Chris Galvan

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

If you took all vulnerability exploitation attempts targeting your organization and grouped them into three buckets of new, active, and dormant - it might look like this. The blue is the proportion of "active" exploits that your sensors have registered in the recent past. Exploits represented by the teal area have been attacked in the past but have gone dormant for a time (it's been a while since you've seen them). The red undercurrent corresponds to new exploits never seen before. My takeaway? Newly exploited vulns get the most *attention*, but the older ones get the most *action*. #infosec #cyber #cybersecurity #vulnerabilitymanagement #vulnerabilities This comes from a brand new Cyentia Institute study exploring years of exploitation activity. It's available here with no registration required: https://lnkd.in/gBbsgwQM

89

13 Comments

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

It's CMMC o'clock. Do you know where your controls are? If you thought you could keep kicking the old CMMC can down the road for another few months or years before having to really deal with it, think again. The timeline for having the CMMC certification requirements in federal contracts has just been accelerated. (Thank you Jacob Horne for spotting the OIRA announcement!) Do you know if your environment could pass CMMC tomorrow? A month from now? Do you know where the gaps are and how to mitigate them? Remember, those indefinite POAMs that never close are a thing of the past now. As the old camping joke goes, I don't need to outrun the bear, I just need to outrun you. Your competitors have been publicly downplaying their CMMC concerns while quietly working to shore up their controls ahead of the deadline. What have you been doing? The real worry isn't just "getting past" the CMMC certification so you don't lose your contracts or a chance to bid on new business. It's thinking you got past the requirements just to find out later you were wrong. In the realm of federal contracts that's called a "false claim," as in the False Claims Act - a criminal offense. It's not just about getting past CMMC. It's about getting there with integrity and credibility. If you're still relying to manually populated spreadsheets or legacy GRC platforms acting as repositories for manually collected artifacts, that compliance confidence you need becomes rather hard to achieve. True end-to-end compliance automation that drastically reduces your reliance on manual evidence collection and subjective interpretation of control posture is the answer. What's the question? Why haven't you implemented compliance automation in your environment? Why indeed. Learn more at https://lnkd.in/ezSb5rGv #cmmc #compliance #cybersecurity #govcon #security #automation

1

Howdy LinkedIn network. I'm looking for tips on a good textbook for building and managing cybersecurity programs. I've been using this book for several years, but it's getting dated in some areas (2015 pub). https://lnkd.in/ecQJChRn I'm looking for something that broadly covers key aspects of a cybersecurity program and isn't bogged down in technical minutia or overly academic. This is for MS of IT and MBA course taken by students who aren't necessarily cybersecurity professionals. I've found it hard to replace the Enterprise Cybersecurity book because so many are focused on one aspect of security programs (e.g., incident response or risk management) and don't really cover all the moving parts and how they fit together. I should also add that the book isn't the sole source of content I use in the course. I add a ton of other resources (mine and others') related to the topics covered. The book mainly serves as a foundation / structure to hang everything on. Please don't respond with comments like "you don't need a cyber degree." Regardless of whether there's merit to that argument, it's not helpful for this request. These students have already made their decision and my job is giving them the most value I can for their money. Appreciate any tips!

33

47 Comments

Getting ready to lead discussions in Boston this week. Come join to talk about supply chain attacks - think about all your devices, not just software - and better security testing in your software development lifecycle.

4

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1

Time to step up protection for federal agencies. If you can monitor it - you can trust it. AI-powered data lake technology allows you to get air tight on which assets you can consider a trusted part of your network. Workloads, users, endpoints, services, data. This is the definition of zero trust. It's the only way to protect our critical infrastructure.

189

4 Comments

It feels like there's a massive data breach being leaked or sold every day now. I don't recall a time like this before. What's going on? I remember when there were months between major database leaks (like during the Ashley Madison era). It seems that although cybersecurity is on everyone's mind and ransomware poses a real threat to businesses, hackers are still able to exploit companies in ridiculous ease. Most of these attacks are due to preventable reasons like poor credential management, lack of MFA, and tokens or secrets left in public or private repositories. How is it that in an industry worth trillions, which understands these problems and sees new startups created every day to tackle these issues, we still see breaches happening daily? *While I agree with Swift about the costliness of holistic cyber-defenses, it is worth emphasizing that most breaches are so easily preventable with proper cyber hygiene (e.g don't let your employees download infostealers on their work computer or save corporate credentials on their home computer). Edit: removed IntelBroker’s recent db examples because idk if they were verified or not.

62

21 Comments

National Institute of Standards and Technology (NIST)'s #NVD has had a lot of chatter lately, with speculation from the private sector about how it's going to collapse. There are a lot of moving pieces definitely, but it seems to me that we levy too much finger pointing at the federal government for this. We have been very fortunate to have a widely successful US-government funded program for 20 years, and an entire industry has been built around the expectation that it's going to still be there. Because NVD is so heavily utilized, we as the private sector have a responsibility to make sure NVD continues to be a success. The consequences are once again having a thousand vendors with a thousand different risk scoring prioritization methods once again. It's like rewinding the clock to 2002, and will encourage monopoly power in the hands of a few cyber vendors whose entire business model is just documenting vulnerabilities and scoring them. Check out my op-ed in the Federal Times on the topic! https://lnkd.in/eRgHpY6c #vulnerabilitymanagement

37

2 Comments

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

Those who are following CMMC have (probably? hopefully?) heard of the DoD Procurement Toolbox and its FAQs regarding cybersecurity. If not, here is a link to the Toolbox: https://lnkd.in/eM9i3pj5 DoD published an update to the FAQs yesterday for the first time in about 4 years. There are some interesting changes, and it is also interesting to see what has not been updated. I am especially intrigued by the United States Department of Defense’s answers to Q15 and Q16. Given all the work with #CMMC and the much anticipated new rules, I would have expected them to update the answers to mention that the assessments are coming. Below is a direct link to the PDF. Thanks to Robert Metzger and Joe Scholefield, CCP for finding and posting this. https://lnkd.in/exEGfxDx

11

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57