Tim Held

Cybercriminals often bypass technical defenses by targeting employees through sophisticated social engineering attacks and phishing scams. A robust security strategy must include ongoing employee training and attack simulations to build a human firewall.

1

Audit readiness ≠ security readiness. They overlap — but they’re not the same thing. Audit readiness answers: “Can we prove we did the thing?” Security readiness answers: “Would the thing actually stop or detect the attack?” What audit readiness looks like: • Policies exist (and were reviewed). • Tickets show approvals happened. • Screenshots show a setting was enabled. • A sample of logs is attached. • A quarterly access review spreadsheet is signed. What security readiness looks like: • The control fails loudly when broken (alerts/tickets). • Coverage is continuous, not point-in-time. • Exceptions are time-boxed and tracked. • Owners have SLAs to remediate failures. • Incidents map back to scenarios (risk assumptions get updated). ⚠️ The common trap: We collect evidence that looks great… for controls that can still break silently. 💡 Practical move (do this with one control this week): Pick one “audit-ready” control and add one “security-ready” signal: • “Vulnerability scans completed” → Alert on critical vulns aging past SLA (e.g., >14/30 days). • “Backups exist” → Proof via restore test results (last restore date + time-to-restore). • “Security training completed” → Measure behavior: phishing failure rate trend + high-risk repeat. That’s how you satisfy audits and reduce real risk. Your leading question should be: “Would this control work on a bad day?”

7

Good morning! Here is this week's ICS Advisory, Other CERT, & Vendor Vulnerability Advisories Weekly Summary for 13 – 17 October 2025. See attached or link to Weekly Summary Slides: https://lnkd.in/eHiyeZ3i This past week, CISA released 12 new CISA ICS Advisories for the following vendors: Siemens, Rockwell Automation, & Hitachi Energy. Two updated CISA ICS Advisories were released for Schneider Electric & Delta Electronics. Based on the new CISA advisories, Critical #Manufacturing, #Energy, Commercial #Facilities, #Water & #WastewaterSystems, #TransportationSystems, and #Food & #Agriculture are the potentially affected critical infrastructure (CI) sectors. The ICS Advisory Project identified 23 new ICS Advisories for Moxa [Industrial Switch, Router, & LTE Cellular Router], Westermo [Operating system], SICK [Baggage System, Smart Service Gateway], LANCOM [Unified Firewalls], Schneider Electric [Energy Management Systems], PHOENIX CONTACT [UPS & AC charging controller], Murrelektronik [PROFINET, compact module], Dassault Systèmes [3D design & lifecycle management software.], Philips [Picture Archiving & Communication System (PACS)], Ashlar-Vellum [3D modeling software], Eaton [Intelligent Power Protector (IPP) software], Ruijie [Wireless Bridge], Delta Electronics [AC Servo Drive Software], & four update for Schneider Electric [EMS, PLCs]. For a more comprehensive understanding, you can view the summary details of other CERT & Vendor product advisories identified last week (13 – 17 October 2025) and read the vendor advisory using the links provided at: https://lnkd.in/eWdPxeAG The ICS Advisory Project identified One KEV Catalog CVEs correlated with a CVE identified in one new CISA ICS Advisory: ICSA-25-289-10 – Siemens HyperLynx and Industrial Edge App Publisher - Google Chromium V8 - CVE-2025-6554, CVSSv3: 8.1. https://lnkd.in/eg5Cbgx7 This past week, Siemens released 21 (6 new, and 15 updated) Security advisories, each with a corresponding CISA ICS Advisory, except for one (SSA-083019). View previous ICS Advisory Project weekly summaries: https://lnkd.in/eQKxhAEi To view the updated ICS Advisory Project Dashboards, visit: icsadvisoryproject.com Sign up to receive ICS[AP] Weekly Summary Slides and Other CERT and Vendor Advisory Summaries via email every Monday https://lnkd.in/eUwQrrj4 I appreciate everyone's comments & support. Have a great week! #CISA #ot #ics #otsecurity #cybersecurity  #cybersecuritythreats #cybersecurityawareness #industrialautomation #chemical #hydro #oilandgas   Disclaimer: The views expressed in my LinkedIn posts and profiles are my own, not those of my employers or LinkedIn.

22

Risk changes faster than your quarterly report. New misconfigurations, new exposures, new attack paths can appear in days, not months. Continuous Threat Exposure Management keeps your risk map current so you are fixing what matters now, not what mattered last quarter.

3

Businesses heading into renewing their PCI AOC & ROC keep in mind the PCI 4.0 requirements that include "Best practice until 31 March 2025". These requirements are now a hard requirement to obtain a PCI AOC & ROC in 2025. A requirement that will likely impact most organization is 8.4.2 which states "MFA is implemented for all access into the CDE" - this requirement brings up a key topic in PCI auditing, segmentation. Having a clear scope helps organizations meet controls. There is a tug of war for leaders to decide on budgets and implementing controls. Say you have accurate scoping of your card data environment, you can apply strict access controls around that area only, this gets you passed the PCI audit. Should you roll out MFA organization wide, absolutely, however, organizations with limited budget need to decide between MFA roll out or keeping the business operating, segmentation is key to getting MFA rolled out in a manner that meets PCI requirements. example of segmentation: - X users access the CDE in Y manner ONLY. The CDE has physical/ACL rules blocking communication between non-CDE environments. The non-CDE environment users do NOT access CDE, if they do, MFA is required. - Remember, segmentation must be validated, include segmentation in your annual penetration testing, which will serve for the segmentation validation AND the PCI requirement for segmentation test. #PCI #PCIAOC #Cybersecurity #MFA

5

Will your System Security Plan (SSP) lead to a false start at the assessment? Most CMMC Level 2 assessments fail before the auditor even looks at the network. Why? Because the SSP is weak. It’s Evidence Item #1, and if it doesn’t meet the Lead Assessor's expectations, the audit stops there. Here is how to make your SSP actually "Assessor-Ready": 1. Target the 320 Objectives: Don't just write to the 110 practices. Use NIST SP 800-171A. If your SSP doesn’t explicitly address every sub-objective (a, b, c), it’s an automatic finding. 2. Define Asset Categories: You must distinguish between CUI Assets, Security Protection Assets (SPA), and Contractor Risk Managed Assets. An auditor needs to know exactly which requirements apply to which device. 3. Be Specific (Who, What, How): Write precise statements that describe how your organization implements controls to meet the objectives will pass. Here is an example: “Authorized access to the CUI Enclave is restricted via Microsoft Entra ID (GCC High) using role-based security groups. Permissions are granted based on "least privilege" and "need-to-know" following an approved Access Request Form. Evidence is maintained in SEC-POL-01 and quarterly Entra ID Group Membership exports.” 4. Map to Artifacts: Treat your SSP as a roadmap. Link every control directly to a specific piece of evidence (e.g., Policy-V2 or Firewall-Logs-Q1). If the assessor can find the proof instantly, the interview stays short. 5. You are accountable: If you use cloud services (Azure/AWS), clearly define your Shared Responsibility. You are likely responsible for 70% of the controls—show where the provider provides support and where your organization closes the gap. If you have questions, I can help. #CMMC #Cybersecurity #NIST800171 #Compliance #DIB

4

1 Comment