Arell Chapman

The NCUA’s Automated Cybersecurity Evaluation Toolbox, or ACET, provides credit unions of all sizes the means to easily determine and measure their cybersecurity preparedness over time. For more information or to download the ACET Toolbox, visit https://go.ncua.gov/ACET. #creditunions #cybersecurity #finance

10

This. Security identification display policies and challenge procedures are not only for airports, seaports, power plants, or military installations. Organizations need to train their staff to recognize when someone does not belong in security areas, and how to respond. Physical security is a critical component of information security.

2

🚨 Legacy MFA isn’t enough to stop modern threats 🚨 Organizations face growing challenges from MFA bypass attacks, where attackers trick users into revealing not just their credentials but also MFA codes (like SMS or push notifications). The solution? Modernize authentication with FIDO. 🔑 Why FIDO Matters: Built-in cryptographic techniques block credential theft, even if users are tricked. Works seamlessly with operating systems, phones, browsers, SSO providers, and websites. Prevents attackers from logging in , even with stolen credentials. 💡 Case Study Highlight: The USDA deployed FIDO authentication for ~40,000 staff, overcoming challenges like seasonal workers and lab environments. Their success shows that migrating to FIDO is achievable for any organization. Read the USDA’s inspiring journey to modern authentication. 💭 Remember: Malicious actors don’t break in—they log in. Let's stop them. #CyberSecurity #MFA #FIDO

6

Do you know how to fight #phishing? We’ve got everything you need to avoid taking the bait. 🎣 Learn more information about how you can protect yourself from phishing scams at https://lnkd.in/g4C53DdS. #BanksNeverAskThat

1

The LinkedIn Learning roadmap "𝐈𝐦𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐘𝐨𝐮𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐌𝐨𝐝𝐞𝐥𝐢𝐧𝐠 𝐒𝐤𝐢𝐥𝐥𝐬" includes courses to enhance security professionals' threat modeling capabilities.. 𝐎𝐯𝐞𝐫𝐯𝐢𝐞𝐰 This learning path is around the STRIDE threat modeling framework. Each course in the series delves into one of these categories, providing learners with the tools and knowledge to identify, analyze, and address these threats effectively. 𝐈𝐧𝐬𝐭𝐫𝐮𝐜𝐭𝐨𝐫 Adam Shostack guides the learning path. He brings extensive experience as a consultant and author and provides valuable insights and practical approaches throughout the courses. 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠 𝐨𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐬 The learning path establishes a robust foundation in threat modeling principles and practices. Using the STRIDE model to identify and analyze critical security vulnerabilities, participants will acquire comprehensive skills and practical experience applying threat modeling to secure products and services effectively. 𝐂𝐨𝐧𝐭𝐞𝐧𝐭𝐬 The program includes six courses that cover threat modeling, from foundational principles to specific threats. The first course introduces the principles of threat modeling. Subsequent courses explore specific aspects, such as identity spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each course provides techniques, security risks, and countermeasures to address cybersecurity challenges effectively. 𝐂𝐨𝐧𝐜𝐥𝐮𝐬𝐢𝐨𝐧 This learning path is crucial for diverse professionals who want to enhance their knowledge of threat modeling. It offers a structured approach to comprehending cybersecurity threats and the best practices for handling them. It is valuable for those in security architecture, software development, and IT security management roles who aspire to build or improve their threat modeling capabilities. #threatanalysis #threatmodeling #stride #security #cybersecurity

6

My colleague Jeremy Baumruk and I spoke at the Iowa Bankers Association annual conference on the importance of leadership in cyber security Very well attended conference, and it was really exciting to see the energy and excitement around the banking community. In cyber security, I believe that we all put a lot of emphasis in "community", and this is no different in banking. Because we all have industry specific challenges, this is a great way to strategize, and socialize with folks in the same industry to help solve problems! Looking forward to the next conference!

54

Securing Access - Part 1 - Authentication 🔑 In a recent news article, a disgruntled ex-employee 😡 gained unauthorized 🚫 access to his former employer's environment computer test systems and deleted the virtual servers, resulting in significant financial losses. 💸 💭 How can we prevent such incidents? 💭 We can look at three parts:  (i) Authentication🔑, (ii) Authorisation ✅, and  (iii) Monitoring 🔎 🔑 Authentication 🔑 1. Individual accounts Personnel should be assigned individual accounts for their work purposes. Using shared accounts may lead to accountability issues. 2. Remove account(s) Accounts of terminated employee(s) should be removed/disabled timely. For high-risk functions/roles, organizations take proactive action to revoke accounts of laid-off employees immediately after formal notification. Others may take a different approach by off-boarding the access x-days prior last working date. 3. Implement MFA MFA provides an additional layer of security. Despite the knowledge of credentials, perpetrators without the MFA would not be able to complete the sign-in process. 4. Restrict login  Remote access can be further restricted using parameters like IP address, and geographic location, including time-bound restriction on specific hours.  5. Password controls  Lastly, password hygiene. Enforce strong password controls like minimum length, complexity, history, and rotation, etc. Remember to include account lockout after x-failed attempts too. #LBFalumni  #SkyHighTower  #bingshare炳分享4149 #cybersecurity #authentication 

54

4 Comments

Watch the Oxnard City Council following the water workshop, to learn about City's water supply.

4

October is Cybersecurity Awareness Month. Watch Brandi Cole, Chief Risk Officer, and Lora Hartshorn, Risk Manager, as they offer up tips to help keep your information safe. Learn more about fraud prevention at https://lnkd.in/gMTECUd5

4

🔒 Join Me Live! 🔒 Exciting news! I'm thrilled to announce that I'll be participating in a webinar "Constructing a Secure Application Security Foundation"! 💼💻 Don't miss out! Register now and join me for this engaging session. See you there! 🌟 #Webinar #ApplicationSecurity #Cybersecurity #InfoSec #StackHawk

16

1 Comment

Interesting article highlighting the importance of the CISO position and why organizations should value the insight and knowledge qualified CISOs provide.

8

📢 Big news at eScope Solutions! Our Senior Vice President, Dean Marshall, has been featured in this year’s CU Edge Magazine by the CrossState Credit Union Association🎉 In his insightful article, Dean shares expert advice on strengthening cybersecurity for credit unions—a must-read for anyone in the industry looking to enhance their security posture. Check out the article here: https://lnkd.in/eG5gMrNb We’re proud to have leaders like Dean driving conversations that matter in the credit union community! #CreditUnions #Financialinstitutions #Cybersecurity #MSP #MSSP #NCUA

17

1 Comment

"Human Risk Management" starts with detecting and measuring human #security behaviors and risks. The management comes in by educating and enabling the workforce to protect themselves and their organization against cyber attacks, building a positive security culture. While far from the only focus, AI has brought about fun new trends to consider. Good piece by Dan Lohrmann.

6

Is your financial institution #NCUA compliant? Need help getting and staying compliant with NCUA cybersecurity regulations? Dox can help! Simply call #DoxElectronics at (585) 473-7766 today to schedule a free, no-obligation initial consultation. You may also visit us online at https://lnkd.in/esk58RRT. #Cybersecurity #Regulations #Compliance

3

Great insights from Angela! Are there any additional takeaways from these top 5 Webster First blog articles? Let us know what you think.

5

The countdown has started ... less than a month away. CornCon X: The Cyber Games, taking place on October 4-5, 2024 in Davenport, IA. This isn’t just another cybersecurity conference. It’s a unique experience that combines top-tier professional insights with a vibrant community atmosphere. What sets CornCon apart? 🌟 - Diverse Topics & Expert Speakers: With over 65 world-class speakers, CornCon covers a wide range of topics from ransomware and IoT to AI and medical devices. - Hands-On Villages & Training: Engage in interactive sessions and hands-on training that provide practical skills you can apply immediately. - CISO Executive Summit: A dedicated summit for CISOs to discuss the latest trends, challenges, and strategies in cybersecurity leadership. - Kids’ Hacker Camp: A unique feature where the next generation of cybersecurity experts can learn and play. A huge shoutout to John D. Johnson, the visionary founder of CornCon. Don’t miss out on this incredible opportunity to learn, network, and grow. Register now and join us in Davenport for an unforgettable experience! https://corncon.net #Cybersecurity #CornConX #CyberGames #CISO #HackerCamp #CyberCommunity

19

🌟 Don't miss the most important webinar for financial institutions in 2025! 🌟 Join Dupaco Community Credit Union's Chief Risk Officer, Todd J Link, and interface.ai's Chris Bechtel for a live discussion on the key priorities for financial institutions in 2025: fraud prevention and enhanced digital member experiences. Here’s what you’ll take away: 🔒 How Dupaco combats fraud with AI, device biometrics, and anti-spoofing. 💡 How AI delivers 24/7 personalized support to Dupaco's members, creating deeper, more meaningful member connections. 📈 How Dupaco has upgraded from IVR to IVA to automate 80% of after-hour calls without compromising service quality. And don't forget to bring your questions for the live Q&A! Register here: https://lnkd.in/gvqzvHUu

22

1 Comment