Jonathan Cote

Detection Without Response Is Just Noise CMMC Audit Lesson: Alerts Don’t Matter If No One Owns Them Day 3 reinforced something critical about SI controls: Detection alone doesn’t equal security. Auditors wanted to know: - What generates alerts - Who receives them - How they’re triaged - What severity means - How response timelines are defined - Where outcomes are documented They weren’t impressed by alert volume. They cared about: - Ownership - Escalation - Repeatability - Closure If alerts don’t turn into action, they’re just background noise. CMMC rewards environments where signals lead to decisions, not dashboards.

3

2 Comments

"Suspected Iran-linked threat actors are conducting password-spraying attacks against hundreds of organizations, primarily Middle Eastern municipalities, in campaigns that security researchers believe may have been aimed at supporting bomb-damage assessment following missile strikes. Tel Aviv-based Check Point Research on Tuesday said that the attackers used multiple source IP addresses to target numerous Microsoft 365 accounts, affecting more than 300 organizations in Israel and more than 25 in the United Arab Emirates. While most of the password spraying hit these two Middle Eastern countries, the researchers tracked similar activity from the same attacker against a "limited number" of targets in the US, Europe, and Saudi Arabia. The attacks happened in three waves - March 3, March 13, and March 23 - and Iran-linked groups, including the Islamic Revolutionary Guard Corps' Peach Sandstorm and Gray Sandstorm, are known to use this method to gain initial access to victims' Microsoft 365 environments and steal sensitive information. While Israel's municipal sector bore the brunt of the password-spraying attacks, other industries, including technology (63 attempts), transportation and logistics (32), healthcare (28), and manufacturing (28), were also targeted." https://lnkd.in/gNFGSqay

1

A coffee maker just reminded us why IoT security can’t be an afterthought. An IT professional discovered his parents’ Keurig K-Supreme SMART generated over 1 terabyte of network traffic in 10 days — enough to saturate a home access point and degrade the entire network. The good news? Most of that traffic never left the local network. It wasn’t a classic data exfiltration. It was almost certainly a software bug. The bad news? A device whose job is to heat water and puncture a pod was capable of generating sustained ~9 Mbps of upstream traffic and disrupting connectivity for everything else on the network. This is the everyday risk of the “smart” home (and the smart office): • Devices we barely think about can become noisy, unstable, or compromised • Default connectivity often exceeds actual need • Lack of segmentation turns a single glitch into a network-wide problem Practical takeaways to reinforce with our teams and users: 1. Segment IoT devices onto isolated networks or VLANs by default 2. Monitor traffic baselines — anomalies matter even when they’re “just” bugs 3. Challenge every device that demands always-on internet access 4. Prefer offline or limited-connectivity options when the convenience doesn’t justify the risk If a coffee machine can do this, what else is quietly misbehaving on your network? #CyberSecurity #IoTSecurity #CISO #NetworkSecurity #RiskManagement. #KnowYourRisk #KnowYourExposure https://lnkd.in/gcQdyRNp

19

5 Comments

You spend millions on your technology stack—but can you show exactly how those investments support your compliance obligations? That question points to what we believe is a major enterprise challenge: the missing layer between technology and compliance. I’m excited to be presenting a conference panel on “The Missing Layer: Connecting the Technology Stack to Compliance Frameworks” together with Reynaldo G.. Organizations have invested heavily in security tools, platforms, and architectures. They have also invested heavily in satisfying controls across multiple compliance frameworks. But too often, there is no structured, persistent, queryable map connecting the two. The result? • Compliance becomes manual and expensive. • Evidence gets rebuilt every audit cycle. • Existing control coverage remains hidden. • Tool overlap goes undetected. • Organizations may invest in additional capabilities without fully understanding what they already have. In our panel, we’ll explore a practitioner-oriented approach to changing that dynamic: 🔹 Technology inventory 🔹 Multi-framework control mapping to capabilities 🔹 Gap and overlap analysis 🔹 Reporting insights for internal stakeholders We’ll discuss how organizations can move beyond simply identifying compliance gaps and start asking: ➡️ What compliance coverage already exists in our technology portfolio? ➡️ Where are capabilities duplicated across tools? ➡️ Where can consolidation create value? ➡️ Where do genuine gaps remain and require investment? The conversation is grounded in enterprise practice and applicable across IT and OT environments. More importantly, it is intended to encourage peer dialogue, community insights, and real-world experiences rather than prescribe a one-size-fits-all solution. Compliance should not be disconnected from the technology investments organizations have already made. The opportunity is to turn that relationship into intelligence. Looking forward to presenting this panel with Reynaldo Gonzalez and engaging with the cybersecurity, GRC, architecture, and technology community. #Cybersecurity #Compliance #GRC #SecurityArchitecture #ToolRationalization #TechnologyStack #RiskManagement #TSCI #ITSecurity #OTSecurity

7

1 Comment