Edwin Covert

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

148

30 Comments

Quantifying cyber risk is a valuable tool for communicating with leadership because it puts risk into business terms. Risk quantification is a business decision-support tool. It provides a scientific, repeatable, and defensible method for making decisions. #cybersecurity, #CISO, #Cyberrisk #OperationalRiskManagement #RiskQuatification #CRQ #Cybersecurity#CyberSecurity, #training, #workshops

5

Where should we focus the IRIS next? You decide! The Information Risk Insights Study (IRIS) research series from the Cyentia Institute aims to provide rigorous analysis to support organizations in assessing and managing cyber risk. https://lnkd.in/e_BGmwT Over the years, we've examined the overall frequency and financial losses from security incidents, compared those metrics across different sectors and org sizes, conducted in-depth study of the 100 largest cyber loss events, researched massive multi-party incidents, and focused on particular threats (e.g., ransomware). We generally select topics to cover in the IRIS based on community interest and availability of sponsorship funds. So - back to the question at the beginning of this post. What would you like to see the IRIS focus on next? Are there vendors, gov agencies, or other organizations out there interested in sponsoring an IRIS on particular topics? Let us know! #cyberrisk #cybersecurity #cyberattacks

5

New On Target! Risk Management Framework #Risk #RiskManagers #Framework #ArcherEnergySolutions #CriticalInfrastructure #Compliance #NERC #FERC #Cybersecurity #PhysicalSecurity https://lnkd.in/gmUSp3j9

1

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

The future of cyber risk quantification lies in our ability to respond to new risks, quickly iterate, and effectively communicate. I teach Cyber Risk Quantification and promote the use of open and free tools. Contact me for more information. #cybersecurity #cyberriskquantification #cyberprofessionals #educators #ciso #cio #cybersecurityrisk #cyberrisk #riskanalysis #CRQ #vulnerabilitymanagement #cyberattacks #cybertraining #riskmanagement #riskmodeling #cyberriskmodeling #cybercrime #cyberthreat #boisestate #boisestate 

2

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

Finally! This is the winning statement I see as a critical issue in industry today: "Compliance frameworks are merely starting points". Too often I see programs that are designed to become compliant... and then stop. True security requires continuous strides towards operational excellence across your risk managed attack surface. I recommend all practitioners of our art to study multiple sources on the topic, including this one. 👉 Practical tips here: https://gag.gl/D8cP6U #Cybersecurity #Kitecast #PrivateContent #CMMC #AISecurity #ZeroTrust #ComplianceTrends

15

A recent report from the Environmental Protection Agency (EPA)’s Office of Inspector General (OIG) has revealed significant cybersecurity vulnerabilities in over 300 U.S. drinking water systems. These weaknesses threaten service disruptions, data breaches, and potential damage to critical infrastructure, affecting the safety and accessibility of water for millions of Americans. #DataBreaches #CyberAttacks #WeProtect cybersecurity.art - Art of Cyber Security https://lnkd.in/gXWedhpV

2

The Environmental Protection Agency lacks a documented plan to coordinate incident reporting with CISA, the agency’s Office of Inspector General found. Environmental Protection Agency officials found critical or high-risk vulnerabilities in 97 drinking water systems that serve more than 26 million people across the U.S., according to a report released last week by the agency’s Office of Inspector General. Another 211 water systems, servicing almost 83 million people, had medium-to low-risk vulnerabilities, including open portals that were visible from the outside. These water systems could face major disruptions or physical damage if a malicious hacker tried to exploit those vulnerable systems. The OIG report noted the EPA does not have an incident reporting system and relies on the Cybersecurity and Infrastructure Security Agency’s system. The OIG also could not find documented policies and procedures for how the EPA coordinates with CISA and other federal agencies to address these issues. #criticalinfrastructurecyberrisk #cyberriskmanagement #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

Highlight of RSA was the seeing Rori Boyce-Werner, Shelby Descoteaux, CISSP, Elizabeth Hubbard, and Shawn Powers, session “OperandAI: Practical Security for Artificial Intelligence” - great panel!

99

3 Comments

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

To protect patients’ private information and ensure resilience against cyberattacks, hospitals are leaders in proactive cybersecurity measures. FAH urges CISA to consider our comments to the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Proposed Rule, which are based on our members’ experience serving patients and maintaining critical healthcare infrastructure. They include: - More narrowly defined terms in order to support CISA’s ability to quickly review and analyze data; - An extended reporting time frame; - Harmonized cyber incident reporting among federal and state agencies; and - Confidentiality of cyber reports. Read the letter: https://lnkd.in/eGrBuwtf

1

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9