Stian M.

NIST has just released the initial public draft of CSWP 48, part of its Migration to Post-Quantum Cryptography project: "Mappings of Migration to PQC Project Capabilities to NIST Cybersecurity Framework 2.0 and to Security and Privacy Controls for Information Systems and Organizations." The project is here: https://lnkd.in/gRFVYh_N and the actual document [PDF]: https://lnkd.in/g4k47mP7 This is the first in a series of implementation-focused white papers under the Migration to PQC initiative. It follows the excellent second public draft of CSWP 39 (Considerations for Achieving Crypto Agility), which was released in August. Together, these documents form a growing body of practical guidance from NIST helping organizations prepare for the transition to post-quantum cryptography. CSWP 48 maps the real-world capabilities demonstrated in NIST NCCoE’s PQC migration lab environment - like cryptographic asset discovery, algorithm interoperability, and inventory management - to familiar risk frameworks: NIST Cybersecurity Framework 2.0 and SP 800-53. If you’re planning your PQC migration (and you should be), you need a way to integrate cryptographic modernization into your existing cybersecurity, risk management, and compliance processes. This document can help you with that. It shows: - How core functions like crypto discovery and inventory align with CSF outcomes and SP 800-53 controls - Which foundational governance and control practices should be in place before implementing PQC tools - Where new PQC-focused activities support broader cybersecurity goals, not just crypto modernization The public comment period is open through October 20, 2025. Consider contributing if you are in the industry. Our team at Applied Quantum has already completed our review and drafted our comments submission. In short: it’s a strong initial draft. We did suggest a few areas for future expansion such as tighter integration with supply chain management and enterprise risk strategy, but overall, this paper is already useful if you’re getting started with crypto inventory, discovery, or roadmap planning. This is exactly the kind of structured, implementation-ready guidance the community needs as we move closer to a post-quantum future. Well done to NIST and the NCCoE team. I’m looking forward to what comes next in this series. #PQC #PostQuantum #QuantumReadiness #QuantumSecurity #QuantumResilience #QuantumResistance

187

5 Comments

Cybersecurity in the Age of AI Imagine a world where your top-tier malware analyst never sleeps, never misses a pattern, and works at machine speed — reverse engineering suspicious binaries in minutes, not hours. Or consider an AI red teamer that walks into a capture-the-flag competition and quietly outperforms some of the best offensive security minds in the field. This isn’t speculative fiction. It’s happening now. Cybersecurity is being rewritten by artificial intelligence — not just as a force multiplier, but as a new kind of player entirely. We’re not talking about automating ticket queues or correlating alerts anymore. We’re talking about autonomous systems that rival — and sometimes outperform — human experts. The implications are as vast as they are urgent. If your SOC, your strategy, and your thinking haven’t adapted to this shift, you're not just behind — you’re exposed. #Cybersecurity #AI #AIinSecurity #ThreatIntel #MalwareDefense #ProjectIre #Microsoft #RedTeaming #Claude #SOCLeadership #CyberExecs #CISO #CEO #SecurityInnovation #FutureOfSecurity

623

59 Comments

Organizations don't actually realize how one big cyberattack can set them back like 20x their entire cybersecurity budget, not to mention the huge headache involved and risk of total shutdown & repeated attack. In 2025 the lowest hanging fruits for hackers are corporate credentials/cookies of employees, which allows them to infiltrate into the most critical systems available and eventually deploy ransomware. If you properly monitor for exposed credentials, you significantly minimize the risk that already took down tens of huge companies (I documented these attacks in the last few years - https://lnkd.in/dMfDEr5f, we literally had the data before the attackers in just about all of these instances) Start with an ethical disclosure from us to understand the scope of your exposure, I think you'll be surprised at what's out there - https://lnkd.in/dmj9R5xj

26

1 Comment

Clorox is suing Cognizant for $380M. The reason? A 2023 cyberattack that crippled their operations, allegedly caused by poor help desk controls and a botched incident response. - This wasn’t just a breach. It disrupted supply chains, damaged customer trust, and is now turning into a legal battle with one vendor blaming the other. As security professionals, we often say: "Third-party risk is your risk." But too often, those warnings get ignored… until it’s too late. This case raises questions that CISOs and boards must be asking: - Are our vendors following the same standards we require internally? - How strong are our controls against social engineering, especially at the help desk? - Do we have contractual clarity around incident response ownership? Link to the full article is in the comments. #Cybersecurity #RiskManagement #GRC #InfoSec #CISOs

99

27 Comments

The Power of Advanced Threat Modeling In today’s interconnected world, security can’t be an afterthought. Threat modeling—done early and done right—transforms cybersecurity from reactive firefighting into proactive risk prevention. Key takeaways from “Advanced Threat Modeling”: Use proven frameworks like STRIDE, PASTA, and DREAD to identify threats systematically. Integrate modeling into DevSecOps with “Threat Model as Code” for automation and scalability. Start with high-value applications, then expand across the enterprise. Leverage tools like OWASP Threat Dragon or IriusRisk for consistency and collaboration. Measure success through reduced vulnerabilities, faster remediation, and increased developer security awareness. Why it matters: Organizations that embed threat modeling into their architecture and development lifecycle see fewer security incidents, lower remediation costs, and stronger resilience against evolving threats. Bottom line: Security isn’t just about patching holes—it’s about designing systems attackers can’t exploit. Threat modeling makes that possible. Cybersecurity and Infrastructure Security Agency Eureka DevSecOps Stride Pasta Garofalo Secure Application InfoSEC

25

The Cybersecurity and Infrastructure Security Agency (CISA) and Sandia National Laboratories have launched Thorium — a free, automated malware and forensic analysis platform. It integrates commercial, custom, and open-source tools, enabling defenders to automate analysis, speed up investigations, and adapt to evolving threats. #CyberSecurity #MalwareAnalysis #IncidentResponse #ThreatIntelligence #DigitalForensics

55

We've published cheat sheets for the first three volumes of NIST's new Digital Identity Guidelines! If you're planning on reading SP 800-63-4, 63A-4, or 63B-4, visit the Trusted Cyber Annex site (link in the comments) and download our cheat sheets for free. They not only highlight the recommendations and other information that we think are the most important, but they also include the NIST definition of each term next to where that term is first used. These additions make the Digital Identity Guidelines easier and faster to absorb. Please spread the word about this work! We are 100% reader-supported, so we rely on you to help us reach the cybersecurity community. Thank you!

56

8 Comments

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments