Micah Wells

We've received reports of threat actors impersonating multiple New Jersey local municipalities to steal sensitive data and funds and exploit public trust by using common phishing tactics to demand payments. Learn more; https://lnkd.in/e6Pu9WMi #cybersecurity #infosec #phishing #NJCCIC

9

🔍 Not all SOC 2 reports are created equal. AICPA recently released a guide to help readers evaluate the quality of SOC 2 reports. Whether you're a CISO, TPRM lead, auditor, or vendor risk assessor—this matters. ✅ A strong SOC 2 report depends on the audit firm’s expertise, reputation, and peer review history. 🛑 Don’t rely blindly—question the quality, not just the checkbox. You have the right to ask better questions. Push for higher audit standards across the industry. #SOC2 #AuditQuality #VendorRisk #Cybersecurity #AuditifySecurity

3

Shawn Murphy and Jeff Cassidy, CISSP explain how threat hunting fits into the “Left of Bang” strategy and mindset, a driving principle of WEI’s deep cybersecurity practice. @CyberTrust Massachusetts 💡 Listen to the full #podcast episode here: https://lnkd.in/eYGXQfmz

4

Fraud is engineered. Your controls should be too. This week’s GRC Tip: "Fraud exploits trust gaps. Build controls to detect manipulation, not just mistakes." 🔷 Need to upgrade your fraud, waste or abuse defences from passive to proactive? Let’s talk. #Fraud #GRC #Audit #TuesdayTip

1

Now, more than ever, government agencies are taking the risk of third-party service providers (and their sub-contractors) more seriously than ever. If you are an organization that is required to comply with NYS DFS 500 regulation, make sure your vendor management program is in place and is followed.

4

The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh

7

Cybersecurity compliance shouldn't be scary - if it is, it doesn't have to be. We test following the NIST CSF 2.0 framework, validate for SOC 2/ISO, and pen-test apps/APIs so disclosures are timely and boring (the good kind). Want peace of mind? Schedule a compliance readiness review with us. Read more about our cybersecurity offerings here: https://hubs.la/Q03QBXC60 #InTimeTec #SOC2Compliance #Cybersecurity

16

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments

Dear Business and IT Audit Leaders, Before I assess any cloud environment, I ask 8 strategic questions. Why? Because cloud security isn’t just technical, it’s business-critical. #CloudSecurity #CyberAudit #ITAudit hashtag #AIaudit #RiskManagement #CloudSecurityRisk #CyVerge #CloudSecurityAudit #Cyberverge #Governance #CloudResilience #CloudGovernance

3