Mark Simos

We need to be moving toward machine speed patching. We have to go from carrying individual buckets to hoses that flow all the time while we keep the humans focused on leaks (exception management) ⬇️

This is hard work to do, but starting later on this work means you have less time to do it. We need to look at each stage of patching for each type of asset, then find ways to remove the manual human steps in that process.

techcommunity.microsoft.comBuild a patch strategy for today’s threat pace with Microsoft | Microsoft Community HubAI-accelerated vulnerability discovery and remediation are changing how organizations manage risk. As discussed in Pavan Davuluri’s recent blog, Microsoft is...

For your Intune managed devices, check out this guidance - techcommunity.microsoft.com/blog/intunec...

If you're just starting out in cybersecurity, trying to build your career, or navigating the sometimes painful journey of growing in it, you may want to check out my "What's My Job Again?" talk recorded at BSides Tampa. Check out the talk here - www.youtube.com/watch?v=uVAA...

I cover: • How security roles and responsibilities should work • What usually goes wrong - common antipatterns • What happens when important security responsibilities fall through the cracks • Practical tips for fixing those problems • How to navigate (a broken) organization

I'm updating an MCRA visual mapping Microsoft security technologies to security disciplines + the roles that primarily use them. Early draft 👇 Useful? Wrong? Confusing? Missing something? What would you change or add? Would love your feedback!

One of thing I talked about in my last Tampa BSides talk is how security and business leaders can and must work together effectively as accountable and responsible stakeholders. Video Here - www.youtube.com/watch?v=l0cC... Link to download the slides here - zerotrustplaybook.com/events/

If your business and security and technology people are fighting with each other instead of working together, you will experience more business disruption from more incidents and higher impact of each incident.

This is especially critical today as AI accelerates the pace of business strategy changes, technology changes, and attacker evolution/speed. If people are wasting time talking past each other or blaming each other, then they are falling behind faster than ever.

Collaboration is critical to be effective at Security and at business - you need to bring the best ideas together from different backgrounds to manage a these complex and tricky problems with very difficult trade-offs.

youtube.comSecOps SOC ExplainedYouTube video by Mark Simos

My new video on Security Operations (SecOps/SOC) just dropped! I cover all the important aspect of SecOps including how AI does 𝘢̲𝘯̲𝘥̲ 𝘥̲𝘰̲𝘦̲𝘴̲𝘯̲'̲𝘵̲ change SecOps. Share and Enjoy! www.youtube.com/watch?v=DX2N...

▬▬▬▬▬▬ Video Chapters ▬▬▬▬▬▬ 0:00 SecOps/SOC Explained 2:52 How AI-Driven Attacks impact SecOps workload 6:18 SecOps Mission and Key Metrics 7:35 Core SecOps Capabilities 10:38 Bringing SecOps Capabilities to Life with People, Process, and Technology ⬇️

14:32 SecOps Roles and Operating Model 24:51 Agentic AI and SOC Automation 29:45 AI Opportunities across SecOps 33:19 Practical Takeaways

youtube.comSecOps SOC ExplainedYouTube video by Mark Simos

This video explains the SecOps mission, core capabilities, operating model, roles and responsibilities, architecture building blocks, and how AI and agentic automation are changing SecOps/SOC for security leaders, architects, and practitioners.

What is success in cybersecurity? Rapid incident response and remediation? Preventing things from going bump in the night? Both of are part of it as they contribute to overall security success of attacker failure. Video - www.youtube.com/watch?v=iOfg...

I talk about this more in my "Cybersecurity Explained" video in my new YouTube channel including the 'infinite playlist dynamic', the different security disciplines that must work together, and more.

youtube.comCybersecurity ExplainedYouTube video by Mark Simos

Note: This is part of the first videos on the channel on basic cybersecurity assumptions & definitions that are different from what many people were taught so I don't have to keep re-explaining these in later videos on advanced topics. www.youtube.com/watch?v=iOfg...

'Attacker failure' is driving up cost and friction to remove the cheap, easy, and reliable attack techniques from their menu with both effective prevention and response (and working as a team to help everyone get better)

Ideally we are so successful at cybersecurity that attackers give up and open a fruit stand, but that is pretty unlikely so let's stay practical and focus on increasing their failure / decreasing their success.

I love MITRE ATT&CK …but it doesn't tell the whole story I recently published a video on YouTube describing a 3-D view of adversaries we face, how it relates to & expands on ATT&CK (+ legacy Lockheed Martin kill chain), & how they are using AI today. www.youtube.com/watch?v=fgPv...

Attack operators are humans - creative and intelligent humans with motivations, habits, strategies, and operating models that guide who they attack and how they attack.

youtube.comKnow Your AttackerYouTube video by Mark Simos

We must understand why these humans do what they do, what they are after, how they operate to achieve their goals, & the consistent attack methodology they use across attacks and attack techniques (plan, enter, traverse, execute objectives). video here - www.youtube.com/watch?v=fgPv...

ATT&CK does an awesome job of driving a standard language and taxonomy for the proven technical attack techniques (even though it has never become a formal 'standard') but... ⬇️

Understanding and predicting attacker behavior requires much more than just the techniques that attackers use (or that they use AI/Agents to automate)

One way to visualize why organizations must view IT systems as business assets, must own all the risks including security, and must shift security integration left is to take a long view over the asset's lifetime.

An expensive piece of equipment that can't be secured (patched/etc.) creates a business disruption and risk later in life when support runs out. Avoiding requires security requirements/mitigations in contract negotiations (when vendor is willing to concede things to close a sale)

learn.microsoft.comIntegrate OT/IoT security into the Infrastructure/Networking disciplineUse the Microsoft security adoption model to secure OT/IoT assets and resources across the business, based on Zero Trust principles.

This is captured in a 'tale of two systems' diagram in the Microsoft Security Adoption Framework (SAF) documentation - learn.microsoft.com/en-us/securi...

The recording for "Security is team sport, but we aren’t planning like a team" is now live! Recording - www.youtube.com/watch?v=l0cC... Slides - www.slideshare.net/slideshow/se...

This talk covered ➕ Hard-won career tips and learnings for practitioners and leaders ➕ Security roles and responsibilities ➕ How to avoid the blame game that undermines everything security does ➕ A whole bunch of security antipatterns

➕ A 'tale of two cities' style case study of doing security right/wrong ➕ Aome age of empires 2 references ➕ ...and a bunch more.

22 Sept

I recently released a new video "Know Your Attacker" that covers who the attackers we face are, why they do it, and how they approach attack operations (including how they are using generative AI today), and what this means for you. www.youtube.com/watch?v=fgPv...

22 Sept

I also describe the main attack/kill chains and relative advantages/limitations of each

21 Sept

I just released a new video "Zero Trust Explained" www.youtube.com/watch?v=6bqf... It covers ► What Zero Trust is (fixing broken assumptions from classic security) ► How this concept evolved, how Zero Trust is required for AI security (and is accelerated by AI) ⬇️

21 Sept

► Key principles and guiding commandments ► How it looks different to a business leader, security/technology leader, or security/technology practitioner ► Real world examples

youtube.comCybersecurity ExplainedYouTube video by Mark Simos

18 Sept

One of the first videos I posted is "Cybersecurity explained" that covers the basics of what cybersecurity is, what success looks like (attacker failure), and what it takes to build organizational resilience www.youtube.com/watch?v=iOfg...

18 Sept

This is a pretty short video that hits on stuff that some folks get wrong (or were never taught): 0:00 Cybersecurity Explained 0:11 Threat Actors, Attack Operations, and Business Risk 4:20 Security Success Means Attacker Failure ⬇️

18 Sept

6:10 Prevent, Respond, and Learn Across the Lifecycle 9:15 Build Organizational Resilience 11:10 Use End-to-End Security Architecture 15:15 Focus on People, Teamwork, and Continuous Adaptation 🔚

I've been a little bit quiet lately because I've been (re)building my YouTube channel - Mark on Cybersecurity I just posted the first 3 new videos. Share and Enjoy! MarkonCyber.com

I will mostly share what I have learned over the years about cybersecurity as well as how I turn these learnings into actionable guidance through professional storytelling, share some career tips and advice, and other stuff I have learned along the way.

I have a bunch of ideas in the works, but I am also very interested in hearing what you want me to cover so send me questions, suggested topics, etc.

I've been a little bit quiet lately because I've been (re)building my YouTube channel - Mark on Cybersecurity I just posted the first 3 new videos. Share and Enjoy! MarkonCyber.com

The plan for my little corner on YouTube is to share what I have learn about making the complex topic of cybersecurity simple, clear, and practical. There are no ads or sponsorship, it’s just me. Feel free to subscribe.

Hey all, I recorded a short video with a preview of the sessions and standards we will talking about at the FREE Security Forum event in Arlington, VA (near Washington DC) meet.opengroup.org/event/cbab26... Registration closes September 7 Would love to see you there!

◾ Who are They, and Why are They Attacking Us?: Building Realistic Requirements for Security with the Security Matrix Standard ◾ Building Security into your Organization: Security Principles for Architecture and the Zero Trust Commandments

◾ AI-Driven Attacks and Software Exploitation (Mythos, MDASH and More) ◾ AI and Zero Trust ◾ Speaking to the Board about Security ◾ DevSecOps and Zero Trust ◾ Making Decisions using CRQ: Applying the Open FAIR™ Methodology to Zero Trust Implementation

I am really looking forward to talking about this work and how you can use it with the other folks who have been doing a lot of work to shape this with their experience including Hasan Yasar Nikhil Kumar Tony Carrato and John Linford

Sessions include: ◾ A Unified Set of Standards for Security: Security and Zero Trust Body of Knowledge ◾ Security is EVERYONE’S Job: The Security Roles and Glossary Standard

3 Sept

Come hear the authors in speak in person (and ask them questions) on the upcoming Security Matrix standard. We will be live at the upcoming Security Forum event in Washington DC on September 15-17. (technically Arlington, VA) Agenda & register here - meet.opengroup.org/event/cbab26...

3 Sept

This event is: ◾ Coming soon - Registration closes September 7 ◾ FREE - No charge, but only 75 seats available and they are filling up ◾ Vendor-neutral (not focused on Microsoft or any other security vendor)

1 Sept

If you are in the Washington DC area, you are invited to a free vendor-neutral event focused on the toughest cybersecurity challenges Sep 15-17 aka.ms/TOGevent I would love to see you all there!