Ken Fishkin, CISSP, CIPP/US

If you’re at the Zywave Cyber Risk Insights conference today, look for me! I’ll be joining a panel at 1:45 to discuss whether we’ve reached a critical mass yet with data to adequately model and manage #cyberrisk. https://lnkd.in/dK2d3HHe

13

1 Comment

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

Who attended our threat briefing with KPMG covering Scattered Spider's cloud and on-premise TTPs?? What did you think? If you weren't able to join us for the briefing, ping me and I can share the recording! Crucial for the community to know the TTPs we have identified to hunt for in your IaaS, SaaS, CI-CD, IDP environments. TTPs are increasingly being copied and used by other threat actors. DM me to see our Scattered Spider battle-tested Cloud Detection and Response (CDR) platform live in action or for details on our no-cost CloudSec Health Check (will uncover activity other solutions like CSPMs and SIEMs consistently miss)

1

It's September 25, 2024. Do you know where your organizations vulnerabilities are? Don't wait for a cyberattack to happen! Vulnerability assessments and remediation allow you to take a proactive approach to security, finding and patching vulnerabilities before they become problems. Contact HaltSec Security Services. We can help!!!

1

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

CrowdStrike Responds to Delta's Legal Threats Over Software Update Outage 💥 Cybersecurity firm CrowdStrike is pushing back against Delta Air Lines' legal threats following a recent software update that disrupted Delta's operations. In a strongly worded letter, CrowdStrike claims Delta misrepresented the situation and that it was Delta's own IT decisions that worsened the outage. CrowdStrike also states that they repeatedly offered assistance to Delta, including a direct offer from their CEO to Delta's CEO, but received no response. This public exchange escalates the tension between the two companies. It remains to be seen whether Delta will pursue legal action or if the companies can find a way to resolve this dispute. #cybersecurity #aviation #software #Delta #CrowdStrike #dispute https://lnkd.in/ezRb24cJ

6

4 Comments

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

2

🔐 CMMC Needs Clear SSO Rules: Here’s Why- Current CMMC, NIST 800-171/172, and FedRAMP lack explicit controls for Single Sign-On (SSO), creating critical security risks. The Problem ⚠️ No defined SSO boundaries ⚠️ Unrestricted third-party SSO poses risks ⚠️ Breach amplification and reduced visibility The Solution * Define SSO boundaries * Restrict SSO to vendor ecosystems * Align with Zero Trust principles The financial sector enforces strict SSO controls—shouldn’t defense systems do the same? 💬 What’s your take? Should SSO boundaries be mandatory in cybersecurity frameworks? #Cybersecurity #CMMC #NIST #DefenseIndustry #ZeroTrust #SSO #DoD #CISA #NSA

4

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Cybersecurity Snapshot: After Telecom Hacks, CISA Offers Security Tips for Cell Phone Users, While Banks Seek Clearer AI Regulations http://ow.ly/hKiE105WiMo

8

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

Compliance will often be positioned as adversarial to cybersecurity, but often it plays an important role in defining the reasonable and appropriate controls for risk reduction that should be implemented by cybersecurity teams. Thanks to Derrick Kean Auxtero for the great graphic to illustrate this point!

7

1 Comment