Vaughn L. Hazen

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5

Working on research for a whitepaper and would love insights from my OT security network, particularly those from operator/asset owner organizations. Do you use metrics to assess the cost per asset (or system) to secure it? How do you differentiate between operational expenses (e.g., ongoing maintenance and licenses) and equipment costs (e.g., firewalls, security features in OT assets)? If there are metrics you’ve discontinued, I’d also love to hear about what hasn’t worked. I understand this might not be a public conversation, so feel free to DM me if you’re open to sharing!

3

1 Comment

This will be really interesting to present. With an active campaign happening a lot of the indicators are human and cyber indicators that are difficult to piece together with traditional AV and EDR. It takes an investigative mindset and the right data to identify the 1 in 1000 users that may have infiltrated your organization. Come along to learn from my colleagues and myself based on current research and investigations.

5

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

Fifteen years ago, IT Security was a backstage concern🔒. Fast forward to today, it's a boardroom staple📈. Yet, Abuse Management remains outside the boardroom's purview. Why the lag, and how do we bridge this critical gap?🤔 Abuse Management, the dark horse of organizational safety, is often overlooked but carries vast implications for user trust and safety🛡️. As digital platforms💻 become the lifelines of our economy, the urgency to protect users from abuse has never been higher. But here's the kicker: Abuse Management isn't just a safety net; it's a strategic advantage💪. It speaks volumes about a company's commitment to user safety, trust, and the overall quality of the digital experience. This is the narrative we need to bring into the boardroom🏢. How do we elevate Abuse Management to the boardroom level quickly? 1. **Quantify the Impact**: Start by translating abuse incidents into business metrics. Highlight the direct correlation between user trust, platform safety, and the bottom line💰. 2. **Educate and Advocate**: Board members may not be aware of the significance of Abuse Management. Create briefs, present case studies, and show the tangible benefits of proactive abuse management strategies📚. 3. **Integrate with Corporate Governance**: Embed Abuse Management within the broader corporate governance framework. This elevates its importance and ensures it's a regular item on the agenda, not an afterthought✅. 4. **Leverage Technology**: Demonstrate how innovative technologies can streamline Abuse Management, making it necessary, feasible, and efficient🚀. It's time to challenge the status quo. Let's not wait another 15 years to prioritize Abuse Management in the boardroom. Engage, discuss, and share your thoughts below👇. How can Abuse Management be a boardroom topic today, not tomorrow?

12

3 Comments

The Cybersecurity and Infrastructure Security Agency released a new periodical, "Modern Approaches to Network Security," in partnership with the Federal Bureau of Investigation (FBI), the Canadian Centre for Cyber Security, and others. In summary, the article discusses VPN challenges, solutions such as Zero Trust, Secure Service Edge (SSE), and Secure Access Services Edge (SASE), and best practices. Here are my key takeaways and more on each. This article is a valuable resource that is worth your time. Key Takeaways 1) VPNs Are Not Enough: Traditional VPNs have significant limitations and vulnerabilities that necessitate more robust solutions. 2) Adopt Zero Trust Principles: Embracing Zero Trust Architecture enhances security by verifying all access requests continuously. 3) Leverage SASE and SSE: These modern frameworks offer scalable, flexible, and integrated security solutions for today's dynamic environments. 4) Implement Network Segmentation: Effective segmentation limits the impact of breaches and reduces the attack surface. 5) Proactive Vulnerability Management: Regular assessments and timely patching are essential to prevent exploitation. Challenges with VPNs VPNs have long been the go-to solution for remote access. However, they have their flaws. Inherent risks include IP address and DNS spoofing, complexity of implementation, potential misconfigurations, and failure to enforce network segmentation, which increases the risk of lateral movement by attackers. Embracing Zero Trust Architecture Implementing ZTA involves several key components: Micro-segmentation, Least Privilege Access, Continuous Monitoring, Strong Authentication, and Authorization, Using multifactor authentication (MFA) and strict access controls to verify identities and permissions continuously. The Rise of SASE and SSE SASE provides several advantages over traditional approaches: Scalability, Flexibility, Improved Performance. SSE, a subset of SASE, focuses on security services, including ZTNA, SWG, and CASB. Network Segmentation Network segmentation is a fundamental security practice that involves dividing a network into isolated segments to contain the spread of potential threats. There are several methods of network segmentation: Physical Segmentation, Logical Segmentation, Micro-Segmentation, and Unidirectional Architectures. Proactive Vulnerability Management (the basics) Cyber programs must adopt a proactive approach to identifying and remediating vulnerabilities before they can be exploited. This is done through Automated Vulnerability Scanning, Patch Management, and Actionable Threat Intelligence. #cybertech #cio #ciso #networksecurity #zerotrust #cyber #sase https://lnkd.in/g-nEKbRb

45

6 Comments

IANS is coming to Montreal, November 19th @ 8:30 - 10am ET (Downtown) Rethinking DLP for an AI World As business units clamor to use GenAI tools, security teams must take another look at their data protection strategies. Traditional DLP products and approaches must be reconsidered as the risk of overexposure of data internally, via a tool like M365 Copilot, or data sharing externally, via services like ChatGPT or Github Copilot, bring about new considerations regarding data access and protection. I will be there and lead a conversation of risks to be aware of and strategies to mitigate those risks. For more information or to register, contact Aidan Delaney!

25

2 Comments

Rant: Why would an association of Information System Security professionals force the use of cookies or deny access to its member site? "Click Accept to consent and dismiss this message or Deny to leave this website." C'mon Dr. Shawn P. Murray, Jimmy S, CISSP, CRISC, CISM, Lee Neely, Laura H., David Vaughn Full banner: "This website uses cookies to store information on your computer. Some of these cookies are used for visitor analysis, others are essential to making our site function properly and improve the user experience. By using this site, you consent to the placement of these cookies. Click Accept to consent and dismiss this message or Deny to leave this website.  Read our Privacy Policy for more." Sure, there are ways around this, but why? "Enhancing my experience" is monetizing the behavior of paid members.

13

7 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

I am unreasonably thrilled that my team here at CISA placed an explicit Creative Commons CC0 v1.0 license on the #KEV. This isn't a change in licensing, per se, since it was implicit all along. Pretty much every data set the US federal government produces is unencumbered by restrictive licensing (with some very rare exceptions). That said, it's nice to have a direct and obvious link now on the front page of https://cisa.gov/kev that makes it clear that yes, you can actually use and repackage and visualize and resell and do pretty much whatever you want with all the KEV data you like. Open Data is Best Data. This kind of thing is why I took this fed job in the first place.

162

2 Comments

Risk Appetite - the New Black? There were excellent discussions and insights at yesterday's 6D.Security Conference, which explored the challenges and opportunities presented by AI and emerging technologies on the security professional’s agenda. I asked the "THE GUARDRAILS: Getting It Right, Now!" panel whether Risk Appetite is the New Black where consuming AI risk might be the goal instead of the devils to avoid. The notion of "consuming risk appetite" takes on new meanings because of the new extreme capabilities and use cases enabled by AI, which were not even conceivable until very recently. Is this time to refresh Mike Burgess' 2015 "FIVE KNOWS of Security" paradigm to "FIVE KNOWS of AI Safety"? I think resisting AI is futile. We need to learn to live with it, like it or not. I want to thank Adam Spencer for moderating the panel with Chirag D Joshi, Elena Chan and Sulata Bhattacharjee and sharing their insights on my question. I look forward to learning your perspective. Please provide your comment below.

15

4 Comments

Great summary of our recent guidance paper from the esteemed Alex Sharpe. Thanks Alex!

17

1 Comment

This piece on insider risk and the vulnerabilities associated with a remote workforce is particularly thought-provoking. Managing organizational risk is a complex challenge, and it requires the expertise of many brilliant minds. It highlights the ongoing difficulties organizations face; insider risk is a critical issue that warrants serious consideration. Companies can take significant steps to mitigate these risks, such as fostering a culture of bidirectional loyalty. Some key questions to consider include: 1. Is insider risk incorporated into a central risk register and prioritized alongside other risks? 2. Does the organization clearly identify its crown jewels? 3. What data classification scheme has been applied to these crown jewels? 4. Is there adequate monitoring in place for the organization’s most critical assets? The value of addressing these questions remains constant, regardless of whether employees are working remotely or in the office.

3

As the DORA-TLPT deadline approaches, having the right tools is key! VECTR™ offers powerful support for TLPT requirements. Check out this post to see how Security Risk Advisors is helping new and existing clients to prepare for January 2025 and beyond! 🔍 #Cybersecurity #PurpleTeam #RedTeam #ThreatLedPenetrationTesting #ThreatIntelligence #Compliance

4

Read all about our VP of SA Jordan Camba talk about his experience as a Detection Engineer and Threat Hunter. "As a Detection Engineer and Threat Hunter, my passion for MITRE ATT&CK is boundless. It's an essential framework for assessing, measuring, and communicating the breadth and depth of our detection capabilities. However, the utility of MITRE ATT&CK is often compromised by inaccuracies and a lack of precision in how some organizations apply mappings. This can lead to a distorted understanding of our security posture, ultimately misallocating resources and weakening our defenses." Read more in his latest blog here: https://lnkd.in/e7CzWazn Why Precision and Accuracy Matter in MITRE ATT&CK Mappings - - Accuracy ensures that the tactics, techniques, and sub-techniques correctly represent the detected activities, providing a clear and reliable view of our security landscape. Inaccurate mappings can lead to confusion and misplaced focus, undermining the integrity of threat detection efforts. - - Precision, on the other hand, involves the granularity of these mappings. It's about capturing the specific details that make detections actionable. A lack of precision can leave us with a general, but not necessarily useful, understanding of potential threats. Here are some common mistakes: ❌ Mapping without sub-techniques ❌ Overlapping techniques ❌ Incorrect technique assignments How to fix these mistakes? Follow a few simple rules: 1. Keep it simple - Focus on what is immediately observable and mapto Sub-Techniques where possible. 2. Don't be greedy - Not all techniques can be detected with logs and telemetry and not every detection needs a Technique/Sub-Technique. 3. Become a better threat researcher - Improve your ability to find, interpret, and understand research on malware, tools, techniques, and vulnerabilities and instantiate a lab environment. At SnapAttack, we are committed to refining the quality of these mappings. Our platform offers: ✅ Pre-Written Tested Detections: A growing library of Sigma rules tested in our Sandbox sessions, with accurate ATT&CK mappings. ✅ MITRE ATT&CK Prioritization & Coverage Reporting: Using top-tier Threat Intelligence, we prioritize techniques and sub-techniques according to industry and regional relevance. ✅ Research Sandbox: A tool for hands-on-keyboard research to enhance threat detection capabilities. #CyberSecurity #ThreatDetection #MITREATTACK #SnapAttack #DetectionEngineering #ThreatHunting #CyberDefense #SecurityPosture #AccuracyAndPrecision

16