Sreenath Sreepada

In Korea, a series of major security incidents have occurred in organizations that were already certified under security compliance schemes such as ISMS-P or ISO/IEC 27001, leading to growing skepticism about the practical value of these certifications. At the same time, many organizations respond by announcing plans to increase the frequency of penetration testing as a preventive measure. Why, then, do security certification schemes continue to fall short? Frameworks such as NIST RMF and NIST CSF are fundamentally built on the assumption of continuous security monitoring. In contrast, domestic security certifications and conventional penetration tests remain point-in-time assessments, with structural limitations: they neither provide continuous assurance nor offer holistic visibility across the full system lifecycle. Since 2022, through my involvement in NIST’s Migration to Post-Quantum Cryptography project, I have come to view cryptographic transition not as a one-off engineering exercise, but as a challenge of continuous and real-time security operations. Cryptography is no longer static infrastructure; it is an operational security asset that must be continuously discovered, assessed, and governed. To address this gap, the U.S. government has been operating the CDM (Continuous Diagnostics and Mitigation) program. CDM is often misunderstood as network-centric monitoring; in reality, it is a system-wide and integrated approach designed to continuously validate whether security controls remain effective in real time across assets, identity and access management (IAM), networks, and data. Importantly, the U.S. Government Accountability Office (GAO) has repeatedly emphasized that the effectiveness of CDM should not be demonstrated through policy documents or compliance artifacts alone, but through operational, machine-consumable data that evidences actual risk reduction and control performance. In this sense, CDM shifts assurance from documentation-based compliance to data-driven and continuously verifiable security posture. Regardless of ongoing debates over its effectiveness, the CDM approach itself offers an important direction for preparing for the exponential growth of security incidents in the era of Agentic AI. Today, much of the discussion around defending against AI-driven attacks emphasizes the use of AI-based security solutions. While this is certainly part of the answer, it cannot substitute for getting the fundamentals right. In my view, the solution lies not merely in more rigorous certification or fancy AI, but in ensuring that security is treated as a continuous capability—driven primarily by real-time visibility into the effectiveness of controls across assets, IAM, networks, and data, and only then augmented by AI. https://lnkd.in/g64aytWk --> Korean https://lnkd.in/gCa_7D6e --> English

44

1件のコメント

Welcome to SOCRadar® Extended Threat Intelligence 2026 Japan Threat Landscape Report (Japanese)! Download Now: https://lnkd.in/g8e5cgpK Japan continues to face a commercially driven cyber threat environment where data theft, access sales, ransomware, phishing, and DDoS attacks intersect. This report analyzes how threat actors target Japanese organizations and monetize stolen data and credentials across underground ecosystems.Download the full report to gain concise insights into Japan’s evolving cyber risk landscape. #DarkWeb #Ransomware #Phishing #DDoS #SOCRadar #ThreatReport #Japan #ThreatIntelligence #BrandProtection

33

Hong Kong's new Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICSO) changes the cybersecurity landscape for Critical Infrastructure Operators. The question is no longer: "Do we have cybersecurity controls?" The question is: "Can we demonstrate compliance, resilience, governance, incident readiness, and auditability?" Organizations that wait until designation or regulatory engagement may find themselves scrambling to establish and operationalize: ✓ HK PCICSO and COP - Awareness Training ✓ Identify Critical Computer Systems (CCS) ✓ Establish Security Management Plans (SMP) ✓ Conduct risk assessments ✓ Prepare incident reporting procedures ✓ Build audit-ready evidence Securing Things Limited helps CIO organizations assess IT & OT cyber resilience and readiness, identify compliance gaps and build practical compliance programs aligned to the PCICSO Code of Practice. Is your organization ready? Reach out for confidential discussions at info@securingthings.com or reach out directly to M. Yousuf Faisal #PCICSO #CyberSecurity #HongKong #CriticalInfrastructure #CISO #OTSecurity #Compliance #CyberResilience #IT #OT #Cybersecurity #AISecurity #ITSecurity #SecurityManagementPlan #

3