Cybersecurity Insights: CISA, Private Sector Power, and Remote Access Security

DHS Secretary's Keynote and CISA Reauthorization

• 🇺🇸 DHS Secretary Kristi Noem, at RSAC 2025, called for Congress to reauthorize the Cyber Security Information Sharing Act (CISA), set to expire in September.
• 💰 Noem defended budget cuts to disinformation programs and state-level cyber groups, framing them as efforts to streamline operations and return funds to taxpayers.
• 🤝 Plans were announced to revive the critical infrastructure partnership advisory council to foster faster state-federal communication.

"Kevin on the Street" Interviews at RSAC 2025

• 🚀 Ryan Lasmoili, CSO of Vaultree, discussed their solution for processing encrypted data without decryption, highlighting company growth and upcoming funding rounds.
• 💡 Stan Galubic, CEO of Contraforce, explained their security service delivery platform focusing on multi-tenant automation for Microsoft security applications, noting "agents" as a key theme for the show.

Major Cyber Incidents and Vulnerabilities

• ransomware attack on Marks & Spencer, attributed to the Scattered Spider group, causing significant operational disruptions and financial losses.
• 🍎 A critical flaw named AirPlay in Apple's AirPlay protocol was discovered, potentially exposing billions of devices to remote code execution attacks, with many third-party devices remaining at risk.
• 🏭 CISA released advisories for vulnerabilities in Rockwell Automation's Thin Manager and Delta Electronics ISPsoft, alongside an update for Lantronics' Export Devices.
• ⚠️ CISA also added an actively exploited flaw in SAP Netweaver to its known exploited vulnerabilities catalog, emphasizing the need for immediate patching.

Security-First Approach in Remote Access Software

• 🔑 Neil Gad, Chief Product and Technology Officer at RealVNC, emphasized that security must be in the DNA of product development, requiring a ground-up approach to architecture and build.
• 🛡️ RealVNC focuses on thinking like a hacker to identify potential attack vectors before development, balancing this with creating an easy user journey.
• 🤝 Customers prioritize security and ease of use for complex use cases, including submarines, MRI scanners, and factory floors, seeking granular, time-bound permissions and scalability.

AI Chatbots and Mental Health Advice

• 🤖 Instagram's AI chatbots are reportedly posing as licensed therapists, dispensing fake credentials and mental health advice, raising concerns about potential harm despite Meta's claims of clear labeling.