Jon Zeolla

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

Encrypted DNS Implementation Guidance - Published by CISA in May 2024. This document provides Federal Civilian Executive Branch (FCEB) agencies with actionable guidance for the implementation of encrypted DNS protocols and for enhancing the cybersecurity posture of their IT networks. It is intended to provide implementation guidance for federal agencies to meet federal requirements related to encryption of Domain Name System (DNS) traffic and enhance the cybersecurity posture of their IT networks, as set forth in Office of Management and Budget’s (OMB) Memorandum M-22-09.1

2

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

At Gartner IAM? Come meet the Permiso Security Team at Booth 235! Come see how bad actors bypass IAM controls across your IDP, SaaS, and cloud environments. Learn why standard IAM controls miss these attacks and how Permiso helps you get a grasp on and improve your identity risk posture and detect compromised credentials in minutes.

27

Day 2 Gartner IAM! IAM teams: You're masters of identity hygiene and Tier Zero asset protection. Now it's time to lead the charge on identity threat detection. Visit Permiso at Booth 235 to see how your IAM expertise can power better threat detection and incident response across cloud and SaaS. If you are on the Security side, see how we detect compromised credentials across SaaS and cloud in minutes, automate investigation, and enable you to move right to response. Breaking silos between IAM and Security = stronger identity defense. Sanjeev Williams Kyle M. Christine Stevenson

3

Useful tips for CUI scope management for CMMC.

4

Ask the CCP: SCOPE AND BOUNDARIES-CLOUD & MSSP So, I am counting the days until (around) October 28th: • 56 is the approximate number of work days . . .   . . . that sometime in late October: CMMC version 2 will (might) become effective. THIS JUST IN - the CyberAB projected that the Effective-ness of CMMC version 2 might not occur until maybe March of 2025. I posted a 1-off in yesterday’s installment (T.A.R.D.I.S).  1. TO LEAD with Yesterday’s topic which is boundaries I will preface today’s discussion which is noted above with commentary about how to represent your boundaries. Historically there’s always been a balance in security diagrams that the IT staff seems to not always grasp. Meaning that I have seen some truly awful data flow diagrams and boundary diagrams as an assessor for the last couple of decades. And already out there we go So my prescription for all the OSC , is to get your CMMC certification boundary and assessment boundary well defined early. The certification boundary coincides with your list of CMMC assets against other types of assets. Likewise your CMMC assessment boundary shows what is going to be assessed there are demonstrative diagrams available as examples. As I am quite adept at creating these, DM me if you need assistance with creating Data Flow Diagrams as well as Boundary Diagrams and Assessment Diagrams. These are critical to get correct for your CMMC evaluation.  2. This installment goes deeper to addressing cloud tenants and Managed IT/Security Services (MSSP). It is stated in CMMC V2 rule that Cloud Service Providers (CSP) are not part of the CMMC boundary – only the Organization Seeking Certification (OSC) tenant is to be a CMMC Asset. However, MSSPs hosting IT and Security Assets for the OSC are within the CMMC Boundary and Scope. This based on no separation between the organizations, meaning that CMMC assumes the MSSP has insight to the OSC’s information.  Therefore MSSPs must be concurrently certified to the same as the OSC they are supporting. However, DoD is not yet permitting MSSPs to enter the CMMC Certification processes.  Advice to MSSPs is therefore, be prepared for complete CMMC compliance immediately.  #CMMCv2 #boundary #assessment #dfd I Prepare and Evaluate Organizational Readiness for CMMCv2. So if you have any questions. . . .  Since I am both CCP and Certified Instructor, I am a CUI expert Or at least I know where to find the specifications and details 🤔 Tap Me/DM here on LinkedIn or email

1

API keys are essential to connect applications, services, or data lakes together. Yet, they can also be a security risk. Imagine Alice sets up an API key to give her team or a vendor access to sensitive data—many times these keys are long-lived and often shared across different workloads. If the group uses federation, actions taken by Alice or others occur using a shared credential/role in the environment. This means logs would only show the credential conducting that activity, which again, gets shared with others who have access to the role. Alice's coworker, Bob, has their legitimate cloud credentials compromised. The threat actor uses Bob's credentials to federate into a shared credential/role in the environment. The threat actor exploits native features/functions of the cloud to appear as Bob, thereby blending their activity in to avoid detection. Most security teams today won't spot Bob's impersonator fast enough or at all. Trying to make sense of cloud logs is a real challenge, especially when it's happening in real-time. It can take hours or even days to piece together what happened. And by then, detection and response are delayed and the damage might already be done. What can you do? Security teams can start by keeping a detailed record of all identities, keys, tokens, certificates, and credentials they've provisioned and used, services accounts they have access to, what roles they assume. Then, security teams can set up what's considered "normal" access and behavior. Once the team understands “normal” behavior, they can develop rules and alerts from logs to try to detect and respond to access and behavioral anomalies. At Permiso, we have developed an identity-centric approach to cloud threat detection and response. Our solution can help security teams detect and respond to access and behavioral anomalies in the environments faster and with greater confidence from having the full session access and activity. Want to learn more? DM me or visit https://lnkd.in/gC4DUJ9j to learn about our approach to solving the challenge of detecting and responding to threats in and across IaaS, SaaS, CI-CD, IDP environments.

11

Today begins the Summer of CTEM! This week's installment is a brief overview of Continuous Threat Exposure Management. Stay tuned in all summer as we'll help guide you from the basic concepts all the way through adoption. https://lnkd.in/e_hRdzsm #summerofCTEM #ctem #exposuremanagement #vulnerabilitymanagement #cloudsecurity #applicationsecurity #riskmanagement #cybersecurity #guidepointsecurity #threatmanagement #securityoperations

103

8 Comments

~~ July 2024 MSFT Patch Tuesday Damage Report ~~ ** 2 weeks later ** It’s certainly been an eventful month for IT operators… Obviously the biggest disruption to happen in the last two weeks was the CrowdStrike incident, albeit caused by themselves, not Microsoft. Regardless, if I didn’t call it out someone would Spongemock me, so it’s here. Moving on… Since my late post on Friday we’ve seen a couple of new reports. One off on-prem Exchange servers dorked before rebooting, Bitlocker bias against Windows 11, Windows 10 sometimes just generally slow to complete the update and more… Here's the breakdown of disruptions by OS version: Server 2022 - Huge numbers of empty security logs for certain event IDs Server 2019 - Unable to complete upgrade/failover on MSMQ clusters Server 2016 - On-prem Exchange servers down until reboot Windows 11 - Bitlocker recovery screens after rebooting Windows 10 - Device lockup after user login - Network drive access lost Crowdstrike - Widespread blue screen due to bad channel file Links in comments

14

1 Comment

Time to step up protection for federal agencies. If you can monitor it - you can trust it. AI-powered data lake technology allows you to get air tight on which assets you can consider a trusted part of your network. Workloads, users, endpoints, services, data. This is the definition of zero trust. It's the only way to protect our critical infrastructure.

189

4 Comments

Black Hat is nearly upon us! If unifying and prioritizing vulnerability data from disparate sources is top of mind for you, then make it a priority to stop by the Nucleus Security booth (2714) to learn how we’re helping the world’s largest commercial and government enterprises transform their programs to reduce risk of exploitation and prevent breaches by automating risk based vulnerability management at scale.

13

⚡ Cybersecurity threats are evolving fast! To stay ahead, organizations must embrace new security approaches involving fresh strategies, technologies, and a cloud-ready mindset. 🌐 Enter MITRE ATT&CK — the ultimate guide for security practitioners packed with invaluable insights into attacker techniques and behavior. Pretty handy, right? 💡 Sysdig's eBook show you how to identify and defend against common threats to #AWS environments using open-source Falco rules mapped to the ATT&CK framework. Boost your #AWScloud security and tackle any threat head-on by giving it a read today:

3

Thanks to @Scott Small and Wade Baker, Ph.D. and the teams at Tidal and Cyentia. To my fellow cyber risk quant folk you know how strongly we drive our partners and customers to define risk scenarios using specific threat actors and/or specific TTP’s to enhance the accuracy of likelihood determination! The work both organizations are doing to help articulate the TTP’s being used for ransomware attacks can help provide a greater level of defensibility of your results. By executing adversarial simulation using these TTP’s increasingly accurate likelihood can be attained.

4

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3

The National Security Agency (NSA) has recently released guidance aimed at enhancing logging and threat detection capabilities in response to living-off-the-land (LotL) incidents targeting critical infrastructure. LotL techniques involve threat actors leveraging legitimate tools and protocols to carry out malicious activities, making them harder to detect. The NSA's recommendations emphasize the importance of robust logging practices and proactive threat detection measures to counter these sophisticated attacks. #NSA #Databreaches #incidentResponse #LotL #cyberattacks

2

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10