Bob Burton

Yesterday, the National Institute of Standards and Technology (NIST) released the Risk Management Framework (RMF) Small Enterprise Quick Start Guide. This guide aims to assist small, under-resourced organizations in understanding the NIST RMF's core components and the importance of managing #infosec and #privacy risks. It serves as an introductory tool for entities to design and implement effective #riskmanagement programs. The guide underscores the need to frame, assess, respond to, and monitor risks, ensuring organizational resilience. https://lnkd.in/dBtQkCZj #informationsecurity #cybersecurity #security

11

A few weeks ago, I wrote a post sharing research breaking down exposures across enterprise and cloud infrastructure. By volume, the majority of exposures affected Active Directory but the most critical exposures were found in cloud environments. (see https://lnkd.in/euvfKvGJ) I wanted to follow that up with a similar view comparing the distribution of critical exposures among different industries. Per the attached chart, about half of the industries shown follow the overall pattern of Cloud > Active Directory > IT/Network devices. But there’s quite a bit of variation and some sectors buck that trend entirely. For example, very few of the critical asset exposures affecting the Energy, Transportation, and Healthcare sectors are in the cloud. On the other hand, the share of critical exposures in cloud environments is much higher than average in the Agriculture and Manufacturing industries. I share this because the diversity and sprawl of the modern attack surface make it difficult to answer seemingly simple questions like "Where are our critical exposures?" And the fact that every industry's or organization's answers will vary makes answering it all the more difficult and important. If you'd like to see more on what we learned from analyzing exposures from tens of thousands of attack path assessments, download the full report from Cyentia Institute and XM Cyber here: https://lnkd.in/dPfqXG7y #exposuremanagement #vulnerabilitymanagement #cyberrisk

40

3 Comments

As I previously posted, I’m struggling with PCI 4.0 Targeted Risk Analysis(TRA) process on frequency. The frequency on certain activities like vulnerability scanning and user access reviews are already determined by Corporate Policy, not a TRA. And some of these are “influenced” by other regulatory requirements such as SOX - must conduct quarterly user access reviews. Maybe a TRA would be a better approach to determining frequency, but I already have standards. What does the TRA contribute to an existing standard? One could argue that the TRA supports that standard but in reality I think it leads us to a foregone conclusion that quarterly is sufficient. I may end up with some type of TRA word salad that validates whatever frequency that the Company standards dictate. I’m still working on it, version 5. But I think having supporting Corporate Standards allows me to examine the risks of not complying with the aligned standards is the best approach to produce a TRA. Unless I go to version 6, which is unknown at this time.

[New Webinar] Reclassification Update: OMB Requests Input for SOC Revision. 7/17 at 2 pm ET. Today OMB announced the beginning of a multi-year process to revise the Standard Occupational Classification. Through this process, OMB will consider whether to change the classification of public safety telecommunicators from the administrative/clerical category to the category for Protective Service Occupations. Join us on July 17 for a webinar to explain APCO’s strategy for providing input to OMB, how this effort relates to the 9-1-1 SAVES Act and what you can do to help ensure that OMB finally corrects this outdated classification. https://lnkd.in/ekhmW5am

11

⏰ Just 20 hours left to register for another insightful SANS Institute webcast titled "SANS 2024 SOC Survey: Facing Top Challenges in Cybersecurity." Kicking off at 10:30am PT TOMORROW, Fri., July 12, our very own Scott Dowsett CISSP CISA CRISC CDPSE will speak soon after at 11:00am EDT and will join a panel discussion to follow (@ 11:45am EDT) with several other industry experts including Christopher Crowley, Shahar Ben-Hador, Joshua Costa, Bob Hansmann, Mick Leach, Jay Lillie, Byron Page, Edward Wu, and Ashish Malpani. 👏🏼 Learn more and register here 🔗 : https://lnkd.in/gKWdSSKN #cybersecurity #AI #SOC #ThreatIntel #SecurityAutomation #SecurityOperations

37

2 Comments

📣 CMMC Program Final Rule Published 📣 The final program rule for the Cybersecurity Maturity Model Certification (CMMC) Program was published in the Federal Register recently. The key takeaways include: -There are 110 identifiable and applicable security requirements specified in the new NIST SP 800-171. -Firms in the DoD supply chain are now required to provide adequate security on all contractor information systems. For example, defense contractors must confirm that any Cloud Service Providers (CSPs) used by the contractor to handle CUI meet Federal Risk and Authorization Management Program (FedRAMP) Moderate Baseline or the equivalent requirements. It also requires defense contractors to flow down all the requirements to their subcontractors who process, store, or transmit CUI. -NIST SP 800-171 has 3 levels of certification. Level 1, which is self-certified. Level 2 now has 2 separate classifications for certification including a self-certification option and a C3PAO option. For you Star Wars buffs, that is not a typo. It stands for CMMC 3rd Party Assessment Organizations. These are similar to ISO or SOC2 compliance audit agencies. The final level, Level 3 will require DoD certification. -Understanding your contractual requirements based on your defense partnership will mandate the level of certification required, and your obligations to the security, management and accountability your organization will require. Full Ruling here: https://hubs.ly/Q02Wk45N0 With risks and requirements changing quickly, it's hard to know how to ensure your compliance. SkyTerra is here to help, book a meeting with our team to learn if these new rules affect your compliance: https://hubs.ly/Q02Wk2qj0

1

Achieve foundational and professional ISMS certifications to become a qualified Security Officer. Go to ico-cert.org to read more about this role and exam specifications. #careergrowth #professionaldevelopment #cybersecurity #itsm #dataprotection #icocert #iso27001 #informationsecurity #securityprofessionals #ams19011 #itcertification #lifelonglearning

3

Update from ICS Advisory Project 👇🏼👇🏼👇🏼

3

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

Cybersecurity is a constant battle. Learn how to proactively defend your organization against evolving threats using the MITRE ATT&CK framework. This presentation will discuss how ThreatNG aligns with MITRE ATT&CK to help you strengthen your defenses and mitigate risk. Discover how to: - Gain visibility into your external attack surface 🔍 - Identify and address vulnerabilities before they're exploited 🔒 - Detect and respond to threats at every stage of the attack lifecycle 🚨 - Safeguard your critical assets and sensitive data 💼 Want to learn more? Visit the following page to download our free mapping document: https://lnkd.in/ebxGC9PK #ASM #AttackSurface #AttackSurfaceManagement #Cybersecurity #CybersecurityAwareness #DigitalRiskProtection #DRP #EASM #ExposureManagement #ExternalAttackSurfaceManagement #CTEM  #ExternalAttackSurface #Security #Securityawareness #SecurityRatings #TPRM #VulnerabilityAssessment #MITREATTCK #ThreatIntelligence #CyberDefense #DataProtection #RiskManagement #CyberResilience #VulnerabilityManagement #CloudSecurity #Privacy

3

Windows PHP server owners patch now - PHP ADDRESSED CRITICAL RCE FLAW POTENTIALLY IMPACTING MILLIONS OF SERVERS Researchers at cybersecurity firm DEVCORE discovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-4577, in the PHP programming language. An unauthenticated attacker can exploit the flaw to take full control of affected servers. https://lnkd.in/gq3VMaQp (Thanks Critical Insight for the reminder)

13

5 Comments

Putting on the final touches for the ISACA Central Maryland Chapter (CMC) Cybersecurity Framework (#CSF) event next week! Have you signed up? @Kelly Hood and I are presenting an overview of the NIST Cybersecurity Framework v2.0, highlighting the key updates from version 1.1 and guidance for using the CSF v2.0 to mature your cybersecurity capabilities and addressing compliance needs. Not signed up? It's not too late. Use the link below for more information and to register for the event. 👇 https://lnkd.in/erhXdqtu

10

CISA (Cybersecurity and Infrastructure Security Agency) has proposed new reporting requirements for significant cyber events across critical infrastructure sectors, including healthcare. These requirements aim to enhance cybersecurity measures but have raised concerns within the medical community. MGMA (Medical Group Management Association) has suggested that instead of adding duplicative reporting requirements, CISA should collaborate closely with HHS (Department of Health and Human Services) to streamline existing regulations under HIPAA. They also expressed concerns about the proposed size-based threshold, which could impose reporting obligations on smaller physician offices with revenues as low as $9 million annually. Do you agree that collaboration between CISA and HHS could streamline regulatory burdens? #HealthcareSecurity #CISA #CybersecurityReporting

5