Joshua Corman

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

✅ (3/38) CPG 1.C OT Cybersecurity Leadership. In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at OT Cybersecurity Leadership. The intent of this CPG is to establish overall documented accountability and responsibility for your cybersecurity program for Operational Technology. We need a person's name or a position title that is unambiguous. This is very similar to the CPG we covered yesterday, 1.B for Organizational Cybersecurity Leadership, but this is about OT. The CPGs captured this as a separate goal to make sure we have alignment here. It could be the same person, but ideally this would be somebody with authority over OT and understanding of the risks to the OT environment. It's noteworthy that this leader is likely much closer to operations than an organization level leader who may be more focused on overarching corporate strategy. In most cases this will go beyond cybersecurity to include Safety, Operational Resilience and other Operations focused risks. This person needs to be a senior leader in the organization with the authority and political clout to get things done, and engages in: ➡️ Planning ➡️ Resourcing ➡️ Executing This leader is accountable and responsible, but that does not mean they have to do it all themselves. These activities can be delegated, as long as the named leader ensures cybersecurity is managed effectively. I have seen a few programs that named a figurehead to this function, but did not give them the authority they needed to execute. Or did not support the resource requests needed. Resources comes in the way of staff, budget and also organizational support. The most common mistake I see is tasking somebody that does not understand OT with this responsibility. If you have decided that your CISO or similar will be responsible, it's important that we make sure to educate them and other senior leaders to align with OT risks. In our Notion CPG template at https://lnkd.in/eP-pfWfk we provide a high level overview of this goal, and suggest a potential tool, wikijs, to capture this and other details in your program. You could just as easily use SharePoint, a Word doc or commercial tools. The tool does not matter as much as clearly defining accountability and communicating this to the organization. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #cybersecurityleadership

11

1 Comment

🚨 Positive News from the NIST NVD Team! 👇 NIST has released a new NVD announcements page + some important updates: 𝗔𝗱𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝗦𝘂𝗽𝗽𝗼𝗿𝘁 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁: NIST has contracted additional support to restore pre-February 2024 CVE processing rates within the next few months. 𝗔𝗱𝗱𝗿𝗲𝘀𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝗕𝗮𝗰𝗸𝗹𝗼𝗴: NIST is collaborating with CISA to ingest the backlog of unprocessed CVEs to the NVD, with plans to clear the backlog by the end of the fiscal year. 𝗟𝗼𝗻𝗴-𝗧𝗲𝗿𝗺 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: NIST is implementing technology and process updates to sustainably manage the increasing volume of vulnerabilities. This includes supporting automation in vulnerability management, security measurement, and compliance. 𝗖𝗩𝗘 𝟱.𝟭 𝗥𝗲𝗰𝗼𝗿𝗱 𝗦𝘂𝗽𝗽𝗼𝗿𝘁: Since May 14, 2024, NIST has been ingesting both CVE 5.0 and CVE 5.1 records, including support for CVSS 4.0 and #purl. 𝗖𝗼𝗺𝗺𝗶𝘁𝗺𝗲𝗻𝘁 𝘁𝗼 𝘁𝗵𝗲 𝗡𝗩𝗗: NIST assures that it remains dedicated to maintaining and modernizing the NVD. 𝗜𝗺𝗽𝗿𝗼𝘃𝗲𝗱 𝗖𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗶𝗼𝗻: Most importantly in my opinion, NIST promises that moving forward they will keep the community informed of their progress toward normal operational levels and their future modernization plans. Only time will tell if these commitments will indeed materialize... #VulnerabilityManagement #InformationSecurity #CyberSecurity National Institute of Standards and Technology (NIST)

65

8 Comments

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

11

1 Comment

Identity Deception in ITDR - Yes this is the old Honey Pots concepts There is another interesting concepts in ITDR called as Identity Deception, it is conceptually similar to honeypots used in networking. Both involve creating decoy elements designed to attract and engage potential attackers Honey Accounts: These are fake user accounts created within identity stores (like Active Directory) that are designed to attract attackers. When an unauthorized user attempts to access these accounts, it triggers alerts and allows security teams to respond quickly. Honeytokens: These are deceptive credential profiles placed in identity caches on endpoints. They serve as early warning signals when accessed by unauthorized users, helping to identify potential breaches before they escalate   These identities should be known to your ITDR systems though, this is not a way of checking which ITDR tool is more effective. https://lnkd.in/e7ckJxGQ #TheIdentityNavigator #iam #ITDR #IdentityAndAccessManagement

21

2 Comments

Along with a few colleagues on the AFCEA International Cyber Committee, we put together a white paper on the use of AI in security. A summary is below. The paper is free but you have to fill out a short form to download it. "Navigating the Future of Cybersecurity with Artificial Intelligence" In a rapidly evolving digital landscape, cybersecurity is no longer solely a concern for the military and private sectors; it is also critically important for civilian government agencies. As cybersecurity threats grow more sophisticated, leveraging artificial intelligence (AI) becomes essential for protecting vital civilian infrastructure and services. This white paper, developed by the AFCEA International Cyber Committee, examines the transformative role of AI in enhancing cybersecurity across all sectors in the United States, and provides a comparative analysis of AI integration in Europe, Asia-Pacific and the Americas. https://lnkd.in/d4uhGFAN

26

1 Comment

I’ve been telling folks for years to prepare for DPIAs to become public one way or another. It’s not a secret filing. Shrewd privacy and communication professionals will recognize the opportunity to counsel organizations on how to stop creating & hiding skeletons in the closet. Because when DPIAs become public, everyone will know what you know, including: - how honest & thorough you were from the jump (or did it take 5 versions to meet the requirements?) - known risks you haven’t told them about yet - how transparent you are with regulators - how you evaluate tradeoffs - if you have command of both technical & legal controls

5

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

Per the updated NIST standards, the U.S. government has a one-year transition period to adopt the new CUI standard for current operations, while new federal programs must adhere to the requirements right from the start. CUI encompasses a range of data types, including personal military records, export control research, and internal intelligence community data. This classification is applied to non-sensitive information within agencies or the Department of Defense that doesn't meet the classification criteria but still poses risks if not properly secured. NIST underlines the significant national security implications of compromising this data, especially as data is often shared between devices or accessed remotely by agencies and contractors.

1

Struggling to understand the NIST CSF 2.0 framework? Download your copy of this guide to access an in-depth mapping of BeyondTrust solutions to the categories and sub-categories outlined in the NIST CSF 2.0 guidance, the CSF Reference Tool, and more! In this comprehensive free guide, you'll learn: 💡 The true impact of NIST CSF 2.0 across the cybersecurity landscape 💡 A breakdown of what's new and what’s changed in version 2.0 💡 How to increase your alignment to the framework Download now and strengthen your security posture. https://lnkd.in/ePzrrtCQ #NIST #NISTFramework #Compliance #Cybersecurity #BeyondTrust

4

ICYMI: The inaugural study on EPSS performance and broader vulnerability exploitation trends published this week. If you've ever wanted data-driven answers to questions like these listed in the ToC shown here, download it today (free, no registration req'd): https://lnkd.in/gBbsgwQM #vulnerabilitymanagement #vulnerabilities #infosec

51

8 Comments

Looking for a way to apply the CIS Critical Security Controls version 8.1 to industrial control systems? Download our guide for guidance on how to apply the security best practices found in CIS Controls v8.1 to ICS environments here: https://lnkd.in/eFJvNquJ #ciscontrols #ics

23

2 Comments

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Why you still haven't cracked 7 figures in vCISO revenue ...and what to do about it. A security program won't be effective without: ❌ Security Policies ❌ Risk Management ❌ Executive Participation ❌ Performance Management ❌ Accountability leading the charge What do all these things have in common? vCISO Services. Are you: ✅ Including vCISO as part of your default proposals? ✅ Recommending vCISO in the risk assessment? ✅ Talking cyber performance management? ✅ Weaving vCISO value into your decks? ✅ Positioning the need for a leader? Bottom line: Is this all part of a crafted narrative that educates, illuminates, and entreats your clients? Because don't get it twisted - your clients NEED vCISO. Their program will flounder without it. Helping them understand that is where you come in. Don't make the mistake of assuming your clients "don't want" vCISO. They need it. And you won't scale to $1M+ without it. ----------------------------------------------------------- 👋 Hi there; my name's Jesse. 🚀 I help you scale your vCISO program; profitably. -----------------------------------------------------------

29

14 Comments

There's a new cyberespionage campaign targeting government agencies in EMEA and Asia by a group called SneakyChef. They use lures that are scanned documents related to government affairs. This campaign uses a wider range of targets and infection techniques than previous ones. Stay vigilant and educate your colleagues about these threats! #cybersecurity #APT #governmentthreats https://lnkd.in/dM9qz5EM

18

More reading for comments and analysis for the future. The new revisions also help us understand the interpretation of the existing revisions we are helping companies with. Exciting times. We don't get into cybersecurity because it is boring. We love change.

7

So, it's that time of year again and I will be speaking and traveling a lot. I will be at the following events, and please come to say hi or listen if you want. September 4: CISO Roundtable with Cybertech NY September 5: Incident Response Keynote panel at Cybertech NY with Cytactic September 7: Human Security Engineering at Luminarium Bogata September 10: Human Security Engineering at Luminarium Medellin September 12: Your Budget is a horse's ass at GoSec Conference 2024 in Montreal September 17: Quantitative Techniques for managiing risk exposure webinar, CYE webinar with Reuven (Rubi) Aronashvili, Katherine Kuehn, and Cody Scott September 23: Psychological Indicators of Human Vulnerability, InfoSec World Orlando October 3: Audience Choice at CornCon Cybersecurity Conference, Davenport October 16: Psychological Indicators of Human Vulnerability, ISC2 Security Congress, Las Vegas October 30: TBD Keynote at Layer 8 Masters CISO Forum, San Diego October 31: Applying AI to Cyber Risk Quantification at Cyberdefense Magazine CISO Conference, Orlando November 8: The Worst Cybersecurity Advice I Ever Heard, @Bsides South Florida November 27: Keynote stage, Black Hat MEA, Riyadh December 10: Leave Me the F*ck Alone, Cybersecurity Marketing Society Conference, Philadelphia Februay 8-13: Human Security Engineering, CruiseCon, The Caribbean, where I will be the least esteemed speaker in attendance. ;) I might have left something out, so please remind me if I left out your event. Either way, I will hopefully catch up with friends along the way. I will admit that I am most excited about CruiseCon, but that is my passion project. Either way, I look forward to seeing you all there.

52

16 Comments