CISA's New Fangs, Fact Check, Fact Check and Fact Check Again, Smooth Ransomware Operators, The Great Data Breach Lawsuit Gallop, Patches Galore, and Loose Lips: Security Breach. It's CISO Intelligence for Thursday 23rd January 2025.
In today's issue, CISA now has more bite, always check sources before passing on information, smooth-talking hackers, you can't dance your way out of a lawsuit, there's a whole lot of patching going on, and when bragging becomes a security breach.
💡
"Gives me everything I need to be informed about a topic" - __UK.Gov__
Table of Contents
1. Biden Gives CISA Sharp Molars and a Fierce Roar: Software Supply Chain Gets Its Bite
2. Don't Fall for the Hacker Hype: Verify Before You Amplify
3. Ransomware Gangs in Disguise: When Your IT Support Becomes an IT Nightmare
4. A Citibank Tango: The Litigation Two-Step
5. Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products
6. Secrets Floated: The Case of the Loose-Lipped Analyst
Sign up for CISO Intelligence.
21st century industry insights for the modern CISO
It won't hurt, I promise.
Email sent! Check your inbox to complete your signup.
No spam. Unsubscribe anytime.
Biden Gives CISA Sharp Molars and a Fierce Roar: Software Supply Chain Gets Its Bite
_When the going gets tough, the tough get teeth._
What You Need to Know
The Biden administration has intensified efforts to safeguard America's software supply chain by empowering the Cybersecurity and Infrastructure Security Agency (CISA) with more authority. Executives need to focus on enhancing their software acquisition and management protocols to ensure compliance and enhanced resilience against cyber threats. Immediate action is crucial to adapt strategies to this new directive and possibly engage in collaborations for upcoming compliance audits.
CISO Focus: Software Supply Chain Security
Sentiment: Strong Positive
Time to Impact: Immediate
*
In a decisive move, the White House has turned its attention to reinforcing the software supply chain, a critical backbone of national security. This strategic directive, through presidential order, amplifies CISA's mandate, enabling it to set definitive security benchmarks across federal software acquisitions. Organizations nationwide are now on a tighter leash to assess and comply with a standard of software security diligence.
The Why and the How
The solar winds cyberattack was an eye-opener, shaking foundations and spreading vulnerabilities across global networks. In its aftermath, the need for fortified defenses became glaringly apparent. Hence, federal action was inevitable. This order aims to stifle vulnerabilities at their roots, ensuring software vendors adhere to stringent security requirements, thereby bolstering defenses across all federal IT infrastructures.
Biting Into Compliance: What It Means
With CISA now wielding sharper implements, they will impose stricter compliance standards:
Mandatory CBOM: The creation of a Cybersecurity Bill of Materials (CBOM) for any software acquisition, mirroring the traditional Bill of Materials in physical manufacturing.
Regular Audits: Scheduled, more frequent audits to ensure the integrity and adherence of software products to security standards.
Vendor Lock-ins: Encouraging strategic partnerships with vendors meeting high-security thresholds, creating a ripple of influence across the private sector.
Immediate Implications for Businesses
For enterprise entities, especially those interacting with federal bodies, rapid adjustments are necessary:
Enhance Supply Chain Protocols: Companies must invest in robust security infrastructure that can align with the newly mandated guidelines, with a particular focus on software provenance and integrity.
Vendor Evaluation: Increased vetting of vendors and third-party software solutions is crucial, making due diligence more than a box-ticking exercise.
Skill Upgradation: Upskilling of IT staff to manage and navigate the evolving cybersecurity landscape and tools.
The Broader Impact
The ripple effect of this order is anticipated to stretch beyond federal corridors. As CISA aligns its teeth with broader industry collaboration, firms in private sectors may adopt similar rigor to gain federal confidence. This cascading standardization can uplift national cybersecurity posture holistically, promoting a safer digital ecosystem at large.
A Sardonic Finish: “The Byte before the Bite”
While addressing the supply chain has been long overdue, the reinforced focus from the presidency is a leap toward guaranteeing more than software security—it's about digital trust. The invigorated CISA isn't just another bite in the digital wilderness; it's a spectacle where the agency emerges with a set of teeth capable of making a difference, byte by byte.
*
Vendor Diligence Questions
1. Does the vendor provide an exhaustive Cybersecurity Bill of Materials (CBOM) for each software product, and how frequently is it updated?
2. How does the vendor ensure compliance with CISA's new security requirements, and can the vendor highlight specific measures undertaken to meet them?
3. Can the vendor provide evidence of successful, recent security audits conducted by independent third parties according to the new prescribed guidelines?
Action Plan
1. Assessment: Initiate a comprehensive evaluation of current software supply chains against the new federal standards.
2. Engagement: Engage with vendors to gain insights into their compliance measures and future adaptation plans.
3. Training: Drive training programs for IT personnel focused on the new compliance requirements and auditing processes.
4. Collaboration: Foster collaborations with compliance consultants to streamline transformation processes.
*
Source: Biden order gives CISA software supply chain 'teeth'
*
Don't Fall for the Hacker Hype: Verify Before You Amplify
_Fact-checking is the vaccine for viral misinformation._
What You Need to Know
In a rapidly evolving digital landscape, it is imperative for executive management and board members to stay sceptical of claims made by cyber threat actors. The current trend sees an increasing number of organizations taking these assertions at face value, which could lead to panic and poor strategic decisions. Management is expected to implement a robust protocol for verifying all threats claimed by adversaries before acting or sharing information publicly.
CISO focus: Threat Intelligence Verification
Sentiment: Strong negative
Time to Impact: Immediate
*
In the world of cybersecurity, sensationalism can spread faster than any malware. Cyber threat actors have learned to exploit the media and public's appetite for breaking news by making audacious and often exaggerated claims about data breaches and cyber incidents. The latest episode in this ongoing saga has highlighted the critical need for diligent fact-checking and a skeptical approach to such assertions.
The Rise of Unverified Claims
The cybersecurity domain has witnessed a significant uptick in unverified claims made by hackers. These claims often involve data breaches or cyber-attacks meant to sow chaos or enhance the hackers' reputation. Many organizations, eager for transparency or caught off-guard, may inadvertently amplify these messages without due diligence, potentially exacerbating the situation.
Example 1: Recent Data Breach Allegations
A recent case that made headlines involved a claimed data breach of a major financial institution. The threat actors published supposed proof, which was later revealed to be outdated or unrelated data. However, by the time verification had debunked the claim, stock prices had fluctuated, and reputational damage had been inflicted.
Why Verification is Crucial
Prevent Panic: Untested claims can cause unnecessary panic among stakeholders and customers.
Protect Reputation: Premature response to unverified claims might tarnish the organization’s reputation if proven false.
Resource Allocation: Allocating resources to address non-existent threats can divert attention from genuine security needs.
Protocols for Verification
For any organization, particularly those in the public eye, it is essential to develop a rigorous protocol for verifying cyber threats:
Initial Assessment: Quickly evaluate the reliability of the source. Is it known for sensationalism?
Technical Verification: Utilize forensic investigation to corroborate the claims with tangible evidence from IT systems.
Collaboration with Peers: Join industry groups where peers may share similar experiences, insights, and lessons learned.
Official Statements: Only release information to the public after thorough verification, avoiding hasty announcements.
Lessons from Past Experiences
A pattern emerges over time; revisiting past experiences with threat claims can guide future responses. Learn from industry-recognized breach timelines and response strategies that effectively mitigate public relations fallout.
Why Are Threat Actors Doing This?
Threat actors have multiple motivations for making exaggerated claims:
Publicity: Successful misinformation can elevate a hacker group's status within the cybercriminal community.
Tactical Diversion: Overstated claims divert attention and resources away from the actors’ main activities.
Financial Manipulation: In some cases, claims aim to manipulate stock prices for financial gain, as seen in some high-profile speculative attacks.
The Critical Role of Communication
In these scenarios, internal and external communication strategies play a vital role. Ensure that all teams, from PR to IT, are aligned on the verified facts when addressing stakeholders and media to prevent mixed messages.
Fact-Checking in the Digital Age
While technology is an excellent tool for fact-checking, the human element remains indispensable. Engage cybersecurity staff in continuous training programs to enhance skill sets in recognizing valid from false claims.
Caution Is Key
In the metaphorical race between the lie and the truth, where lies circle the globe before truth has time to lace its shoes, organizations must prioritize thoroughness over speed. Err on the side of caution by erring on the side of verification.
In today’s digital ecosystem, where information is the currency and disinformation lurks like counterfeit bills, organizations cannot afford to be penny-wise and pound-foolish. Verify claims, bolster defences, and equip your teams to discern fact from fallacy—before the rumor mill spins you out of control.
*
Vendor Diligence
When engaging with cybersecurity vendors, consider the following questions:
1. How do you validate claims regarding potential threats from hackers or internal sources?
2. Can you provide examples where due diligence altered your response to a threat claim?
3. What tools or systems do you employ to corroborate third-party threat intelligence?
Action Plan
1. Develop and implement a protocol for threat verification, integrating IT, PR, and management roles.
2. Educate employees across departments about the importance of verifying cyber threat claims.
3. Foster industry partnerships to share intelligence on threat actor behaviors and misinformation strategies.
*
*
Ransomware Gangs in Disguise: When Your IT Support Becomes an IT Nightmare
_When cyber attack meets Oscar-worthy performance!_
What You Need to Know
Cybercriminals are masquerading as IT support personnel within Microsoft Teams to launch phishing attacks aimed at deploying ransomware. As an executive, ensure immediate review and enhancement of IT support protocols and employee awareness regarding phishing tactics. Implement multi-factor authentication and review incident response strategies today.
CISO focus: Cybersecurity Awareness & Phishing Defense
Sentiment: Strong negative
Time to Impact: Immediate
*
Phishing Attacks in Disguise
In an audacious new tactic, cybercriminals are now impersonating IT support staff within Microsoft Teams to carry out phishing attacks that pave the way for ransomware deployment. This development adds a new layer of sophistication to ransomware strategies as attackers leverage legitimate communication platforms to deceive and exploit organizations.
Inside the IT Impersonation Attack
* Modus Operandi : The attackers infiltrate a company's communication network, posing as IT support personnel. The trick? Convincing employees to grant access, download malicious files, or reveal sensitive information.
* Platform of Choice : Microsoft Teams serves as the playground, with attackers using its chat and collaboration features to build faux credibility.
* End Game : Deploying ransomware to lock down organizational systems and demanding a hefty ransom for unlocking data.
This approach is particularly insidious as it preys on the established trust within internal communication systems and the urgency often associated with IT support scenarios.
Impact and Consequences
The repercussions of such attacks can be devastating. Financial losses from ransom payments, operational disruptions, and long-term damage to trust and reputation are just the starting points.
* Financial Implications : Losses can range from monetary payments to attackers to massive costs associated with data recovery and system restoration. According to reports from Cybersecurity Ventures, global ransomware damage is predicted to cost upwards of $265 billion by 2031.
* Operational Disruption : Ransomware attacks can bring operations to a standstill, affecting everything from critical infrastructure to daily business operations.
* Reputational Damage : Trust, once lost, can be hard to rebuild. Companies face the risk of losing clients and damaging relationships with partners.
Preventive Measures
It's crucial for organizations to bolster their defenses:
* Educate Employees : Awareness is the first line of defense. Conduct regular training sessions to help employees recognize phishing attempts and understand the importance of verifying the identity of IT personnel contacting them.
* Strengthen Authentication : Implement multi-factor authentication (MFA) to add an additional security layer, ensuring that even if credentials are compromised, unauthorized access can be curtailed.
* Update Incident Response Plans : Keep your incident response strategies updated. This should include clear procedures on handling phishing attempts and ransomware incidents.
* Monitor Communication Channels : Regularly review and monitor internal communication channels for unusual activity or unauthorized entries.
The Chilling Truth
In the world of cyber security, the sophistication and audacity of attacks are continually evolving. The impersonation of IT personnel for phishing attacks highlights a dangerous trend towards exploiting trust.
As attackers become more cunning by donning the guise of trusted insiders, organizations must remain one step ahead by fortifying their defenses and nurturing a culture of vigilance. Threat actors may have come up with a 'best impersonation' script, but our resolve to thwart their efforts remains uncompromised.
*
Vendor Diligence Questions:
1. How does your platform detect and prevent impersonation attempts in internal communications?
2. What mechanisms are in place to log and analyze unusual communication patterns?
3. How can your services support real-time alerts and incident response during suspected phishing campaigns?
Action Plan
1. Review and Revise IT Protocols : Ensure all IT support interactions require verifications separate from those being communicated in Teams or similar platforms.
2. Employee Training Blitz : Initiate a company-wide training campaign focused on recognizing phishing tactics within collaboration platforms and ensuring vigilance at all times.
3. Security Layering : Deploy additional security tools within communication platforms to detect unusual access attempts and engagement anomalies.
4. Updated Incident Response Simulation : Conduct a phishing and ransomware simulation to test the readiness of your teams and identify potential weaknesses in your response strategies.
*
Source: Ransomware gangs pose as IT support in Microsoft Teams phishing attacks
*
A Citibank Tango: The Litigation Two-Step
_Citibank trips over legal hurdles, but it’s the clients left in a cha-cha of chaos._
What You Need to Know
In a landmark decision, the New York Attorney General Letitia James has secured a critical court win that allows her lawsuit against Citibank to proceed. The legal clash centers on data breach allegations, which purportedly left countless consumers vulnerable. Executives are advised to closely follow litigation developments, re-evaluate data protection strategies, and prepare a public relations plan to mitigate potential fallout.
CISO Focus: Data Protection and Litigation
Sentiment: Negative
Time to Impact: Immediate
*
When Banking Bottom Lines Meet Data Breach Headlines
In a severe blow to Citibank, the highly publicized legal battle with the New York Attorney General just took a dramatic turn. The court's decision to allow the lawsuit to continue underscores the gravity of data protection lapses and the consequential legal liabilities that financial institutions face today. But what does this mean for the public, the brand, and the broader banking industry?
Allegations at the Core
The lawsuit alleges that Citibank’s inadequate data security measures resulted in a significant data breach, compromising sensitive consumer information. According to the New York Attorney General, these lapses were not only preventable but highlighted systemic faults in cybersecurity investment and execution. As data breaches become more frequent and damaging, the pressure mounts on institutions like Citibank to ramp up their cybersecurity posture.
Raining on Citibank's Parade
This suit arrives at a particularly delicate time for Citibank as it is already wrestling with various compliance and regulatory challenges. The potential impact of adverse media coverage following such an event could tarnish its reputation, potentially resulting in customer attrition and financial decline. With consumers increasingly vigilant about the safety of their data, any perceived negligence could disrupt their loyalty.
Scrutiny on Operations
The lawsuit places a magnifying glass over Citibank’s operations, questioning the robustness of its data protection policies and practices. While lending institutions are generally viewed as beacons of financial security, any breach undermines public trust. Solvability depends not merely on legal defenses but chiefly on going beyond compliance to embrace a culture of cybersecurity excellence.
Stepping into Proactive Measures
Citibank must now face the music and deter further scrutiny by actively upgrading its data security measures. As leading financial entities adjust their internal controls post-incident, Citibank must follow suit. This includes deploying enhanced encryption technologies, conducting regular security audits, and training staff to recognize and mitigate potential threats.
Industry Impacts
The broader financial industry sees this case as a cautionary tale. Cybersecurity strategies must lean into predictive analysis and machine learning to anticipate breaches before they happen. Lessons from Citibank's litigation should encourage financial firms to reassess risk management strategies, aligning cybersecurity investment with the evolving threat landscape.
No Denouement without Cost
Citibank's current predicament serves as a stark reminder that when it rains, it pours. Financial institutions must be ready to defend against multifaceted threats—both known and unforeseen. The takeaways mirror a dance with devastating consequences where missteps are realized not in the quiet performance halls of data centers but rather, the glaring spotlights of courtroom drama.
*
Vendor Diligence Questions
1. How does your encryption approach protect against unauthorized data access and data leakage?
2. Can you provide recent case studies where enhanced cybersecurity has mitigated legal risks for financial institutions?
3. What are your audit and compliance procedures to ensure alignment with industry-standard data protection regulations?
Action Plan
Immediate Appraisal: Instantly evaluate existing data protection measures, using this lawsuit as a case study for improvement.
Security Audit: Conduct comprehensive security audits, identifying and rectifying weak links in data protection mechanisms.
Crisis Management: Develop and test a crisis communication plan to effectively address potential fallout, including clear messaging around corrective actions being implemented.
Stakeholder Engagement: Brief all stakeholders, from board members to frontline employees, on security protocols and the importance of maintaining customer confidences.
Continuous Improvement: Foster a culture of continuous improvement in cybersecurity; leverage insights from industry standards and emerging technologies to stay ahead.
*
Source: NY Attorney General James Announces Court Win Allowing Lawsuit Against Citibank to Continue
*
Patch Attack: Oracle's Fix-it-All Campaign
_Oracle's new patch party: everyone’s invited, vulnerabilities not welcome._
What You Need to Know
Oracle has recently released a significant patch update addressing 318 security flaws across its product suite. Board members should be aware that these vulnerabilities could potentially impact key systems in their digital infrastructure. It's crucial to ensure that your IT and cybersecurity teams prioritize deploying these patches to secure your organization's assets. Expect to see progress reports on patch deployment and remediation status at the next board meeting.
CISO focus: Vulnerability Management, Patch Management
Sentiment: Strong Positive
Time to Impact: Immediate
*
Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products
In a move that showcases a proactive approach to cybersecurity, Oracle released its biennial critical patch update for January 2025. The comprehensive update aims to rectify 318 security flaws within its multiple product lines. From database systems to the widely used Java platform, Oracle has tackled vulnerabilities that, if left unpatched, could have led to severe cyber threats.
Key Highlights
* Magnitude of Fixes: This update stands out due to the sheer number of patches provided. By addressing these multiple critical vulnerabilities, Oracle reaffirms its commitment to ensuring the security and functionality of its products.
* Affected Products: The patch covers an array of Oracle’s lineup including Database Server, Oracle E-Business Suite, Communications Applications, and of course, Java SE. Each of these is integral to global operations in numerous enterprises, adding to the patch’s significance.
* Severity of Vulnerabilities: Described vulnerabilities ranged from easy-to-exploit bugs that could affect confidentiality, integrity, and availability of data, to more complex security loopholes that hackers could exploit for deeper infiltration within organizational networks.
What This Means for Businesses
Any organization leveraging Oracle products needs to immediately action these patches to mitigate risks. With cyber threats increasing in sophistication and frequency, unpatched systems can become easy prey for malicious actors. By deploying these updates, firms not only protect their digital assets but also uphold client trust and regulatory compliance.
Immediate Actions for IT Departments
1. Assessment and Inventory: Conduct a thorough inventory of Oracle-based systems within the company. Ensure a comprehensive understanding of which products and versions are in use.
2. Patch Deployment: Create a streamlined action plan to integrate the patches with minimal downtime, focusing first on systems with the most severe vulnerabilities.
3. Testing and Evaluation: Once patches are applied, rigorous testing should follow to confirm successful deployment and rebuff potential post-update issues.
Industry Reactions
Security experts and IT professionals have praised Oracle's exhaustive patch update for its breadth and critical nature. Many suggest that such comprehensive updates should be the industry benchmark, emphasizing the importance of transparency and proactive vulnerability management.
On the other hand, some critics argue that such high volume patches indicate a reactive, rather than proactive stance in vulnerability mitigation. They advocate for better development practices that catch vulnerabilities earlier in the lifecycle instead of post-deployment.
The Broader Perspective
Consider these patches as routine maintenance akin to changing the oil in your car. A regular, methodical approach to updating systems not only avoids breakdown but enhances performance and security longevity.
Sentiment Analysis
This article represents a strong positive development within the cybersecurity industry, showcasing Oracle’s dedication to product security.
Time to Impact
The impact is immediate as businesses can secure their systems against these vulnerabilities now, potentially preventing a breach rather than reacting to one.
*
Vendor Diligence Questions
1. How does Oracle prioritize and identify which vulnerabilities to patch in each critical update?
2. What testing processes does Oracle employ to ensure that patch deployment does not adversely affect system performance or integrity?
3. Can Oracle provide detailed patch notes and any timelines related to the discovery, notification, and remediation of vulnerabilities?
Action Plan
Immediate Prioritization: IT and cybersecurity teams should prioritize systems by their vulnerability risk and business impact.
Monitoring and Metrics: Establish a monitoring system to track the patch deployment process and identify any anomalies or failures.
Education and Communication: Enhance organizational awareness through briefings, underscoring the importance of patch updates in maintaining cybersecurity resilience.
*
Source
[Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products](https://thehackernews.com/2025/01/oracle-releases-january-2025-patch-to.html)
*
Secrets Floated: The Case of the Loose-Lipped Analyst
_You would think spies would spy better!_
What You Need to Know
A former CIA analyst has pled guilty to disclosing highly sensitive, top-secret information to unauthorized individuals. As leaders, this breach highlights the importance of reinforcing security protocols and evaluating insider threat programs. Immediate steps should be taken to assess access privileges and bolster staff training on data protection policies.
CISO focus: Insider Threat Management
Sentiment: Strong Negative
Time to Impact: Immediate
*
In a scenario straight out of a spy novel gone wrong, an ex-CIA analyst has found themselves in a quagmire of legal trouble and espionage betrayal. After confessing to leaking top-secret data, the now infamous whistleblower has reignited debates around internal security measures and the inevitability of insider threats.
The Fallout from a Whistleblower
This unraveling conspiracy begins with a CIA analyst, pledged to protect national security, who's recently admitted to sharing classified intelligence with unauthorized parties. Ostensibly, this act was perpetrated with intent to inform rather than to betray, yet the magnitude of the information divulged tells a contrasting story. As this high-profile case draws back the curtains on a fragile internal security framework, organizations must grapple with the enduring risks of allowing too much access to too few individuals.
Security Protocols on Trial
As unsettling as it is illuminating, this breach underscores the necessity for rigorous insider threat programs. Current protocols at the CIA and similar institutions have now been juxtaposed against the apparent ease with which sensitive data was compromised. The evident lapse in security brings forth three burning questions:
How frequently are access permissions audited within critical security organizations?
What training is provided to prevent insider threats and ensure adherence to data protection policies?
How might organizations recalibrate their approach to monitoring data access and identifying potential internal vulnerabilities?
Implications for Industry and Government
As organizations reel from the implications of the guilty plea, both government bodies and private-sector entities stand at a crossroads. The perennial question remains: how do you defend against a threat that operates from within your ranks? Recent analyses suggest a multipronged approach that involves both technical safeguards and human-centric strategies. This includes refining access controls, embracing zero-trust architectures, and enhancing the cultural emphasis on data responsibility through continuous education and clear reporting structures.
Chatter in the Digital Shadows
In the digital alleyways where security experts congregate, the consensus swings heavily towards zero-tolerance policies and real-time monitoring solutions to catch such infractions before they escalate. Innovative technology, such as AI-driven behavioral analytics, offers promising pathways for preemptively identifying red flags in employee activities.
Drawing Parallels and Learning Lessons
Drawing parallels with previous insider breaches, this incident should serve as a sobering reminder to executives everywhere. Historical precedents, whether linked to Manning, Snowden, or lesser-known figures, reveal a chronic vulnerability to insider threats that must be countered with renewed vigor.
Priority One: Renew efforts to strengthen insider risk tools and techniques.
Compliance Matters: Regular audits to ensure compliance with existing and updated security protocols.
Psychological Profiling: Cultivate organizational trust while keeping a watchful eye on anomalies.
Of Mice and Men (Tell Tales)
As the ex-analyst’s account plays out in the media, expect scrutiny from all corners. An unfortunate blend of ego, ideology, and misjudgment melds to illustrate tales not only of treachery but of human fallibility. For institutions tasked with maintaining a nation’s secrets, the ticking clock counts the seconds of a race against human error—a folly that must always be outpaced and outmeasured.
*
Vendor Diligence Questions
1. How does the vendor's solution improve the detection and management of insider threats?
2. What measures does the vendor employ to stay ahead of emerging insider threats and security trends?
3. Can the vendor provide case studies or past performance reviews from sectors with high-security requirements?
Action Plan
Action Plan:
1. Audit and Revise Access Controls:
Conduct immediate audits of current access privileges.
Implement role-based access management and regularly review these permissions.
2. Enhance Training and Awareness Programs:
Develop comprehensive training initiatives focusing on insider threat awareness.
Launch frequent, mandatory refreshers on security policies for all personnel.
3. Deploy Insider Threat Detection Solutions:
Invest in AI-powered behavioral analytics solutions.
Integrate real-time monitoring and alerts to catch and mitigate risks quickly.
*
Source: Ex-CIA Analyst Pleads Guilty to Sharing Top-Secret Data with Unauthorized Parties
*
_CISO Intelligence is lovingly curated from open source intelligence newsfeeds and is aimed at helping cybersecurity professionals be better, no matter what their stage in their career._
_We’re a small startup, and your subscription and recommendation to others is really important to us._
*Thank you so much for your support!(