Cybersecurity Response Plan w/ Frank Grimmelmann of ACTRA - AZ TRT S06 EP03 (264) 2-9-2025

 

Cybersecurity Response Plan w/ Frank Grimmelmann of ACTRA

 

- AZ TRT S06 EP03 (264) 2-9-2025              

 

What We Learned This Week

• ACTRA Arizona Cyber Threat Response Alliance
• Cyber threats affect everyone from Gov’t to business to private and growing
• Companies need to be responsive with speed to be effective + share information of attacks
• ACTRA has members from both government and private sector
• ACTRA helped create a state cybersecurity response model that other states can use

 

 

Guest: Frank Grimmelmann

https://www.actraaz.org/actra/leadership

President & CEO/Intelligence Liaison Officer

 

Mr. Grimmelmann also serves as Co-Chair (together with Arizona's Chief Information Security Officer) for the Arizona Cybersecurity Team (‘ACT’), created through the Governor’s Executive Order signed in March 2018. He also serves as a Founding Member of the National Leadership Group for the Information Sharing & Analysis Organization Standards Organization (‘ISAO SO’) at the University of Texas San Antonio (UTSA), created under the President’s Executive Order 13691 in February 2015. As ACTRA’s leader, Mr. Grimmelmann was invited as the first private sector representative in the Arizona Counter Terrorism Information Center (ACTIC) and served as its first private sector Executive Board representative from 2014-2019. He presently acts as ACTRA’s designated private sector liaison to ACTRA’s Key Agency and other non-Member Stakeholders. 

 

Mr. Grimmelmann served four terms as AZ InfraGard’s President from 2009-2012, serves today on numerous academic advisory boards, co-Chairs the Greater Phoenix Chamber's Cybersecurity Workforce Collaborative initiative, and is an engaged Member of the Arizona Technology Council’s Cybersecurity Advisory Board.  In 2019, Mr. Grimmelmann was honored by the FBI, and the Board of Directors of both ACTRA and Arizona InfraGard as the first recipient of Arizona InfraGard’s ‘Visionary Award’ for creating the ACTRA framework  over his last 2 terms as Arizona InfraGard’s President, and ACTRA's resulting collaboration between law enforcement/ intelligence agencies/USCYBERCOM, and its public, private and academic organizations over the past 7 years.   He was simultaneously recognized by the FBI’s then Deputy Director for his contribution over the years. He remains an active Member of InfraGard since 2003 and an active Lifetime Member of the FBI Citizens Academy since 2006.  

Since 2002 he has devoted his full-time attention to protecting our nation’s critical infrastructure and national security interests, through eliminating unnecessary silos that hinder communication, allowing  us to respond to today's increasing threat from our cyber adversaries, and in turn permitting ACTRA's Member Organizations to protect their critical infrastructure and our national security interests, while protecting their organization's assets .  

Educationally, he holds a dual MBA in International Business and Finance from the University of California at Berkeley and brings decades of experience as a senior executive in finance, healthcare and government, prior to focusing on Cybersecurity in response to 9/11.   

 

 

 

Notes:

 

Seg 2

 

Cyber threats affect everybody, business, personal, and government.

Cyber crime is a fact of life that we need to live with it, but stay ahead.

 

Criminals are on the offense and only have to be correct 1% of the time.

Everybody else is playing defense and has to be right 100% of the time.

 

AI is an advanced tool that is turned out to be a two edge sword, can help and hurt.

AI can only catch so much but can give a few of what is going on.

 

This is a matter of national security, dealing with homeland security and many other departments of the government.

 

You have threat intelligence to determine roles on how you’re going to handle hackers and ransom ware. Hackers can be local or foreign.

 

All companies need a cyber policy and some sort of rapid tactical response.

 

Cyber attacks are an ever growing threat to people and businesses, and continue to surge in 2024. There was 107% surge in malware attacks.

 

These are on corporate computers, computers at work or home computers or even Home devices like Ring. You get a text through devices, phishing attacks.

 

Company business email can be compromised in an attack, people’s passwords come out and it leads to millions of dollars in losses.

Elderly people are very vulnerable, 353,000 attacks.

 

You have supply chain threats by terrorist and nation state actors. There was a recent attack on United Healthcare for 100 million. People‘s information was exposed. This led to a $22 million ransom payment.

 

Cyber attacks cause $2.9 billion in damages. Companies are paying ransom to faceless criminals. Very tough for the FBI to be tracking down on these criminals and try to fend off the extortion of stolen data.

 

Payments for ransom could be made through Bitcoin, which is difficult to trace, though it leaves somewhat of a forensic trail. Constant need for regulation and oversight from the government.

 

Famous incident last year was not even an attack, but the Crowdstrike software update. ACTRA had a quick response that day. One that helps clients and partners recover fast. In a similar instant, Delta was down for weeks with computer problems.

 

When you think about what goes on with banks back to 2008 - what loans they have on balance sheet and then off balance sheet securitized - not regulated like normal loans.

 

Issues with underwriting standards on loans. Not even sure what can be affected in a Cyber attack. Off balance sheet loans and debt is similar to crypto or Bitcoin where it is not being regulated.

 

PPD-41 was a directive to show responsibilities of government agencies and dealing in cyber. You had homeland security as a defensive arm to protect the nation’s assets.

 

Enforcement is done in the US by the FBI. Overseas it’s done by US Cyber Command.

 

 

Seg 3

 

Frank background in the 1990s in private business, worked in healthcare. Then was the chief info officer and the only 2000s at clinical in Stanford. Healthcare is very vulnerable.

 

Post 9/11 he worked with FBI outreach program called InfraGuard on how to share intelligence with cyber threats. Needs to be treated like terrorism or criminal acts, though they’re taking stolen IP. Need to move to a more stable world.

 

2011 study was done by government organizations to review the process and make recommendations on how to deal with counterterrorism and cyber.

 

90% of the critical infrastructure in the US is in the private sector. They do need Fed level help, but have also have a local response. Cyber threat actors move quickly and act like a terrorist organization.

 

General Stanley McChrystal had a great quote,

‘It takes a network to defeat a network.’

Cybersecurity is everyone’s problem. You need education and organization.

This is a 5th generation problem and you have to be adaptive.

 

ACTRA is a nonprofit dealing with cyber security. They’ve got pillars of empowerment, trust technology and intelligence. Need for the private companies to develop to train and recruit to handle this threat.

 

They created a model which allows to bring the fight on offense - and all work together sharing information. Virtual response team, small and big with the private sector as a partner.

 

ACTRA is a hub for info, and keeps its member information private.

Some members are public like Arizona State. Actual model can be used for the rest of the nation. Government and private cannot do it alone.

Not all states have this type of organization, but probably need it.

 

 

Seg 4

 

ACTRA started in January 2013. Give U.S. states a model for cyber security.

Collective defense and share information with public and private organizations.

The goal is to breakdown silos between government and the corporate world.

 

Not just a thing tank, has an active model. Review of ACTRA model is best in the country and a good hub for response and info.

 

In 2015, they helped Wisconsin create their own state organization for cyber threats. Soon after, Maryland created one using ACTRA as a model. Needs to be an effort of collaboration, merge the construct of entrepreneur spirit to take action.

 

So the government cyber threats are handled nationally at a Fort Meade, where the NSA is.

 

Frank’s background in business in finance and healthcare fields.

 

Info is useless if not used for action. You need actionable intelligence that is current to take down a threat. You need more than continuing education and certificates for people, must go beyond this.

 

Virtual response team like a local militia who can help protect assets. Going after cyber criminals can be a little bit like a whack a mole.

 

Overtime, hopefully there will be a national strategy for info sharing. A type of decentralized and local organization that work with government.

 

The private sector owns the vast amount of data so they have to determine who they’re going to share it with and how.

 

Defend vs Cyber fast while still working within the spirit of the law.

 

 

 

Seg. 1

Clips from Related Shows:

Cybersecurity, Disruption, Blockchain & Terrorism w Ari Redbord of TRM Labs

- BRT S02 EP31 (78) 8-1-2021

 

 

What We Learned This Week

• Cybersecurity is extremely important industry for national security
• TRM Labs startup in cyber-security, monitors blockchain
• OFAC - Gov’t administers economic and trade sanctions
• Ransomeware – specific breach, takeover of a computer system, holds data hostage

• Programatic Money Laundering – bad guys create new addresses, create ‘shell’ companies

 

Guest: Ari Redbord, Head of Legal and Government Affairs w/ TRM Labs

https://www.linkedin.com/in/ari-redbord-4054381b4/

https://www.trmlabs.com/post/trm-labs-appoints-ari-redbord-as-head-of-legal-government-affairs

 

Ari is formerly a US Attorney, and worked in the Treasury Department, now advises the Government on cybersecurity, and Blockchain.

Cybersecurity is a fast growing and extremely important industry for national security, and corporate interests. There are Nation States acting as bad players in the cyber realm and targeting the US Government and US business. We discuss the advancements in technology on cyber crime, blockchain, crypto, and online fraud.

How is the FBI dealing with Ransomware, and other cyber attacks on prime targets like the Colonial Pipeline, or other big corps. What Regulations are coming in banking, and Fintech, with KYC (Know Your Customer), plus the big banks like JP Morgan Chase and Goldman are on board. 

What the blockchain ledger can help solve in security, to monitor criminal activity in real time with the help of crypto exchanges like Coinbase.  Lastly, what TRM Labs does for clients, how they advise, operate, and who they work with.

 

Full Show: HERE

 

 

Phishing, Malware & Cybersecurity - Try Not to Get Pwned

- BRT S02 EP47 (94) 11-21-2021

 

What We Learned This Week:

 

• Have I been Pwned? Means have I been breached / hacked – did someone hack my email or website
• Phishing – most common type of email threat, like when you receive a strange email with a link – Do Not Open – DELETE (and alert other office staff of the email)
• Ramsonware – hack your website, or data – hold it hostage for an extortion ‘ransom’ payment
• Dark Web – where stolen data, & info is being bought & sold
• VPN Connections – direct and secure

 

Guests: Vince Matteo, Seven Layer Networks, Inc.

https://sevenlayers.com/

Vince Matteo is a certified penetration tester, a security researcher, and a senior consultant at Seven Layers (.com) where he focuses on securing small businesses.  Vince is the author of "Hacking 101 – A Beginner’s Guide to Penetration Testing", he's a bug bounty hunter with 17 published critical vulnerabilities, and he's presented talks on offensive hacking at security conferences -- most recently GrrCON in Grand Rapids, MI and BSides in College Station, TX.  Outside of work, Vince is an accomplished endurance athlete, an Ironman age group champion, and in his spare time, you can find him in the desert -- training for the next hundred-mile ultramarathon. 

 

Full Show: HERE

 

 

Biotech Shows: https://brt-show.libsyn.com/category/Biotech-Life+Sciences-Science

 

AZ Tech Council Shows: 

https://brt-show.libsyn.com/size/5/?search=az+tech+council

*Includes Best of AZ Tech Council show from 2/12/2023

 

Tech Topic:

https://brt-show.libsyn.com/category/Tech-Startup-VC-Cybersecurity-Energy-Science 

Best of Tech: https://brt-show.libsyn.com/size/5/?search=best+of+tech

 

‘Best Of’ Topic: https://brt-show.libsyn.com/category/Best+of+BRT

 

  

Thanks for Listening.

Please Subscribe to the AZ TRT Podcast.

 

 

AZ Tech Roundtable 2.0 with Matt Battaglia

The show where Entrepreneurs, Top Executives, Founders, and Investors come to share insights about the future of business. 

AZ TRT 2.0 looks at the new trends in business, & how classic industries are evolving. 

Common Topics Discussed: Startups, Founders, Funds & Venture Capital, Business, Entrepreneurship, Biotech, Blockchain / Crypto, Executive Comp, Investing, Stocks, Real Estate + Alternative Investments, and more… 

 

AZ TRT Podcast Home Page: http://aztrtshow.com/

‘Best Of’ AZ TRT Podcast: Click Here

Podcast on Google: Click Here

Podcast on Spotify: Click Here                   

More Info: https://www.economicknight.com/azpodcast/

KFNX Info: https://1100kfnx.com/weekend-featured-shows/

 

 

Disclaimer: The views and opinions expressed in this program are those of the Hosts, Guests and Speakers, and do not necessarily reflect the views or positions of any entities they represent (or affiliates, members, managers, employees or partners), or any Station, Podcast Platform, Website or Social Media that this show may air on. All information provided is for educational and entertainment purposes. Nothing said on this program should be considered advice or recommendations in: business, legal, real estate, crypto, tax accounting, investment, etc. Always seek the advice of a professional in all business ventures, including but not limited to: investments, tax, loans, legal, accounting, real estate, crypto, contracts, sales, marketing, other business arrangements, etc.