Mike Johnson

Nicely done team! Looking to deploy copilot or get data governance under wraps? Let us Shoe you how with a complimentary copilot or Data Risk Assessment leveraging Varonis!

4

The Biden administration’s proposed restrictions on Chinese-made technology in private sector networks underscore the increasing convergence of cybersecurity and geopolitics. For big industries which rely on complex supply chains, this proposal signals the need for a more vigilant approach to assessing vendor risk and securing critical infrastructure. While the geopolitical implications could be significant, the bigger challenge for businesses may lie in balancing the need for innovation with the importance for enhanced security. This moment serves as a reminder that cybersecurity is not just about defending against attacks, but about proactively managing the threats that come with the company's business strategy to ensure long-term stability.

3

If you are in the #insiderrisk #insiderthreat space or you find it interesting, this is indeed the conference you MUST attend! Please find registration information below and stop by our booth! #cybersecurity #zerotrust #dtexsystems #insiderrisk #insiderthreat

2

One likely initial application is Bus Rapid Transit, where the buses have dedicated lanes free from other road users. With fewer parameters for the automated systems to handle, BRT will be an important real-life validation arena for autonomous driving.

3

AI is transforming industries, but when it comes to critical infrastructure—the systems that power our homes, deliver healthcare, and safeguard digital networks—the stakes couldn’t be higher. The U.S. Department of Homeland Security’s Roles and Responsibilities Framework for AI in Critical Infrastructure is a timely blueprint, emphasizing the need for a collaborative, strategic approach to AI deployment. Here’s why this matters and how we can drive meaningful progress. The Framework underscores that securing critical infrastructure is a shared responsibility. It calls on AI developers, infrastructure operators, cloud providers, and the public sector to align across areas like responsible design, data governance, and safe deployment. At the same time, it warns of interconnected risks—from operational disruptions to AI-enabled cyberattacks across sectors. While its voluntary guidelines are a crucial step forward, the global and systemic nature of AI threats demands stronger, proactive regulations and global standards. Transparency in AI systems must extend beyond technical documentation. We need to build a culture of AI literacy among our non-technical stakeholders—policymakers, business leaders, and the general public—so they can engage meaningfully with AI-related decisions. Trust in AI is not only about the systems themselves but about the people who build and govern them. Read more at: https://lnkd.in/eVyix4jv

19

2 Comments

In this 3rd blog on #genai security, our #datascience and #securityresearch teams focus on the #datasecurity and #modelsecurity of #llm. We discussed potential different types of #genai #dataleak and #threats to #models: https://lnkd.in/gb_CH3_5

49

We see this issue on our end as well at Black & Veatch in organizations with critical infrastructure -- power, oil and gas, water, transportation to name a few. We hear it all the time: “We're air gapped. We’re safe.” As you reference in your article, that’s a myth, and can be a dangerous one. Some in the industry think we have this firewall - a Demilitarized Zone (DMZ)- between IT and OT and it’s sectioned off. That doesn't account for the employees, contractors and people with access to your HMI systems, that goes out to your entire supply chain. The myth of the air gap can lead to a false sense of security, one that can lead to consequences for safety and uptime. Great article, Prajeet Nair and many of your comments resonated with me, Dawn Cappelli, CISSP. https://lnkd.in/gfdTSsEP

26

3 Comments

How Tech Talent is Shaping the Future of National Defense Interested in joining the US Cyber Reserves? The U.S. Department of Defense is tapping into Silicon Valley’s top talents to revolutionize national security, launching a unique program to onboard tech leaders as part-time military reservists. This initiative isn't about trading keyboards for rifles; it's about elite technologists offering their expertise in cybersecurity, AI, and data analytics during weekend commitments, bridging the gap between private-sector innovation and public defense. Leading the charge is Brynt Parmeter, the Pentagon’s chief talent management officer, envisioning a future where CTOs and senior data professionals step into roles as uniformed officers, tackling crucial digital challenges. The shift in mindset is remarkable, as Silicon Valley shifts from hesitancy towards defense work to embracing it as indispensable, given the current global realities with China, Ukraine, and beyond. This program signifies a crucial shift in perspective: the recognition that future battles will be fought with algorithms, not traditional weaponry. It highlights the critical necessity for collaboration between the business sector and the government. As technology advances rapidly, attracting top-tier talent from the private sector is not just about filling skill gaps, it’s about safeguarding national security and maintaining global competitiveness. Read more at WSJ (paywalled):

17

2 Comments

The US automotive news: The DOT defines the V2X suite as safety-critical and releases a detailed plan to deploy V2X on US roads within 10-12 years. Cybersecurity included! Ready, steady, go! 🚗📡🚦 The US Department of Transportation (DOT) released last month a document titled "Saving Lives with Connectivity: A Plan to Accelerate V2X Deployment," which outlines a roadmap and key building blocks for V2X deployment on US roads. What is very heartwarming is that cybersecurity is given its due focus in the document: "Cybersecurity is critical to ensure V2X technologies - and the information they provide - can be used and are trusted through standard procedures to validate that information is correct." Now it's our job to ensure that the V2X implementations used by the industry follow all necessary best practices and provide state-of-the-art cybersecurity not only today but also in 2036! Please ensure that you have the right people and processes in place to be ready. Link [PDF]: https://lnkd.in/dGjW8Agc #automotive #cybersecurity #cyber #security #V2X #vehicle #carhacking #vehicle #safety #technology #regulation #usa #transportation #roadmap

66

Compromise a cloud service, and tens thousands of vehicles can be affected at once. Matt MacKinnon of Upstream Security walks us through the world of cloud security for connected vehicles, transport trucks, tractors, and other "stuff that moves." Hitting Tens of Thousands of Vehicles At Once | Listen to The Industrial Security Podcast Episode 131 ➡️ https://bit.ly/4eN2c7N

10

#FUD & #buzzword alarm! 😉 Even though this "epoch-making" incident will temporarily bring security risks (especially when introducing security controls) and their countermeasures back into serious discussion, "smart solutions" (supported in this case by cloud and high privileged accounts) will continue to establish themselves. Therefore, we will need to continue preparing for and adapting to such incidents. AI will not solve this trend immediately but will rather amplify it because of the pressure of the market. #crowdstrike #businessimpactanalysis #cloudrisk #threatmodeling #testing #resilience #ai-overreliance #ai-excessiveagency

4

This is the kind of effort we need to really tackle vulnerability management with a proper effort around accurate prioritizations. This effort is aimed at bringing “Common Platform Enumeration, Common Vulnerability Scoring System, Common Weakness Enumeration, and Known Exploited Vulnerabilities to CVEs” together, including a pass through an SSVC decision tree. I am beyond excited to see such an effort and yet I remain concerned that without the required support and adoption by our vendors, this will merely represent another data point we cannot easily normalize with our tools. #VulnerabilityManagement #Security #BlueTeam

14

As risks heighten, organizations must overcome persistent security challenges. In her latest blog, Nirmeet Bhogill shares more on this and other key insights from the 2024 CISO Report.

3

At the SoCal CISO Summit on December 3rd, attendees have an incredible variety of sessions and topics to choose from throughout the day! Register below to join sessions like this one, led by: -Yanek Korff, Co-Founder and COO, Expel -Rushton James, VP, CISO, Liberty Dental Plan -Steve Schwartz, CISSP, Vice President and CISO, Lionsgate Entertainment -Shoaib Qazi, CISO and Technology Officer, RXO How to Assess Security Maturity and Why It Matters Maturing your security posture requires knowing how to objectively assess your organization, use industry best practices and frameworks, and select the right tools to advance your business. This complex, time-intensive process often takes a backseat to defending yourself against ever-evolving threats. Getting started can be overwhelming, so finding time to assess and improve your security maturity is a tall task. Join this session to discuss: -Benchmarking SOC performance using common assessment frameworks and tools -Determining your security maturity level, and how to fill gaps you’ve identified -Analyzing the impact of data and AI on your security posture Special thanks to Expel for sponsoring this session! #socalciso #evantaciso

15

GlobalTechTV - Episode 13 - Announcements from AWS re:Invent 2024 https://lnkd.in/dYeTiZtR https://lnkd.in/dPCd-j-x Ariel Munafo, Anxhela B. Haddad #aws #awsreinvent #announcements #podcast

5

Cyber-Informed Engineering is the most important development in OT security since the term “OT security” was coined in 2005. This webinar is designed to introduce Cyber-Informed Engineering as a program and methodology. ➡️ https://lnkd.in/gmFBwc7Y I highly recommend if you joining if you work in OT security

46

1 Comment

Identifying core business functions and having a protection, recovery, and business continuity plan is essential. This is yet another reminder for asset inventory, system segmentation, visibility, incident response plans and business continuity planning. Tracking this one. #cybersecurity #networksegmentation #incidentresponse #businesscontinuity #ciso #cto #plan #tabletop #invest #people

10

Highly recommended read - thanks to Sandy Dunn for sharing. The paper introduces Mantis, a framework that uses prompt injections to defend against AI-driven cyberattacks. This approach is relevant because it turns a known vulnerability of Large Language Models (LLMs) into a defense mechanism, disrupting automated attacks. By deploying decoy services, Mantis can mislead attackers and even compromise their systems. This research opens up new possibilities for autonomous and proactive cybersecurity strategies.

31

2 Comments