Erik Peterson

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

Small business owners, this one's for you! The NIST Cybersecurity Framework offers a proven approach to managing cybersecurity risks. This free resource provides a quick start guide to help you get started. ➡️ Learn how to identify, protect, detect, respond to, and recover from cyber threats. Download the NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide today! #cybersecurity #smallbusiness #riskmanagement #NIST https://lnkd.in/gnByJvYM

20

It’s time to define a new cyber risk equation. One that rethinks what’s possible and defies old obstacles. Here’s a look at how we’re reframing our best-in-class portfolio. See more on our product page.

3

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

59

Made some words on Help Net Security about what it means to be an industry leading Enterprise DSPM. Sure, cloud is great and it's benefits are massive, but we can't ignore data on-prem and most importantly, sitting on mainframes processing transactions every day for the last 50-60 years! It's time for contextual visibility across all data domains to ensure proper security, compliance, privacy and governance. Enterprise DSPM the 1touch.io way enables teams to unlock the value of their sensitive data in a privacy-preserving way to drive new business and avoid running into the regulatory buzzsaw. https://lnkd.in/emwjfVG3

17

You need to use the findings and automate based on those. eBPF is not enough.

2

Clause 8 of ISO42001 focuses on operational planning and control to effectively manage your AI systems. See below for what compliance executives need to know. 📋 1. Plan and Control AI Operations (Clause 8.1) ✅What to do: - Establish criteria and processes for AI system development, deployment, and monitoring - Implement controls determined through risk assessment and treatment (see Clause 6) - Monitor effectiveness of controls and take corrective action if needed ❓What to think about: - How do our AI operations align with organizational objectives and policies? - Are our AI operational processes well-defined, documented, and understood? 🔍 2. Conduct Regular AI Risk Assessments (Clause 8.2) ✅What to do: - Perform risk assessments at planned intervals or when significant changes occur - Follow the risk assessment process defined in Clause 6.1.2 - Document and retain risk assessment results ❓What to think about: - How frequently should we conduct AI risk assessments based on our context? - Do we have the necessary expertise and resources to perform comprehensive assessments? ⚠️ 3. Implement AI Risk Treatments (Clause 8.3) ✅What to do: - Execute the risk treatment plan developed under Clause 6.1.3 - Verify effectiveness of risk treatment options - Review and update treatment options if risks change or treatments are ineffective - Document risk treatment results ❓What to think about: - Are our risk treatment options aligned with our risk appetite and tolerance? - How can we ensure risk treatments remain effective over time? 📊 4. Perform AI System Impact Assessments (Clause 8.4) ✅What to do: - Assess impacts of AI systems on individuals, groups, and society per Clause 6.1.4 process - Conduct impact assessments regularly or when major changes are proposed - Retain documented information on impact assessment outcomes ❓What to think about: - What are the potential unintended consequences of our AI systems? - How can we engage relevant stakeholders in the impact assessment process? 📝 5. Maintain Documented Information (Clause 8.1) ✅What to do: - Ensure appropriate operational planning and control documentation - Provide evidence that processes are carried out as planned - Control changes to operational processes and review unintended change consequences ❓What to think about: - What level of documentation is necessary to demonstrate operational control? - How will we manage and communicate changes to our documented processes? 👥 6. Manage Supplied Processes, Products and Services (Clause 8.1) ✅What to do: - Ensure externally provided processes, products and services are appropriately controlled - Apply operational controls to outsourced AI system components and services ❓What to think about: - How do we extend our operational controls to suppliers and partners? - What criteria should we use to evaluate and select external providers? For help getting started, please reach out! #ISO42001 A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou

9

✅ (3/38) CPG 1.C OT Cybersecurity Leadership. In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at OT Cybersecurity Leadership. The intent of this CPG is to establish overall documented accountability and responsibility for your cybersecurity program for Operational Technology. We need a person's name or a position title that is unambiguous. This is very similar to the CPG we covered yesterday, 1.B for Organizational Cybersecurity Leadership, but this is about OT. The CPGs captured this as a separate goal to make sure we have alignment here. It could be the same person, but ideally this would be somebody with authority over OT and understanding of the risks to the OT environment. It's noteworthy that this leader is likely much closer to operations than an organization level leader who may be more focused on overarching corporate strategy. In most cases this will go beyond cybersecurity to include Safety, Operational Resilience and other Operations focused risks. This person needs to be a senior leader in the organization with the authority and political clout to get things done, and engages in: ➡️ Planning ➡️ Resourcing ➡️ Executing This leader is accountable and responsible, but that does not mean they have to do it all themselves. These activities can be delegated, as long as the named leader ensures cybersecurity is managed effectively. I have seen a few programs that named a figurehead to this function, but did not give them the authority they needed to execute. Or did not support the resource requests needed. Resources comes in the way of staff, budget and also organizational support. The most common mistake I see is tasking somebody that does not understand OT with this responsibility. If you have decided that your CISO or similar will be responsible, it's important that we make sure to educate them and other senior leaders to align with OT risks. In our Notion CPG template at https://lnkd.in/eP-pfWfk we provide a high level overview of this goal, and suggest a potential tool, wikijs, to capture this and other details in your program. You could just as easily use SharePoint, a Word doc or commercial tools. The tool does not matter as much as clearly defining accountability and communicating this to the organization. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #cybersecurityleadership

11

1 Comment

IT environments are changing. Is your monitoring and observability solution keeping up? We've created an Observability Consideration Checklist to help you assess your current and future needs. Use the checklist to determine if a self-hosted or SaaS monitoring and observability solution is right for where you are today–and where you’re going tomorrow.   https://lnkd.in/eV6aE2AB

5

Know your cloud risk, expose your biggest cloud gaps and close your priority cloud exposures fast. This is Tenable. Your cloud exposure ends here.

8

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/q424105O2IL

8

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/9yeq105M2RV

4

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/4wMB105OfpG

7

Really conflicted on this "Lessons from XZ Utils" piece from CISA. A lot of it is good, but the conclusions seem disconnected from the actual attack, impractical, and misguided - particularly this section: "This compromise highlights a fundamental shift needed: every technology manufacturer that profits from open source software must do their part by being responsible consumers of and sustainable contributors to the open source packages they depend on." In the xz attack itself, the burnout that led to the maintainer transfer was *caused* by the attackers and sock-puppets. It's also a dramatic oversimplification to imply that issues like this would be prevented if companies contributed financially or through work. Yes - responsible OSS consumption requires a deep understanding of what you're using and a plan to maintain it in the event of the project going EOL or an unpatched vulnerability, but requiring organizations to contribute back is an overreach not backed by real-world data or even the post-mortem of this specific event. Funding and contribution has a role in OSS, but for most organizations it should come far far far after basic security principles like defense-in-depth, inventory management, and patching procedures. Groups like CISA are in a great position to help monitor the broader OSS ecosystem for risk and align efforts to help make funding and contribution productive, but without that foundation in place this is just a recipe for confusion. Simply framing organizations that use OSS in a secure-manner in full accordance with all the terms in the licensing as "irresponsible" is much more irresponsible IMO. https://lnkd.in/eYFR9fgT #cisa #oss #xz #sustainability

33

7 Comments