Mike Saxton

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

"(1) Affirming Official. The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA’s compliance with the CMMC Program requirements and has the authority to affirm the OSA’s continuing compliance with the specified security requirements for their respective organizations. (2) Affirmation content. Each CMMC affirmation shall include the following information: (i) Name, title, and contact information for the Affirming Official; and (ii) Affirmation statement attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements to their CMMC Status for all information systems within the relevant CMMC Assessment Scope." #cmmc #dod #cybersecurity

25

ECS selected #Axonius to support DHS's CDM program. Axonius will provide comprehensive #Cybersecurity asset visibility and vulnerability management, enabling efficient risk management: https://dy.si/m5nFJ

2

🗞️ In CyberScoop: "[T]he years of work to build up federal collaboration with industry are paying off, from the Joint Cyber Defense Collaborative to the National Risk Management Center — the 'proto' version of the JCDC, [Chris Krebs] said — to the National Security Agency’s Cybersecurity Collaboration Center. "'We’re starting to see that these things work with the resources and time into it, but it’s generating results and there’s no better evidence of the results, I think, than when Russia invaded Ukraine, and the ‘Shields Up’ campaign and the breadth to which that was able to change behavior in industry,' said Krebs, now chief intelligence and public policy officer at SentinelOne." To learn more, read the full article by Tim Starks: https://s1.ai/CS-Collab

42

Does being compliant with CMMC really matter right now? A small fraction of defense contractors have already done the hard work to prepare for these critical requirements to protect our national defense infrastructure. For the remaining ~200,000 contractors, it is a risk management decision. Can you afford to lose contracts with those clauses? Would your business stay afloat without that government customer? Could waiting hurt your business and bottom line? We have seen companies lose HUGE contracts that resulted in having to layoff people who have been there for 20 years. This stuff has a huge impact. Don’t think that you have to do it all at once! You just need to start with a solid plan and a budget. When you do this, you are ahead of the majority and will be on your way to a competitive advantage before you know it. The hardest part is getting started. Feeling stuck? Valor Cybersecurity is here to help you get ready. #cybersecurity #defense #compliance #dod

6

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

DISA Expands Thunderdome Zero Trust Program Deployment; Brian Hermann, Quoted. ExecutiveGov discusses the Defense Information Systems Agency's (DISA) expansion of the Thunderdome zero trust program. In 2023, the program was deployed to 15 sites and plans are underway to extend it to 60 more sites in 2024. The program involves four key components: 🔐 Customer security stacks 🔗 Software-defined wide area networking 📴 Secure access service edge capability, and 💯 Application security stacks. Brian Hermann, DISA's director of the cybersecurity and analytics directorate, emphasized the program's role in advancing zero trust architecture, which is crucial for organizational security. DISA has also finalized the contracting process to support the U.S. Coast Guard’s network security improvement efforts through Thunderdome. Versa Networks is at the forefront of enhancing cybersecurity with their pivotal role in DISA's Thunderdome project. Their cutting-edge solutions are setting new standards in securing our nation's digital infrastructure. For more details, you can read the full article here:-https://lnkd.in/gd4wAWM2 #DISA #Thunderdome #ZeroTrust #Cybersecurity #versanetworks #channelpartners

5

Developing secure products is crucial as threats continue to evolve. 🛡️ ☁️ 🔐 Discover the concept of Secure by Design (SbD), its benefits, key considerations, and actionable items to successfully embed SbD into your #security strategy. Check it out. 👇 Authors: ✒️ Eric Johnson, Senior Instructor, SANS Institute ✒️ Bertram Dorn, Principal, Office of the CISO, AWS ✒️ Paul Vixie, Deputy CISO, VP, and Distinguished Engineer, AWS #AWS #CloudSecurity #AWSExecutiveInsights

34

3 Comments

Yesterday, I had the pleasure of attending #CMMCDay. There were a lot of great discussions kicked off by Matthew Travis, The Cyber AB. I took a few key points from the discussion throughout the day. 1. False Claims Act - This will continue to be the primary compliance review for the DoD. Why not 'deputize' those within the DIB to police themselves. With the payouts being received from false claims act, it appears that it will be an effective tool for the DoD. 2. Rulemaking Timeline - The DoD continues to adjudicate public comments on the #CMMC Program rule (CFR 32) and all indications are that it will be released by fall 2024. This rule will make CMMC affective and allow certifications to begin outside the Joint Surveillance Assessment (JSVA) Program. CFR 48 that will mandate CMMC be included in contracts is expected to be delayed until later in 2025. Therefore, the DoD will essentially provide a grace period from Fall 2024 to mid/late 2025 for organizations to get certified prior to mandating it in contracts. 3. Not Just Technology - CMMC is a verification and validation program. Organizations must demonstrate that they are implementing the CMMC Requirements to a third-party assessor; while some controls (e.g., encryption, malicious code scanning) can be performed using technology, other controls (e.g., background screening, training, security assessments) require people to perform. 4. 100% Ready - There was a lot of discussion on the activities within the JSVA. These assessments provide insight into what organizations can expect during a CMMC assessment. One of the key themes coming from these assessments is if you aren't 100% convinced your organization is ready for an assessment - then you’re not ready! If you couldn’t attend and want to learn more about these and other topics, send me a note. I'd be happy to share additional insights. If you were able to attend, what key points did you take away from the event?

14

Heads up on this once in 5 years opportunity to sponsor Cyentia Institute research into the largest #cybersecurity incidents. See the call for sponsors for the 2025 "Xtreme" edition of the Information Risk Insights Study at the link below. #cyberrisk #cyberresilience #cyberattacks https://lnkd.in/etc6FjsY

39

2 Comments

Tired of managing security testing across a scattered team? AttackIQ Mission Control centralizes control testing for faster remediation and improved ROI. 📅 Join Jose Barajas at 10 AM PT/12 PM CT/1 PM ET on July 18th to learn how AttackIQ Mission Control streamlines security operations for organizations. Discover how to seamlessly orchestrate testing across departments and locations, gain insights specific to your role with role-based dashboards, and simplify testing workflows for faster results. ➡ Register today and optimize your #SecurityOperations: https://bit.ly/3RZa5hw #LinkedInLive #Cybersecurity

13

Baltimore, Maryland: Last week, on the fringe of the AFCEA TechNet Cyber Conference, Mike Walsh sat down with Francis Rose to chat about the DoD's Comply-To-Connect (C2C) program and how this investment made by Congress creates a net-positive wrt -- ✍ Executive Order 14028: 1️⃣ "It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order." 2️⃣ "To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, the Federal Government must take decisive steps to modernize its approach to cybersecurity." Which requires the Federal Government to invest in and secure both Information Technology (IT) and Operational Technology (OT) systems. BL: The continuous monitoring, assessment, and security of all IT, IoT, and OT endpoints are both necessary and achievable to "build secure systems in untrusted networks" #ZeroTrust. ☠ 🌀 Volt Typhoon: 1️⃣ The discovery of Chinese malicious code embedded in the telecommunications systems used by the U.S. military in Guam, home to three strategic U.S. bases, sent waves through the national security community. The Chinese Communist Party (CCP) currently uses cyberspace to achieve espionage and intellectual property theft objectives. 2️⃣ However, they aspire to use malware hidden in our critical networks to disrupt our response to a future CCP invasion of Taiwan. BL: This cannot be overstated: denying the availability of weapon systems in the garrison is as effective as destroying them on the battlefield.

32

#ICYMI: NCSC recently released updated guidance by the National Insider Threat Task Force. Explore this compendium of best practices for insider threat practitioners at: https://lnkd.in/ecFZX2Wf

120

2 Comments

"A comprehensive guide authored by Dean Parsons, SANS Certified Instructor and CEO / Principal Consultant of ICS Defense Force, emphasizes the growing need for specialized ICS security measures in the face of rising cyber threats." #criticalinfrastructure #ICS #cybersecurity

3

The National Security Agency (NSA) has recently released guidance aimed at enhancing logging and threat detection capabilities in response to living-off-the-land (LotL) incidents targeting critical infrastructure. LotL techniques involve threat actors leveraging legitimate tools and protocols to carry out malicious activities, making them harder to detect. The NSA's recommendations emphasize the importance of robust logging practices and proactive threat detection measures to counter these sophisticated attacks. #NSA #Databreaches #incidentResponse #LotL #cyberattacks

2