Caleb Barlow

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

This is such an important reminder of why all orgs need to take cybersecurity and ransomware resilience seriously, and resource and prepare accordingly. If you need help, our team at Gate 15 is here. 👋🏼 New York Attorney General Letitia James and the attorneys general of Connecticut and New Jersey today secured $4.5 million from Enzo Biochem, Inc. (Enzo) for failing to adequately safeguard the personal and private health information of its patients… The Office of the Attorney General (OAG) found that Enzo had poor data security practices, which led to a ransomware attack that compromised the personal and private information of approximately 2.4 million patients… - Attackers were able to access Enzo’s networks using two employee login credentials. - Two login credentials were shared between five Enzo employees and one of the login credentials hadn’t been changed in the last ten years, putting Enzo at heightened risk of a cyberattack. - Once logged in, the attackers installed malicious software on several of Enzo’s systems. Enzo was not aware of the attackers’ activity until several days later because the company did not have a system or process in place to monitor or provide notice of suspicious activity… As a result of today’s agreement, Enzo has agreed to pay a $4.5 million penalty, of which New York will receive $2.8 million, and adopt a series of measures aimed at strengthening its cybersecurity practices going forward. https://lnkd.in/gGaznec6 #cybersecurity #ransomware #resilience #preparedness #liability #gate15 #newyork #criticalinfrastructure #homelandsecurity

3

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

Our latest article dives into the specific penetration testing mandates under the #NYDFS Cybersecurity Regulation known as 23 NYCRR 500. We explain what’s required, recent regulatory updates, and how to effectively integrate these requirements into your cybersecurity program to maintain compliance.Get the insights you need—read the full article on our website. #CyberSecurity #Compliance #NYDFS #PenetrationTesting #FinancialServices

4

Marketing & e-commerce best practices need to evolve. If you have to trick people or withhold information to convert a sale, that should tell you something about the true value of what you're selling.

5

The Environmental Protection Agency lacks a documented plan to coordinate incident reporting with CISA, the agency’s Office of Inspector General found. Environmental Protection Agency officials found critical or high-risk vulnerabilities in 97 drinking water systems that serve more than 26 million people across the U.S., according to a report released last week by the agency’s Office of Inspector General. Another 211 water systems, servicing almost 83 million people, had medium-to low-risk vulnerabilities, including open portals that were visible from the outside. These water systems could face major disruptions or physical damage if a malicious hacker tried to exploit those vulnerable systems. The OIG report noted the EPA does not have an incident reporting system and relies on the Cybersecurity and Infrastructure Security Agency’s system. The OIG also could not find documented policies and procedures for how the EPA coordinates with CISA and other federal agencies to address these issues. #criticalinfrastructurecyberrisk #cyberriskmanagement #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

Thanks to @Scott Small and Wade Baker, Ph.D. and the teams at Tidal and Cyentia. To my fellow cyber risk quant folk you know how strongly we drive our partners and customers to define risk scenarios using specific threat actors and/or specific TTP’s to enhance the accuracy of likelihood determination! The work both organizations are doing to help articulate the TTP’s being used for ransomware attacks can help provide a greater level of defensibility of your results. By executing adversarial simulation using these TTP’s increasingly accurate likelihood can be attained.

4

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

Tracking your SPRS score doesn't have to be a guessing game. Victor Cich, Compliance Consultant at RADICL, explains how our platform’s live SPRS score calculator simplifies NIST 800-171 compliance. With real-time updates, you can easily monitor progress, identify roadblocks, and ensure your team stays on track. In this clip, Victor walks through how our tool makes compliance management effortless for both teams and executives. How are you tracking your compliance progress? #SPRS #NIST800171 #CyberSecurity #Compliance #RealTimeTracking #RADICL

6

If you took all vulnerability exploitation attempts targeting your organization and grouped them into three buckets of new, active, and dormant - it might look like this. The blue is the proportion of "active" exploits that your sensors have registered in the recent past. Exploits represented by the teal area have been attacked in the past but have gone dormant for a time (it's been a while since you've seen them). The red undercurrent corresponds to new exploits never seen before. My takeaway? Newly exploited vulns get the most *attention*, but the older ones get the most *action*. #infosec #cyber #cybersecurity #vulnerabilitymanagement #vulnerabilities This comes from a brand new Cyentia Institute study exploring years of exploitation activity. It's available here with no registration required: https://lnkd.in/gBbsgwQM

89

13 Comments

Risk is handled through Avoidance, Acceptance, Mitigation, and Transfer. A CISO cannot avoid business risk, and must deal with it. Mitigation is what you do in your #cybersecurity program, which leaves Transfer and Acceptance. Without adequate #CyberRiskQuantification, you have no idea what you're doing. It is critical to get this right, or you could be in very serious trouble.

15

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Great PoC linking real-life identities to consumers of CSAM based on Infostealer infections. We did something similar at Hudson Rock, linking real-life identities to cybercriminals and even received a shoutout in Recorded's research. Infostealers contain troves of data from millions of infected computers, which can be used for various types of investigations. Expect even more cool Infostealer-related use cases to surface.

8

1 Comment

The proposed rule would also require the disclosure of cyber incidents to CISA and physical security concerns to TSA. The Transportation Security Administration is seeking public comment on proposed requirements for surface transportation and pipeline companies to implement cyber risk management programs, the agency said Wednesday. The public comment period ends on Feb. 5, 2025. The proposed rule calls for certain pipeline, passenger and freight rail operators and rail system companies with high-risk profiles to develop comprehensive cyber risk management programs. Pipeline, rail and certain bus transportation or transit systems would be required to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency. The sectors would report any physical security risk concerns to TSA. #criticalinfrastructurecyberrisk #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

1 Comment

I’ve been telling folks for years to prepare for DPIAs to become public one way or another. It’s not a secret filing. Shrewd privacy and communication professionals will recognize the opportunity to counsel organizations on how to stop creating & hiding skeletons in the closet. Because when DPIAs become public, everyone will know what you know, including: - how honest & thorough you were from the jump (or did it take 5 versions to meet the requirements?) - known risks you haven’t told them about yet - how transparent you are with regulators - how you evaluate tradeoffs - if you have command of both technical & legal controls

5

If anyone needed an explanation on the raise of #impersonation scams, this video should show the level of easy scaling criminals have access too. https://lnkd.in/ejnWFyau An entire upside-down industry exist to build and sell this kinf of tooling. Our predictions grow in volume weekly, the velocity and variety of attacks continue to raise. Reactive solutions are more and more showing the limit of real time processing. #PreCrime #predictiveintelligence #cybersecurity #PreemptiveDefense

43