Adam Gomes, CISSP-ISSAP, CCSP

Lehigh University understands the critical importance of robust cybersecurity defenses. They implemented Armis Centrix™ for VIPR Pro – Prioritization and Remediation to streamline their efforts and significantly improve their security posture. Learn how Armis Centrix™ helped Lehigh University: - Reduced cybersecurity risks by 40% through effective prioritization and remediation of vulnerabilities. - Enhanced visibility across their network, enabling them to identify and address threats faster. - Achieved faster response times to potential threats, minimizing potential damage. Read the full case study now: https://bit.ly/4755Ln5 #Armis #ArmisCentrix #VulnerabilityManagement #VulnerabilityPrioritization #Cybersecurity

15

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3

Another Unitronics security advisory today. Note that if you have a Unitronics Vision PLC, you cannot rely on the Info Mode passcode to protect you. This is previously the top mitigation advice in other advisories for this product line. CVE-2024-1480 may be used to retrieve the passcode even when it is changed. Your best bet is, unfortunately, limiting access to the device entirely. The vendor did not say much to us about this, other than to confirm that is indeed a new issue that was never previously disclosed. We have seen no evidence that this bug is in use, but some hacktivist groups are targeting this specific model of controller. We're rolling out signatures in Platform KP_Plus-7.0. https://lnkd.in/gyzKiBwj

29

2 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

58

Confident in managing hidden threats within your network? Ryan Toole of Lehigh Valley Technology MSP details how Lumu detects and responds to adversaries that bypass defenses. Watch the full testimonial here. >> https://zurl.co/cnck #MSP #Cybersecurity #NetworkSecurity #ThreatDetection #Visibility #CaseStudy

22

1 Comment

⏰ ICYMI ⏰ SiegeCast "Attacking Active Directory" is now loaded up on our Youtube! ➡ https://lnkd.in/eP237ENX Senior Security Consultants Justin Palk and Corey Overstreet provide you practical insights and introductory strategies to guide you through identifying and exploiting vulnerabilities within Active Directory. #hacking #infosec #cybersecurity

5

The PCI DSS v4.0.1 update provides much-needed clarifications that can help us all strengthen our cybersecurity measures. With clearer guidelines on MFA and payment scripts, we can better protect sensitive data. How is your organization adapting to these changes? Reach out to Arbure for a deep dive into these updates. #PCIDSS #Cybersecurity #Compliance #PCIUpdate

4

MSPs often see backup only as a way to recover the system in case of a failure, data loss or cyber attack. Backups are much more than that.

18

There are several items that are missed on any data security audit. One is the Cybersecurity Risk Management Plan and Assessment. Typically found in only 1% of audits. An Incident Response Plan. Found less than 1% of the time. But almost never found are Data Flow Diagrams. With over 50% of the organization's data on the cloud, without the data flows completed, no one, yes no one in the organization knows where all the PII, PHI, PFI, PCI and other critical data is located. It takes about a month to complete all the data flows for an organization since all the department heads need to share their knowledge. When complete, these secure documents will allow the organization's leaders to strategize how they will protect their data. Without the data flows, many segments of the organization's data are not properly managed or protected. The organization will not have a backup plan if access to these systems is lost. So ID.AM.03 of the NIST Core V2 is a critical data security control. Please download the CSF and do the work that needs to be done to protect your organization.

10

6 ICS advisories for your review.

5

Power up ⚡ your vulnerability remediation cycle with the platform designed to zap 21st century headaches. We're talkin' saving time spent patching, automating your work, and getting back on CISA's good side. Here's how Vicarius helps: 🔹 See everything in one place: Forget siloed data and endless spreadsheets. Vicarius provides a single source of truth for all your vulnerability data. 🔹 Prioritise like a pro: Vicarius goes beyond just severity scoring. It uses real-time context to prioritise vulnerabilities that matter most to your organisation. 🔹 Patch smarter, not harder: Integrate patching for Windows, Linux, Mac, and third-party applications – all from the same platform. 🔹 Automate the mundane: Free yourself from repetitive tasks. Vicarius automates patching, threat mitigation, and even vulnerability scans. Try vRx today, risk-free, pain-free. (Seriously, why wait? ) #vulnerabilitymanagement #cybersecurity #CISA #automatedsecurity #patching

2

AFCEA TechNet Cyber Day One in Baltimore is underway! Come visit us at Booth #3349 and meet the teams from Phoenix TS, OffSec, and Alliance Cyber. Rebecca G. Eddie Chang Christine Harper Michael Cornecelli Learn about our latest cybersecurity training, certifications, and consulting services, and how our offerings can help elevate your cybersecurity game. #TechNetCyber #PhoenixTS #OffSec #AllianceCyber #CyberSecurityTraining #CyberSecurityConsulting

8

Small business owners, this one's for you! The NIST Cybersecurity Framework offers a proven approach to managing cybersecurity risks. This free resource provides a quick start guide to help you get started. ➡️ Learn how to identify, protect, detect, respond to, and recover from cyber threats. Download the NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide today! #cybersecurity #smallbusiness #riskmanagement #NIST https://lnkd.in/gnByJvYM

20

Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a vulnerability in Ivanti Endpoint Manager that is currently being actively exploited. Agencies are urged to apply available patches immediately to mitigate potential risks. This flaw could allow attackers to gain unauthorized access or execute malicious code, posing a significant threat to sensitive data and systems. It's crucial for organizations using Ivanti Endpoint Manager to prioritize these updates to safeguard their environments. #TechSecurity #CyberThreat #SecurityPatch #ITSecurity #Ascellainfose

1

I see TAs looping over wevtutil and deleting event logs on any.run and various reports. Why? Anyone wants to fill me in - please let me know. I get the action is defense evasion. Most orgs send logs to a SIEM. Are they catching and deleting the logs prior to the SIEM push? Let me know. #cybersecurity

1

For those still attempting to work through the Crowdstrike update, check out this GPO script to fix the issue: https://lnkd.in/eUMU52YY It takes a couple of reboots to take effect but this along with a helpdesk script instructing users how to boot into safe mood with networking might go a long way.

17

Compliance standards mean absolutely nothing when the rubber hits the road? Who would’ve thought? It’s almost like compliance isn’t the solution to anything… Seriously though, what do we expect? Attaining compliance standards is by and large a checkbox exercise that organisations pretend to follow. I would love to see a compliance standard that actually resulted in the implementation of meaningful controls and discouraged compliance attaining gaming.

1