Nick Galbreath

OCR Director Defends HIPAA Updates: "There's a very high cost of doing nothing. A successful cyberattack can cost far more in terms of reputation, potentially paying a ransom, remediation of information systems, protection for those whose PHI was accessed, potential civil lawsuits from harm to individuals, and not to mention my investigators coming and knocking on your door and asking for information and talking about penalties." https://hubs.ly/Q04793ML0

1

One shortcoming in the #A2A spec, is that the spec assumes that there is a one to one correspondence between a "server" (that is, a "physical server instance" with a port number and some process listening) and an Agent. So if you request http://somehost:8080/.well-known/agent-card.json you get the ONE and ONLY AgentCard for that server... which defines ONE Agent. Now obviously one can serve multiple Agents from a Server, so this seems... sub-optimal. So far all the A2A project people have said is "Put each Agent's AgentCard on a different port" (Uuuuggh... does not scale and is a PITA to manage) or "use different context paths" (which strictly speaking breaks the ".well-known" semantics). There are a variety of proposals out there for how to address this. I'd love to see them simply allow .well-known/agent-card.json to return a array of AgentCards OR at least define .well-known/agent-cards.json or .well-known/agents.json to return such an array. But short of that, a solution I quite like, and am knee deep in implementing, is to simply NOT change the spec at all, and just make the "root" Agent an "AgentListerAgent" if there are multiple Agents on the server. In my vision, this Agent has an AgentCard listing skills like "list_agents", "search_agents", "get_agent_by_name" and so on, which do exactly what they sound like they would do... and in either case, triggering those skills would return an array of AgentCards for the cases where multiple matches are possible. The downside is that this adds one extra step to the handshake, but the upside is that it requires no change to the existing spec, and natively uses A2A to solve the problem. The other thing about this, is that it also cleanly supports the case where the "AgentListerAgent" can return Agents that are *not* actually hosted on the current Server instance. That is, if it were the front-end to, say, an #AgentRegistry of some sort. Then it would return AgentCards that point to any Agent registered with the Registry. (Note: the description of each individual Agent in its AgentCard defines how to reach it. Of course you could munge that up if you, say, know that the Agent is behind a proxy of some sort and you know the "real" route to the Agent). #AI #Agents #AIAgents #AgentRegistry #AgentCard #MultiAgentSystems

1

Website cloning attacks are a form of digital impersonation where threat actors replicate a company’s legitimate website to deceive users, harvest credentials, or redirect payments, often before enterprises even realize a clone exists. These attacks exploit brand trust at scale, turning familiarity into a weapon against customers. Continue reading https://lnkd.in/e5DXPwQy

8

In this episode of IT SPARC Cast - CVE of the Week, Louis Schmidt and I examine a critical Apple security vulnerability patched in iOS, iPadOS, macOS, watchOS, tvOS, and visionOS 26.3. The focus: CVE-2026-20700, a memory corruption flaw in Apple’s dynamic link layer that could allow attackers to break out of the sandbox and achieve remote code execution (RCE). Although exploitation requires physical access, the definition of “physical” in today’s hybrid enterprise world is broader than it sounds. Remote management tools, compromised accounts, lost devices, or improperly secured BYOD endpoints can all create real-world exposure. With Apple’s unified “26” operating system line now spanning every platform, this patch affects: • iOS 26.3 • iPadOS 26.3 • macOS 26.3 • watchOS 26.3 • tvOS 26.3 • visionOS 26.3 Security researchers are classifying this vulnerability as critical/high severity, and enterprises are urged to patch immediately. ⸻ 🔎 CVE-2026-20700 Details • Type: Memory corruption • Impact: Sandbox escape → Remote Code Execution • Exploit Path: Physical or logical device access • Risk Level: High/Critical (no official CVSS published) • Fix: Upgrade to Apple OS version 26.3 ⸻ ⚠ Why This Matters for Enterprise IT 1️⃣ BYOD Risk Surface Bring-Your-Own-Device policies mean iPhones, iPads, and Macs often connect to corporate networks without full administrative control. A vulnerable device on your network increases lateral movement risk. 2️⃣ Physical Access Isn’t Just “Someone in the Room” Remote tools, compromised Apple IDs, or stolen devices expand the meaning of physical access. 3️⃣ Upgrade Hesitation Is Real Apple’s 26 release introduced major UI changes (including the controversial glass interface). Stability concerns have led some users to delay upgrades — increasing exposure time. Security must outweigh aesthetic or usability concerns. ⸻ 🛠 Enterprise Recommendations • Immediately communicate required upgrade to 26.3 • Enforce OS minimum versions where possible • Review BYOD policies and mobile device controls • Audit Apple device access on corporate networks • Educate users about lost/stolen device risk Youtube Episode 25 - https://lnkd.in/ebEw_Zib  YouTube Channel - https://lnkd.in/eUFCpk8V   Apple Podcast Link - https://lnkd.in/eKDZpm93  Spotify Link - https://lnkd.in/ekEFx_KE  Amazon Podcast Link - https://lnkd.in/ekPB4Pqa Acast Link - https://lnkd.in/ehDHfztt 

3

Sick SOC: A Practical Checklist of Symptoms! That SOC that looks operational (alerts, dashboards, tools) but lacks strategy, visibility, and repeatable response, so it quietly fails. Yeah… that’s called a sick SOC. I love the term “Sick SOC” — framed by Reza A. in his article, highlighting key metrics and warning signs that indicate your SOC isn’t operating at its best quality. • Strategic misalignment • Process & governance breakdown • Visibility & detection gaps • Knowledge & capability gaps vs threats • Architecture & technical implementation flaws • People & culture You can’t cure a sick SOC with more alerts; you cure it with clarity, coverage, and capability: https://lnkd.in/g9k63pfF If you want to make that checklist more “complete” and more usable in real SOC assessments, I’d add these categories: • Service management + customer alignment (SOC as a product) • Detection engineering lifecycle  • Data quality management (not just “data sources”) • Identity-centric operations (where modern incidents live) • Resilience + readiness • Third-party / supply-chain visibility I don't know what you heard about me! I practice, test, learn in public, and share what actually works ... daily and free! Threat hunting 101 series on YouTube: https://lnkd.in/g7D4pTVk Daily Cyber Drops on Medium: https://lnkd.in/gsekf7kB Nothing Cyber. Keep hunting. #cybersecurity #threathunting #threatdetection #opensource #tips #career #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #dataanalysis #incidentresponse #ai

31

2 Comments

Apple has announced it will support Merkle Tree Certificates for PQC and has released a draft root store policy. Jason Soroko and I share some of the surprising requirements in this draft on the Root Causes Podcast. https://lnkd.in/gDEmUnB7

18

493 out of 494 SOC 2 reports. Nearly identical. Same paragraphs. Same grammatical errors. Only the company name changed. That was Delve. A $300M compliance producing copied audit reports at scale. Hundreds of companies are now trying to prove to their auditors that their compliance posture is actually real. This is the thing that nags at me. AI is going to write most of the code. And if that's true, the code should be the first thing you interview when building a compliance program. Not your engineers filling out spreadsheets. The code itself. We built TestifySec for this. Version 3.0 shipped last week. It reads your source code, your infrastructure, your CI/CD pipelines. Produces SSPs with citations down to the file and line number. Finds your data stores, identity services, crypto, cloud infra. Classifies boundaries and maps everything to NIST. Your engineers don't get tapped on the shoulder. Every build step is cryptographically attested with Sigstore and Archivista. Policies are enforced before deployment. Multi-provider AI code review (Claude, Gemini, Codex) runs on every PR and blocks merge on critical findings. The platform identifies gaps in your compliance posture and prioritizes them by authorization impact. We partner and integrate with most tools (including OSCAL), for example excel docs can be inputs or outputs. We also support and partner with GRC like Vanta and Secureframe so they get source-of-truth data pulled from your actual code and pipelines. If you got caught up in the Delve situation: send us your SOC 2 documentation. We'll run it against your codebase and show you where your compliance claims match reality and where they don't. 30 days of full platform access. Your auditors shouldn't have to take your word for it. Neither should you.

43

14 Comments

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment