Marsh McLennan Director Shares Advice on CTI Teams, Vendor Breaches and Information Sharing
Summary
Casey Beaumont of Marsh McLennan discusses reducing incident-response friction through unified leadership, assessing vendors after breaches, and the value of information-sharing communities for cyber threat intelligence.
Key points
- Beaumont says unified leadership across CTI, threat hunting, red team and incident response can reduce resource-allocation delays and duplicated work during incidents.
- She advises against automatically disqualifying vendors after a breach and recommends asking what control gaps led to it, whether attackers gained persistence, whether Marsh McLennan data was exposed or exfiltrated, and how the vendor is addressing gaps.
- Beaumont says smaller organizations can gain leverage and support in vendor breach discussions through information-sharing groups such as FS-ISAC.
- She recounts that a personal connection tipped her team off about Scattered Spider registering domains shortly before the group began targeting colleagues’ personal cell phone numbers.
- Beaumont emphasizes that CTI analysts benefit from building knowledge-sharing networks, beyond relying on tools.
Article Details
- Topic
- Reducing organizational friction in cyber threat intelligence through unified leadership, vendor breach assessments, and information-sharing communities