDirector #CriticalInfrastructure

The Intelligence and National Security Alliance (INSA) recognized in a recent paper the shared responsibility of the public and private sectors in defending the U.S. #cyberinfrastructure. It finds that while federal cybersecurity policies are rapidly evolving—Executive Order 14028 and the White House’s March 2023 National Cybersecurity Strategy offer vivid examples—there is inconsistency in private sector #cybersecurity, posing a risk to businesses and #criticalinfrastructure. Titled, ‘Challenges and Opportunities of Enabling Information Sharing?’ the INSA paper promotes the importance of information sharing among private sector firms and offers practical recommendations for corporate leaders to enhance cybersecurity measures. By implementing the five suggested action steps, private sector firms can effectively improve their information-sharing capabilities. It also realizes that the national security and economic prosperity of the U.S. depends on the public and private sectors’ shared responsibility to defend its cyber infrastructure. While federal cybersecurity policy and practice are evolving swiftly, private sector cybersecurity remains inconsistent, leaving at risk much of the country’s business and critical infrastructure. #Threatlandscape #riskmanagement https://lnkd.in/gsu3r-84

Might thanks to the ???????? folks from #AUKUS down under for Detecting & Mitigating #microsoft #ActiveDirectory #compromises / #Breaches Of note to the #infosec #opsec #Cab #BlueTeam #redteam 'Highlighted threats include: ??#Kerberoasting: Attackers crack #serviceAccount passwords to escalate privileges. ??Password Spraying:?"#MaliciousActors #exploit reused passwords to take control of user accounts." ??Golden Ticket: A forged Kerberos ticket can grant persistent access to a domain. The report provides?practical recommendations?for mitigating these threats, such as adopting?tiered access control models / #RBAC , implementing?#phishing-resistant #MFA, and closely monitoring?Active Directory events?to detect suspicious activity early. This global ?? effort underscores the importance of?international ??collaboration??? in strengthening cybersecurity measures. These findings also align with?#CISA’s #ZeroTrust Maturity Model, which emphasizes securing?identity,?privileged access, and continuous monitoring—key pillars ??? in defending against AD compromises. ?? ' -- Sean Connelly?? BreachAware? Silent Breach Bob Carver Michael Tchuindjang David Mauro Garett Moreau ???? Alexandre BLANC Cyber Security Doowan Lee WILLIAM SLATER ?? yes #yuge