Darshil Shah

Today’s San Antonio Chapter of CFMA lunch reminded me why cross-functional learning is one of the most underrated risk management tools we have. Here are the three insights that hit hardest for me: 1. Tax changes create security gaps. Rushed tech purchases to capture bonus depreciation or R&D credits often skip security vetting and that’s where exposure creeps in. 2. Construction firms face rising cyber risk. According to the Dodge Construction Network, 59% of construction firms experienced a cybersecurity threat over a two year period. The industry’s complexity makes it a prime target. 3. Finance + IT disconnect = avoidable risk. In most of the firms I talk to, finance leaders can’t list all of the cloud tools their project teams rely on. This is a blind spot attackers love. Takeaway: Your tax strategy, growth plan, and cybersecurity posture aren’t separate. They’re interconnected systems that can either reinforce or undermine each other. Huge thanks to Kathryn Hall, Bradley Frantz, Nita McBride, and the speaker for today's session Shelley Woitena for an outstanding CFMA meeting. Also wanted to thank Denice Allison for the introduction to the San Antonio crew. What’s an unexpected place you’ve learned something critical about your business?

6

1 Comment

Identity and Access Management (IAM) is a key guardrail for secure access. This guide explains core IAM components, how they protect resources, and why they are foundational to Zero Trust security strategies. Read the breakdown: http://oal.lu/I9q5t #IAM #ZeroTrust #Security

3

CISSP to CISM: Mindset Tweaks to Ace the Exam Both CISSP and CISM build techno-managerial skills, but CISM leans harder into executive governance. If you're CISSP-certified, you already handle technical depth plus basics like asset management and compliance. CISM amps up the strategic layer for leadership roles. CISSP mindset: Balance hands-on tech (cryptography, network security) with managerial oversight (policy development, incident response). Study by mastering scenarios across all domains, practicing adaptive multiple-choice questions. CISM mindset: Elevate that foundation to pure governance. Prioritize business alignment in every answer, focusing on risk prioritization for the C-suite and program metrics. Exam essays demand you frame security as a value driver, not just a cost center. Key shift: Less "how to implement" (CISSP strength), more "why prioritize this risk over that one." Use your CISSP knowledge as bedrock, then layer on ISACA case studies and boardroom-style reasoning. Who's making the jump? What CISSP skills carried over most for you? #CISM #CISSP #Cybersecurity #InfoSecCareer

35

5 Comments

I found this an odd release from CISA today. Guidance for SIEM / SOAR implementation. I’ve read through most of it, and will make another round, but it reads like an executive presentation. Even the practitioners guide. I’m not really sure what they were hoping to accomplish. The important logs section is a good index/reference page, but the rest is both short sighted and dangerous to call guidance in my opinion. There’s not enough info to estimate log sizes at this level. Even the fact of saying you need to centrally collect logs is short sighted as there are many ways now to decentralize the logs and have the same or better value. They scratch the surface on noting this, but don’t explain the nuance enough. I’ve worked with one of the best engineering and orchestration teams, and this barely scratches the surface of what we did. That being said, it’s a good guide book for someone new to the space, for considerations of design, and for what to expect in the framework that is built. I think one of the biggest things I didn’t see, is doing this right requires the right strategy, and especially the right skill sets. You need people that understand data, big data, and development. There’s is a lot of development here; like you essentially need a development team and solid relationship between threat intel, detection engineering, soc and development teams to do it right. This also scales differently depending on the size of the org, but even in a small org, there’s a level of entry and cost of doing business, but you’re going to have to err on the side that requires less care and feeding which is not a monolithic centralized system. I’m curious what others think. I’m sure Jonathan Rau has some opinions. :). I’m also curious what Sean Maher thinks.

34

22 Comments

CMMC Compliance Deadline: Are You Ready for October 1st?   The DoD’s latest update to 48 CFR Part 204.75 makes it official: CMMC certification is mandatory for contractors starting October 1, 2025. If your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must be certified to bid, renew, or extend DoD contracts. 🎯 Don’t risk disqualification. As a CMMC Registered Practitioner Organization (RPO), Concertium helps defense contractors like you: * Assess and close compliance gaps * Build cybersecurity policies and procedures * Train your team and prepare for certification ⏳ Time is running out. Let’s get you ready before Phase 1 begins. 📅 Book your free consultation today: concertium.com/cmmc-rpo

10

Most organizations are deploying AI, but very few are securing it! Microsoft’s AI Security Risk Assessment makes it clear that traditional controls cannot address new threats like model inversion, data poisoning, and adversarial inputs. Security must now begin at the data layer, model governance has become the new perimeter, and explainability is essential for both operations and compliance. AI risk is no longer theoretical—it is operational and must be treated as such.

153

9 Comments

The Real Test of Cyber Resilience Happens Before the Attack The real test of an organization isn’t measured in the chaos of an attack — it’s measured in the discipline built during calmer days. Wargames, tabletop exercises, and a strong security-by-design mindset determine how well a business navigates uncertainty when it matters most. In today’s landscape, good security is no longer a cost center. It is a business enabler, a competitive differentiator, and a foundation of digital trust. As global threats accelerate, one truth is becoming clearer: Organizations that invest early in skills, AI, and secure architectures will lead the next era of cyber defense. They will define how the world stays resilient in an age shaped by constant digital risk. Resilience isn’t accidental. It’s engineered — long before the first alert fires. #CyberResilience #SecurityByDesign #Wargaming #IncidentResponse #DigitalTrust #BusinessEnabler #CyberDefense #Leadership #AIinSecurity #FutureOfSecurity

3

Federal Public Key Infrastructure (PKI) has evolved from a vital security tool into a costly legacy liability due to fragmented systems, manual processes, and escalating maintenance demands amid budget constraints. Modernization through FedRAMP-authorized cloud-native PKI-as-a-Service promises up to 60% cost reductions by consolidating operations and automating certificate lifecycles. This shift enables Zero Trust compliance, post-quantum readiness, and phishing-resistant authentication without disrupting existing trust chains. Agencies can redirect resources from routine tasks to strategic cybersecurity priorities, turning PKI into a scalable asset. Read more in this article https://lnkd.in/dTmM_yyp

10