Josh Yavor

A breach leading to fake breach, which in the end is still a reputation issue ➡️ Maine breach portal abused to publish fake data breach disclosures Somehow this lead to accidental doxing by the organization being hacked. Yet another reminder that it becomes more and more challenging to maintain integrity of online systems, and while the threat landscape evolves, with AI powered exposure, one of the strategy, as I repeat for years, it to reduce the exposure. Rely more on internal systems. I also disagree with the story blaming VPNs etc. I think VPNs (client machine to organization infra) are a key to keep operating with limited exposure. Of course the VPN solutions must implement best practices (including cryptographic MFA with tools like hardware key or passkeys), and added security audit for the traffic (and additional overlapping controls), combined with proper segmentation. ➡️ So far, and given the situation, public cloud is a no go for private data, attack surface is out of control. Minimizing the stack is key. And, if you don't have the resources for this, and you must pick a cloud, ensure your cloud is not exposed, and have privileged identity management with strong access control, somehow working the same way as VPN, ideally on private cloud. 💡 Many online solutions offer extra security, leak monitoring and stronger detection capabilities, they should all be enabled if you can. https://lnkd.in/ekjRMwVx

12

There is a conversation that security leaders dread more than almost any other. Not the conversation with the attacker. The one with the board. Not because boards are unreasonable. But because the board is asking a business question and most security programs are built to answer a technical one. "Are we secure?" is a technical question with a complicated answer. "Would the business survive a serious attack?" is a business question, and it requires a completely different kind of answer. The security leaders that navigate board conversations well have done something specific: they stopped trying to translate their security program into business language and started building the answer to the business question directly. They know their recovery time. They know which systems the business cannot operate without and what their exposure looks like if those systems go dark. They can tell the board not just what controls are in place but what the actual consequence of a failure would be and how long recovery would take. That is a harder thing to know than whether your tools are configured correctly. It requires a different kind of assessment entirely, one that starts with the business question rather than the technical one. The leaders who walk into board conversations with that kind of clarity are in a different position from the ones who walk in hoping the board doesn't ask something they can't confidently answer. When your board asks the survival question, what does your answer actually look like?

9

1 Comment

Facts. The industry got hooked on compliance like it’s protection—when criminals don’t care about your checkboxes. If attackers respected policy, we wouldn’t need incident response teams. Compliance is a comfort blanket. Real security is what holds up when somebody’s actually trying to break in.

12

2 Comments

Most security leaders aren’t struggling with awareness. They’re struggling with assumptions. We assume attacks will be sophisticated. We assume alerts will give us time. We assume compromise will be obvious. But many of the incidents we’re seeing right now don’t follow that pattern. They’re simple. Quiet. And effective. Access is gained. Legitimate tools are used. And by the time it’s detected, the impact is already operational. That shift requires a different mindset. Not just “How do we stop attackers?” But “What happens if they’re already inside?” Where would they go first? What could they control? How far could they move before you knew? The strongest teams I see are spending more time on those questions.

30

1 Comment

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

Loss of view came before loss of control. That is the detail from the Minnesota water attacks worth carrying into this region. More than 30 communities lost visibility and control of water and wastewater equipment in a single weekend in late July. No zero day, no custom malware. The controllers were reachable straight from the internet, and operators were locked out of their own process. Water is a designated CII sector in Singapore, and the updated Cybersecurity Code of Practice took effect on 29 July, two days after that weekend. Detect, respond and recover is now the standard, not perimeter defence. Across 338 million simulations in our Blue Report 2026, fewer than 1 in 7 attacks generated a meaningful alert. Deployed is not the same as working. Who has proven the difference in your environment? #OTSecurity #CriticalInfrastructure #CTEM

4

Do phishing simulations actually change user behavior or could they be doing more harm than good? In our latest episode of the Shared Security Podcast, Scott Wright, CISA discusses the potential downsides of frequent testing and why focusing on reporting rates might just be the key. Listen in and re-evaluate your approach to phishing simulations! Links below to listen wherever you get your podcasts!

16

1 Comment

I asked my buddy Grok the following - in terms of risk calculation does cyber risk act on a bell curve or is it more like a spike? I'll summarize the response. If you want to geek out, click the link at the bottom. Could you imagine if you went through all of the time and treasure to calculate your risk and make important decisions only to find out at an inopportune time that you used the wrong model? Form Grok: Cyber risk doesn't follow a neat bell curve. It's more like a sharp spike of everyday minor incidents with a dangerously long, heavy tail of rare but catastrophic events that happen far more often than Gaussian models predict. The popular FAIR model (Factor Analysis of Information Risk) is excellent for breaking down risk into quantifiable factors and running Monte Carlo simulations, but don't put too much solace in it alone: it often relies on lognormal or similar distributions for severity that can still underestimate those extreme tails where real-world cyber losses (think massive breaches or ransomware shutdowns) behave more like power-law/heavy-tailed phenomena. Bottom line for risk pros: use FAIR as a strong starting framework, but layer in tail-focused methods (extreme value theory, Pareto tails, etc.) and stress testing to avoid dangerously understating black-swan-level exposures. Stay vigilant, cyber catastrophes aren't as "six-sigma rare" as bell-curve thinking suggests. Or just comment #easybutton below and I can show you the way. #CyberRisk #RiskQuantification #FAIR #TailRisk The entire response if you want to geek out is at: https://lnkd.in/eUkpxnww. But the summary is

13