What are the best tools for identifying and addressing cybersecurity risks as a business advisor?

Today's threats require continual monitoring of techniques being newly deployed and a constant inventory of all applications, supply chains, vendors, sub- systems, endpoints and network architectures. An operating culture and environment that allows staff to identify and rank perceived gaps and threats is also necessary as many environments often have very specialized operations, code and systems only a handful of people truly understand but attackers will extensively study and use in an attack if it gives the right leverage. The SolarWinds case will be interesting to watch as it implies more sophisticated risk assessment, along with the decisioning & remediation fully documented, esp. for publically traded companies.

Vulnerability scans are essential to help a company's vision of risk. Through them, we can identify flaws that need to be corrected, mature and improve the company's vulnerability management process. Establish the deadlines and risks that these identified flaws need to be corrected, measure the criticality for the company. I see many benefits in using a scanning tool, whether it's open source or not.

Vulnerability scanners work very well for known vulnerabilities, but as many recent events have demonstrated, many zero days unknown or not yet disclosed exist and are being exploited. Vulnerability scanned definitely need to be in the mix but one has to recognize their limitations, reporting characteristics and have in place a system linked with remediation ticketing and documenting other mitigations.

A realização de um PenTest, ajuda a organização a entender e corrigir suas vulnerabilidades antes que um atacante real as encontre. Existem diversos tipo de testes que podem ser feitos, desde a realização de ataques à infraestruturas, sistemas web, simulações de phishing, processos e pessoas, etc. O mais importante é a organização tentar realizar estes testes em ambientes que tenha grande importância para o negócio, podendo assim endereçar planos de ação diversos para corrigir os gaps que forem encontrados.

Pentest in my opinion is essential to validate the vulnerabilities identified. The pentest will use the skills of possible malicious actors, so try to exploit them in all sorts of ways and techniques. This helps the company understand which improvements within its defense layer need to be improved and proactively avoid possible security incidents.

De acordo com o relatório "X-Force Cloud Threat Landscape Report" da IBM, privilégio excessivo em ambientes Cloud, têm sido um fator de vulnerabilidade global, visto que que o uso inadequado destes acessos podem acarretar diversas ameaças, como por exemplo Movimentação Lateral entre ambientes, após uma máquina e/ou serviço ser comprometido. Falando de Risco Humano, o "2022 Data Breach Investigations Report" da Verizon, relata que mais de 80% das violações de dados, ocorreram por fatores humanos, tendo a engenharia social como principal ofensor, utilizando por exemplo técnicas de phishing, ou malwares roubadores de credenciais. Estes são alguns exemplos, mas mostra claramente a necessidade de investirmos em treinamentos sobre os temas.

The three pillars of a company are People, Processes and Technology. It is therefore extremely important for companies to have in-house information security training. They cover standard subjects such as phishing, stronger passwords, but the main and essential thing is that within these training sessions, employees are taught the institution's Security Policy. Employees will be aware of what activities can and cannot be carried out, how data should be "handled" and shared, and access to certain content. I always recommend that training sessions are 100% tailored to the company's reality, always addressing security issues in general, but giving this insight into what can happen to us and how you can help prevent possible security incidents.

When choosing a cybersecurity incident response tool, focus on key criteria: Integration: Ensure it integrates seamlessly with your existing security infrastructure. Automation: Look for tools that automate tasks to expedite response times. Scalability: Ensure it can grow with your organization's needs. Threat intelligence: Access to up-to-date threat data is essential. Reporting and analytics: Detailed reporting helps in post-incident analysis. Ease of use: User-friendly interfaces reduce training time. Compliance: Ensure the tool aligns with relevant regulations. Vendor support: Opt for tools with strong vendor support and regular updates.

Os SOCs centros de operações de segurança precisam de agilidade nas três principais etapas de sua função: triagem, quando os profissionais responsáveis analisam alertas e logs para identificar quais eventos precisam ser escalados ou não; investigação, quando os especialistas se aprofundam em entender a atividade maliciosa, incluindo sua origem e extensão; e caça de ameaças, quando dados forenses e telemétricos são examinados detalhadamente para entender uma tentativa de ataque ou risco.

These days I would say this should be #1 on the list and not down at #5. The plan should involve all critical personnel for escalation, communication, mitigation and documentation. New state and federal regulatory requirements dictate now very short time windows for notifications and formal regulatory filings. The tools mentioned here might help with detection, but they aren't the complete plan.

When selecting a cybersecurity audit framework for a company, it is important to consider several key criteria. These include the scope of the framework, compliance with relevant regulations and industry standards, a comprehensive risk assessment process, clear and concise reporting, scalability, ease of use, and cost-effectiveness

Um dos principais pontos de partida para endereçar na jornada de Cyber Security, entendo como sendo abordagens sobre Gestão de Identididades e Acessos (IAM). Já parou pra avaliar alguns temas como: Utilização de usuário genérico; Utilização de usuário de serviço pra logar em ambientes; Falta de visibilidade e gestão de Acessos Privilegiados (exemplo equipes de Infra, Suporte, Dev, Adm de Redes, trabalhadores terceiros); Políticas de senhas bem definidas, contendo dentro outros exemplos, quantidade mínima de caracteres, mescla de letras maiúsculas/minúsculas, números e caractéres speciais); Ativação de MFA sempre que possível; Revisão periódica de Acessos; Adoção de políticas de Separação de Funções. Princípio de menor privilégio.

So apparently this is an AI generated article - which is interesting. Not sure which pieces AI did (I think that needs to be disclosed..) I would say the ranking of prioritized actions in this list need to be swapped around a bit, along with sources pulled/posted and some items added. For instance, cybersecurity/risk insurance should be here along with tools for the CI/CD pipeline, ticketing, etc. Cybersecurity has become a much bigger challenge given the threat environment and requires not only "tools" but often org/cultural and operational changes.