Chris Betz

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

A person of interest is someone who has come to the attention of law enforcement officials in connection with a crime. This could be because they were seen near the crime scene, knew the victim, or have a criminal history. However, a person of interest has not yet been arrested or charged with a crime. Investigators will typically gather more information about a person of interest before deciding whether to pursue charges. Here are some of the reasons why someone might become a person of interest: · They were seen near the crime scene around the time it took place. · They have a history of committing similar crimes. · They knew the victim well. · They lied to investigators about their whereabouts or activities. · They have suspicious financial activity linked to the crime. It is important to note that being a person of interest does not mean that someone is guilty of a crime. Law enforcement officials investigate many people during a criminal investigation, and most of them are never charged. If you are ever contacted by law enforcement officials and told that you are a person of interest, it is important to be polite and cooperative. However, you should also consult with an attorney to protect your rights. You have the right to remain silent and the right to an attorney. https://lnkd.in/dJZSRkpT

16

1 Comment

If you are in the #insiderrisk #insiderthreat space or you find it interesting, this is indeed the conference you MUST attend! Please find registration information below and stop by our booth! #cybersecurity #zerotrust #dtexsystems #insiderrisk #insiderthreat

2

Happy #CMMC Day! Quick thoughts on the rule from my first pass at a read below. In short, exciting times, and it puts me back in a bit of nostalgia remembering the early DFARS 7012 days and the first whispers of "CMMC" on some webinars. What a process it's been. See the rule here: https://lnkd.in/grPxUnTx Anyway, my thoughts: Chiefly, I see a number of smart, common-sense determinations from DoD on some major architectural concerns we had. On the concern regarding managed services providers like Sentinel Blue possibly being deemed in scope for FedRAMP requirements, we see language that make much clearer that the services we provide to our partners does not scope us in for FedRAMP. On the concern that tools we use to provide security protection to our partners, deemed security protection assets, would require full implementation of all 110 requirements, we see language that provides a much more reasonable interpretation, allowing SPAs to only be assessed against security requirements that are “relevant to the capabilities provided” On the concern that virtual desktop infrastructure may be scoped in a way that would require us to protect the “dumb client”, or the computer you open the virtual desktop from, we see language where DoD has made clear that we can keep those assets scoped out using appropriate technical controls to prevent data transfer. On the potential requirement for Sentinel Blue to achieve CMMC Certification before any of the partners we support could achieve theirs, the final rule no longer creates any requirement that Sentinel Blue and MSP/MSSPs even need a CMMC Certification. That’s a significant change that shifts things around a bit. These are good moves on the whole, and I think improve things for the DIB vs. the way things were looking. #msp #compliance #cybersecurity #cmmc #dfars #dib

56

5 Comments

Here's what HashiCorp's ~$6B sale to IBM can tell us about the fate of more than 20 other cybersecurity companies. (HCP is squarely in the "hybrid" company category — more infrastructure than security, but still very relevant to our industry, so let me have this one!) The $3-5B valuation range is easily the most polarized (and treacherous) for both our public and private companies right now. We have ~20 public and private companies valued between $3-5 billion. All but two of them are *private* (including both VC-backed and PE-owned companies). This means a few things: → VC-backed companies are either IPO candidates or...who knows. Several 12 VC-backed companies in this valuation range are right in the mix of cybersecurity's IPO pipeline. Rubrik is going public any day now at a $7B+ valuation. Acronis, Arctic Wolf, Cato Networks, Forter, and Socure have all shared plans to go public. The other six have raised significant capital and likely have the time and runway to grow into IPO candidates. They might be 3+ years out from going public. Timing doesn't matter if they use it to become sustainable companies long-term, but it also means they could get stuck. → Most of the PE-backed companies in this range will probably go public again. Five companies in this range (now owned by private equity firms) used to be public companies. Each of them needed to take a minute and work on some things outside the public eye. Most of these companies will either get back to public markets (eventually) or become large strategic acquisitions — especially with the track record of Thoma Bravo (Sophos), Vista Equity Partners (KnowBe4), and KKR (Barracuda Networks). All of these companies are early in their PE holding period, so there's no rush to sell before they have their scale, predictability, and story figured out. → It's basically "up or out" for public cybersecurity companies in the $3-5B valuation range. We had 11 public companies in this valuation range at the end of 2021, including both "pure" and "hybrid" companies. Now, we have two (Commvault and Darktrace, or four if you stretch and include Varonis and Rapid7). The rest of the companies who crossed through this range either (a) went through the roof and went on to much higher valuations, (b) stayed public but got corrected to lower valuations, or (c) were taken private. --- The biggest takeaway from HashiCorp is this: companies in the $3-5 billion valuation range (give or take) have to perform across the board — growth, profitability, vision...everything. Anything less than excellent is a tough spot to be in, at least until the expectations of public market investors relax a bit.

201

9 Comments

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

Your files are dying. That SSD you keep in the closet, the one from your old system "just in case". Yup, degrading as we speak. SSDs are *shockingly* bad at power off retention, esp if it's near it's endurance rating. The JEDEC standard only requires 1 year of unpowered data retention at 30C after max TBW (writes). --- Now here is where physics starts to get goofy. The conductivity of a semiconductor scales with temperature, and electrons have a nasty tendency of floating out of their gates. Powered-on retention is *better* at higher temperatures, Power-off retention is better at lower temperatures. If your closet stored SSD is hot, (like, crazy hot, 55C+), the data retention decreases to less than a week! In other words, MLC NAND likes to run hot, but be stored cold. --- Yes, I'm mostly trying to scare you into backing up your data actively. Cold storage is not a solution. It's not all doom and gloom however. Thankfully, retention goes way up when a drive is closer to new. If you're not close to the max TBW, and storing the powered off drive at a reasonable temp, you start to hit 10+ years of retention. Even so, I wouldn't risk it. Whether spinning rust or the newest SSD, an active archive is a happy archive.

577

36 Comments

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

Hey everyone, here is where we will begin really digging into the details of #CMMC levels. My full post is here: https://lnkd.in/gZKXAY3C I tried to not be too wordy and dry, but there's only so much you can do with government regulations (even with 10+ years of experience with them, I can only do so much). For a quick summary, level 1 focuses on mostly basic hygiene requirements. It does bring in physical security as part of cyber, which I was happy to see. The most technical requirements are probably the segmentation and malicious code monitoring/scanning parts. Even for companies without DoD contracts, I would probably recommend that level 1 be followed just as a general minimum level of protection. All of these requirements will be a part of levels 2 and 3 as well, and we'll see a big jump in complexity for level 2 next week.

8

1 Comment

Interesting #scam. Adding some details for clarity: 1. Scammer cuts out part of the gift card that contains the actual redemption code, and returns the card to the rack. 2. Innocent victim buys that card. Once payment is made, the card becomes active. 3. Unclear: How does the scammer know about the activation? I assume they try the redemption code every few days. 4. Either way, the person who bought the card is out of the money. According to the FTC, there may be a possibility to get the money back. if a gift card scam happens to you, act fast: Report it to the gift card company. Tell them you were scammed. Give the gift card company the information from your receipt or a copy of the numbers on your gift card. Ask for your money back. Once you report a gift card scam to the gift card company, ask for your money back. If the money was frozen or not downloaded by the scammer, some gift card companies will give the money back. Tell the FTC. Your report makes a difference and helps #stopscams. Link to FTC page in comments #giftcard #scam #cutout

490

42 Comments

It was an honor to be asked to collaborate on this piece with Automation.com. I hope it helps others understand the past, present and future state of securing critical infrastructure. I reference the "past" because as the Chief OT Strategist here at Cyolo I must understand our customers and industry trends on all levels. Living with the mindset of "those who forget the past are destined to repeat it" we must never forget the impact it truly has on the present and future state of ICS/OT. This articles vision is where things are going (hence the title) but no one has a crystal ball into the future. But if we look into the past at people, process and technology, trends and patterns do occur. I welcome your thoughts and feedback on the article and I look forward to the chance to write more thought leadership in the future. #criticalinfrastructure #icssecurity #cisa

8

👾 If you have the book, please share a pic of your little reader and their thoughts + favorite chapter(s)! (Or if you're a CISO that read it to brush up on skills via the acronym and terminology index, power to you. Please share your experience too.) 👾 So many people ask me how I was able to write a book as an 8-year-old. My response? "How dare you make eye contact and speak to me." This is a showcase of my amazing Kiwi humour—it doesn't make sense, no one really wins from the joke, it's not even funny—but it brings me joy. Order your copy today through the website—it's the title of the book plus dot com dot au. You have to work for that purchase because LinkedIn hates external links now, apparently. Include a note in the checkout if you want me to customize a love letter on the inside cover. Co-written by Craig Ford and me, this book tackles digital safety and awareness through engaging short stories. We address serious topics subtly so kids understand the importance of online safety—topics like sextortion, photo sharing, email scams, viruses, password importance, and much more. All done with the hope of sparking interest in a career within IT. #DigitalSafety #CyberAwareness #ChildSafety #CareersInIT #OnlineSafetyForKids

81

18 Comments

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

43

1 Comment

A so-called "Sleepy Pickle" attack is performed with a tool like Flicking. Flicking is an open-source program for detecting, analyzing, reverse engineering or creating malicious Pickle files. An attacker merely has to convince a target to download a poisoned .pkl via phishing or supply chain compromise — and then, upon deserialization, their malicious operation code executes as a Python payload. https://lnkd.in/gcY6tU6B #informationsecurity #cybersecurity #technology #cyber #cybersecuritytraining #cyberawareness #usarmy #usmarines #usmc #usairforce #airforce #usnavy #navy #uscg #coastguard #military #veterans  

1

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

In a recent development, US Intelligence sources have attributed a cyber attack on the Trump campaign to Iran. This attack targeted Roger Stone with email infiltrations, as corroborated by reports from Microsoft and Google detailing Iranian APT involvement against both presidential campaigns. This revelation underscores the increasing sophistication and boldness of state-sponsored cyber threats, emphasizing the importance of robust cybersecurity measures in political campaigns and beyond. The attribution of the attack to Iran highlights the geopolitical implications of cyber warfare, demanding heightened vigilance and proactive defense strategies against such nation-state actors. As cybersecurity professionals, it is imperative to stay updated on these evolving threats, leveraging threat intelligence, and employing advanced security measures to safeguard critical assets against highly capable adversaries like Iranian state-sponsored threat actors.

2

We do a lot of security questionnaires. Increasingly, we see AI Questionnaires attached to security questionnaires and procurement flows. Many assume companies use AI. There is no "yes" / "no" option, just "explain how you train your models" or "how do you prevent using our data from training your models". The same questionnaires that assume companies use AI don't even assume the company encrypts data but ask whether the company does encrypt data before asking "how do you encrypt data at rest". #ai #trust #iso42001

7