How to Reduce Cybersecurity Risks

The OWASP® Foundation Threat and Safeguard Matrix (TaSM) is designed to provide a structured, action-oriented approach to cybersecurity planning. This work on the OWASP website by Ross Young explains how to use the OWASP TaSM and as it relates to GenAI risks: https://lnkd.in/g3ZRypWw These new risks require organizations to think beyond traditional cybersecurity threats and focus on new vulnerabilities specific to AI systems. * * * How to use the TaSM in general: 1) Identify Major Threats - Begin by listing your organization’s key risks. Include common threats like web application attacks, phishing, third-party data breaches, supply chain attacks, and DoS attacks and unique threats, such as insider risks or fraud. - Use frameworks like STRIDE-LM or NIST 800-30 to explore detailed scenarios. 2) Map Threats to NIST Cybersecurity Functions Align each threat with the NIST functions: Identify, Protect, Detect, Respond, and Recover. 3) Define Safeguards Mitigate threats by implementing safeguards in 3 areas: - People: Training and awareness programs. - Processes: Policies and operational procedures. - Technology: Tools like firewalls, encryption, and antivirus. 4) Add Metrics to Track Progress - Attach measurable goals to safeguards. - Summarize metrics into a report for leadership. Include KPIs to show successes, challenges, and next steps. 5) Monitor and Adjust Regularly review metrics, identify gaps, and adjust strategies. Use trends to prioritize improvements and investments. 6) Communicate Results Present a concise summary of progress, gaps, and actionable next steps to leadership, ensuring alignment with organizational goals. * * * The TaSM can be expanded for Risk Committees by adding a column to list each department’s top 3-5 threats. This allows the committee to evaluate risks across the company and ensure they are mitigated in a collaborative way. E.g., Cyber can work with HR to train employees and with Legal to ensure compliance when addressing phishing attacks that harm the brand. * * * How the TaSM connects to GenAI risks: The TaSM can be used to address AI-related risks by systematically mapping specific GenAI threats - such as sensitive data leaks, malicious AI supply chains, hallucinated promises, data overexposure, AI misuse, unethical recommendations, and bias-fueled liability - to appropriate safeguards. Focus on the top 3-4 AI threats most critical to your business and use the TaSM to outline safeguards for these high-priority risks, e.g.: - Identify: Audit systems and data usage to understand vulnerabilities. - Protect: Enforce policies, restrict access, and train employees on safe AI usage. - Detect: Monitor for unauthorized data uploads or unusual AI behavior. - Respond: Define incident response plans for managing AI-related breaches or misuse. - Recover: Develop plans to retrain models, address bias, or mitigate legal fallout.

Is your security team stuck in firefighting mode? Use this Cybersecurity Strategy Matrix to build a balanced security roadmap: 𝟭. 𝗘𝗺𝗯𝗲𝗱𝗱𝗲𝗱 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 (Existing Systems + Existing Controls) → Strengthen password policies and access management → Enhance patch management processes → Conduct deeper security awareness training → Low risk, focuses on security fundamentals 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Strong foundation with minimal disruption 𝟮. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗻𝗼𝘃𝗮𝘁𝗶𝗼𝗻 (Existing Systems + New Controls) → Implement EDR/XDR solutions over traditional antivirus → Deploy AI-based threat hunting capabilities → Adopt zero-trust architecture frameworks → Moderate risk, leverages advanced protections 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Significantly improved protection without system overhaul 𝟯. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝗽𝗮𝗻𝘀𝗶𝗼𝗻 (New Systems + Existing Controls) → Extend current security monitoring to cloud workloads → Apply existing controls to newly acquired systems (M&A) → Secure shadow IT with established security baselines → Moderate risk, focuses on consistent security coverage 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Unified security posture across your growing environment 𝟰. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗧𝗿𝗮𝗻𝘀𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 (New Systems + New Controls) → Build security for containerized environments → Implement quantum-resistant encryption → Develop custom security for IoT/OT environments → Highest risk, prepares for emerging threat landscapes 𝗢𝘂𝘁𝗰𝗼𝗺𝗲: Future-proofed security ready for emerging threats Effective cybersecurity requires balancing immediate needs with long-term resilience. Where is your security program investing today?

Your biggest cybersecurity threat might not be your employees — it might be your coffee machine. Everyone’s worried about employees clicking phishing emails… …but who’s worried about the smart thermostat leaking your sensitive data? (You should be.) When we talk about human cyber risk, it’s not just laptops and emails. It’s the people who plug in devices they don’t understand — or don’t think about — that open the backdoor. The truth is: The Internet of Things (IoT) is your weakest (and most ignored) security link. 📺 Smart TVs. 🏅 Fitness trackers. ☕ Coffee machines. 🔔 Video doorbells. 💡 Smart lighting. 🌡️ Even that “harmless” Wi-Fi-enabled fish tank thermometer in your lobby. (Yes, that actually happened to a casino in 2019 where the whole high roller database was exfiltrated through an IoT connected fish tank thermometer. Ouch.) If it connects to the internet, it can connect a threat actor to you. ACTIONABLE TAKEAWAYS: ✔️ Audit your IoT Devices: List everything in your business and home that’s internet-connected. If you don’t track it, you can’t protect it. ✔️ Segregate Networks: Keep IoT devices on a separate Wi-Fi network from business operations and sensitive information. ✔️ Change Default Credentials: Most IoT breaches happen because devices are left on factory settings. Change all passwords — immediately. ✔️ Update Firmware: Your smart devices need updates just like your computer does. Patch regularly or retire them if they’re no longer supported. ✔️ Train Your People: If they’re plugging it in, they’re opening a portal. Awareness matters. Train users to think before they connect. Bottom line: Human risk isn’t just about bad passwords and phishing clicks. It’s about our instinct to trust technology we don’t fully understand. If you employ humans, if you use IoT, you have risk. Manage your humans. Manage your tech. Or someone else will. #HumanRisk #Cybersecurity #IoTSecurity #InsiderThreat #CyberHygiene #Leadership #SecurityAwareness

Security Shouldn’t Disrupt Business. It Should Enable It. The biggest complaint I hear from CIOs? Security is slowing things down. Security isn’t about building walls, it’s about keeping the business moving safely. Here’s how to reduce risk without disrupting operations: 1️⃣ Try and gain visibility is everything. This WON'T disrupt anything and gives you full visibility into your network traffic. • Monitor network traffic (Corelight works great) • Map assets & data flows • Track east-west movement • Watch cloud resource usage 2️⃣ Zero Trust, But Make It Simple • Start with privileged accounts • Remove standing privileges. • Enable just-in-time access • Microsegment critical assets 3️⃣ Lock Down Identity & Access • MFA everywhere (no excuses) • Monitor login patterns (my fav is CrowdStrike Falcon Identity) • Track login sources • Flag unusual access attempts 4️⃣ Fix Your Logs (Most skip this!) • Standardize log formats (Cribl). Hey, I did it for Vijilan Security and the engineers just fell in love with it. • Centralize logs (LogScale) • Set retention policies (1 year live, 7 years associated raw logs for each detection) • Enable real-time alerts This is how I would present the numbers to my superiors: ✅ 65% fewer exposed assets ✅ 45% faster threat detection ✅ Zero business disruption ✅ 30% fewer false positives 5️⃣ If you want quick and dirty way to gain quick wins, do this: ✔ Disable unused admin accounts (24h) ✔ Review external facing services (48h) ✔ Implement basic segmentation (1 week) ✔ Roll out MFA (2 weeks) Security isn’t about perfection, it’s about progress. Apply 80/20 rule and move your way up. Start small, build momentum, and integrate security without breaking what works. Want more insights like this? Follow me for practical security strategies. #CISO #CrowdStrike #falcon #cribl #ZeroTrust #AttackSurface #Corelight #ITEXPO2025