Martin Roesch

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

59

✅ (3/38) CPG 1.C OT Cybersecurity Leadership. In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at OT Cybersecurity Leadership. The intent of this CPG is to establish overall documented accountability and responsibility for your cybersecurity program for Operational Technology. We need a person's name or a position title that is unambiguous. This is very similar to the CPG we covered yesterday, 1.B for Organizational Cybersecurity Leadership, but this is about OT. The CPGs captured this as a separate goal to make sure we have alignment here. It could be the same person, but ideally this would be somebody with authority over OT and understanding of the risks to the OT environment. It's noteworthy that this leader is likely much closer to operations than an organization level leader who may be more focused on overarching corporate strategy. In most cases this will go beyond cybersecurity to include Safety, Operational Resilience and other Operations focused risks. This person needs to be a senior leader in the organization with the authority and political clout to get things done, and engages in: ➡️ Planning ➡️ Resourcing ➡️ Executing This leader is accountable and responsible, but that does not mean they have to do it all themselves. These activities can be delegated, as long as the named leader ensures cybersecurity is managed effectively. I have seen a few programs that named a figurehead to this function, but did not give them the authority they needed to execute. Or did not support the resource requests needed. Resources comes in the way of staff, budget and also organizational support. The most common mistake I see is tasking somebody that does not understand OT with this responsibility. If you have decided that your CISO or similar will be responsible, it's important that we make sure to educate them and other senior leaders to align with OT risks. In our Notion CPG template at https://lnkd.in/eP-pfWfk we provide a high level overview of this goal, and suggest a potential tool, wikijs, to capture this and other details in your program. You could just as easily use SharePoint, a Word doc or commercial tools. The tool does not matter as much as clearly defining accountability and communicating this to the organization. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #cybersecurityleadership

11

1 Comment

It is easy to protect PL/SQL from security vulnerabilities. - https://lnkd.in/eqdFZB9n #plsql #protect #databreach

2

DFIR Triage Guide: When Every Second Matters! Triage isn't optional unless you like playing 'Guess what just crashed! During an active cyber incident, every minute counts. Triage helps quickly assess the data to identify potential leads, prioritize evidence, and allocate resources accordingly. It also helps identify the most critical systems and data to focus on, minimizing damage and preventing further compromise. Here are the key reasons why triage is critical: • Time Sensitivity • Resource Management • Containment and Mitigation • Evidence Preservation • Focused Investigation Here is an excellent article by Terryn Valikodath that explains Why Triage is Not Optional: https://lnkd.in/gYid_g8W Triage helps us act fast, but data analysis ensures we act right! Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

75

20 Comments

Cybersecurity Blind Spots in IaC and PaC Tools Expose Cloud Platforms to New Attacks: Cybersecurity researchers have disclosed two new attack techniques against infrastructure-as-code (IaC) and policy-as-code (PaC) tools like HashiCorp's Terraform and Open Policy Agent (OPA) that leverage dedicated, domain-specific languages (DSLs) to breach cloud platforms and exfiltrate data. "Since these are hardened languages with limited capabilities, they're supposed to be more secure than https://lnkd.in/guYVm7pF

1

ATTN: New Cyentia Institute study. If you're responsible for managing or remediating security vulnerabilities, you'll want to read this one. #vulnerabilitymanagement #cybersecurity #infosec #vulnerabilities

44

2 Comments

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

⚡️Some domains likely used by #transparentTribe #APT36 counciling[.]com nbssedelhi[.]org ashifdigitalseva[.]xyz birthdeath[.]in gov-certificate[.]com viewss[.]click admin-mcas-df[.]ms admin-mcas[.]ms mcas-df[.]ms mcas[.]ms verifycertificate[.]info nimsme[.]org

1

1 Comment

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

11

1 Comment

Small business owners, this one's for you! The NIST Cybersecurity Framework offers a proven approach to managing cybersecurity risks. This free resource provides a quick start guide to help you get started. ➡️ Learn how to identify, protect, detect, respond to, and recover from cyber threats. Download the NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide today! #cybersecurity #smallbusiness #riskmanagement #NIST https://lnkd.in/gnByJvYM

20

July 2024 #Free Webinar Week 1 (2 CPEs)   Session 1: Building and Scaling Continuous Security-Compliance   Date & Time: July 11, 2024 6:00 PM PDT - 7:00 PM PDT   Speaker: Chintan P., Head of Product & Design, LVT (LiveView Technologies)   A practical guide on building and scaling a world class security programs.   Register here: https://lnkd.in/gCVr26cf   #ISACASV #ISACA #webinar #Compliance #Security Session 2: Preparing an effective info security compliance program for a small-and-medium business (SMB) to build trust for their service-offering   Date & Time: July 11, 2024 7:00 PM PDT - 8:00 PM PDT Speaker: Sanjay Mathur CISSP, CISM, CRISC, Partner and Info Security Professional, Frictionless Security Typically, small, and medium businesses (SMBs) are hard pressed on budget, time, and resources. Yet, they have demands of the third-party risk management (TPRM) programs of their potential corporate buyers to demonstrate trust around their service-offerings. This requires an information security and compliance program, and preparedness for an independent and objective audit and certification of their management assertion on the trustworthiness of their services.  Based on a couple of real-life scenarios of our clients, this presentation will discuss the challenges, roadblocks, and pitfalls in setting up an info security compliance program for an SMB   Register here: https://lnkd.in/gCVr26cf     #ISACASV #ISACA #webinar #Compliance #Trust

20

2 Comments