CISA's 4-day deadline is a risk decision.
Threat: confirmed. Vulnerability: critical. Risk: unacceptable.
That is what precise vocabulary produces.
In your next security meeting, listen for how your team uses Threat, Vulnerability & Risk.
CISA on May 4 gave federal agencies 4 days to patch a CVSS 9.9 bug.
That decision was due to their understanding of three keywords.
Threat. Vulnerability. Risk
What does each word mean?
RISK: Likelihood × Impact for YOUR organisation specifically.
Not what could happen in the world but what could happen to you, given your exposure.
Examples:
→ Phishing = Threat
→ No security training = Vulnerability
→ Risk = probability × cost of breach
I shared CIA Triad tips all through the week. Now we move to the next phase. But before we go, here is a recap.
CONFIDENTIALITY
Only the right people see the right data.
Case: Medtronic; 9M patient records exposed.
Controls: RBAC, MFA, encryption, data classification.
AVAILABILITY
Systems must be accessible when needed.
Case: 313 Team DDoS; systems intact but businesses stopped.
Controls: redundancy, DR plan, DDoS protection.
ALL THREE TOGETHER
Case: PyTorch Lightning (April 30): credentials stolen, repos poisoned, pipelines down. Zero alerts.
NIST, ISO 27001, GDPR, SOC 2 and every GRC framework protect these three pillars.
#CIATriad#Cybersecurity#WeeklyRecap
That last one? Live proof.
PyTorch Lightning (April 30) stole credentials, poisoned repos, and disrupted pipelines from a trusted package. No internal alert.
These are not technical failures.
They are governance failures.
That is what GRC is built to fix.
A developers installed a package for a project. However, instead of just doing its job, it does more by stealing your cloud credentials in silence.
No alarm. No alert. No audit flag.
That is not hypothetical, it is what happened with the PyTorch Lightning attack this week.
6 ways your org violates the CIA Triad
1. Shared passwords: breaks Confidentiality
2. No version control: breaks Integrity
3. Untested backups: breaks Availability
4. Excessive privileges: breaks all three
5. Shadow IT: breaks all three
6. Unvetted dependencies: breaks all three
Building something from nothing is the hardest (and most rewarding) work there is. Happy #WorkersDay to everyone out there grinding to make their vision a reality. 🌍🚀
What are you building today? Drop it below! 👇 #MayDay#360ideas