h3 { font-weight: bold; font-size: 18px; color: #C72026; } .pod { width: 100%; border: solid 3px #C72026; padding: 7px; margin: auto; }

A goal of the editorial team at Security magazine is to provide insightful thought-leadership focused content from security leaders to our readers through as many routes as possible. One way we do this is through our podcast channel, The Security Podcasts.

In addition to our monthly eMagazine and ongoing web coverage, Security magazine regularly releases podcast episodes which feature cybersecurity and physical security leaders from various industries. These security professionals share insights and stories from their experiences and careers providing leadership advice and discussions on emerging security threats and trends.

In addition to the podcast episodes featuring interviews with security leaders in the industry, for the past three years Security has been bringing readers the Cybersecurity & Geopolitical Discussion. This monthly video podcast streams live on LinkedIn and is also available on our website after. Each month, Chief Information Security Officer (CISO) of Cyjax Ian Thornton-Trump CD, Partner at Red Goat Security Lisa Forte, and CEO of Grey Hare Media Philip Ingram MBE, ruminate on some of the biggest issues and current events in cybersecurity and geopolitics facing the world today.

Below is just a sampling of some of the most recent podcast episodes featuring conversations our editors at Security editors have had with security professionals.

 

 

 

https://www.securitymagazine.com/articles/100773-the-power-of-podcasts

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } .w3-panel:after,.w3-panel:before { content: “”; display: table; clear: both } .w3-panel { padding: 16px; margin-top: 16px; margin-bottom: 16px } .w3-leftbar { border-left: 6px solid #386994!important } .w3-color,.w3-hover-color:hover { color: #386994!important; background-color: #eaf1f7!important } .w3-large { font-size: 20px!important } .w3-sans-serif { Nunito Sans’,Arial,sans-serif } .w3-opacity,.w3-hover-opacity:hover { opacity: 0.60 }

Say this, not that. Read that, not this. Do this, not that. You too can become a great leader if you simply follow the exhortations of leadership lists that can be found all over the Internet. 

Which phrases should good leaders never say? Dozens of articles purport to document the five, eight, 12, or 17 no-nos. Conversely, great leaders may exhibit their very greatness by injecting key incantations in their communications with staff. The Internet is rife with lists of books every effective leader should read, the most productive leadership habits, the top leaders to follow on social media, and probably even the ten best foods, seven best hats, and 12 best catchphrases.

At worst, these lists are silly or mere clickbait. At best, they are useful guides. But almost every tally is subjective, devoid of context, or pat. 

Keeping up with them is draining. The sheer number of them can make you, well, listless. 

Recognizing that items on such lists are often mere devices employed to make a larger point, below I identify reasonable examples of advice for leaders that come from reputable sources. Then I offer a different perspective. 

Things that leaders should never say

“I don’t know”: This phrase appears as taboo on several leadership lists, with critics emphasizing that leaders should add context and substance around these three words, lest the person look unprepared or foolish. But a simple “I don’t know,” especially among your reports, can be disarming, poignant, and honest. Used sparingly and strategically, it can even inspire staff to find the solution. 

“I’ll do it myself”: Commentators disparage this phrase because it suggests impatience and lack of faith in staff to accomplish important tasks. But “I’ll do it myself” can be an example of excellent servant leadership, especially if the task is no one’s responsibility, is particularly difficult, or qualifies as scut work. Some security executives have filled in for absent officers at key sites after their regular workday concludes. 

“It’s good enough”: The knock here is that the phrase capitulates to mediocrity, that the quality of work must only exceed a low bar. However, the phrase can also mean “don’t let perfect be the enemy of the good,” which signifies that achieving a marginally better result is not worth significant time and effort. “It’s good enough” may represent the most efficient use of resources. 

Things that leaders should do

“Make their bed”: Admiral William McRaven’s premise is that making your bed every morning fosters discipline, diligence, intentionality, and organization. It gives you a win first thing in the morning. Although the admiral would probably approve of other actions to substitute for making your bed — washing the breakfast dishes, for example — one could argue that mundane tasks are a waste of time. Do Warren Buffett, Elon Musk, and Jeff Bezos make their beds every morning (I have no idea), or is their time better spent providing value for themselves, their staff, their shareholders, and the public? If making their bed motivates them, comforts them, or helps them clear their minds, great. But for many leaders, it’s a waste of time. 

Eat last: Per Simon Sinek, it’s not a good practice — or look — to relax, dine, or leave first when working with your staff in the trenches. Good leaders take care of their people first. Sometimes, though, an effective leader needs to stand on ceremony. In various cultures around the world, declining to break bread or share a first drink with your host is a grievous insult. Lucrative contracts have been lost due to less severe breaches of protocol. 

Meditate: All work and no play makes Jack a dull boy — and perhaps a candidate for a mental breakdown. Meditation has proven beneficial effects on blood pressure, memory, and stress, for example. But it’s not for everyone. Walking, jogging, napping, deep breathing, golf, reading, or martial arts can have many of the same effects, especially in combination. 

Everyone loves lists — they are pointed, short, and easy to read. Most leadership lists contain at least some nuggets of wisdom, if not a catalog of best practices. 

Read them critically, though, and in the context of yourself, your team, your organization, your industry, and your culture — or of whomever you are trying to assist or mentor. 

No list fits every purpose or applies universally. This one included. 

 

(Postscript: I wrote this piece on a Southwest flight from Dallas to Washington, DC. A fellow traveler mentioned that Admiral McRaven was on board — but up at the front, while we were in the rear. I did not suggest that the admiral title his next book, Leaders Sit in the Back.) 

https://www.securitymagazine.com/articles/100772-absolutely-the-most-important-list-you-will-ever-read

Recent data has shown that around 225,200 cybersecurity professionals are needed to close the current talent gap. Only 85% of available cybersecurity positions are filled, accounting for 1.2 million workers currently employed. 

Security leaders weigh in 

Dave Gerry, CEO at Bugcrowd:

“By creating career growth opportunities and rallying behind the mission of helping customers, their customers and the broader digital community defend against cyberattacks, employees feel they have an opportunity to better themselves and the broader community.

“For years, we’ve been led to believe there is a significant gap between the number of open jobs and qualified candidates to fill cybersecurity jobs. While this is partially true, it doesn’t provide a true view into the current state of the market. Employers need to take a more active approach to recruiting from non-traditional backgrounds, which, in turn, significantly expands the candidate pool from just those with formal degrees to individuals, who, with the right training, have incredibly high potential. Additionally, this provides the opportunity for folks from diverse backgrounds, who otherwise wouldn’t be able to receive formal training, to break into the cybersecurity industry providing income, career and wealth-creation opportunities that they otherwise may not have access to. 

“Organizations need to continue to expand their recruiting pool, account for the bias that can currently exist in cyber-recruiting, and provide in-depth training via apprenticeships, internships and on-the-job training, to help create the next generation of cyber-talent.”

Gareth Lindahl-Wise, Chief Information Security Officer at Ontinue:

“Without question, there is a shortage of both skilled and experienced cyber professionals today. Moving forward, we need to bridge the skills gap and enhance the cybersecurity workforce. We must incentivize the hours people put into training, if it is worth it, it is worth rewarding (think small financial benefits, additional time off for study etc.). Encourage and enabling job shadowing and sharing.

“Internships, sabbaticals and job shares are all potential ways of accelerating real world experience. Unfortunately, there have been some fledgling attempts within the United Kingdom with NCSC (or CNPI at the time). Technical qualifications are not necessarily the issue — we are fishing in a pool for fish that haven’t had the time to grow to the size we want.”

Tim Callan, Chief Experience Officer at Sectigo:

“In addition to stagnating salaries and high stress, enterprises should consider the career path options they make available to their own employees. They can provide better environments by embracing modern architectures, implementing new tools like AI, and automating the routine work that takes up too much of IT professionals’ days. Platforms, such as ITSM and CLM, can take away mind-numbing repetitive tasks, reduce stress and give tech-savvy employees more reason to stick with their current careers.”

Dean Webb, Cybersecurity Solutions Engineer, Merlin Cyber:

“The rapid emergence of AI tools for both offensive and defensive cybersecurity over the past year demonstrates just how quickly things can change for the cyber workforce. While AI defensive tools will help to counterbalance most AI-driven attacks, the AI-enhanced generation of phishing and other social engineering attacks goes up directly against often-untrained humans. We will have to find better means of automating defenses on corporate as well as personal emails, texts and chatbots to help us hold the line when it comes to AI-enhanced social engineering.”

Omri Weinberg, Co-Founder and CRO at DoControl:

“The cybersecurity skills gap is representative in many industries and for companies of all sizes. While looking for individuals to train in specific skill areas, it’s also critical for individuals to be trained to see the wider landscape that makes up the security industry. Opening an individual’s eyes to the different paths that a cyber professional can take allows these resources to train in multiple skill areas and cover additional ground to reduce the skill shortage overall.

“The HR process still isn’t quite there yet when it comes to finding talent in the cybersecurity industry. There are plenty of available resources in the market that are not being given an opportunity to either tell their work story or be hired. Some of the hiring issues go back to needing a candidate that has every skill on the job requisition and this can be farther from reality. The gap can be minimized when hiring managers and HR representatives work closely together to understand when a candidate is qualified for a role and is also a fit for the companies’ culture.

“There are plenty of programs available that offer cybersecurity skills. Companies should continue to promote and offer training programs to increase their current talent pool and to better prepare their employees for the ever evolving landscape of cybersecurity.”

Sunil Muralidhar, Vice President at ColorTokens:

“While filling today’s cyber skills gap is extremely important, one area that we must look at is the mental health and stress levels of today’s cyber pros. Working with security professionals across varying roles reveals a common thread of high stress levels among them. For managers of security teams, there are actionable strategies to promote team members’ overall well-being:

• Foster personal connections: Encourage team members to share personal experiences without prying, and lead by example by sharing your own stories.
• Practice empathetic listening: Cultivate the skill of listening without judgment and ask questions to understand colleagues’ perspectives.
• Promote physical activity: Incorporate walks during one-on-one meetings or play games like foosball or ping pong to get the oxygen levels up and foster camaraderie.
• Advocate for time off: Ensure adequate coverage when team members take time off by staggering vacation schedules.
• Respect personal time: Discourage meetings during evenings or weekends that encroach on family or personal time and encourage everyone to block off their calendars for personal activities.
• Cultivate a growth mindset: Support individuals in setting and achieving their professional goals, whether it’s pursuing a promotion or transitioning to a different role.
• Stay attentive: Be vigilant for behavioral changes like lack of focus or tardiness and offer supportive check-ins to address any underlying issues promptly.”

https://www.securitymagazine.com/articles/100789-security-leaders-respond-to-industrys-need-for-225-000-professionals

A wave of ransomware attacks in the United States and United Kingdom that have disrupted clinical operations and forced hospitals in both regions to turn away patients is the latest reminder of the fragility of life-saving infrastructure and how lucrative it can be for attackers looking for a payday or an opportunity to sow discord into the lives of patients. 

In May, St. Louis-based Ascension Healthcare, one of the largest private healthcare systems in the United States, had to take clinical operations offline due to a breach in their system. Even more recently, several hospitals within the U.K.’s NHS were crippled when attackers launched a ransomware attack against a vendor company called Synnovis that helps manage blood transfusions and lab services in some U.K. hospitals.

The healthcare industry is one of the most sought-after sectors for threat actors today, with the average cost of a ransomware incident having risen 63% to $450,000 between 2022 and 2023. When attacking life-saving infrastructure like hospitals and care centers, these attackers know that they’ll have upper hand in any ransom negotiation, and thus can hold out in hopes of receiving more for their stolen or encrypted data. 

This is unfortunately a tried-and-true strategy for attackers. A recent example occurred earlier this year, when Change Healthcare was breached due to a lack of multifactor authentication and exposed millions of American’s health data. The frequency and severity of these attacks led to remarks this week from White House deputy national security advisor Anne Neuberger that the administration will soon require hospitals to adhere to minimum cybersecurity standards, as well as begin free cybersecurity training for small and rural hospitals. Healthcare organizations not only hold the keys to troves of personal and confidential information on patients; they also have mass networks of critical medical technology, and operate on complex, interconnected supply chains that involve multiple software providers and internet-connected devices. 

Why does this interconnectedness of this ecosystem matter? It’s because while it is great for rapid advancements in medical care, it’s equally lucrative for opportunistic bad guys. The more integrated hospitals and care facilities are, the larger the attack surface on which bad guys can launch a social engineering scam or a malware-based attack. The most common attacks generally seen levied against the healthcare industry tend to take advantage of the older technology these hospitals run on, and usually involved long-known external facing vulnerabilities and phishing attacks. 

When organizations are too busy to patch or simply unaware of these known vulnerabilities, they put themselves and their patients at risk. Likewise, when the staff at a hospital or medical facility aren’t trained to recognize and report a phishing email, attackers can simply spam their targets with spoofed email addresses or realistic-looking messages until they find an employee who unwittingly gives up their credentials. The attackers know all of this and use it to their advantage.

These types of attacks are endlessly viable for threat actors because they focus on exploiting the weakest link in any given healthcare company. Organizations that are as large and interconnected as Ascension or other national healthcare providers struggle to shore up all their cyber vulnerabilities, inadvertently putting patient health and safety at risk. But when recovering from an incident, it’s critical that these victims prioritize patching external facing vulnerabilities and establishing a comprehensive top-to-bottom 24/7 security operations capability. Without these in place, the risk of a repeat, successful attack is very high.

Reducing the cyber risk in the healthcare industry is a multi-step process that should focus on establishing a baseline of cybersecurity standards, such as implementing multi-factor authentication (MFA) and identity access management principles that reduce the risk of network intrusion or stolen credentials. Privileged Access Management tools, for example, are vital to ensuring that if an attacker gets in, they are not able to elevate their privilege and easily access a company’s most sensitive data. 

These tools can enable the separation of administration and normal user credentials through implementations such as Privileged Access Workstation (PAW) and Tiered Access Models, helping prevent the bad guys from accessing critical patient data once they walk through the front door. Companies should prioritize regular reviews of their privileged access pool and make the necessary changes as they are needed. 

Regularly scheduling information security trainings can also help employees stay educated and alert for social engineering scams, and the IT department should be conducting annual or biannual compliance checks against themselves to ensure they’re up to date against an ever-changing threat landscape. Keeping security training lessons front of mind via micro-sessions is key versus annual bulk training that isn’t as well retained by employees. 

If healthcare organizations follow these key steps, there will hopefully be less of them in the headlines for serious, patient-impacting breaches in the months and years to come. 

https://www.securitymagazine.com/articles/100785-beyond-the-breach-the-ongoing-fragility-of-healthcare-cybersecurity

Giu 13, 2024 Marina Londei News, Phishing, RSS 0

---

Un ricercatore di sicurezza, conosciuto sul web come mr.d0x, ha rilasciato un toolkit per realizzare operazioni di phishing sfruttando le Progressive Web App (PWA).

Le PWA sono applicazioni create con tecnologie web come HTML, CSS e JavaScript che possono essere installate sul dispositivo in modo da avere un comportamento molto simile a quello nativo. Il problema, spiega il ricercatore, è che è possibile manipolare l’interfaccia utente per eseguire attacchi di phishing, con l’obiettivo di sottrarre le credenziali inserite.

Quando la vittima accede al sito web controllato dall’attaccante può cliccare sul pulsante “Installa come applicazione Microsoft” per scaricare e installare l’app sul proprio dispositivo. Dopo l’installazione, l’app fa navigare l’utente su una pagina web di phishing che presenta un form di login. A questo punto l’attaccante non deve far altro che raccogliere le credenziali inserite e usarle per altri scopi.

Il ricercatore ha condiviso il codice del toolkit su GitHub per permettere a chiunque di modificarlo e adeguarlo ai propri scenari di test.

Contattato da Bleeping Computer, il ricercatore ha spiegato che gli utenti che non utilizzano le PWA potrebbero essere più esposti a questo attacco perché non sanno che le applicazioni di questo tipo non dovrebbero avere una barra degli URL. “Anche se Chrome sembra aver preso provvedimenti contro questo problema mostrando periodicamente il dominio reale nella barra del titolo, credo che l’abitudine delle persone di “controllare l’URL” renderà questa misura meno utile” ha aggiunto il ricercatore.

Mr.d0x ha anche specificato che oggi quasi nessun programma di cybersecurity menziona le Progressive Web App come un meccanismo di phishing e che la mancanza di familiarità degli utenti con queste applicazioni potrebbe rendere la tecnica molto efficace. “Vedo questa tecnica usata dagli attaccanti per chiedere agli utenti di installare un software e poi nella finestra della PWA avviene il phishing” ha concluso mr.d0x.

---

---

---

https://www.securityinfo.it/2024/06/13/creato-un-toolkit-per-il-phishing-tramite-progressive-web-app/?utm_source=rss&utm_medium=rss&utm_campaign=creato-un-toolkit-per-il-phishing-tramite-progressive-web-app

The Microsoft Threat Analysis Threat Center reports that a sophisticated Russian disinformation campaign is attempting to undermine the Paris Olympic Games. These campaigns are also targeting France, French President Emmanuel Macron and the International Olympic Committee (IOC). 

The report states that two Russian disinformation groups are at the heart of this campaign: Storm-1679 and Storm-1099. As the Olympics draw closer, it is likely that the actions of these disinformation groups will increase in intensity. 

Secuity leaders weigh in

Patrick Tiquet, Vice President, Security & Architecture at Keeper Security:

“The recent Microsoft report underscores the significant cyber threats posed by Russian actors to the Paris Olympics. By combining AI capabilities with all the other tools in their arsenals, threat actors could unleash a multifaceted assault involving anything from sophisticated misinformation campaigns to cyber espionage and even potential disruptions to critical infrastructure. However, while these threats loom large, they also present an opportunity for event organizers to bolster their cybersecurity defenses. By embracing advanced encryption methods, implementing stringent access controls and conducting regular security audits, organizers can effectively mitigate many of the risks being posed to the Games.”

Patrick Harr, CEO at Pleasanton, Calif.-based SlashNext Email Security+:

“Emotions run high during high profile events, such as the Olympics, and hackers will quickly take advantage of the predictability of fans falling prey to malicious content that leads to data breaches. With this popular sporting event, it’s easy for hackers to prey on the excitement. 

“The sophistication of phishing threats is becoming more difficult to detect, especially for users. With the Olympics nearly upon us, Olympic-themed phishing sites will pop up to steal credentials for future corporate-based attacks or commit credit card fraud. Organizations must educate their employees and, most importantly, be proactive in securing BYOD. With the increased use of BYOD and dual-purpose devices, it’s important to avoid giving away login credentials or accidentally adding malicious browser extensions which can be used to breach corporate assets.

“Protect your organization by encouraging users to exercise extreme caution when participating in anything related to the Olympics. Most importantly, have the right security tools in place, including real-time mobile, browser and email security solutions.”

Andrew Harding, Vice President, Security Strategy at Menlo Security:

“I’ve worked on the cyber defenses associated with the Olympics in the past, and the kind of attack varies. The focus has tended to be on the newest technology or the weakest area of defense. In the Beijing 2008 Olympics, there was concern about Wi-Fi being compromised — and over privacy. In Soichi, during the 2014 Winter Games, sophisticated network defenses protected the games-related infrastructure — and the Russian government monitored all web traffic to defend against terrorist threats. While these defenses prevented attacks, some objected to the monitoring, retention and analysis of all that user data. But the worries many had over DDoS attacks on the games were largely managed with effective defenses. Much has changed in the last four to eight years.

“As threat actors have adopted more adaptable and evasive techniques, I worry that traditional controls might not be able to stop phishing attacks and ransomware delivery. Without a secure enterprise browsing a solution, impostor web sites or sites that smuggle malware onto computers or phones can slip through defenses. Research from Menlo shows these attacks increasing greatly, and it’s supported by the Cisco Talos Threat Intelligence, which shows that these tactics increased 20% in the first half of 2024. Any target of consequence has to worry about these new tactics. Whether the goal is notoriety to advance a cause or financial cybercrime, targets don’t get much bigger than the Summer Olympics. As in past games, private companies and governments must work together to prevent a cyberattack, but it’s worrisome that new tactics have emerged and are growing in use and effectiveness as we approach such an important event. 

“The scale and significance of the event make it an attractive target for cybercriminals, hacktivists and even nation-state actors. Therefore, robust cybersecurity measures are essential to safeguard the integrity, security and smooth functioning of the Olympic Games.”

JT Keating, Senior Vice President of Strategic Initiatives at Zimperium:

“Today, mobile security and education in the enterprise is more crucial than ever. In most cases, mobile devices represent a significant, unaddressed attack surface for enterprises. No matter if they are corporate-owned or part of a BYOD strategy, the need to implement proper security controls and educate end-users about potential threats is critical.

“Without defenses in place to stand up against these growing threats — especially during events like the Olympics — enterprises and their employees are left at risk. However, education is only part of the solution. Attackers are becoming increasingly sophisticated and are always developing new tactics and techniques to undermine employees that have undergone some level of anti-phishing training. Technology is available today that can help fill in the gaps, minimizing the risk and attack surface presented by threat actors.

“As technology evolves to address new business challenges and needs, the modern mobile era has ushered in a new category of security to help combat current threats. Organizations can and should continue to use Mobile Device Management (MDM) — but only if they are tying it to a Mobile Threat Defense (MTD) solution, which can detect and prevent mobile device, network, phishing and malicious app attacks.”

https://www.securitymagazine.com/articles/100784-russian-disinformation-campaign-attempts-to-disrupt-the-paris-olympics

Security professionals angling for top jobs in the industry often focus on the role of Chief Security Officer. Is that the best job search strategy? 

The job title “Chief Security Officer” became an ANSI standard in 2009 and has been revised on occasion to refine and update responsibilities. Developed by ASIS International, the original concept of the CSO role envisioned the position as having responsibility for the strategy and governance of security related risks facing organizations. The standard supported the concept of convergence with the role serving as a single point of accountability in pursuit of a broader view. 

While some companies do have converged security programs, it is also common to have a separation between the corporate security function and that of information- or cyber-security. The CSO might have a broader mandate while the Chief Information Security Officer, or CISO, might be more narrowly focused. 

But is a CSO or CISO always the senior-most security role? Job titles vary widely across organizations and not every top security job is a CSO. Naming conventions differ across industries and that adds to the mix. Someone looking for a senior security role will find more opportunities by casting a wider net instead of searching only for a job titled CSO or CISO. 

For instance, the top security job in one company might be considered a vice-presidential role while in another, it could be simply titled “Security Director.” Organizations often have naming conventions for positions. Job titles are kept in parity with other departments in the company and may not be an exact reflection of the responsibilities of roles. CSO might not be a job title they can use. 

It is also helpful to research the reporting relationships in companies you are interested in working for. Gain an understanding of where the security function reports within the organization. The top security job could report to the CEO or board of directors. Or it might report through the legal or information security organization chart. 

And do not be surprised if the role you are interested in is not “global.” Job titles that have the word “global” are not always accountable for worldwide programs. Very often the term simply means the position is part of the organization’s global security program. Your responsibilities may be local or regional while being part of the worldwide program. 

More variations on the top security job title occurs on social media job search platforms. Very often companies who post jobs there are instructed to simplify their advertised job titles to fit within specific algorithms the platform’s software uses to match candidates to positions. This makes it difficult to identify what level a job is or what its actual accountabilities are. 

Recognition that organizational and cultural changes are ongoing will help you be open to more job opportunities. 

The success of any senior security executive is not necessarily measured by job title. Instead, it is your ability to build credibility with leadership and positively affect the security and risk management programs of an organization. Regardless of what your title is. 

https://www.securitymagazine.com/articles/100771-do-security-job-titles-affect-your-job-search-strategy

Security is known to be a fast-paced field, and security leaders often find themselves in vastly different positions than they held a few decades ago. Oftentimes, this includes a shift between public and private sector careers. Two security leaders discuss their experience moving out of public security and law enforcement and into the private sector.

Scott Ashworth, Global Security and Resilience Leader at Google

Transitioning away from law enforcement proved to be a challenging decision. With a deep passion for my work, especially as a young Investigations Lieutenant experiencing a rapid ascent, I found myself at a pivotal crossroads. It was a moment where I grappled with the choice of either capitalizing on the momentum of my career within the force or strategically shifting gears into the corporate realm. 

My decision to shift careers stemmed from a desire for new challenges and opportunities for growth. After years of serving in law enforcement, I felt the need to explore a different avenue where I could apply my skills and expertise in a new context. Corporate security presented itself as the perfect blend of my law enforcement background and a fresh professional environment. 

One of the most significant challenges I faced during this transition was adapting to the corporate culture. Law enforcement operates within a strict hierarchical structure, whereas corporate environments often emphasize collaboration and flexibility. Learning to navigate this change required me to cultivate a new set of interpersonal skills and adopt a more nuanced approach to leadership. 

However, my experience in law enforcement provided me with a solid foundation for success in corporate security. The critical thinking, problem-solving and crisis management skills honed in the field are invaluable assets in the corporate world. My ability to remain calm under pressure and make quick, informed decisions has proven invaluable in handling security threats and emergencies within a corporate setting. 

Furthermore, my background in law enforcement has equipped me with a deep understanding of risk assessment and mitigation strategies. Whether it’s implementing access control measures, conducting security audits or developing emergency response protocols, my law enforcement experience has been instrumental in designing comprehensive security solutions tailored to the unique needs of corporate environments. 

Transitioning from law enforcement to corporate security has also allowed me to leverage my expertise in law and regulations to ensure compliance with legal requirements and industry standards. From overseeing internal investigations to liaising with law enforcement agencies, my legal background has been an asset in maintaining the integrity and security of corporate operations. 

Moreover, the transition has provided me with the opportunity to broaden my professional network and collaborate with individuals from diverse backgrounds. Building relationships with stakeholders across departments has not only enhanced communication and collaboration but also enriched my overall professional experience.

In hindsight, while the transition from law enforcement to corporate security posed its challenges, it has been a rewarding journey of personal and professional growth. My background in law enforcement has provided me with a unique perspective and skill set that I’ve successfully applied to my roles in protecting professional athletes and now leading tech industry security teams to ensure the safety for the staff and customers of a Fortune 10 company. As I continue to navigate this dynamic field, I’m excited about the opportunities for further learning and development that lie ahead.

Ryan Schonfeld, Founder & CEO, Hivewatch

Being a police officer was one of those childhood dreams of mine, where I decided in first grade and never wavered from there. I entered the police academy after college and began specializing in fraud-related crimes, but one thing that frustrated me was how far behind we were from the criminals we were trying to apprehend. Ultimately, that frustration led me to a master’s degree in IT and system design and eventually led me to focus efforts on addressing computer-related crimes. 

My career led me to work for the U.S. State Department as a consultant where I was sent overseas and tasked with training law enforcement. I realized then that there were a lot of opportunities in the private sector that were law enforcement-adjacent that still revolved around helping people and solving big problems without having to physically fight people and take on more risk. 

My later career took me to a large guarding company, where I was tasked with learning how to use technology to make our jobs more efficient. Later, when I ran Global Security Technology for Fox Entertainment, the technology around building a cohesive command center was my focus and I began to realize the growth the industry still needed. Through building a consulting firm dedicated to helping security professionals navigate the technology side of the business and later starting a software company, HiveWatch, each step in my public sector career has allowed me to build on the knowledge base I have and continue to grow. 

As more and more law enforcement officers contemplate a transition, the question of tenure, retirement, and pensions becomes top-of-mind. What I’ve found is that the private sector offers more opportunity for growth, better compensation and benefits packages, and potentially can give you more long-term growth and earnings comparatively. 

It’s also a way to build something that the world needs. If you’re interested in entrepreneurship, go do it. Find an idea and make mistakes. No one gets it completely “right” the first time and making mistakes and figuring things out is part of the amazing journey and the process of creating change. 

The bottom line is: whether you’re looking to transition or contemplating life after law enforcement, there’s fun, excitement, and a need in the private sector. Start to build your network through platforms like LinkedIn, have conversations about the state of security or public safety, and leverage the vast amount of knowledge you have to begin your journey. 

https://www.securitymagazine.com/articles/100770-how-law-enforcement-can-prepare-for-a-career-in-the-private-sector

The Occupational Safety and Health Administration (OSHA) has determined that a crane and rigging services provider violated federal law by firing a company truck driver on June 5, 2020, for refusing to exceed safe driving limits set by the Federal Motor Carrier Safety Administration.

An investigation determined the driver employed by Crane Masters Inc. told their employer that, after working 19 hours on June 4, 2020, it would be unsafe for them to operate a commercial vehicle as they had not gotten the legally required amount of time off before returning to work. The Houston company responded by terminating the driver.

OSHA found the company fired the employee illegally for exercising their protected rights under the federal Whistleblower Protection Program, and the department’s Regional Solicitor in Dallas presented its case during a formal hearing in Houston on Oct. 14, 2022.

On May 13, 2024, the judge issued a decision upholding OSHA’s findings and ordered Crane Masters to pay the former truck driver $14,945 in back pay, interest and compensatory damages. The company must also expunge the former employee’s record and post a notice to employees.

https://www.securitymagazine.com/articles/100788-osha-determines-construction-whistleblower-was-wrongfully-terminated

KnowBe4 has released its 2024 Phishing by Industry Benchmarking Report. This report measures the likelihood that an organization’s employees would fall for a phishing or social engineering scam, assessing the status of security preparedness and awareness across global industries such as government, healthcare and critical infrastructure. 

54 million simulated phishing tests were analyzed in the report. These tests involved more than 11.9 million individuals from 55,675 organizations across 19 industries. Through this analysis, the report found that without security awareness training, 34.3% of users were likely to click on malicious links or follow through with scam requests. When phishing tests are integrated into regular security awareness training, organizations see this number decline to 18.9% within 90 days. After a year of regular training, it declines to 4.6%. 

The report reinforces the importance of managing the human element in order to properly secure an organization. 

https://www.securitymagazine.com/articles/100781-untrained-users-are-the-greatest-weakness-in-a-cyber-defense-plan