Daniel Kennedy

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Some good reminders as a response to Verizon DBIR report (data breach investigation report) "Credential and Secrets Theft: Insights from the 2024 Verizon Data Breach Report" It's your job as infrastructure manger, developer, security people, solution provider, so secure all of this. connected=hacked cloud=leak #cybersecurity #cloud #dbir #clowd

15

2 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

Another supply chain attack underscores the critical need for a strong enterprise cyber risk management (ECRM) program. Recently, Infosys McCamish Systems (IMS) notified nearly 6.1 million individuals of a 2023 ransomware incident that compromised sensitive data, including Social Security numbers, medical records, and financial information. Among those affected were 57,000 Bank of America clients. This breach highlights the vulnerabilities in supply chains and the importance of a robust ECRM program to proactively monitor, assess, and respond to cyber threats. A strong ECRM program not only safeguards sensitive data but also ensures business continuity and trust. #CyberSecurity #ECRM #SupplyChainAttack #DataProtection

6

1 Comment

VM remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from VM to exposure management and effectively prioritize high-risk exposures across their complex attack surface. http://ow.ly/oGFk105PbnX

3

Interesting Okta vulnerability (see link below) allowed users with usernames longer than 52 characters to potentially log in without password being validated. Kudos to Okta for a very detailed post on the issue but the root cause is that Okta seems to have used a password hashing algorithm (bcrypt) to generate a key. The fix was to use a key derivation function (PBKDF2) instead. Okta asked customers to verify logs to see any improper authentication methods. It is unlikely this was abused as the vulnerability was found (disclosed responsibly it looks like) and fixed quickly. But my co-founder Kartik CDS who full name expands to 45 characters breathed a sigh of relief :) It's 2024 - bcrypt and other password hashing functions have been around for a long time. It is well known that most implementations of bcrypt have limitations on password length (usually 72 bytes). Okta used a combination of user id + user name + password to derive a key. 20 byte user id and a 52 byte user name will easily go past the 72 byte limit rendering the password useless. Crypto is hard to get right and the impact of even a slightly improper use of crypto can be dangerous as can be seen by this advisory. We all write encryption/crypto policies as part of our compliance programs. The policies are almost always right but subtle mistakes such as these can be hidden everywhere. #encryption #keyderivation https://lnkd.in/g9dUQYXf

75

2 Comments

Useful tips for CUI scope management for CMMC.

4

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/9yeq105M2RV

4

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/4wMB105OfpG

7

Learn the ins and outs of internet exposure in the context of vulnerability management: https://lnkd.in/eta2umrs.

9

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

Saw this on Reddit and chuckled. Combining Simpsons with InfoSec? Always appreciated. But I’d be remiss if didn’t point out that an absence of alerts is not always a good thing. Your logging pipelines and monitoring tools could be broken or misconfigured, or even the tool itself. Always include a health check poll or establish a heartbeat to check in logs. That way you know when a tool isn’t doing its job.

6

What tools do you know of that allow building SSVC decision trees at scale? Do any exist? I believe some vendors in the risk based vuln mgmt sector can utilize rules to build some level of decision tree.. But I'm not sure how deep that goes. - Does anyone know tools that help with this? - If you are currently doing SSVC, what technology are you using to accomplish it across hundreds of thousands of vulnerabilities with and without CVE's? #VulnerabilityManagement #SSVC #Security #CVSS #CVE

17

17 Comments

Optimize your decision-making and resource allocation by accepting and recasting risks in Tenable Security Center. 👀 Watch now! ➡️ Learn more: https://lnkd.in/ePsC_KhU #Cybersecurity #RiskManagement #Tenable

11

The proposed rule would also require the disclosure of cyber incidents to CISA and physical security concerns to TSA. The Transportation Security Administration is seeking public comment on proposed requirements for surface transportation and pipeline companies to implement cyber risk management programs, the agency said Wednesday. The public comment period ends on Feb. 5, 2025. The proposed rule calls for certain pipeline, passenger and freight rail operators and rail system companies with high-risk profiles to develop comprehensive cyber risk management programs. Pipeline, rail and certain bus transportation or transit systems would be required to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency. The sectors would report any physical security risk concerns to TSA. #criticalinfrastructurecyberrisk #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

1 Comment