Ismail Guneydas

Today’s San Antonio Chapter of CFMA lunch reminded me why cross-functional learning is one of the most underrated risk management tools we have. Here are the three insights that hit hardest for me: 1. Tax changes create security gaps. Rushed tech purchases to capture bonus depreciation or R&D credits often skip security vetting and that’s where exposure creeps in. 2. Construction firms face rising cyber risk. According to the Dodge Construction Network, 59% of construction firms experienced a cybersecurity threat over a two year period. The industry’s complexity makes it a prime target. 3. Finance + IT disconnect = avoidable risk. In most of the firms I talk to, finance leaders can’t list all of the cloud tools their project teams rely on. This is a blind spot attackers love. Takeaway: Your tax strategy, growth plan, and cybersecurity posture aren’t separate. They’re interconnected systems that can either reinforce or undermine each other. Huge thanks to Kathryn Hall, Bradley Frantz, Nita McBride, and the speaker for today's session Shelley Woitena for an outstanding CFMA meeting. Also wanted to thank Denice Allison for the introduction to the San Antonio crew. What’s an unexpected place you’ve learned something critical about your business?

6

1 Comment

Modern eBike on-board computers are basically small PCs that not only offer motor control, navigation, and performance monitoring, but also store lots of sensitive user data. The Bosch Nyon series of board computers are cutting-edge devices from one of the market leaders in the eBike business, which is why they are especially interesting for forensics. Therefore, we conducted an in- depth forensic analysis of the two available Nyon models released in 2014 and 2021. On a first- generation Nyon device, Telnet access could be established by abusing a design flaw in the update procedure, which allowed the acquisition of relevant data without risking damage to the hardware. Besidestheuser’spersonalinformation,thedataanalysisrevealeddatabasescontaininguseractivities, including timestamps and GPS coordinates. Furthermore, it was possible to forge the data on the device and transfer it to Bosch’s servers to be persisted across their online service and smartphone app. On a current second-generation Nyon device, no software-based access could be obtained. For this reason, more intrusive hardware-based options were considered, and the data could be extracted via chip-off eventually. Despite encryption, the user data could be accessed and evaluated. Besides location and user information, the newer model holds even more forensically relevant data, such as nearby Bluetooth devices.

2

Cybersecurity concerns highlighted during SXSW as FBI launches new initiative Operation Winter Shield encourages people and businesses in Central Texas to take steps to protect data during large events. #cyber #cybersecurity #events https://lnkd.in/guZEkCyt

15

1 Comment

Chiplets are changing the game for AI + automotive… but they also widen the supply-chain attack surface. When you’re assembling systems from multiple dies, across multiple vendors/fabs, it’s easier for something shady (or just unverified) to slip in, and one bad chiplet can compromise the whole package. Worth a read: https://lnkd.in/ged8uJA8 Big thanks to Agam Shah and the Dark Reading team for a great story.

15

1 Comment

In my new article published by ICIT, Executing the RMF as an Engineering Discipline, not a Paperwork Exercise, I discuss how the Risk Management Framework must function as part of engineering, not as a compliance process. RMF was created to align design, implementation, and operations so that control performance is demonstrated through verified system behavior rather than documentation. The article explains how integrating RMF into development pipelines, architecture decisions, and operational telemetry allows authorization decisions to reflect real conditions in production. When security is designed, tested, and monitored as part of engineering, the framework delivers what it was meant to provide. Systems maintain authorization by demonstrating continued security in operation. Read the full article on ICIT: https://lnkd.in/eup93tvi #cybersecurity #technology

19

Accepted papers for the Symposium on Usable Security and Privacy (USEC 2026) are now available: https://lnkd.in/gTzcPvf2 📈 Submissions up 65% 🎯 Acceptance rate 33% Encouraging signs for the continued growth and impact of usable security and privacy research.

39

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments