Event Security Requirements

Today is Super Bowl Sunday. 65,000 fans will pack Levi's Stadium. Over 100 million people will watch from home. And behind the scenes? The NFL is running one of the largest cybersecurity operations in America. Here's what most people don't know. The NFL built a dedicated cyber command center inside the stadium this week. Cisco installed 1,500 Wi-Fi 7 access points. 35+ federal, state, and local agencies are active. CISA is on site. The Secret Service is on site. And they're expecting 35 terabytes of data uploads from fans during the game. Why does this matter? At Super Bowl LVIII in 2024, Cisco blocked: ○ 354,000 connections from blacklisted regions ○ 39,000 security intelligence events ○ 1,600 intrusion events triaged At Super Bowl LVII in 2023: ○ 416,000 blacklisted connections blocked ○ 8,884 intrusion events ○ 187,000 malicious DNS requests blocked Meanwhile, outside the stadium? Phishing scams spike 57% on Super Bowl Sunday. Fake ticket sites. Fake betting apps. Fake streaming links. The global sports market is worth over $600 billion. And today, every cybercriminal on earth is watching the same game you are. Just not for the same reasons. The NFL's cybersecurity team doesn't get a halftime show. But they might be running the most important defense on the field today.

Last year, I started an AI security company called Cover Our AI hardware can detect guns underneath clothes and bags. And I’m currently funding $10M into it Here's why this technology is critical and the traction the last 12 months: 1/ Company Overview: Cover is designing concealed weapon detection imaging scanners, similar to airport scanners, but with 10x higher frequencies and up to 4-meter stand-off distances It’s as safe for human bodies as home Wi-Fi Cover has licensed intellectual property from NASA's Jet Propulsion Laboratory related to high frequency terahertz imaging Other updates: > Team is 12 people, mostly engineering > Offices in Bay Area & Pasadena > Fully self funded; I’m my own VC 2/ Why are we doing this? School shootings are up ~10x from a decade ago - it's a problem that's getting significantly worse. I believe our solution at Cover can help to prevent these at scale (majority of shootings are unplanned) Attached you’ll see a chart of K-12 school shootings since 1966. Besides schools, this technology will work at any public venue: > Stadiums > Churches > Hospitals > Airports And It’s not just weapons, it can also checks for explosives. In the long run, I believe most major venues will have weapon imaging systems like this 3/ Technology, Generation 1 Our first-generation system was completed this summer and is now operating daily in our lab Real guns are used for training data and to test our in-house AI image detector Our system shown in the attached image, is capable of detecting weapons through clothing/bags 4/ Technology, Generation 2 Design is currently underway for our 2nd generation system, and it's a radical upgrade: > Cheaper per unit > Increased field of view > Enhanced weapon detection > Improved penetration through clothes/bags 5/ What's next? The team is heads-down designing Generation 2 of the imaging system. We hope to have this complete and validated in 2025 We’ll then begin alpha testing with local schools in the U.S. We’re pushing - this can't come soon enough; every week kids are dying

🌍International Guidance for Enhanced Cybersecurity: Best Practices for Event Logging and Threat Detection🌍 The Australian Government's Australian Cyber Security Centre (ACSC), in collaboration with global partners like the #NSA, #CISA, the UK's #NCSC, and agencies from Canada, New Zealand, Japan, South Korea, Singapore, and the Netherlands, has released a comprehensive report on best practices for event logging and threat detection. 🚀The report defines a baseline for event logging best practices and emphasizes the importance of robust event logging to enhance security and resilience in the face of evolving cyber threats. Why Event Logging Matters: Event logging isn't just about keeping records—it's about empowering organizations to detect, respond to, and mitigate cyber threats more effectively. The guidance provided in this report aims to bolster an organization’s resilience by enhancing network visibility and enabling timely detection of malicious activities. 🔍 Key Highlights: 🔹Enterprise-Approved Event Logging Policy: Develop and implement a consistent logging policy across all environments to enhance the detection of malicious activities and support incident response. 🔹Centralized Log Collection and Correlation: Utilize a centralized logging facility to aggregate logs, making detecting anomalies and potential security breaches easier. 🔹Secure Storage and Event Log Integrity: Implement secure mechanisms for storing and transporting event logs to prevent unauthorized access, modification, or deletion. 🔹Detection Strategy for Relevant Threats: Leverage behavioral analytics and SIEM tools to detect advanced threats, including "Living off the Land" (LOTL) techniques used by sophisticated threat actors. 📊 Use Case: Detecting "Living Off the Land" Techniques: One highlighted use case involves detecting LOTL techniques, where attackers use legitimate tools available in the environment to carry out malicious activities. The report showcases how the Volt Typhoon group leveraged LOTL techniques, such as using PowerShell and other native tools on compromised Windows systems, to evade detection and conduct espionage. Effective event logging, including process creation events and command-line auditing, was crucial in identifying these activities as abnormal compared to regular operations. Couple this report with the CISA Zero Trust Maturity Model (ZTMM): The report's best practices align with CISA's ZTMM's Visibility and Analytics capability. By following these publications, organizations can progress along their maturity path toward optimal dynamic monitoring and advanced analysis. (Full disclosure: I was co-author of CISA's ZTMM) 💪Implementing these best practices from the Australian Signals Directorate & others is critical to achieving comprehensive visibility and security, aligning with global cybersecurity frameworks. #cybersecurity #zerotrust #digitaltransformation #technology #cloudcomputing #informationsecurity

Course 1: The Different Security Plans and Reports (Security Documents) In security management, each situation requires a tailored response. That’s why different plans and reports are developed each with a specific purpose. Here are the essential documents every security professional should know: 1. Site Security Plan This plan outlines all the preventive and protective measures in place to ensure the safety of a site (hotel, building, compound, etc.). It includes: - Access control and entry points - CCTV and surveillance systems - Visitor management - Security personnel deployment and patrols - Sensitive zones and access levels Goal; Prevent intrusion, theft, sabotage or terrorist acts. 2. Evacuation Plan This plan provides clear procedures to safely and quickly evacuate people from the site in case of emergency: fire, bomb threat, earthquake, etc. It covers: - Emergency exits and escape routes - Assembly points - Roles and responsibilities (floor wardens, evacuation guides) - Alarm systems and signage Goal; Protect lives during a dangerous situation. 3. Contingency Plan This plan anticipates exceptional situations that could disrupt operations, outside of immediate emergencies. Examples include: - Extended power outages - Strikes or civil unrest - Epidemics or pandemics - Natural disasters (floods, storms) It provides alternative solutions and adjustment procedures to keep activities running. Goal; Ensure operational continuity in unpredictable events. 4. Crisis Management Plan This plan defines the organization’s strategy to respond to major crises that could affect its reputation, safety, or operations. It includes: - A crisis management team with clear roles - Internal and external communication protocols - Coordination with local authorities - Action plans for different scenarios Goal; Manage the crisis effectively, minimize damage and regain control. Key Security Reports 1. Risk Assessment Report This report identifies potential risks that may impact people, assets or operations. It evaluates the likelihood and impact of each risk and proposes mitigation strategies. It includes: - Hazard identification - Vulnerability analysis - Risk matrix (likelihood vs. impact) - Recommendations Goal; Help decision-makers prioritize risks and allocate resources effectively. 2. Threat Assessment Report This report focuses specifically on intentional threats (criminal, terrorist, insider threats, etc.). It analyzes: - Potential adversaries and their capabilities - Historical data and intelligence - Likely targets and methods of attack - Security gaps or weaknesses Goal; Understand and anticipate hostile threats to enhance proactive protection. https://lnkd.in/eaYwg8Dh #SecurityManagement #Physicalsecurity #RiskAssessment #CrisisManagement #EvacuationPlan #SecurityPlanning #ThreatAssessment #SiteSecurity #SafetyFirst #SecurityProfessionals

Do you think Data Governance: All Show, No Impact? → Polished policies ✓ → Fancy dashboards ✓ → Impressive jargon ✓ But here's the reality check: Most data governance initiatives look great in boardroom presentations yet fail to move the needle where it matters. The numbers don't lie. Poor data quality bleeds organizations dry—$12.9 million annually according to Gartner. Yet those who get governance right see 30% higher ROI by 2026. What's the difference? ❌It's not about the theater of governance. ✅It's about data engineers who embed governance principles directly into solution architectures, making data quality and compliance invisible infrastructure rather than visible overhead. Here’s a 6-step roadmap to build a resilient, secure, and transparent data foundation: 1️⃣ 𝗘𝘀𝘁𝗮𝗯𝗹𝗶𝘀𝗵 𝗥𝗼𝗹𝗲𝘀 & 𝗣𝗼𝗹𝗶𝗰𝗶𝗲𝘀 Define clear ownership, stewardship, and documentation standards. This sets the tone for accountability and consistency across teams. 2️⃣ 𝗔𝗰𝗰𝗲𝘀𝘀 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 & 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 Implement role-based access, encryption, and audit trails. Stay compliant with GDPR/CCPA and protect sensitive data from misuse. 3️⃣ 𝗗𝗮𝘁𝗮 𝗜𝗻𝘃𝗲𝗻𝘁𝗼𝗿𝘆 & 𝗖𝗹𝗮𝘀𝘀𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 Catalog all data assets. Tag them by sensitivity, usage, and business domain. Visibility is the first step to control. 4️⃣ 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 & 𝗗𝗮𝘁𝗮 𝗤𝘂𝗮𝗹𝗶𝘁𝘆 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 Set up automated checks for freshness, completeness, and accuracy. Use tools like dbt tests, Great Expectations, and Monte Carlo to catch issues early. 5️⃣ 𝗟𝗶𝗻𝗲𝗮𝗴𝗲 & 𝗜𝗺𝗽𝗮𝗰𝘁 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀 Track data flow from source to dashboard. When something breaks, know what’s affected and who needs to be informed. 6️⃣ 𝗦𝗟𝗔 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 & 𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 Define SLAs for critical pipelines. Build dashboards that report uptime, latency, and failure rates—because business cares about reliability, not tech jargon. With the rising AI innovations, it's important to emphasise the governance aspects data engineers need to implement for robust data management. Do not underestimate the power of Data Quality and Validation by adapting: ↳ Automated data quality checks ↳ Schema validation frameworks ↳ Data lineage tracking ↳ Data quality SLAs ↳ Monitoring & alerting setup While it's equally important to consider the following Data Security & Privacy aspects: ↳ Threat Modeling ↳ Encryption Strategies ↳ Access Control ↳ Privacy by Design ↳ Compliance Expertise Some incredible folks to follow in this area - Chad Sanderson George Firican 🎯 Mark Freeman II Piotr Czarnas Dylan Anderson Who else would you like to add? ▶️ Stay tuned with me (Pooja) for more on Data Engineering. ♻️ Reshare if this resonates with you!

🔐 Understanding Firewall, IDS, ACL, IPS & SIEM – A Simple Visualization Cybersecurity can feel complex, but this illustration breaks it down into something we all understand: a secured military checkpoint. 🚧 1. Firewall = The Main Security Gate Just like a gate controls which vehicles can enter a restricted area, a firewall filters network traffic. It decides what is allowed in/out based on predefined rules — blocking suspicious or unauthorized connections. 🆔 2. IP Address Check = Identity Verification Every car entering the gate has a number plate. Similarly, every device or packet entering a network is identified by an IP address. This helps the firewall know who is requesting access. 📝 3. ACL (Access Control List) = Guard Checking the Permission List The soldier with the checklist represents an ACL. ACLs define who is allowed, what actions are permitted, and what must be blocked. It’s like telling the guard: ✔ Allow this IP ❌ Block that IP ✔ Permit only certain services 🔍 4. IDS (Intrusion Detection System) = The Surveillance Camera The camera above the gate symbolizes an IDS. It observes and detects suspicious activities but doesn’t take action. It alerts the security team when something unusual happens. 🎯 5. IPS (Intrusion Prevention System) = Armed Response Team The soldiers with weapons represent an IPS. Unlike IDS, an IPS actively blocks or neutralizes threats in real-time — stopping attacks before they reach the network. 🏢 6. SIEM (Security Information & Event Management) = Security Operations Center (SOC) Inside the monitoring room is the SIEM, which collects logs and alerts from Firewall, IDS, IPS, and other systems. It correlates events, identifies patterns, and provides real-time security visibility to analysts.

𝗜 𝘁𝗵𝗼𝘂𝗴𝗵𝘁 𝗜 𝗸𝗻𝗲𝘄 𝗳𝗿𝗼𝗻𝘁𝗲𝗻𝗱 𝘂𝗻𝘁𝗶𝗹 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝗮𝘀𝗸𝗲𝗱: “𝗛𝗼𝘄 𝗱𝗼 𝘆𝗼𝘂 𝗽𝗿𝗲𝘃𝗲𝗻𝘁 𝗫𝗦𝗦? Most developers ignore web security until something breaks. I did too. But today, security isn’t just a backend concern, it’s part of your frontend job. I paused and went back to the fundamentals. Not just how to build, but how to secure what I build. 🔐 7 Web Security Concepts That Changed the Way I Code: 𝗫𝗦𝗦 – when user input becomes a weapon 𝗖𝗦𝗥𝗙– when logged-in users become attackers 𝗖𝗢𝗥𝗦– misconfigured headers = data leaks 𝗝𝗪𝗧 𝗶𝘀𝘀𝘂𝗲𝘀 – tokens in localStorage = easy target 𝗖𝗦𝗣 – your browser-level firewall 𝗖𝗹𝗶𝗰𝗸𝗷𝗮𝗰𝗸𝗶𝗻𝗴 – UI that tricks users silently 𝗦𝗲𝗰𝘂𝗿𝗲 𝗛𝗲𝗮𝗱𝗲𝗿𝘀 – one-time config, huge impact 𝗦𝗼𝗺𝗲 𝘀𝗰𝗲𝗻𝗮𝗿𝗶𝗼-𝗯𝗮𝘀𝗲𝗱 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀 𝗜 𝗳𝗮𝗰𝗲𝗱: 🔷 A user pastes <script>alert('XSS')</script> in a text field and it executes. What went wrong and how do you prevent it? 🔷 Your app stores JWT tokens in localStorage. What are the risks involved? 🔷 A form on your site is being submitted from another domain, how do you block it? 🔷 After logout, users can still access previous pages via the browser back button, how do you prevent this? 🔷 You allow users to upload images. What security checks should be in place on the frontend? 🔷 You dynamically inject scripts using innerHTML. What could go wrong? 🔷 Your app is embedded in an iframe on a third-party site. What vulnerabilities might arise? 🔷 You’re using a public CDN for loading scripts. How do you ensure the script hasn’t been tampered with? 🔷 A button triggers an action without user interaction when opened from an external link, what’s the issue? 🔷 Your frontend sends a POST request on button click, but it’s being triggered by attackers silently, how do you prevent it? Security is not optional anymore. It’s what separates “𝘄𝗼𝗿𝗸𝘀 𝗳𝗼𝗿 𝗻𝗼𝘄” from “𝗿𝗲𝗮𝗱𝘆 𝗳𝗼𝗿 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻.”

I’ve been in the #CUI marking weeds with a client lately, and if you didn’t already know, trust me, people find it confusing for a reason. It’s not just about knowing whether something is CUI. It’s about... ◾ Understanding which categories apply ◾ Knowing when dissemination controls are required ◾ Applying the right banner markings ◾ Getting the right information in the designation indicator block ◾ AND doing it all consistently across systems, documents, and communications No big deal, right? 😉 Just make sure you “mark media with necessary CUI markings and distribution limitations.” [MP.L2-3.8.44] There’s no shortcut here. Even with experience, I'm reminded that it takes time and careful review to get it right. So while I’ve still got all the tabs open, I figured I’d share a few links we always keep handy when working through this. CUI Marking Handbook https://lnkd.in/eHHQhuJX DoD CUI Awareness & Marking Training Slides (Dec 2024) https://lnkd.in/er2cYgDP NARA CUI Registry of Markings https://lnkd.in/eS8GaM2g DoD CUI Registry https://lnkd.in/e3zEFqpz DoD Distribution Statement Reference https://lnkd.in/eeNQ8pDX Marking CUI correctly isn’t just slapping “CUI” at the top of a document, it’s a nuanced process. If you're working through it and feeling stuck, you’re definitely not alone. Reach out if you'd like a hand! #CMMC #OpticCyber

AIUC-1 and OWASP GenAI Security Project's Agentic Top 10, mapped end-to-end. Eight gaps live between them. I co-authored this with John Sotiropoulos, working with Emil Bender Lassen and Abby Shen from the AIUC-1 team. A crosswalk isn't another framework. We didn't add a control list to the pile. We took two standard people who already run and mapped them against each other, both directions. The mappings are useful. The gaps are the story. Eight of them. Real ground, the kind the agentic threat models say you can't skip. They cluster in three places. Agent identity and how agents talk to each other. No per-agent attestation. No mutual authentication. No kill switch. Runtime containment. No circuit breakers, no blast-radius caps, no monitoring of what the agent does inside its own walls. Supply chain attestation. No signed tool manifests, no prompt version control, no bill of materials for the agent's dependencies. Notice the pattern. Every gap opens up the moment the model stops being a component you filter and becomes an actor that plans, calls tools, and acts. Standards built for the component era guard the input and the output. The agent era exposes everything in between. Here's the part that should bother you. The single most broadly mapped control was "prevent unauthorized agent actions." Scope enforcement. Least agency. It maps to eight of the ten threats. Still not a checkbox. It bundles five separate control functions, and covering one doesn't cover the rest. Relevance is not sufficient. Having control of your matrix is not the same as being covered. One more thing. We ran an automated multi-signal pass next to the human review. It surfaced five new mappings. It found zero of the eight gaps. The machine connected what was already there. The humans found what wasn't. Read the eight gaps and decide where your own stack is exposed. Link in the comments. Special thanks to our expert reviewers Tomer Elias, Madjid Nakhjiri, Vineeth Sai Narajala, and our technical contributors, Syed Aamiruddin, Kellen Carl, Emmanuel Guilherme, Violeta Klein, CISSP, AIGP, CEFA, Rico Komenda, Narendra K., Gaurav M., Roger Sanz, PhD Otto Sulin 👉 Follow and connect for more AI and cybersecurity insights with the occasional rant #AgenticAI #OWASP #AIGovernance

Crowds, cars, and cyber - what the Liverpool parade incident taught me. Yesterday, while visiting Liverpool after visiting family in Romania, I watched from close the city prepare for the victory parade. Excitement everywhere. But one look at the route - tight bottlenecks, limited egress points - and I chose distance over confetti. Hours later a car ploughed through the crowd. Not terrorism - officially. Still terror in every scream, every child carried to an ambulance. The only thing that slowed the driver? Bystanders pounding the bonnet. Sometimes people are the last control. Quick lessons (physical = cyber): 🔹 Design is a control. Wide lanes, hard barriers, clear exits. Same as network segmentation. 🔹 Intel > optics. High-vis vests look good; real-time data saves lives. 🔹 One threat surface. Cars breach perimeters as fast as malware breaches firewalls. 🔹 Assume chaos, drill for it. Tabletop, red-team, crowd-flow models - transferable skills. 🔹 Bias blinds risk. “Just a family parade” = “too small to hack.” Challenge every assumption. ❗️⚠️Call to practitioners ▪️ Fuse physical-security SMEs into cyber crisis teams (and vice-versa). ▪️ Stress-test mass-gathering plans like critical systems — threat-model, patch, repeat. ▪️ Hire diverse panels; fresh eyes spot blind spots Personal take away: I’ll never trade proximity for safety. Security is one discipline, many domains. Design for good intent, plan for worst case - so people (and high performers) stay, celebrate, and thrive. Stay curious. Stay prepared. When the layout feels wrong, trust your risk radar and step back. Read full article: https://lnkd.in/gCY6f_Ev Picture 1 source: BBC, all others personal mobile 🌱Stay curious. Stay prepared. And when the design feels wrong, trust your risk radar and step back. #SecurityByDesign #CrowdSafety #RiskManagement #PhysicalAndCyber #Leadership #LessonsLearned