Charles Danley

I see TAs looping over wevtutil and deleting event logs on any.run and various reports. Why? Anyone wants to fill me in - please let me know. I get the action is defense evasion. Most orgs send logs to a SIEM. Are they catching and deleting the logs prior to the SIEM push? Let me know. #cybersecurity

1

Thanks to the good people at Claroty, I found services that list OT/ICS attacks! Some great material here: Newsfeed style: https://icsstrive.com/ Database: https://lnkd.in/e8KM7fJw, https://lnkd.in/eJkM9UYJ But what's interesting? None of them are complete... There was an attack on a Texas water treatment plant in January by, potentially, SANDWORM. It's not on either list. Complete databases will help us with complete information that will need to better decision-making and a fuller intuition. So, if you know of attacks that are not on these lists, use the Report button to add them. #cybersecurity #otsecurity

8

HIPAA Audits Are Back! 👀 The OCR announced HIPAA audits in 2024, focusing on data protection and compliance. Much like the last phase in 2016, they will be reviewing several covered entities and business associates for their compliance with HIPAA security mandates (Title II). Audits will cover: 📋 Risk analysis and management 📱 Information system reviews ✅ Device and media controls 🚨 Security incident procedures HHS has furnished resources for evaluating your adherence to HIPAA regulations to ensure it is in line with expectations. It is highly advised that you assess your current status and confirm that you are in compliance.' #HIPAACompliance #DataProtection #HealthcareSecurity #OCRAudits #PatientPrivacy

61

6 Comments

In my July 1, 2024 blog post, Accountability for Cyber Risk Management: A Critical Imperative for C-Suite Executives and Board Members (https://lnkd.in/gG5Yt2i6), I wrote about the lack of accountability for strong cyber risk management across all industries. This "hall pass" may be going away in healthcare with the introduction of a new bill, the Health Infrastructure Security and Accountability Act by Senators Wyden and Warner. See: https://lnkd.in/eknVc9zs FINALLY! YAY! Hopefully, this bill will pass and provide overdue air cover and support to all the CISOs, CPOs, CROs, CCOs, et al out there! The bill includes a section similar to the SOX requirement on CEOs and CFOs: "(v) provide a written statement signed by the chief executive officer and chief information security officer (or equivalent thereof) stating that the covered entity or business associate is in compliance with security requirements adopted under part 160 of title 45, Code of Federal Regulations, and subparts A and C of part 164 of title 45, Code of Federal Regulations (or a successor regulation), including the applicable security requirements adopted under paragraph (1)(B)." It will take some time, but it's a great start! #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

16

1 Comment

What tools do you know of that allow building SSVC decision trees at scale? Do any exist? I believe some vendors in the risk based vuln mgmt sector can utilize rules to build some level of decision tree.. But I'm not sure how deep that goes. - Does anyone know tools that help with this? - If you are currently doing SSVC, what technology are you using to accomplish it across hundreds of thousands of vulnerabilities with and without CVE's? #VulnerabilityManagement #SSVC #Security #CVSS #CVE

17

17 Comments

The updated CMMC Level 2 assessment guide (version 2.11—Draft) removes all references to Level 1 and "FCI." You won’t find any "Level 1" or "FCI" references in this version; even the Level 1 control numbers from version 2.0 have been renumbered as Level 2 controls. For example, AC.L1-3.1.1 has been renumbered to AC.L2-3.1.1. This means that if the draft version 2.11 moves forward, CMMC Level 2 assessments will no longer include or consider any Level 1 controls—everything assessed will pertain solely to Level 2. CMMC Level 2 Assessment Guide version 2.11-Draft: https://lnkd.in/gChjdzCK What's your thought? KLC Consulting - Authorized CMMC C3PAO KLCConsulting.net [email protected] #CMMC #Cybersecurity #Level2 #AssessmentGuide #DefenseContracting #NIST #InformationSecurity #CyberResilience #RiskManagement #SecureSupplyChain #DoDUpdates #GovernanceRiskCompliance #SecurityFramework #CyberStandards #DefenseIndustry #CriticalInfrastructure #DefenseInnovation

41

27 Comments

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

CISO reporting to 'The Board'...Scary? Yeah probably. It should be. Its real accountability, and an open challenge to your visions and strategies, and your ability to execute accordingly. As a CISO, I often get questions about how to present to 'The BoD' directly. Truth is, there's no single model - Every business is different, and every Board is different. But you know that already cuz you're in a position of leadership and discernment for a reason :) The right message always remains the same- How does your own leadership role, function, and focus contribute to the greater good of the organization? How does it help the business to determine where and how to accept and navigate risk? Not just avoid it. Sounds simplistic. But you may be surprised how many CISO messages don't answer that basic inquiry sufficiently. Your message, at this level, needs to clearly align to a broader forward-looking strategic narrative. If it doesn't, it doesn't resonate, and you haven't positively moved the needle. You never want to be the best checkers player in a chess match. I’m looking forward to demystifying this exact topic at the CISO ExecNet National Member Symposium July 23rd at the Willis Tower in Chicago with colleagues Eric Galis, Susanne Elizer Senoff, and Michael Calderin. #cisoexecnet #ciso #executiveleadership #boardreporting

131

7 Comments

I'm starting a series of articles about Open Bullet 2: fraudsters' favorite tool to conduct credential stuffing attacks. https://lnkd.in/guY_t-B2 In this first article, I give an overview of Open Bullet 2, and its main features, in particular the integration with CAPTCHA farms and the possibility of importing credential stuffing Loli script. The next articles will probably be a bit more technical, e.g. to investigate the fingerprints of Open Bullet with Selenium/Puppeteer, and if attackers can easily modify them from Open Bullet to bypass detection.

29

4 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

58

CMMC Level 2 Assessment Objective: Data in Transit PRACTICE: Organizations must implement cryptographic mechanisms to prevent unauthorized disclosure of controlled unclassified information (CUI) during transmission unless otherwise protected by alternative physical safeguards. ASSESSMENT: The intent of this requirement is to ensure CUI is cryptographically protected during transit, particularly on the internet. The most common way to accomplish this is to establish a transport layer security (TLS) tunnel between the source and destination using the most current version of TLS. Because the use of cryptography in this requirement is to protect the confidentiality of CUI, the cryptography used must meet the criteria specified in requirement SC.L2-3.13.11. Be prepared! Your assessor could ask to 🔍 EXAMINE system and communications protection policy. 🗣 INTERVIEW system or network administrators. 📝 TEST cryptographic mechanisms or mechanisms supporting or implementing transmission confidentiality. (CMMC Assessment Guide: Level 2 Version 2.11, page 222) #CMMC #DoD #cybersecurity #NIST #InformationSecurity https://bit.ly/45HMpUs

41

🚨 Key Insights from the SANS Institute 2024 State of ICS/OT Cybersecurity Report 🚨 The ICS/OT landscape is evolving rapidly, with significant takeaways for organizations aiming to enhance their security posture. Some of the highlights: 🔹 Knowledge Transfer is Critical: Over 50% of the ICS workforce has less than five years of experience. This highlights the growing need for mentorship and structured knowledge transfer to ensure we build a skilled workforce for the future. 🔹 Governance & Security Programs: Where the CISO owns ICS security, 82% of programs are aligned with industry standards. In contrast, only 42% of organizations without corporate-wide policies have mapped their ICS programs to such standards. Governance clearly plays a vital role in ensuring comprehensive security. 🔹 IT-OT Convergence in Budgets: Over the past five years, we’ve seen a clear shift in budget allocation towards shared IT-OT security. In 2024, 38% of organizations report having a joint IT-OT security budget, up from just 29% in 2019. This shows how collaboration between IT and OT is becoming more crucial than ever. 🔹 ICS Monitoring = Better Visibility: Organizations that map their ICS programs to standards and invest in extensive ICS monitoring are 53% more likely to have fully documented all external connections to their industrial environments. This is a clear sign of how proactive monitoring leads to better visibility and risk management. At BlueWater IT Solutions Pvt Ltd, we’re focused on helping industrial clients navigate these evolving challenges by providing Vulnerability Assessment and Risk Management services. We believe the key to success in ICS/OT cybersecurity lies in fostering collaboration between IT and OT teams, and aligning with global standards. Contact Preeti R for more details! Thanks OT Security Furious Warrior for developing a common platform for us. #ICS #OTSecurity #CyberSecurity #ITOTConvergence #SANS2024 #BluewaterITSolutions

3

An Open Letter to ISC2 [This is abridged, with link to full text and refs in comments] In response to my post on ISC2 ignoring the hard times experienced by cybersecurity pros, Debra Taylor, replied with a link to the data she referenced, citing the demand of more than 1,000,000 new professionals. It contradicts everything she claimed. This is a serious issue that implies a gross misrepresentation of the data, intentionally or unintentionally. Intentional implies a gross lack of ethics by ISC2, while unintentional implies gross incompetence. Neither is acceptable. Summarizing the problems with ISC2’s presentation of the data, the major issue is the use of the word “Demand” versus “Need”. ISC2 refers to a “Workforce Gap” of 4.8M people. This is an imaginary gap based upon what ISC2 assumes employers need, not what they will pay for. This is a HUGE problem. Even assuming ISC2’s determination of the “NEED” is accurate, it is not “DEMAND”. Buried in ISC2’s document, in very tiny font, is the disclaimer: “The ISC2 Cybersecurity Workforce Gap is an estimate of the number of people needed globally to adequately secure organizations. The workforce gap is not an estimate of open positions or cybersecurity jobs available.” They acknowledge their data misrepresents reality. Worldwide employment is flat. Their numbers show a total increase of 4,442 cybersecurity pros globally, an increase of .08%. While there was a 60,000 job growth in the Middle East and Asia, it was offset by 60,000 jobs lost elsewhere. There is not a “Demand” gap. ISC2 is knowingly pushing a false narrative of a plentiful job market, which is both unethical and insulting to the members suffering from long-term unemployment. They are monetizing the reputation of members to mislead naïve, entry level people into believing that people are going to throw money at them. The business model is to convince 1,000,000 entry level people to pay $50/year to renew their would-be CC certifications. That would be ok, but they are misleading the target audience, or worse, blatantly lying to them, about the reality of pursuing the profession at this time. Here is what the board needs to do, as ISC2 is apparently itself in turmoil. ISC2 should: · Stop the fraudulent promotion of “estimated” “gap” and focus on the reality of the employment outlook · Perform and promote studies about the cost benefits of implementing proper cybersecurity programs · Promote the benefits of hiring certified people · Create efforts to help long-term unemployed members IMHO ISC2 is losing credibility and turning itself into a predatory business. It has lost its core focus and the board needs to get it back. While board membership is usually a set of formalities, misinterpreting data to this magnitude and misleading people with the data, demonstrates the need for more active oversight and action by the board. ISC2 needs its credibility more than $50M. I can’t believe I am the first person to look at the data in detail.

262

44 Comments

I wonder how many SIEM vendors out there are sweating how GenAI will auto-magically translate data normalizations and field extractions, detections, reports, and dashboards between different products to make SIEM replacements far easier to do. I think they probably should be.

23

28 Comments

Looking at deobfuscated routines is cool and all such as push/pop/jmp etc, but I am struggling to find the value in SIEM detection engineering. In particular - reviewing Sysmon logs. It's almost like when folks share IOCs as MD5. You trying to keep this ish a secret? I'm not player hating on reverse engineering, but for 95+ percent of folks working in cybersecurity - I struggle to find the value of any of that. I'm reading a report and it's all shell code reverse engineering. Cool Story. How about letting folks know how it hits Windows and what the TTPs are. Even given IOCs are almost a waste since most malware is polymorphic. Execute the malware in a VM and tell me what it does. I find infinitely more value in that process. If you feel I'm wrong - tell me. #cybersecurity #blueteam #redteam #bitcointeam

Unlocking PKI: Why It's Not Yet Mainstream in Identity and Access Management 🚀"The Identity Navigator" Podcast - New Episode Alert🚀   In this episode, we dive into the world of Public Key Infrastructure (PKI) and explore why it's not more widely adopted in the Identity and Access Management (IAM) space,  despite being considered the gold standard of credential assurance by many experts.    We'll unravel the complexities of PKI, discuss its advantages and challenges, and examine the reasons behind its limited mainstream presence. Whether you're a security professional or just curious about IAM technologies, this episode will provide valuable insights into the potential of PKI and what it could mean for the future of digital security. Join us as we decode the mysteries of PKI and its role in modern identity management.   https://lnkd.in/eZdPsFy4   Tune in now and let's check them out together 🎧🔍    #TheIdentityNavigator #IAM #Podcast #TechTalk #IdentityAndAccessMAnagement

43

5 Comments

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3