 security by design part 9 security by design part 9 hemraj mon 10202025 502 security by design part 9 joseph f norton sort by latest trending joseph fnorton latest trending image last month i closed my post by saying that in my next series of posts i will endeavor to explore with you the exploding global risk ecosystem which threatens our businesses today and into the future and to help you selfassess as you ask your organization the following question  do you and your business have the ability to anticipate prepare for and adapt to changing conditions to withstand respond to and recover from a cyber business disruption  i will begin this series of posts with a quote from a recent an opinion article published in the washington post on february 14 2024   at this moment the united states faces escalating threats posed by china russia iran foreign cartels sophisticated hackers wmd proliferators spies terrorists and more  gen paul m nakasone article  i was head of the nsa in a world of threats this is my biggest worry by paul m nakasone february 14 2024 published in the washington post general paul m nakasone was commander of the us cyber command director of the national security agency and chief of the central security service until february 2nd 2024 gen nakasone goes on in his article to speak about what remains his biggest worry concerning these continuing and escalating threats he worries that we  make ourselves blind to external threats  by not sharing and connecting the dots of knowledge and intelligence we have available to prevent and block attacks he continues to share his views on how we need to continue to work across and with all aspects of government technology companies businesses and suppliers to businesses and government whose services are increasingly being exploited by terrorists and other bad actors your business is under attack every day  gen nakasone goes on in his article to speak very specifically about the various challenges and aspects of sharing risk and intelligence information across us intelligence agencies his perspectives remind me of the challenges of engaging in risk and threat dialogs within a business as a security officer you are acutely aware of risks and threats to your business yet in the crush of business as usual you may not or do not have the attention of your leadership peers concerning the knowledge and intelligence you possess concerning the risk and threats your business faces it has been my experience that my greatest challenge has always been keeping the attention of my peers focused on the things that would harm our business i am not speaking about the mundane operational tasks and activities of cybersecurity i am speaking about the real risks  high impact high probability risks  the multiplicative effects of low impact high probability risks  and actual unfolding attacks why is this such a challenge we are bombarded with bad news from all corners of online and traditional news and media every day with most of the online news being sensationalized for clicks it is hard for our peers to avoid being influenced into not knowing what to pay attention to or not to pay attention to so why should they pay attention to you let s use an example  february 7 2024 cybersecurity infrastructure security agency advisory prc statesponsored actors compromise and maintain persistent access to us critical infrastructure alert code aa24038a the us authoring agencies have confirmed that volt typhoon has compromised the it environments of multiple critical infrastructure organizations primarily in communications   energy   transportation systems  and water and wastewater systems sectors  in the continental and noncontinental united states and its territories including guam volt typhoon s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations and the us authoring agencies assess with high confidence that volt typhoon actors are prepositioning themselves on it networks to enable lateral movement to ot assets to disrupt functions the us authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and or military conflicts this is not fake news this is real the implications of this are staggering china volt typhoon is already prepositioned inside these critical infrastructure complex digital systems this is not about defending against an attack the attack has already happened you may look at the list of critical infrastructure sectors above and say to yourself that you are not in those business sectors rest assured though that you will be dramatically impacted by any attack in any of these sectors i pray that the organizations penetrated and impacted are taking all appropriate actions to deal with this now to make my closing point today this amazing cisa alert was in the major news feeds for one day it was reported and reposted by many on linkedin for a second day i have seen no other posts after that no continuing dialog no follow up news articles creeping normality strikes again we have become so used to hearing about cybersecurity threats breaches data loss etc that the importance of such risk and threat intelligence is glossed over this example forces me to ask this question  has any senior leadership executive in your organization reached out to ask you about this cisa advisory alert code aa24038a  or have you reached out to any senior leadership executive in your organization to advise them about the ramification of this cisa advisory alert code aa24038a to your organization  i am not in any way suggesting that you need to take any specific action at or within your business because of this cisa advisory alert only you would know if you should be communicating with your senior leadership about this in the words of gen nakasone if you should be in dialog with your senior leadership about this cybersecurity intelligence  failure to do so would be a selfinflicted wound of the highest order    joseph f norton is a risk security and crisis management professional he is a founding member and qualified technology executive of the digital directors network chair of the advisory board with next era transformation group and chief security officer with apf technologies he has served as chief security officer svp at atos chief technology officer and head of operations svp at philips chief technology officer svp at novartis executiveinresidence with mckinsey company and chief technology officer at mcdonald s he has also held professional roles during his career with jpmorgan bank oracle sybase and grumman aerospace corporation and the united states navy latest webinars our proven track of record view all image webinar clone of the ciso exchange for a safer digital world image webinar the ciso exchange for a safer digital world image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government image webinar zero trust architecture adoption in federal government popular articles unleashing business potential the power of adaptive enterprise architecture in the digital age businesses must adopt an adaptive enterprise architecture to succeed doug picirillo 15 best practices in salesforce development many businesses have decided to use salesforce s customer relationship management solution kannan venkataraman 