James Campbell

Proud to share the latest Dragos Knowledge Pack (KP) update, which my team significantly contributed to, focusing on enhancing the detection of ransomware threats targeting Industrial Control Systems (ICS). This update strengthens the Dragos Platform by incorporating new analytics and characterizations specifically designed to identify the evolving tactics ransomware groups use within operational technology (OT) environments. By improving visibility into these malicious activities, we're helping defenders bolster their defenses and better protect critical infrastructure from disruptive ransomware attacks. Check out the blog post for a deeper dive into how these new detections work and why they are crucial for robust ICS cybersecurity. https://lnkd.in/gdFfnUD9

62

4 Comments

Are #cybersecurity incidents growing more costly? Cyentia Institute's recent Information Risk Insights Study points to a 15-fold increase in the cost of #incidents and #databreaches over the last 15 years. The chart on the left shows the distribution of known/reported financial losses from incidents across the time period of study. The typical (median) incident costs about $600K, while more extreme (95th percentile) losses swell to $32M. Note that the chart uses a log scale, so the tail of large losses is a lot longer than it appears. The chart on the right trends the escalating costs of cyber events over time. Median losses from a security incident have absolutely exploded over the last 15 years, rising 15-fold from $190K to almost $3 million! The cost of extreme events has also risen substantially (~5x). So, yeah—cyber events are definitely growing more costly. That said, this picture looks a lot different among different types and sizes of organizations. How are cyber losses trending for orgs like yours? Download the full IRIS 2025 to find out! Link in the comments.

102

15 Comments

Thanks to a darknet monitoring service, our customer was alerted that an adversary had successfully obtained VPN credentials to log into their network. The attacker even shared the screenshot below on a darknet forum as proof. The legitimacy of the breach was later confirmed. Incidents like this highlight the critical role of advanced security services, such as comprehensive darknet monitoring, detecting leaked credentials, compromised accounts, and other sensitive information - potentially preventing significant financial losses before they occur.

333

24 Comments

Let's talk about Non-Certification Assessments in CMMC. 🥇 Possibly the top question I get lately with clients is whether your C3PAO who's performing your L2 Cert Assessment can also do a 'Readiness Assessment' with you As always - IT DEPENDS! (yayy - our favorite) ❓But Matt - why the quotes on 'Readiness Assessment'? Because that's the whole point. One company's 'Readiness Assessment' doesn't necessarily mean the same thing as another's It's a non-official term. And depending on what they're doing in that assessment, that will dictate if they can still perform your L2 Cert Assessment 📄 So, what IS allowed? Well on page 12 of the CyberAB's Code of Professional Conduct, the term "Non-Certification Assessments" is defined: "A non-certification assessment is the conduct by a C3PAO of a full or partial cybersecurity assessment of an OSA that does not result in the issuance or denial of a formal certification." 😎 Okay, so there is a thing that the CyberAB allows C3PAOs to do outside of a formal cert assessment, but wouldn't that impede their independence? Lucky for us, the CoPC defines the exact scenario that needs to happen so that there is no conflict of interest!   Basically, to be regarded as a true mock assessment that does not create a conflict of interest the C3PAO must: A) Follow official assessment processes outlined in 32 CFR Part 170 B) C3PAO shall not provide recommendations, advice, or consulting C) OSA shall receive an official document with the results So it really comes down to - if they're doing A, B, and C of the above, there is no conflict of interest and you CAN use that C3PAO to still do the official Level 2 Certification 💡So, if a C3PAO proposes doing a gap, mock, or readiness assessment AND your Level 2 Certification - just make sure you understand what they are and aren't doing in that assessment before engaging

69

18 Comments

The UK National Cyber Security Centre (NCSC) has released new PQC guidance. Jason Soroko and I take exception to the dates it gives and explain why in the Root Causes Podcast. Audio: https://lnkd.in/guqbbmuq Video: https://lnkd.in/gVm9iDGB

26

Welcome to Third Party Report Management: powered by the Compliance Theatre™️ TPRM is just compliance with extra steps removed. We kept the paperwork but dropped that pesky 'actually checking things' part. What it actually is: ❌ SOC 2 exists (Not Qualified for the semi-finals) ❌ ISO 27001 exists (What? "A Statement of Acceptability?") ❌ Questionnaire answered (They said yes to everything) ❌ Pentest passed (Nessus scan on the internal wiki) ❌ Trust Center exists (must be trusted) ❌ Incident response tested (they have a security email) ❌ Vendor assessed as critical (they're the only ones who replied back) Sample vendor security assessment: - Send 400-question clunky portal link - Receive 400 "Yes" answers - Ask for compliance certificates - "Can we use Okta?" - Do you think security is good? - Accept all risks because "business critical" - Risk score: Inherent is low, residual is kinda lower - Repeat annually regardless of changes Meanwhile, your vendors are: - Deploying to prod 100 times a day - Changing infrastructure hourly - Rotating entire environments weekly - Accessing your data continuously - But hey, I got their SOC2 Bridge Letter! Your "continuous monitoring" is: - Checking if certs expired - Validating security logos still exist - Making sure questionnaire is less than 1 year old - Ensuring screenshots are still in GDrive - Monitoring their Trust Center uptime What it could be (just some examples): ✅ Understanding vendor infrastructure -> Walk us through how configuration changes propagate from development to production, including approval gates and validation steps ✅ Analysing actual security controls -> How you validate security control effectiveness beyond simple existence checks ✅ Assessing real threat exposure -> Demonstrate how you identify and track shadow IT/unauthorized service usage in your environment ✅ Evaluating incident response capabilities -> Explain your automated response to a compromised production credential scenario ✅ Reviewing data flows -> Demonstrate how you identify and control sensitive data movement between environments ✅ Testing security assumptions -> Walk us through how you verify segmentation controls are working as intended ...But this takes too much time. There's no way I can do all of this for all of my vendors!!! Who said you should do it for all your vendors? You can't pinpoint your _really_ critical vendors? Maybe focus on them first, industrialise your approach for performing deep-dives. You can then tier your assessments in a way that makes more sense than SIG Core vs. SIG Lite. Some welcomed disruption is coming soon and building the foundation for scaling assessments that actually provide value to both parties. Watch this space! A funny note: TPRM is checking compliance worst than compliance themselves in order to stay compliant with their own compliance requirements... lol #GRCEngineering

121

49 Comments

“Risk appetite isn’t a document. It’s your next breach waiting to happen.” → If you’re not defining risk, trust me, the attackers already are. Let me be direct. I’ve sat in too many boardrooms where the term “risk appetite” gets tossed around like a buzzword. “We’re a low-risk organization.” “We have zero tolerance for cyber incidents.” And then you look at the operations: - No clear decision authority during incidents - Critical systems with no real-time monitoring - MFA bypassed for ‘convenience’ on executive accounts - Third-party vendors onboarded without any security review That’s not zero risk. That’s wishful thinking disguised as strategy. Here’s the harsh reality: Risk appetite isn’t what you write in policy docs. It’s what you tolerate in silence. It’s the decision not to patch legacy systems because downtime is inconvenient. It’s the 15-minute delay to escalate because no one wants to be “the alarmist.” It’s letting finance push back on a budget increase while your detection controls are two years outdated. And when the breach happens? It’s no longer a theoretical discussion. The attacker defines your risk tolerance for you. They tell you exactly what you were willing to lose. 🧠 If you haven’t asked these questions, you’re already exposed: What are we willing to shut down to contain a breach? At what financial loss do we escalate to the board? Who owns the final call when time runs out and data is on the move? Have we ever practiced making that decision under pressure? If your team hesitates to answer, that’s the real risk. ✅ What real leadership looks like: Put a number on it. If you can’t quantify acceptable loss, you’re gambling. Give authority, not just accountability. Your CISO can’t protect the business if they can’t make hard calls when it matters. Simulate the hard conversations now. If you wait until a breach to figure out your tolerance, you’re already behind. 🎯 Final thought: In this industry, hesitation has a cost. And if leadership won’t define risk appetite, Attackers are more than happy to define it for you. At Microminder Cyber Security, we help leadership teams confront these tough conversations before chaos does. Because clarity under pressure isn’t optional. It’s survival. 📩 DM me if your “risk tolerance” only exists on PowerPoint slides. Let’s turn it into something actionable. 👇 What’s the hardest business decision your team has ever rehearsed under real pressure? #Day18 #CyberSecurity #RiskLeadership #CISO #CyberResilience #Microminder #BoardAlignment #OperationalRisk #SecurityLeadership #RiskAppetite

256

17 Comments

I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...

54

17 Comments

‼️MSPs, you might want to start getting your house in order! 👀 👨🏼‍⚖️📃The new Cyber Cyber Security and Resilience Bill is proposing to bring MSPs into scope, meaning you’re going to need to align with the NIS regulations, which in turn means aligning with standards and frameworks such as NCSC CAF and ISO27001 with the ICO as regulator. 🔐 👨🏼‍💻Having audited and assessed numerous MSPs over the years for standards like CE+ and IASME CA, they are often lacking with their own controls, even when they are implementing them for their customers… 🌐If you’re going to look at ISO27001, it’s not a quick or cheap undertaking (assuming you do it properly), so I’d recommend starting to look at your controls now, if you haven’t already. #cyber #resilience #cybersecurity #msp #mssp #compliance #nis #regulations Damien Sansom Gareth Guest David Lenagh

35

4 Comments

Stop operating your SOC like a traditional IT Helpdesk. This is a dangerous and mostly overlooked issue. IT helpdesks reserve significant importance in any business. However, SOC’s operating as one, undermines the complexity of the work SOCs undertake. Issues I have encountered: → Responding to events that have already happened. → L1/L2 triage response is slow and siloed. → Treating potential incidents as a ticket resolution task. This is where the principles of the Modern SOC would provide a resolution. Analysts become cross-trained, and empowered. (Not distracted by Netflix on a 12-hour shift) I’d suggest: → Prioritising a shift to Proactive Threat Detection. → Cross-training analysts across all roles, to be well-equipped to respond to incidents. → Periodic audit of ticket responses to support SOPs and acknowledged behaviours. Is your SOC struggling to become more proactive?

141

28 Comments

"We need to impose cost on adversaries and build evidence based resilience" - NCSC CTO Ollie Whitehouse at #BSidesCheltenham this morning. Disrupting attack chains by simulating adversarial behaviours and hardening Windows and Linux functions so that they cannot be exploited by adversaries can be a way to achieve this.

62

3 Comments

Investigation Scenario 🔎 A file named netview_windows.exe was executed on a system on your network. What do you look for to investigate whether an incident occurred? Native data sources only -- no EDR or external tools. #InvestigationPath #DFIR #SOC

46

5 Comments

MDR sharpens visibility. Because resilient businesses need a clearer lens. In today’s cyber landscape, what you don’t see often matters more than what you do. Modern security teams face an overload of alerts. MDR steps in to give clarity where it matters most: - Filters noise so only real threats demand attention - Adds context to alerts for faster understanding - Guides action with expert-driven recommendations - Accelerates decisions when time is critical - Strengthens resilience by spotting what tools alone may miss MDR makes your defenses sharper, faster and more reliable. Graftronics is a Sophos MDR partner, transforming IT teams across organizations in multiple industries. Reach out to us for assessing MDR for your setup. - Vimesh Avlani Managed Detection & Response | Cyber Resilience | Trusted by Mid-Market CXOs

20

4 Comments