Target Rich Cyber Poor

The session looks at a gap the speakers call target rich, cyber poor: hospitals, utilities and small businesses that support critical functions but have little or no dedicated security staff. The speakers said their no-cost vulnerability assessments kept finding the same weaknesses, and they mapped those findings to MITRE ATT&CK to show how attackers got in.

The middle of the talk walks through free federal resources that smaller organizations can use. The Known Exploited Vulnerabilities catalog and its update alerts come first, followed by Cyber Hygiene services for scanning internet-facing assets, the standalone Cyber Security Evaluation Tool for self-assessment, and state-based cyber advisors who can visit in person. The team also reviewed a short list of bad practices: unsupported software, default passwords and single-factor remote or administrative access. Audience members pushed for sector-specific guidance, business cases that let non-technical staff request budget, and matching volunteers with under-resourced organizations.

The takeaway is that free services exist but are underused, so organizations need to be persuaded that security is a business risk rather than an IT chore. The speakers suggested framing security as continuity and insurance for leadership, and building sector-specific playbooks, with practitioners in the room helping draft them.