ThreatReady Newsletter #3

Welcome to issue #3 of the ThreatReady newsletter! 

ThreatReady is your source of actionable truth based on the latest industry news. It offers a people-centric perspective that connects deeply with the challenges and triumphs of leading security teams and strategy.

If the cybersecurity landscape were a chessboard, the ThreatReady newsletter would be your strategic guide to staying three moves ahead of bad actors.

How strong is your AI risk mitigation policy? 🤖

Leaders need to get ahead of the rising risks AI introduces.

Developing policies to mitigate risk and ensure AI acts as an amplifier of good, rather than bad outcomes, is a key part of adapting to this new era. 

HR and legal teams are vital allies for the security leader responsible for crafting policy and a people-oriented process. So if you’re revisiting—or are yet to create—gen AI security policies, use these standards and resources as guidelines for AI risk management:

🧠 ISO 22989: Shared terminology for referring to AI and describing AI concepts, use it to develop your team’s internal language and references. 

📘 ISO/IEC 23894: Guidance on developing risk management policies specifically related to AI. 

📝 NIST AI Risk Framework: NIST’s AI risk management framework (AI RMF) for improving the trustworthiness of AI products or services. 

⚖️  The Artificial Intelligence Act: The European Parliament approved the Artificial Intelligence Act on March 13 to ensure safety and compliance with fundamental rights.

Nurture positive AppSec culture between sec & devs teams 🤝

Aligning security practices with developer workflows is key for shipping secure apps fast. 

Sounds good in theory. But here on earth, many developers would rather sprint through a cactus patch than deal with even more security hoops to jump through that slow development down to a snail's pace. 

How do you get these two teams to collaborate while respecting the secure SDLC? 

1. Shift security left ⬅️

Traditional late-stage secure code reviews slow everything down. Instead, integrate security testing into the dev process from the start—even within IDEs and pull requests. This lets devs catch issues as they code.

2. Manage upwards with meaningful metrics 📈

Prove security's value by reporting on the right metrics.

Being able to report the impact of secure coding practices and track the progress of your DevSecOps program will help you get leadership support and prove the value of secure coding practices. - Billy Yung, Staff Solutions Engineer, Snyk

These metrics can include: 

🔑 Vulnerabilities fixed. 

⏰ Mean time to fix issues.

👩💻 Dev adoption of security tools.

3. Support developer-friendly tooling👩💻

Security tooling integrated into dev workflows needs to be accessible and easy to adopt, enabling consistent secure practices.

The key? 

Make security a seamless part of how devs already work, not an afterthought or extra burden. 

☝️ Speaking of tooling: Let’s face it, most of us in security are guilty of failing to teach devs what to look out for, or what tools to use in the first place. 

If they don’t know what an SQL injection is or how to find it, who’s really to blame? 

Learn more with our 10-point checklist for secure code reviews.

The multimillion-dollar insurance policy right under your nose 📝 

In 2017, Equifax suffered one of the biggest data breaches in history. 147 million folks had sensitive personal info stolen. 

After the dust settled, the U.S. House Oversight Committee report pinned poor incident response planning as the main culprit. There was: 

• Zero visibility into the true scope of the breach.
• Zero effective remediation plan.
• Zero transparency with those impacted.

The total toll? Around $700 million. 

This might’ve been mitigated if incident response planning basics, like good reporting practices, were followed.

Incident Response (IR) reports are the true narrative of a cybersecurity incident's handling—capturing the good, the bad, and the ugly. But their true superpower? 

Turning hindsight into foresight. 

IR reports are also a key document you’ll lean on for support when providing regulators, insurers, and executive leadership with a detailed account of an incident, its origins, and remedial actions taken. 

They’re the (potentially) pre-emptive multimillion-dollar insurance policy buried in existing processes and workflows. 

However building report structures and guidance from scratch is difficult, especially for smaller SOC teams. That’s why our blue team specialists are sharing a free IR reporting template and guide for SOC teams👇

Free IR reporting template (no download required)

Win of the month (let’s celebrate fellow security leaders) 👏

Nathan Kramer, Founder & Principal Security Consultant, Vigilant Cybersecurity: Identified a weakness in a client's customer service procedures that allowed a caller to take over customer accounts with just a little OSINT gathering. Procedures were updated, employees were re-trained, and the vulnerability was remediated!

Ken Underhill, CISO and multi-award winning and international best-selling author of Hack the Cybersecurity Interview: Recently supported Underground Ops in closing their second largest deal to date.

👉 Share your win with the community

Your expertise and insights are invaluable. And we’re eager to share them with our vast audience of over 2.6 million members. 

We’d be honored to feature your top "win" of the month related to your team, department, or security program in the next edition of ThreatReady. 

A “win” could be: 

• Achieving compliance or industry standards. 
• Successfully onboarding new team members.
• Celebrating your team’s performance.

The top wins will be shared in the next month’s edition of ThreatReady (and if it’s really good, may get some additional love on social media). Want to share your win? 

Drop a comment below telling us what it is👇