Dan Desko

The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh

7

Cyber risk is a real and present threat for organizations of all sizes. So what are the most effective ways to manage cyber risk? As with all risks there are three primary management strategies: #1- Risk Avoidance #2- Risk Acceptance #3- Risk Mitigation Props to AlertMedia for this excellent resource on Risk Response Strategies. #risk #riskmanagement #cyberrisks https://lnkd.in/eAJNxB2E

6

1 Comment

AI governance has quickly moved from theory to reality, and many teams are figuring it out in real time. I’m excited to be leading a hands-on AI Governance workshop at the ISACA Kentuckiana Secure Digital Conference (SDC26), where we’ll cover practical ways to: • Scope an AI governance program • Conduct AI risk assessments • Map risks to controls and evidence • Build audit-ready AI governance processes If you work in GRC, risk, compliance, internal audit, security, or privacy, this session is designed to give you tools you can apply immediately. If you’re attending SDC26, I’d love to connect and see you there. 🔗 Register: SDC26.eventbrite.com Curious...how is your organization approaching AI governance right now? #AIGovernance #AIRisk #Cybersecurity #GRC #ISACA

39

🚨$1M Cyber Resilience Fund! We partnered with F500 CISOs to build a #cybersecurity service leveraging their knowledge, best practices, and expertise. And we launched a fund to make it available to organizations of all sizes! CISO developed Toolkits with templates, training programs, leadership development, daily intelligence reports, and more. Reach out to learn more! ➡️ https://lnkd.in/eTmuhYbB #ciso #smb #smallmediumbusiness #security #risk #nationalsecurity #cio #technology #digital #cyber #corporatesecurity #grc #resilience CyberRisk Alliance CyberRisk Collaborative

75

6 Comments

Understanding when to pursue ISO 27001 compliance rather than going for certification—or vice versa—hinges on your organizational priorities, resources, and long-term security strategies. Check the differences and learn which path to choose.

10

If your controls tighten around audits and loosen afterward, governance is becoming seasonal. Constant control, not reactive compression, determines resilience. See how we design governed, always-on oversight here: https://lnkd.in/eBiZ6SbH #ExecutiveLeadership #CyberSecurity #Mindcore

2