Tyler J. Farrar

Scanners, audits, monitoring, SBOMs, reputation systems, governance frameworks. A dense network of epistemic feedback loops that often feed back into a void. The question is what happens when those signals stop terminating in reports and start coordinating capital instead. https://lnkd.in/grQ6-6dc

1

CRITICAL VULNERABILITY ALERT CISA has highlighted a critical security vulnerability - CVE-2025-5086, CVSS 9.0 - impacting Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software. According to Dassault, the issue impacts versions from Release 2020 through Release 2025. Information for this vulnerability can be found on SecAlerts: CVE-2025-5086, CVSS 9.0: https://lnkd.in/gBRUAAbw #ciso #cio #cto #vulnerabilities #cybersecurity #secalerts #msp #mssp #dassault #CVE20255086 https://lnkd.in/ga29CFy4

2

CISA's New SBOM Guidelines Get Mixed Reviews Updated SBOM rules from CISA are a solid step toward making them more useful for cyber defenders but don't address many critical needs, experts say. https://lnkd.in/eK3iw8Ei

1

Characterizing Cybersecurity Outcomes NIST IR 8349 introduces a methodology for defining and measuring cybersecurity outcomes. 📊 This supports ISO/IEC 27001’s requirement for evaluating the effectiveness of security measures and driving continual improvement. Exoexcellence shares this to promote outcome-driven security. #ISO27001 #CyberRisk #SecurityMetrics #ISMSImprovement #NISTMethodology #Exoexcellence

1

Cybersecurity is no longer optional for Ventura County businesses. From phishing emails and ransomware attacks to weak passwords and outdated systems, cyber threats are becoming more common across Ventura, Oxnard, Thousand Oaks, and Camarillo. Many small and mid-sized businesses assume they’re too small to be targeted — but in reality, they’re often the most vulnerable. A single cyber incident can disrupt operations, expose sensitive customer data, and create serious compliance risks under California privacy laws like CCPA and CPRA. That’s why we created a practical Cybersecurity Guide specifically for Ventura County businesses. Inside the guide, you’ll learn: • Common cyber threats affecting local businesses • Email and cloud security best practices • Data backup and ransomware protection strategies • California cybersecurity and data privacy considerations • Long-term cybersecurity planning for business resilience Strong cybersecurity is not just about protection — it’s about business continuity, trust, and long-term growth. Read the full guide here: https://lnkd.in/gHRusXY3 Have questions or need reliable IT support? Get in touch today through the link in our bio. 877-707-TECC info@securetecc.com securetecc.com Proudly based in Ventura County, serving Santa Paula, Ventura, Oxnard, Camarillo, Thousand Oaks, Santa Barbara, Fillmore, Hollywood, Beverly Hills, Pasadena, and Burbank. #Cybersecurity #VenturaCounty #ManagedITServices #BusinessCybersecurity #ITSupport #OxnardBusiness #ThousandOaksBusiness #SecureTECCSolutions #CaliforniaBusiness

2

CISA Issued an Emergency Directive on the F5 Breach What We Know So Far 👉On October 15, 2025, CISA released Emergency Directive ED 26-01, compelling federal civilian agencies to inventory, patch, isolate, or decommission vulnerable F5 devices. 👉 The breach stems from a nation-state actor gaining persistent access to F5’s internal development and engineering systems starting in August 2025. 👉Exfiltrated data reportedly includes segments of the BIG-IP source code and F5 asserts there’s no evidence of tampering with its build pipelines or supply chain, nor confirmed exploitation of undisclosed vulnerabilities. 👉That said, some stolen files may include configuration or implementation data tied to a limited subset of customers, which could offer threat actors insight into deployment patterns. What Organizations & Customers Should Know: 1. Inventory your F5 footprint: Catalog all physical and virtual F5 devices (BIG-IP, F5OS, BIG-IQ, etc.). 2. Evaluate exposure: Check for public internet access to management interfaces; reduce or eliminate such exposure. 3. Apply patches immediately: Apply F5’s October 2025 updates. Prioritize modules with known vulnerabilities. 4. Retire or isolate unsupported hardware: If a device is end-of-support or cannot be securely patched, plan decommissioning or isolation. 5. Enhance logging, monitoring, and threat hunting: Monitor for suspicious changes, credential use, lateral movement, and configuration drift. 6. Engage in forensic review if signs of compromise emerge: If you detect anomalies, coordinate with incident response and your F5 contacts. Big shoutout to Matt Johansen for his clear and concise breakdown on Vuln U. Great resource to follow along on what the latest is (see link below).

32

6 Comments

Audit Retrospective: Lagging Event Logging Maturity Hindered Federal Cybersecurity Response A 2023 GAO report found that 20 of 23 major federal agencies had not met advanced event logging requirements by the deadline. This highlighted the persistent challenge of implementing foundational security controls at scale across complex government IT environments. The performance audit reviewed the incident response capabilities of 24 Chief Financial Officers Act agencies from January 2022 to December 2023, focusing on implementation of Executive Order 14028 requirements. Logging Shortfalls: As of August 2023, auditors found that only 3 agencies had reached the required "Advanced" (Tier 3) maturity level for investigative logging, while 17 remained at the "Not Effective" (Tier 0) level. Detection & Remediation Risk: The report documented that until event logging is fully implemented, the government's ability to detect, investigate, and remediate cyber threats remains constrained. Progress in Other Areas: The review noted positive progress in standardizing incident response plans, with all 23 agencies incorporating the CISA playbook, and 16 agencies reporting at least 80% endpoint detection coverage. Key Challenges: Agency officials identified three major hurdles: lack of skilled staff, technical complexities in logging (especially with legacy systems), and limitations in sharing timely, actionable cyber threat intelligence. Audits like this provide the essential benchmarks that catalyze structured improvement and resource prioritization. The underlying issue of operationalizing comprehensive security telemetry is universal: what foundational data controls has your organization prioritized to ensure effective incident investigation and response? For the detailed findings, review the 2023 GAO report GAO-24-105658, "CYBERSECURITY: Federal Agencies Made Progress, but Need to Fully Implement Incident Response Requirements." #GAO #Audit #Cybersecurity #IncidentResponse #Governance #RiskManagement #Compliance #PublicSector #ContinuousImprovement #ITSecurity

1

In this episode of The Hitchhiker's Guide to the GRC Technology Galaxy Podcast, GRC field researcher and intergalactic GRC hitchhiker Michael Rasmussen sits down with Adil Khan, CEO of SafePaaS, to explore what governance looks like when the enterprise is no longer neatly contained. They begin with the story of SafePaaS, including where it came from, what it set out to solve, and why it has taken a different path from many other GRC platforms. At its core, SafePaaS focuses on one of the most immediate and material risks organizations face today: cybersecurity risk, and how controls around identity, transactions, and access can be continuously governed rather than periodically checked. The conversation moves into real-world use cases, from IT general controls and segregation of duties to continuous monitoring across complex ERP and cloud environments. Along the way, Adil explains how SafePaaS delivers not just compliance, but efficiency, effectiveness, resilience, and agility and why those outcomes matter more than features alone. They also explore how SafePaaS is approaching AI and where it’s being applied today, what’s practical versus speculative, and how automation is reshaping control environments. Finally, they look ahead to 2030 and what governance may need to become as enterprises grow more distributed, systems more autonomous, and risk more dynamic. In a universe where complexity tends to expand faster than control, staying “under control” may require rethinking how control itself is designed.

4