Paul Rivers

The state of Rhode Island publicly released the results of a third-party analysis of the 2024 RIBridges cyberattack and data breach at a press conference with Rhode Island Governor Dan McKee and Chief Digital Officer Brian Tardiff. Cybersecurity company CrowdStrike conducted the analysis, which revealed the five-month timeline of the breach and a more accurate number of impacted individuals -- approximately 644,401 people. RIBridges is a system run by Deloitte that the state of Rhode Island uses to administer important social services benefits like health insurance, food stamps and the Child Care Assistance Program. As previously reported, Deloitte informed the state of a potential security threat to RIBridges on Dec. 5, 2024, stating that there was a high probability that a cyberthreat actor had obtained files containing sensitive information. The Brain Cipher cyberthreat group later took responsibility for the hack. The state took RIBridges temporarily offline and later sent notification letters to nearly 650,000 individuals. The newly released third-party analysis provided clarity on how the cyberthreat actor gained access to the RIBridges environment and how it performed data access, staging and exfiltration activities on 28 RIBridges systems. Reviewing post-incident analyses of healthcare data breaches can help defenders bolster security efforts. https://lnkd.in/gBJR5kBh

7

Shawn Murphy and Jeff Cassidy, CISSP explain how threat hunting fits into the “Left of Bang” strategy and mindset, a driving principle of WEI’s deep cybersecurity practice. @CyberTrust Massachusetts 💡 Listen to the full #podcast episode here: https://lnkd.in/eYGXQfmz

4

This is a fantastic resource and a well done document. There is a new CMMC FAQ. One question in the new FAQ stuck out to me: "Q4. Can Department contractors implement NIST SP 800-171 Revision 3? A4. Yes. Companies can implement Revision 3 but must use the Department’s Organization-Defined Parameters (ODPs) defined in the April 2025 memorandum, “Department of Defense Organization-Defined Parameters for National Institute of Standards and Technology Special Publication 800-171 Revision 3” found here: https://lnkd.in/eN5pnTzB. Because CMMC Assessments will be conducted against Revision 2 until the class deviation memo (Q3 of this section) is withdrawn or otherwise superseded, DIB companies must ensure any identified gaps between Revision 2 and Revision 3 are addressed." We won't know exactly when the class deviation will removed and CMMC will be on 800-171 Rev 3, but if you want to get a headstart you are permitted to implement Rev 3 if you use the DoD's Organizationally Defined Parameters (ODPs). I will note that the ODPs are subject to change during the rulemaking process. #cmmc

8

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

Most people assume the biggest cybersecurity challenges in K–12 come from outdated systems, limited budgets, or a lack of tools. But in my experience, the biggest gap isn’t technical at all; it’s communication. When districts tighten security, restrict access, or introduce new controls, the immediate pushback usually isn’t about the change itself. It’s about the surprise, the impact on daily routines, or not understanding the why. K–12 staff aren’t resisting security. They’re resisting disruption they didn’t see coming. Here’s what I’ve learned: - If people understand why a control is needed, they’re far more willing to support it. - Communicating early builds trust. Communicating late creates frustration. - Teachers will work with IT, as long as IT works with them. - Even the best technical solution will fail without buy-in. - Clear expectations reduce fear, assumptions, and resistance. Security isn’t just a technical effort; it’s a relationship effort. The more transparent and collaborative we are, the smoother the transition from convenience-first to security-first becomes. You can deploy tools and policies all day long, but without communication, none of it sticks. If you want to dive deeper into this topic, I recently published a blog post where I break down this challenge further and share 5 practical communication tips that IT teams can use when rolling out new security controls. https://lnkd.in/g-FSkEFS

1

1 Comment

For years, security teams worked to satisfy auditors and check compliance boxes. But today, the harshest critics of your cybersecurity posture aren’t regulators - they’re insurers. Because cyber risk has become an underwriting risk. If you can’t prove control maturity, you’ll pay more - or worse, find out your coverage means nothing when you need it. Cyber risk is now a pricing, eligibility, and survivability problem, a lot more than a technical issue. Real-World Lessons: When “Covered” Didn’t Mean Protected Even well-funded organizations are learning how unforgiving insurers have become: 1. Inchcape Australia v Chubb Insurance (2022) A ransomware attack caused business disruption, but the insurer ruled losses as “indirect” and not payable. 2. Hacked Business Loses Cyber Payout (Australia, 2023) A small business breach claim was denied - missing MFA and weak controls nullified the policy. 3. Supplier Breach, No Cover (2024) A company’s AU$30K response cost claim tied to a vendor incident was rejected - policy misalignment. These aren’t mere paperwork errors. They reflect a systemic shift: insurers now validate cyber maturity at the same depth attackers exploit it. Meeting the Baseline Isn’t Enough “Compliance-ready” doesn’t mean “insurable.” Policies are being restricted, repriced, or outright denied when: Controls exist only on paper, not in enforcement, and IR playbooks haven’t been tested in 12+ months. MFA or segmentation is missing on privileged or legacy systems, while Shadow IT, unmonitored vendors, or undisclosed prior incidents exist. You can’t produce evidence - metrics, logs, or test reports - on demand. Cyber insurance is no longer a safety net. It’s a maturity audit disguised as a policy. If you approach it like compliance, you’ll overpay or be left uncovered. If you treat it like risk management, you’ll earn leverage - lower premiums, higher trust, and resilience that outlasts any claim dispute.

21

1 Comment

Royce Humpert Jr. has shared some of the development efforts and roadmap for this product. It is truly impressive. This post discusses the application of a thoughtful and extensible framework behind specific deliverables. As the world shifts to technology enabled practice, tools like Neat Labs offers will become the standard toolkit. As just one example (but by no means exhaustive), Security Auditors can shift from the minutia of repetitive data collection and workpaper generation to issues of effectiveness, data workflow, and architectural concerns in applying frameworks to effective security. As always, I speak for myself and as an academic interested in ai evolution and effective security . Neither BDO nor SMU necessarily endorse any products.

6

2 Comments

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments