IoT Security

Podcast Episode 17: Current and Future Concerns of Securing IoT Devices

cybersecurity, Network Security, podcast

Why is my toaster talking to my accounting software? Are internal or outside devices causing DDoS or botnet attacks? Larry Bianculli discusses IoT device security, current and future concerns, with Matthew Pascucci and Joe Goldberg.

continuous monitoring

Third CISO Roundtable Overview – Building a Defendable Enterprise with Continuous Monitoring

cybersecurity, Network Security, Ransomware

It was our third CISO roundtable that we hosted at a local vineyard and the conversation was as lively as ever. I’m not sure if it was the wine tasting, the food or the experience of the CISO’s in attendance, but this event was lively discussion that focused on “Building a Defendable Enterprise with Continuous Monitoring”. The excitement and passion that was coming back from our attendees was nothing short of encouraging to see how these leaders in our field are taking their roles serious in defending their organizations. It was once again a privilege to be in the midst of these leaders learning from their wisdom and experience in the field. This blog is being written as recap of a few highlighted discussion points throughout evening that were discussed.

POLICY AND PROCEDURE

Policy and Procedures – Security Compliance

cybersecurity, Network Security

All organizations have policies and procedures on how particular tasks and goals are established within the organization. The issue here is many of these are either word of mouth or haven’t been written down. This leads to having subjective policies and procedures that morph over time based off a loose understanding of the objective. Almost every regulated organization is being asked to have written policy and procedure to adhere with compliance that allows for a defined and objective method of handling policy and procedures within their organization. This creates a strategic framework for those that the policy and procedures are guiding. This being said, there are a few differences when it comes to policy and procedure.

cybersecurity tabletop

Developing Cybersecurity Muscle Memory with Table Top Sessions

cybersecurity, Network Security

Anything that’s difficult takes time to master, or at least become competent, and it requires constant training and being pushed in situations which will sharpen your reflexes. This is the predominant reason why we perform cybersecurity tabletops in order to improve our reaction time regarding security incidents and breaches. During these situations there’s much more than the technical aspect that needs to be considered and if the entire organization isn’t moving in tandem, mistakes will be made. Organizations as a whole need to live this experience, even if it’s just a tabletop, in order to understand the ramifications of where you might have blinders on from a maturity standpoint. This consistent role playing, aimed to force all levels of participant’s out of their comfort zone, is used to create that tempered muscle memory on how to react to incidents without question.

patch

Just Patch Already… It’s Not that Easy

cybersecurity, Network Security

We’ve all heard it before, “Just patch all the things and you’ll be perfectly fine” and there’s a lot of truth to this statement; it’s also extremely shortsighted. If you’re working in a large enterprise or an organization that uses unique equipment for business functions it’s almost impossible to follow the “patch all the things” mantra. Mostly, because there aren’t available patches or the systems have become unsupported. At CCSI we work with some of the world’s largest organizations and in doing so we’ve noticed that patching isn’t always an option, even though we recommended it as a priority, to some systems on the network. Here are few areas we recommend when patching isn’t an option.

Second Annual Long Island CISO Roundtable

cybersecurity, Network Security

We recently held our second annual CISO roundtable that brought in the attendance of fifteen CISO’s for a candid conversation regarding their concerns, challenges and advice on protecting their organization. Last year’s roundtable showed that Long Island has a security community that’s hungry to learn and grow from each other. This was also evident from the attendance at the first BSides Long Island, which was held in January. It was no surprise that our second roundtable was just as lively and informative as these two events. Throughout the agenda for the night the topics covered ranged from continued challenges, improvement, and future considerations. We’ll briefly touch on a few throughout this blog so the extended community can learn from their wisdom and insights.