Lanita Collette

Last Friday, we live-streamed for Secure Nation with Rachel Arnold and Will Collins, a Program Manager at Pima Community College. The conversation covers various topics related to cybersecurity, education, and community engagement. In a very casual conversation, we cover: OWASP Denver: Frank Victory explains the mission of OWASP (Open Web Application Security Project) and its Denver chapter, highlighting its focus on cybersecurity education, meetups, and an annual conference. Cybersecurity Education: The conversation touches on the importance of hands-on learning, including student-run data centers and cyber warfare ranges at Pima Community College. Community Engagement: The speakers emphasize the value of mentorship, networking, and collaboration in the cybersecurity industry. Personal Stories: Frank shares his journey into cybersecurity, starting from his time in the Marine Corps and transitioning into IT and security. Industry Challenges: The discussion includes insights into penetration testing, risk management, and the evolving landscape of cybersecurity. Upcoming Events: Mentions of conferences, workshops, and local meetups related to cybersecurity. This includes Frank presenting a workshop at the Rocky Mountain Information Security Conference (RMISC.ORG) on May 28th. https://lnkd.in/gcDqu5iE

13

𝗙𝗿𝗼𝗺 𝗣𝗿𝗶𝗻𝘁𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲 𝘁𝗼 𝗣𝗿𝗼𝗽𝗼𝗿𝘁𝗶𝗼𝗻𝗮𝘁𝗲 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲: 𝗟𝗲𝘀𝘀𝗼𝗻𝘀 𝗶𝗻 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆 𝗧𝗿𝗶𝗮𝗴𝗲 When 𝘗𝘳𝘪𝘯𝘵𝘕𝘪𝘨𝘩𝘵𝘮𝘢𝘳𝘦 dropped a few years ago, I was at Texas A&M and part of the team that led the institution-wide response. It was an “all hands on deck” moment. I stood up a real-time internal site, tracked mitigations across thousands of servers, and generated daily reports for leadership. It worked - and it set the bar. But something interesting happened afterward: Every new zero-day or vulnerability announcement triggered the same expectation. 🔥 Full crisis posture. 🔥 Executive attention. 🔥 Immediate campus-wide action. The problem - Most vulnerabilities don’t warrant that level of response. We were slipping into p͟e͟r͟m͟a͟n͟e͟n͟t͟ f͟i͟r͟e͟-a͟l͟a͟r͟m͟ m͟o͟d͟e͟. So I stepped back and asked: 𝗪𝗵𝗮𝘁 𝗳𝗮𝗰𝘁𝗼𝗿𝘀 𝗺𝗮𝗱𝗲 𝗣𝗿𝗶𝗻𝘁𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝘄𝗼𝗿𝘁𝗵 𝗮𝗻 𝗲𝗺𝗲𝗿𝗴𝗲𝗻𝗰𝘆 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗲? And can we generalize those factors so we respond proportionally in the future? That question led to a matrix I built at A&M — and more recently expanded at Harvard Medical School — that evaluates new vulnerabilities across a few key dimensions: * 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆: theoretical, PoC, weaponized, actively exploited * 𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲: internet-facing vs. internal systems * 𝗦𝗰𝗼𝗽𝗲: number and importance of affected systems * 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗼𝗿 𝗰𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗶𝗺𝗽𝗮𝗰𝘁: HIPAA, FERPA, NIH/DoD contract implications * 𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗱𝗶𝘀𝗿𝘂𝗽𝘁𝗶𝗼𝗻/𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹𝗶𝘁𝘆 Crossing these factors produces clear, repeatable 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲 𝗟𝗲𝘃𝗲𝗹𝘀: from routine tracking to coordinated mitigation to true emergency posture. What this accomplishes: * Leaders get clarity instead of chaos * Engineers aren’t whiplashed by unnecessary escalations * Security teams focus their energy where it actually matters * External pressure doesn’t dictate internal panic * Decisions become defensible, consistent, and risk-based These are just basic, publicly available concepts that yield an important principle: 𝗠𝗮𝘁𝘂𝗿𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀 𝗱𝗼𝗻’𝘁 𝘁𝗿𝗲𝗮𝘁 𝗲𝘃𝗲𝗿𝘆 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗹𝗶𝗸𝗲 𝗣𝗿𝗶𝗻𝘁𝗡𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲. 𝗧𝗵𝗲𝘆 𝗯𝘂𝗶𝗹𝗱 𝗮 𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝘁𝗵𝗮𝘁 𝘁𝗲𝗹𝗹𝘀 𝘁𝗵𝗲𝗺 𝘄𝗵𝗲𝗻 𝘁𝗼 𝘀𝗼𝘂𝗻𝗱 𝘁𝗵𝗲 𝗮𝗹𝗮𝗿𝗺… 𝗮𝗻𝗱 𝘄𝗵𝗲𝗻 𝗻𝗼𝘁 𝘁𝗼. It’s been a useful tool that has helped us remember, when a zero day or threat advisory comes out, we don't have to immediately call for all hands on deck. A more effective process is to take a few moments to consider the nature and impact of the vulnerability or threat, and then initiate an appropriate response. If your team ever starts drifting into “respond to everything” mode, a structured triage model might be one of the best gifts you can give them.

3

Looking to secure funding for cybersecurity or technology upgrades in your organization? Whether you're working in K-12 or higher education, tribal government, or a state or local agency, knowing how to build cybersecurity into your next grant-funded project is critical. Join Check Point's @Katherine Fernandez and the Grants Office for an in-depth discussion where we'll explore strategies for identifying and winning cybersecurity grants, as well as securing funding for IT infrastructure, network security, emergency response systems, and more. You’ll gain actionable insights into how to make cybersecurity a central—and fundable—part of your technology projects. This session will highlight: · Current and upcoming funding opportunities across education, and state, local, and tribal governments · How to position cybersecurity in your grant proposals to strengthen competitiveness · Grant-seeking tips and tricks for technology-focused initiatives Don’t miss this opportunity to get expert guidance and boost your chances of securing funding for your next secure, connected project. Register now: https://lnkd.in/e2eqtfGw

20

Most people assume the biggest cybersecurity challenges in K–12 come from outdated systems, limited budgets, or a lack of tools. But in my experience, the biggest gap isn’t technical at all; it’s communication. When districts tighten security, restrict access, or introduce new controls, the immediate pushback usually isn’t about the change itself. It’s about the surprise, the impact on daily routines, or not understanding the why. K–12 staff aren’t resisting security. They’re resisting disruption they didn’t see coming. Here’s what I’ve learned: - If people understand why a control is needed, they’re far more willing to support it. - Communicating early builds trust. Communicating late creates frustration. - Teachers will work with IT, as long as IT works with them. - Even the best technical solution will fail without buy-in. - Clear expectations reduce fear, assumptions, and resistance. Security isn’t just a technical effort; it’s a relationship effort. The more transparent and collaborative we are, the smoother the transition from convenience-first to security-first becomes. You can deploy tools and policies all day long, but without communication, none of it sticks. If you want to dive deeper into this topic, I recently published a blog post where I break down this challenge further and share 5 practical communication tips that IT teams can use when rolling out new security controls. https://lnkd.in/g-FSkEFS

1

1 Comment

Identity and Access Management (IAM) is a key guardrail for secure access. This guide explains core IAM components, how they protect resources, and why they are foundational to Zero Trust security strategies. Read the breakdown: http://oal.lu/I9q5t #IAM #ZeroTrust #Security

3

Eligible Montana public agencies and school districts can now access the SentinelOne whole-of-state security bundle at no cost through the State and Local Cybersecurity Grant Program. This comprehensive package provides automated endpoint protection and 24/7 managed response to help modernize your cyber defense while reducing operational burden. Register for the event on April 8 to learn more: https://ow.ly/9jAE30sU2HR

2