Bryce Slaughter, CISSP

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Its #tsatuesday! If we're going to get this trending, I need to introduce some consistency. So for week 2 - Lets get those Overarching Security Measures completed in one fell swoop. Could we call these these commandments? Maybe it will help. Maybe it won't. M1.02: Thou shall have an appreciation of whats in your network, and you should have a look at pretty often. But don't look at CPE's! Scanning of CPE's is a bit naughty as you might not have permission from the user of that CPE to do it. M1.03: Thou shalt not put important stuff in areas where you don't have full control. M1.04: Thou shalt not put important stuff next to stuff you don't have control over. Unless you've put some things in the way! M1.05: Thou shall think about the controls you have in place, and have the proper governance around control and procedures to control them M1.06: Thou shall not allow something that you've not got full control over, to control something within your core network that could have catastrophic impact to the rest of your business. Kinda works? #tsa #tsatuesday #security #cyber

17

12 Comments

My book 📚 "Incident Response with Threat Intelligence" is also included in this promotion 🤓

65

7 Comments

Help Us Secure Our World this Cybersecurity Awareness Month - Middle Tennessee State University (MTSU) FAST FACTS According to the National Cybersecurity Alliance 2023 Oh Behave! report: 1. 84% of people considered online safety a priority. 2. Only 38% of people use unique passwords for all their accounts. 3. About a third of respondents began using a password manager after receiving cyber training. 4. 79% of respondents were familiar with multifactor authentication. 5. 70% of those who have heard of MFA security measure know how to use it. 6. Only 36% of people always install software updates when they become available. 7. 69% of people express confidence in their ability to identify phishing attempts. 8. 51% of Americans actively report cybercrimes, particularly instances of phishing. October is Cybersecurity Awareness Month, an international initiative that educates everyone about online safety and empowers individuals and businesses to protect their data from cybercrime. Even amidst large-scale data breaches and cyberattacks, Cybersecurity Awareness Month reminds everyone that there are simple, effective ways to keep yourself safe online, protect your personal data, and ultimately help secure our world. Middle Tennessee State University (MTSU) is proud to be a Champion and support this online safety and education initiative this October. The theme of Cybersecurity Awareness Month is Secure Our World! This initiative reminds us that there are simple actions we can take every day to protect ourselves, our families, and businesses from online threats. Cybersecurity Awareness Month focuses on the top four ways to stay safe online: 1. Use strong passwords and a password manager 2. Turn on multifactor authentication 3. Recognize and report phishing 4. Update software Cybersecurity Awareness Month is led by the Cybersecurity and Infrastructure Agency (CISA) and the National Cybersecurity Alliance. For more information about ways to keep you and your family safe online visit https://lnkd.in/gbVrwN7q and https://lnkd.in/guzwsh_8. #MiddleTennesseeStateUniversity #MTSU #ComputerScience #CybersecurityAwarenessMonth #SecureOurWorld

18

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

55

6 Comments

Reading, spelling and reading comprehension are integral to success in jobs requiring concise documentaion. Cybersecurity reports and documents may be used for future reference in security operation or criminal prosecution. #The more you know...!🤔

13

2 Comments

Over the next few days I’ll review my approach to PCI 4.0 Targeted Risk Analysis (TRAs) 12.31 Control. First, I didn’t use the PCI DSS v4.x Sample Template for TRAs. I felt somewhat limited by the “box” for the amount of information I wanted to enter. The language on the form doesn’t match that in Control 12.31.1, which doesn’t make sense to me. I moved to a blank page with the TRA Control number (12.10.4.1) at the top and the text of the TRA underneath. This lets everyone know what is being “targeted”. Next comes the six Elements of the TRA. The six elements listed in Control 12.3.1 that are required for each TRA. Tomorrow I’ll start with Element 1 data.

2

Erich Kron - I have immense respect for @KnowBe4's honest and open approach regarding their recent hiring incident involving a North Korean cyber threat. This situation offers a crucial lesson for all businesses—whether small, medium, or large—that depend on remote talent for their workforce. As they highlighted, their endpoint protection successfully detected and contained the breach early, showing the importance of identity proofing as a key process for preventing such incidents. Together, these measures are incredibly powerful in helping businesses protect themselves from cybercriminals. 🔒👨‍💻 #CyberSecurity #RemoteWork #DataProtection #ThreatDetection #BusinessSecurity

2

1 Comment

Great supply chain attack example & its wild. I'm seeing some of these alerts that led me down the rabbit hole. policytype="policy" srcport=51642 dstport=443 attack="malicious-url" direction="outgoing" user="JohnDoe" authserver="fsso collector" msg="URL blocked by malicious-url-list" profile="IPS" crscore=30 craction=8192 crlevel="high" hostname="cdn.polyfill.io" url="/" https://lnkd.in/gxTp3JhX

1

Good overview of the #CMMC Program Rule Finalization and its implications. https://lnkd.in/e9acmg8U

11

Here is how I am helping ambitious security leaders create more career opportunities. I am often asked "what do you teach people?" So here is a little breakdown. My program has 2 parts; Part 1 - Is all about creating value & how to communicate it. - Documenting your achievements & results. - Ensuring everything you do aligns with business objectives. - Communicating that value and building relationships. - Recruiting high performing teams. - How to create more influence. These topics are key to helping you negotiate & climb the ladder. Part 2 - Is about your personal profile. - Building your LinkedIn. - Creating a CV that sells. - Your leadership brand. - Thought leadership. Without these how can you show your value at first glance. Everything is designed to intertwine and link together. Coaching is one of the most rewarding jobs I have ever done. I get to help people succeed and build deep relationships. And I have had some amazing feedback which I can't wait to share! Lots of enquiries about 'The Security Leadership Blueprint' Very excited to help more people!

21

1 Comment

CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth EXECUTIVE SUMMARY In early 2023, the Cybersecurity and Infrastructure Security Agency (CISA) conducted a SILENTSHIELD red team assessment against a Federal Civilian Executive Branch (FCEB) organization. During SILENTSHIELD assessments, the red team first performs a no-notice, long-term simulation of nation-state cyber operations. The team mimics the techniques, tradecraft, and behaviors of sophisticated threat actors and measures the potential dwell time actors have on a network, providing a realistic assessment of the organization’s security posture. Then, the team works directly with the organization’s network defenders, system administrators, and other technical staff to address strengths and weaknesses found during the assessment. The team’s goal is to assist the organization with refining their detection, response, and hunt capabilities—particularly hunting unknown threats. In coordination with the assessed organization, CISA is releasing this Cybersecurity Advisory (CSA) detailing the red team’s activity and tactics, techniques, and procedures (TTPs); associated network defense activity; and lessons learned to provide network defenders with recommendations for improving their organization’s detection capabilities and cyber posture. During the first phase, the SILENTSHIELD team gained initial access by exploiting a known vulnerability in an unpatched web server in the victim’s Solaris enclave. Although the team fully compromised the enclave, they were unable to move into the Windows portion of the network due to a lack of credentials. In a parallel effort, the team gained access to the Windows network through phishing. They then discovered unsecured administrator credentials, allowing them to pivot freely throughout the Windows environment, which resulted in full domain compromise and access to tier zero assets. The team then identified that the organization had trust relationships with multiple external partner organizations and was able to exploit and pivot to an external organization. The red team remained undetected by network defenders throughout the first phase. The red team’s findings underscored the importance of defense-in-depth and using diversified layers of protection. The organization was only able to fully understand the extent of the red team’s compromise by running full diagnostics from all data sources. This involved analyzing host-based logs, internal network logs, external (egress) network logs, and authentication logs. The red team’s findings also demonstrated the value of using tool-agnostic and behavior-based indicators of compromise (IOCs) and of applying an “allowlist” approach to network behavior and systems, rather than a “denylist” approach, which predominantly results in an unmanageable amount of noise. The red team’s findings illuminated the following lessons lea...

1

🚨 Man Hacks State Registry to Fake His Death Jesse Kipf, a 39-year-old from Kentucky, hacked the Hawaii Death Registry System to fake his own death to avoid child support payments. Top 4 takeaways: ⚡️ He used stolen credentials of a physician to create a false death certificate and accessed various networks to sell information on dark web markets. 🧑‍⚖️ Kipf was sentenced to 81 months in federal prison and must serve at least 69 months. He will also be under supervision for three years after release. 💸 The total damage from his actions, including unpaid child support, is estimated to be over $195,7502. 👮 The case was investigated by multiple agencies, including the FBI and the Attorney General’s Offices of Kentucky and Hawaii. #cybersecurity #news #hacking #StateRegistry #FakeDeath #scam #kraven #KravenSecurity #adamgoss #cti #threatintelligence

1

After querying the regulations.gov CMMC DOD-2023-OS-0063 docket and analyzing every public comment attachment (142), two things became very apparent: 1. Most people with positive comments or negative comments with constructive suggestions for improvement identified themselves by name and/or organization. 2. Most people with negative comments with little to no constructive suggestions for improvement attempted to post anonymously but forgot to remove the author metadata from their uploaded pdfs and docx files. #CMMC #CyberSecurity #InformationSecurity #privacy #GotSecurity? #DoD

24

1 Comment

Those who are following CMMC have (probably? hopefully?) heard of the DoD Procurement Toolbox and its FAQs regarding cybersecurity. If not, here is a link to the Toolbox: https://lnkd.in/eM9i3pj5 DoD published an update to the FAQs yesterday for the first time in about 4 years. There are some interesting changes, and it is also interesting to see what has not been updated. I am especially intrigued by the United States Department of Defense’s answers to Q15 and Q16. Given all the work with #CMMC and the much anticipated new rules, I would have expected them to update the answers to mention that the assessments are coming. Below is a direct link to the PDF. Thanks to Robert Metzger and Joe Scholefield, CCP for finding and posting this. https://lnkd.in/exEGfxDx

11

A few weeks ago, I wrote a post sharing research breaking down exposures across enterprise and cloud infrastructure. By volume, the majority of exposures affected Active Directory but the most critical exposures were found in cloud environments. (see https://lnkd.in/euvfKvGJ) I wanted to follow that up with a similar view comparing the distribution of critical exposures among different industries. Per the attached chart, about half of the industries shown follow the overall pattern of Cloud > Active Directory > IT/Network devices. But there’s quite a bit of variation and some sectors buck that trend entirely. For example, very few of the critical asset exposures affecting the Energy, Transportation, and Healthcare sectors are in the cloud. On the other hand, the share of critical exposures in cloud environments is much higher than average in the Agriculture and Manufacturing industries. I share this because the diversity and sprawl of the modern attack surface make it difficult to answer seemingly simple questions like "Where are our critical exposures?" And the fact that every industry's or organization's answers will vary makes answering it all the more difficult and important. If you'd like to see more on what we learned from analyzing exposures from tens of thousands of attack path assessments, download the full report from Cyentia Institute and XM Cyber here: https://lnkd.in/dPfqXG7y #exposuremanagement #vulnerabilitymanagement #cyberrisk

40

3 Comments