Tag: nist
-
The unified linkage model: A new lens for understanding cyber risk
Tags: access, api, attack, breach, ciso, cloud, compliance, credentials, cve, cyber, cybersecurity, data, defense, exploit, flaw, framework, identity, incident response, infrastructure, intelligence, malicious, mitre, network, nist, okta, open-source, radius, resilience, risk, risk-analysis, saas, sbom, software, supply-chain, threat, update, vpn, vulnerability, zero-day, zero-trustMissed systemic risk: Organizations secure individual components but miss how vulnerabilities propagate through dependencies (e.g., Log4j embedded in third-party apps).Ineffective prioritization: Without a linkage structure, teams patch high-severity CVEs on isolated systems while leaving lower-scored flaws on critical trust pathways.Slow incident response: When a zero-day emerges, teams scramble to locate vulnerable components. Without pre-existing linkage…
-
Cybersecurity management for boards: Metrics that matter
Tags: ai, attack, automation, breach, business, cloud, compliance, control, cyber, cybersecurity, data-breach, deep-fake, detection, dora, finance, firewall, governance, insurance, jobs, metric, mitigation, nis-2, nist, phishing, ransomware, regulation, resilience, risk, scam, soc, threat, trainingWhy does this matter? Resilience aligns with your actual business goals: continuity, trust and long-term value. It reflects your appetite for risk and your ability to adapt. And with regulations like DORA and NIS2 pushing accountability higher up the ladder, your board is on the hook. Financial impact and continuity metrics: You can’t fight cyber…
-
Notable post-quantum cryptography initiatives paving the way toward Q-Day
Tags: attack, awareness, cisa, cisco, communications, computer, computing, crypto, cryptography, cyber, cybersecurity, data, encryption, finance, framework, google, government, group, guide, ibm, infrastructure, intelligence, Internet, iot, linux, microsoft, mitre, ml, nist, nvidia, open-source, service, side-channel, software, supply-chain, technology, theft, threat, tool, vulnerabilityIndustry heavyweights line up behind PQC: Google”¯Chrome became the first mainstream browser to support hybrid post”‘quantum key exchanges by default late last year.The approach combines classical elliptic-curve encryption, for backwards compatibility, with lattice-based PQC derived from ML-KEM.Other industry giants, including Amazon and IBM, have also begun laying foundations for quantum-safe cryptography. For example, IBM has…
-
Notable post-quantum cryptography initiatives paving the way toward Q-Day
Tags: attack, awareness, cisa, cisco, communications, computer, computing, crypto, cryptography, cyber, cybersecurity, data, encryption, finance, framework, google, government, group, guide, ibm, infrastructure, intelligence, Internet, iot, linux, microsoft, mitre, ml, nist, nvidia, open-source, service, side-channel, software, supply-chain, technology, theft, threat, tool, vulnerabilityIndustry heavyweights line up behind PQC: Google”¯Chrome became the first mainstream browser to support hybrid post”‘quantum key exchanges by default late last year.The approach combines classical elliptic-curve encryption, for backwards compatibility, with lattice-based PQC derived from ML-KEM.Other industry giants, including Amazon and IBM, have also begun laying foundations for quantum-safe cryptography. For example, IBM has…
-
Volvo’s recent security breach: 5 tips to speed incident response while preserving forensic integrity
Tags: access, automation, breach, business, cio, ciso, cloud, compliance, control, cyber, cybersecurity, data, data-breach, detection, endpoint, finance, framework, gartner, GDPR, guide, incident, incident response, insurance, metric, mitigation, nist, resilience, risk, risk-management, saas, security-incident, siem, soar, supply-chain, vulnerabilityIdentify and catalog your evidence sources in advance (endpoints, memory, logs, cloud assets)Stage scripts or agents that can snapshot memory and archive logs immediately when an IR trigger firesMake forensic collection part of containment, not something you tack on afterwardModern approaches and even NIST’s updated guidance emphasize that evidence gathering should begin during, not after,…
-
Volvo’s recent security breach: 5 tips to speed incident response while preserving forensic integrity
Tags: access, automation, breach, business, cio, ciso, cloud, compliance, control, cyber, cybersecurity, data, data-breach, detection, endpoint, finance, framework, gartner, GDPR, guide, incident, incident response, insurance, metric, mitigation, nist, resilience, risk, risk-management, saas, security-incident, siem, soar, supply-chain, vulnerabilityIdentify and catalog your evidence sources in advance (endpoints, memory, logs, cloud assets)Stage scripts or agents that can snapshot memory and archive logs immediately when an IR trigger firesMake forensic collection part of containment, not something you tack on afterwardModern approaches and even NIST’s updated guidance emphasize that evidence gathering should begin during, not after,…
-
NDSS 2025 Workshop On Security And Privacy In Standardized IoT (SDIoTSec) 2025, Paper Presentation Session: Security And Privacy In Iot Standards, Protocols And Implementations
Tags: authentication, compliance, conference, data, detection, framework, iot, network, nist, privacy, software, updatePAPERS SecuWear: Secure Data Sharing Between Wearable Devices Sujin Han (KAIST) Diana A. Vasile (Nokia Bell Labs), Fahim Kawsar (Nokia Bell Labs, University of Glasgow), Chulhong Min (Nokia Bell Labs) Analysis of Misconfigured IoT MQTT Deployments and a Lightweight Exposure Detection System Seyed Ali Ghazi Asgar, Narasimha Reddy (Texas A&M University) Privacy Preserved Integrated Big…
-
CISOs face quantum leap in prioritizing quantum resilience
Tags: apple, attack, ciso, cloud, computer, computing, crypto, cybersecurity, data, data-breach, encryption, finance, governance, government, Hardware, healthcare, infrastructure, nist, resilience, risk, service, software, supply-chain, technology, threat, vulnerabilityState of migration: Encryption underpins the security of everything from healthcare records to government data and e-commerce transactions.But just 8.5% of SSH servers currently support quantum-safe encryption.TLS 1.3 adoption, currently at 19%, also trails older, quantum-vulnerable versions, according to a recent study by Forescout.Other experts paint a more optimistic picture of PQC deployment since NIST…
-
CISOs face quantum leap in prioritizing quantum resilience
Tags: apple, attack, ciso, cloud, computer, computing, crypto, cybersecurity, data, data-breach, encryption, finance, governance, government, Hardware, healthcare, infrastructure, nist, resilience, risk, service, software, supply-chain, technology, threat, vulnerabilityState of migration: Encryption underpins the security of everything from healthcare records to government data and e-commerce transactions.But just 8.5% of SSH servers currently support quantum-safe encryption.TLS 1.3 adoption, currently at 19%, also trails older, quantum-vulnerable versions, according to a recent study by Forescout.Other experts paint a more optimistic picture of PQC deployment since NIST…
-
CISOs face quantum leap in prioritizing quantum resilience
Tags: apple, attack, ciso, cloud, computer, computing, crypto, cybersecurity, data, data-breach, encryption, finance, governance, government, Hardware, healthcare, infrastructure, nist, resilience, risk, service, software, supply-chain, technology, threat, vulnerabilityState of migration: Encryption underpins the security of everything from healthcare records to government data and e-commerce transactions.But just 8.5% of SSH servers currently support quantum-safe encryption.TLS 1.3 adoption, currently at 19%, also trails older, quantum-vulnerable versions, according to a recent study by Forescout.Other experts paint a more optimistic picture of PQC deployment since NIST…
-
What Is Shadow AI and Why It Matters? FireTail Blog
Tags: access, ai, breach, business, chatgpt, compliance, data, email, framework, GDPR, governance, leak, monitoring, nist, office, regulation, risk, technology, tool, trainingOct 16, 2025 – Alan Fagan – What Is Shadow AI and Why It Matters – FireTail Blog Quick Facts: Shadow AI Shadow AI is when employees use AI tools within an organization without IT or compliance approval. Shadow AI often leads to data leaks, compliance gaps, and security risks. Examples include entering sensitive data…
-
What Is Shadow AI and Why It Matters? FireTail Blog
Tags: access, ai, breach, business, chatgpt, compliance, data, email, framework, GDPR, governance, leak, monitoring, nist, office, regulation, risk, technology, tool, trainingOct 16, 2025 – Alan Fagan – What Is Shadow AI and Why It Matters – FireTail Blog Quick Facts: Shadow AI Shadow AI is when employees use AI tools within an organization without IT or compliance approval. Shadow AI often leads to data leaks, compliance gaps, and security risks. Examples include entering sensitive data…
-
There’s no such thing as quantum incident response and that changes everything
Tags: apple, attack, china, compliance, computer, cryptography, data, dns, encryption, finance, group, healthcare, incident response, Internet, linkedin, nist, PCI, risk, serviceStep one: Inventory your algorithms and data with a view towards which sensitive data ought to be protected with PQC. This is a data classification exercise where you need to add a column to track whether the datastore or application qualifies for PQC.Step two: Check your internet-facing assets to see which, if any, are already…
-
There’s no such thing as quantum incident response and that changes everything
Tags: apple, attack, china, compliance, computer, cryptography, data, dns, encryption, finance, group, healthcare, incident response, Internet, linkedin, nist, PCI, risk, serviceStep one: Inventory your algorithms and data with a view towards which sensitive data ought to be protected with PQC. This is a data classification exercise where you need to add a column to track whether the datastore or application qualifies for PQC.Step two: Check your internet-facing assets to see which, if any, are already…
-
There’s no such thing as quantum incident response and that changes everything
Tags: apple, attack, china, compliance, computer, cryptography, data, dns, encryption, finance, group, healthcare, incident response, Internet, linkedin, nist, PCI, risk, serviceStep one: Inventory your algorithms and data with a view towards which sensitive data ought to be protected with PQC. This is a data classification exercise where you need to add a column to track whether the datastore or application qualifies for PQC.Step two: Check your internet-facing assets to see which, if any, are already…
-
A View from the C-suite: Aligning AI security to the NIST RMF FireTail Blog
Tags: access, ai, attack, breach, csf, cybersecurity, data, data-breach, defense, detection, framework, governance, grc, guide, incident response, infrastructure, injection, jobs, LLM, malicious, nist, RedTeam, risk, risk-management, strategy, supply-chain, theft, tool, vulnerabilityOct 15, 2025 – Jeremy Snyder – In 2025, the AI race is surging ahead and the pressure to innovate is intense. For years, the NIST Cybersecurity Framework (CSF) has been our trusted guide for managing risk. It consists of five principles: identify, protect, detect, respond, and recover. But with the rise of AI revolutionizing…
-
Beyond the checklist: Building adaptive GRC frameworks for agentic AI
Tags: access, ai, breach, ciso, cloud, compliance, control, crime, data, detection, endpoint, finance, framework, fraud, governance, grc, international, metric, monitoring, nist, risk, risk-management, strategy, supply-chain, switchAutonomous agent drift First, I experienced an autonomous agent drift that nearly caused a severe financial and reputational crisis. We deployed a sophisticated agent tasked with optimizing our cloud spending and resource allocation across three regions, giving it a high degree of autonomy. Its original mandate was clear, but after three weeks of self-learning and…
-
13 cybersecurity myths organizations need to stop believing
Tags: access, ai, attack, authentication, backup, banking, breach, business, ceo, compliance, computer, computing, corporate, credentials, cyber, cybersecurity, data, data-breach, deep-fake, defense, encryption, finance, government, group, identity, incident response, infrastructure, jobs, law, malicious, mfa, monitoring, network, nist, openai, passkey, password, phishing, privacy, regulation, risk, service, skills, strategy, technology, theft, threat, tool, vulnerabilityBig tech platforms have strong verification that prevents impersonation: Some of the largest tech platforms like to talk about their strong identity checks as a way to stop impersonation. But looking good on paper is one thing, and holding up to the promise in the real world is another.”The truth is that even advanced verification…
-
Cybersecurity Snapshot: AI Security Skills Drive Up Cyber Salaries, as Cyber Teams Grow Arsenal of AI Tools, Reports Find
Tags: access, advisory, ai, attack, authentication, breach, business, ciso, cloud, computing, credentials, cve, cyber, cybersecurity, data, defense, endpoint, exploit, extortion, finance, framework, fraud, google, governance, guide, hacker, hacking, identity, incident response, Internet, iot, jobs, login, microsoft, monitoring, network, nist, oracle, organized, password, privacy, ransomware, risk, risk-assessment, risk-management, scam, skills, technology, threat, tool, training, update, vulnerability, vulnerability-management, zero-dayWant recruiters to show you the money? A new report says AI skills are your golden ticket. Plus, cyber teams are all in on AI, including agentic AI tools. Oh, and please patch a nasty Oracle zero-day bug ASAP. And get the latest on vulnerability management, IoT security and cyber fraud. Key takeaways Eager to…
-
The CIA triad is dead, stop using a Cold War relic to fight 21st century threats
Tags: ai, backup, breach, business, ceo, ciso, compliance, csf, cyber, cybersecurity, data, data-breach, deep-fake, firewall, framework, fraud, GDPR, governance, infrastructure, ISO-27001, nist, privacy, ransomware, regulation, resilience, sbom, software, supply-chain, technology, threat, zero-trustRansomware is not just an availability problem. Treating ransomware as a simple “availability” failure misses the point. Being “up” or “down” is irrelevant when your systems are locked and business halted. What matters is resilience: the engineered ability to absorb damage, fail gracefully, and restore from immutable backups. Availability is binary; resilience is survival. Without…
-
Your cyber risk problem isn’t tech, it’s architecture
Tags: ai, attack, awareness, best-practice, business, ciso, cloud, compliance, container, control, csf, cyber, cybersecurity, data, data-breach, defense, finance, framework, GDPR, governance, grc, group, intelligence, Internet, ISO-27001, mitre, nist, PCI, phishing, privacy, ransomware, regulation, risk, risk-assessment, risk-management, software, strategy, threat, training, update, vulnerabilityIf the company already has a mature risk culture: The implementation of a cybersecurity management project becomes more flexible. Since my goal is to share the mechanics to achieve success in a cybersecurity program, I emphasize below some components of this ‘recipe’ to consider: Understand the dynamics and scope of the business, mapping stakeholders, processes…
-
Your cyber risk problem isn’t tech, it’s architecture
Tags: ai, attack, awareness, best-practice, business, ciso, cloud, compliance, container, control, csf, cyber, cybersecurity, data, data-breach, defense, finance, framework, GDPR, governance, grc, group, intelligence, Internet, ISO-27001, mitre, nist, PCI, phishing, privacy, ransomware, regulation, risk, risk-assessment, risk-management, software, strategy, threat, training, update, vulnerabilityIf the company already has a mature risk culture: The implementation of a cybersecurity management project becomes more flexible. Since my goal is to share the mechanics to achieve success in a cybersecurity program, I emphasize below some components of this ‘recipe’ to consider: Understand the dynamics and scope of the business, mapping stakeholders, processes…
-
CMMC and NIST Password Compliance 101: Are They Different?
See how CMMC and NIST password compliance align. Why it matters for DoD contractors, and how Enzoic helps block weak & compromised passwords. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/10/cmmc-and-nist-password-compliance-101-are-they-different/