Yastis

Performs cybersecurity consulting for small to mid-sized tech-enabled organizations. We assess & enhance organizational cybersecurity to minimize risks while obtaining / maintaining compliance with regulatory and / or industry requirements. Primary responsibilities include product / process development, business development, and overseeing all consulting work being performed.

Cybersecurity Consultant

Ohio Air National Guard

Currently the 251st Cyberspace Engineering Installations Group (CEIG) Plans and Resources Branch Chief. Oversees publication of various strategic and operational level planning documents. Works with program leads for various resource management programs to ensure effective and efficient use of government funds. Leads exercise planning and execution processes. Serves as the Defensive Cyber Operations (DCO) Program Manager, responsible for building and managing DCO programs at eight subordinate military organizations.

Cyberspace Operations Officer

Lockheed Martin

Oversaw the classified cyber security team spanning three US government special access programs in support of the F-35 Joint Strike Fighter. Designed, implemented, managed cyber security policy, plans, and processes to enforce compliance with the Joint Special Access Program Implementation Guide (JSIG) and other Department of Defense regulations. This included system auditing, vulnerability management, account management, insider threat prevention, system to system connections, wireless access points, user training, hardware and software evaluations, approvals, tracking, lifecycle management, and providing cybersecurity input for Risk Management Framework (RMF) Assessment and Authorization (A&A) efforts. Served as the lead for the Lockheed Martin Pilot Training Device (PTD) Enterprise Working Group (EWG) with the goal of increasing compliance, standardization, and cybersecurity employee proficiency across all F-35 simulator sites worldwide.

F-35 Classified Cyber Security Lead 

Department of the Air Force (Civilian)

Served as the ISSM for the main unclassified and classified networks for the base, overseeing cybersecurity for 28,000 users. Managed the RMF Assessment and Authorization (A&A) packages for both systems and served as a go-to Risk Management Framework (RMF) subject matter expert for 65 Program Management Offices (PMOs). Led the Command Cyber Readiness Inspection (CCRI) preparation team. Regularly requested by government organizations to provide IT and cybersecurity consulting services for other programs and systems. Managed the installation Digital Loss Prevention (DLP) Program, also known as the Insider Threat Program. Senior Local Registration Authority managing the base Public Key Infrastructure Program. Oversaw the base Software Assurance program, responsible for evaluating and approving software requests.

Information Systems Security Manager (ISSM)

Primary technical advisor and requirements lead for IT projects of all sizes, including installation-wide technical refresh efforts and projects providing services for up to 5,000 users at a time. Managed the Firewall Exception Request Tool and Enterprise Telephony Management System protecting the base voice network boundary. Quickly found and shut down cyber-attack attempts.

IT Requirements Surveyor

Air Force / Ohio Air National Guard (uniformed)

Held technical roles in voice, data, and video network infrastructure systems in both fixed and tactical environments. This included all phases of the lifecycle from planning, to implementation, to operations, maintenance, to decommissioning. Also, trained members in related career fields using both military and commercial standards and procedures.

Cyber Transport Systems Craftsman

Department of the Air Force (Uniformed until 2006 then civilian)

Lead implementation specialist for the highest visibility and most challenging voice and network systems projects. Expansive knowledge of AFB voice and IT architecture. Regularly provided consulting and briefings to management and base users on best practices for their IT projects. Conducted programming and maintenance of the base network for 28,000 users.

Voice and Network Systems Implementation Specialist

Cybersecurity entrepreneur helping small to medium-sized US businesses reduce their cyber risk and increase compliance by providing the right solutions at the right time.

Part-time Cyber Operations Officer, recently named as the 2024 Ohio Air National Guard Company Grade Officer (CGO) of the Year and the 2023 Group Cyber Warrior of the Year.

Active in the leading Las Vegas startup communities collaborating with people building things that the world wants and needs.

#cybersecurity #infosec #privacy #compliance

This session of 'The GRC Room: 5 Questions' features GRC engineering expert Ayoub Fandi.

Ayoub is the Security Assurance Automation Team Lead for GitLab.

He regularly shares his insights here on LinkedIn, as well as through the GRC Engineer podcast and newsletter.

The questions:

1️⃣ Which part of cyber GRC do businesses struggle with the most?

2️⃣ What's one data breach that stood out to you and why?

3️⃣ What's the most impactful GRC-related advice you ever received?

4️⃣ What do you do differently that allows you to excel in this field?

5️⃣ What's the top thing a business can do today to strengthen its cyber GRC?

▶️ Ayoub's responses were on-point, so check out the attached video and let us know what you think!

Mike Andrewes

Owner & Cybersecurity Advisor at Yastis | Scalable cybersecurity for startups and SMBs

In cybersecurity, everybody loves third-party risk management (TPRM).

Well... maybe not everybody.

It's far from a perfect science, but it often determines whether a deal gets signed or falls apart.

Why is TPRM such a challenge?

What can we do to excel at TPRM?

These are the questions - Karina Klever - and I will explore as we welcome Fabrik Co-founder & CPO Henry Stanley to The GRC Room on Oct 15. 

Henry and his company make it easier to exchange risk data for third party security reviews and his TPRM insights are always spot-on.

👉 Next steps: RSVP today or share with your network! 

#cyber #grc #tprm

Mike Andrewes, Nathaneo Johnson and 637 other attendees

Everybody loves third-party risk management

"SOC 2 or CMMC?"

With CMMC showing up as a DoD contract requirement a lot more over the next few months, some companies are going to be making this decision.

When thinking about doing one framework vs another, here are the main questions to consider:

- Based on what we do, where will we see more business opportunity? 

- Are customers or prospects already asking about one of them?

- When weighing costs vs revenue, does the ROI make sense?

In most cases, SOC 2 is the better starting point because it helps close deals across industries and is typically less costly than CMMC.

Of course, you can also leverage the work you do for SOC 2 if you want to pursue CMMC later.

👉 Have you been considering SOC 2 or CMMC?

In cybersecurity,  how do we know when it's time for a new tool?

This question is harder than it might initially seem and we see companies get this wrong pretty often.

My perspective:

- If there's no way to protect or monitor something important, get the tool

- If it'll save you 50% of the time or more and the ROI is meaningful, get the tool

During our August webinar, - Karina Klever - tells Christian Espinosa and me: 

"What do you need? Do you go to the grocery store and buy one of everything? If so, it will be expensive and food will go bad. If you look at the tools you have, you should be able to reverse engineer the requirements."

She then offers up some tips we can use to get this right.

▶️ Check out the attached clip for more info and let us know what you think.

CMMC. FedRAMP. What's the difference?

With the Cybersecurity Maturity Model Certification (CMMC) getting ready to appear in a lot more contracts, there's been a lot of talk about it.

CMMC applies to companies in the DoD supply chain. Depending on the level, it requires anywhere from 17 to about 130 security practices.

The Federal Risk and Authorization Management Program (FedRAMP) applies to cloud service providers working with any federal government agency.

Requirements range from roughly 125 to over 400 security controls, depending on the impact level.

The fun part?

Some companies may need to do both. 

For example, a cloud-based SaaS provider may need CMMC compliance to protect DoD data while also achieving FedRAMP authorization to support agencies like FEMA or the Department of Transportation.

That doesn't have to equate to double work though.

When compliance isn't handled in silos, you can usually set things up so your security controls and associated documentation are valid in multiple realms.

How does a company know when one or both of these might be right for them?

By gauging interest and being realistic about whether what they do supports federal government priorities.

As usual, calculating the ROI is an important part of this.

👉 Any questions about CMMC or FedRAMP? Comments?

The next session of The GRC Room: 5 Questions is here!

This time around, - Karina Klever - and I were joined by Caleb H. Mattingly, CISSP of Secure Cloud Innovations.

Caleb and his company save startups time and money by providing outsourced security & compliance functions.

The questions:

1️⃣ Which part of cyber GRC do businesses struggle with the most?

2️⃣ What's one data breach that stood out to you and why?

3️⃣ What's the most impactful GRC-related advice you ever received?

4️⃣ What do you do differently that allows you to excel in this field?

5️⃣ What's the top thing a business can do today to strengthen its cyber GRC?

▶️ We really enjoyed Caleb's responses and think you will too. Have a great week!

Open video: The GRC Room: 5 Questions | Caleb H. Mattingly, CISSP on youtube.com

The GRC Room: 5 Questions | Caleb H. Mattingly, CISSP

IT and engineering teams commonly handle startup and SMB cybersecurity.

Is this the right approach? It really varies.

Sandra Avila and I recently spoke about this (see attached clip).

Some questions we ask if this is the case at a given company:

- When accounting for other responsibilities, do they have time for this?

- Are they experienced in cybersecurity and compliance or trying to figure it out?

- If using a SaaS tool for compliance automation, is everything being customized to your company?

- Would your company benefit from another set of eyes making sure things are going well?

Bottom line: Having IT and engineering teams handle this stuff is way better than not tending to it at all, so we like to see it. In some cases though, a higher degree of support is needed and that's normal.

#cybersecurity #compliance #startups

The final Cybersecurity Maturity Model Certification (CMMC) Procurement Rule was published on Sep 10!

This means we'll be seeing a lot more DoD contract solicitations that include CMMC provisions when Controlled Unclassified Information (CUI) is involved.

Some vendors will be caught by surprise because CMMC is resource intensive and even applies to sub-contractors.

What should smaller companies do about this? 

Think about CMMC today if DoD contracts are part of what you do.

Calculate the costs and ROI to see if this is worth pursuing.

This work is hard enough and gets even harder when you need to do everything in a short period of time.

☑️ Thinking about going through CMMC? Send me a DM.

Buying a new cybersecurity tool is the easy part. 

The more important part is how it's used afterwards.

Just recently, we were doing an assessment and found that company devices hadn't been scanned by Microsoft Defender in three weeks.

Was this due to a recent configuration change?

Were the scans being kicked off manually, but someone forgot to do it?

Things evolve quickly in cybersecurity.

When a company has a tool in place, but isn't tending to it, that can quickly lead to risky blind spots.

I recently used the example of someone buying a puppy without thinking about the need to feed it, train it, let it out, etc.

If you're going to implement a cybersecurity tool, take the time to set it up correctly, monitor results, and take action when needed.

If you don't have the time or internal skillsets to do this, there are plenty of external companies that can do this for you.

It's worth doing.

#cybersecurity #compliance #software

Have you ever seen service tiers be too large or too small?

SaaS is a good example of when this happens.

About a year ago, we were comparing CRMs.

One of them had a $20 per month per person plan.

That seemed pretty good, but there were a couple of other features we really wanted.

Tell me why the next tier up that included those features was something like $500 a month?

That was no accident. 

They knew people wanted those key features and thought they'd be willing to pay much more for them.

This was one of many reasons we came up with One Scalable Plan.

No rigid tiers, long service commitments, hidden hourly pricing or anything like that.

Check out the attached clip for more on this and let us know what you think.

PS: If the short clip isn't enough, link to a blog post about the plan can be found in the comments.

AJ Yawn's book 'AWS Engineering for AWS' has been getting fantastic reviews and he's in the middle of a national book tour.

When - Karina Klever - asked him about his inspiration for the book during our recent LinkedIn Live event, there was one part that stood out to me the most:

He wanted to do something difficult to show his young son AJ and have something to put in his hands.

Having a three-year-old son myself, this is definitely something I can relate to.

Check out the attached clip for more on this and let us know what you think.

#cyber #grc #engineering

The right amount of cybersecurity isn't always "as much as possible".

For some people, this is obvious on day one in the field.

For many others, it's learned through experience.

A "10" in terms of cybersecurity can be too costly or restrictive for most companies.

Not every company needs to be protected like Fort Knox.

Even if advanced cybersecurity actually is needed, that usually won't happen overnight.

In the case of startups and SMBs, a "7" that keeps costs and business friction reasonable might be the right approach.

Why is this important?

Because many companies think it has to be a "10" or "we'll tackle this another day".

Be proactive. Get started. Doing this right might be easier than you think.

If you need a hand, send me a DM. 😊

The Cybersecurity Maturity Model Certification (CMMC) is tougher than many companies might think.

We've been hearing about it showing in more DoD contract requirements for quite a while now, but some companies are still being caught by surprise now that we're getting closer to full enforcement.

Was there a sense that it would never be enforced?

Was the level of difficulty simply overlooked?

Most of the controls that are part of CMMC aren't brand new anyway.

They were already supposed to be happening as part of NIST 800-171 for nearly a decade.

The challenge? Contractors were largely expected to self-assess.

It's pretty easy to look in the mirror and say "ah yes, we look great."

It's harder when someone is going to validate that.

If you're a company that works with the DoD or plans to soon, it's time to get serious about preparing for CMMC.

This way, there's no chance of missing out on contract opportunities that would otherwise be a great fit.

We have a prep service that simplifies the CMMC process to a large degree, while taking no shortcuts.

If you're thinking about CMMC, check out the attached clip for more on this and let us know if you have any questions.

John was by-the-book, yet he still got tricked by a phishing email.

This was a co-worker from years back.

He's the type of person you can invite to lunch and he'd ask to see it in writing, but we got along well.

I figured he'd have multiple data backups because he's so careful with everything, but he had ... zero backups. 

One day, he got an email about a project, and he was a project manager so it seemed legitimate.

Unfortunately, he downloaded a file that seemed like malware.

When he came to our office to report it, he asked "am I going to lose my data?"

I told him "we'll try to avoid that, but there are no guarantees."

Long story short: 

-Keep a data backup or two that are completely separate from your main system.

-Have an incident response plan (IRP) so everyone knows what to do when there's a cyber incident, because it can happen to anyone.

👉 PS: Luckily, John didn't end up losing any data. Check out the attached clip to hear more about this.

#cybersecurity #cyber #phishing

Taplio

Michael Andrewes's Linkedin Analytics

's Best Posts (last 30 days)

Want to drive more opportunities from LinkedIn?

Taplio

.css-1jgreyo{background-image:linear-gradient(284deg, rgba(39,43,72,1) 0%, rgba(33,47,183,1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Michael Andrewes's Linkedin Analytics

's Best Posts .css-qqfgvy{font-size:var(--chakra-fontSizes-md);}(last 30 days)

Want to drive more opportunities from LinkedIn?

Michael Andrewes's Linkedin Analytics

's Best Posts (last 30 days)