Michael Lotas

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

It's here - CRQ Training! If you're a CISO, risk analyst or assessor interested in quantifying cyber risk don't miss this CRQ Mastery Workshop. Learn basic and advanced method. Hands-on exercises. Full toolkit and risk models. ISC2 and ISACA Chapters save and additional 20% for their members. 20 CPEs. More info and registration https://lnkd.in/ecVj8V5N #ISC2, #ISACA, #Training, CyberRiskQuantification, #CISO, #Cybersecurity

5

ICYMI: NIST Releases RMF Small Enterprise Quick Start Guide In July, NIST launched the RMF Small Enterprise Quick Start Guide. This practical resource is designed to help small enterprises implement NIST RMF without breaking the bank. With this guide, the phrase "we are the government and we are here to help" loses its usual sarcasm and rings true. More deets at https://lnkd.in/eFuXWh55 #NIST #RiskManagement #SmallBusiness #Cybersecurity #RMF #Compliance

5

1 Comment

New proposed amendments to the Defense Acquisition Regulations Supplement (DFARS) are scheduled for publication on August 15, 2024. These changes focus on updating the Cybersecurity Maturity Model Certification (CMMC) requirements for contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The comment period on the proposed DFARS rule will close on Oct. 14. Key Amendments in Policy (DFARS 204.7502) * Contractors must present a current CMMC certificate or CMMC self-assessment results at the required level during contract award. * This requirement applies to all information systems that process, store, or transmit FCI or CUI. Contracting Procedures (DFARS 204.7503) * Contracting officers must verify in the Supplier Performance Risk System (SPRS) that the contractor has posted a current CMMC certificate or self-assessment before awarding contracts, exercising options, or when new DoD UIDs are issued. * The successful offeror must also affirm continuous compliance with the security controls specified in 32 CFR part 170. Definitions Update (DFARS 204.7501) * A new definition for CUI, based on 32 CFR 2002, is included. * Definitions for "current" in relation to CMMC and DoD UID are also added. New DFARS Provision (252.204-7YYY) * A new provision, Notice of Cybersecurity Maturity Model Certification Level Requirements, informs offerors of the required CMMC level and mandates that CMMC certificates or self-assessment results be posted in SPRS. * Level 1 and Level 2 self-assessments must be posted by the offeror, while Level 2 and Level 3 assessments are transmitted to SPRS by third-party assessors and DoD assessors, respectively. * Successful offerors must provide DoD UIDs for contractor systems handling FCI or CUI. Updates to DFARS Clause 252.204-7021 * The clause now includes definitions for CMMC, "current" (as it relates to CMMC), and DoD UID. * Contractors must maintain the required CMMC level throughout the contract duration and submit relevant DoD UIDs to the contracting officer. * Annual affirmations of continuous compliance with security controls must be completed and maintained, along with notifications to contracting officers about changes in contractor systems or lapses in CMMC certification. * Subcontractors must also comply with the appropriate CMMC level before awarding any subcontracts. Contractor Responsibilities and Compliance * Contractors must ensure that data is only transmitted through systems certified at the required CMMC level. * Contractors are required to notify the contracting officer if any changes in certification levels occur that could affect contract performance. * The Department of Defense evaluated different options for CMMC certification timing, ultimately requiring certification at the time of award to balance risks and benefits. #cybersecurity #CMMC #DoD #compliance

8

1 Comment

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

55

6 Comments

Useful tips for CUI scope management for CMMC.

4

6 ICS advisories for your review.

5

CISA (Cybersecurity and Infrastructure Security Agency) has proposed new reporting requirements for significant cyber events across critical infrastructure sectors, including healthcare. These requirements aim to enhance cybersecurity measures but have raised concerns within the medical community. MGMA (Medical Group Management Association) has suggested that instead of adding duplicative reporting requirements, CISA should collaborate closely with HHS (Department of Health and Human Services) to streamline existing regulations under HIPAA. They also expressed concerns about the proposed size-based threshold, which could impose reporting obligations on smaller physician offices with revenues as low as $9 million annually. Do you agree that collaboration between CISA and HHS could streamline regulatory burdens? #HealthcareSecurity #CISA #CybersecurityReporting

5

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

As CruiseCon is not a typical #cybersecurity event, Casey Yarbrough and I recorded the below video to answer the most common questions and just describe the event. The subjects we cover include: * Why I came up with CruiseCon * How are we bringing the type of event that is typically reserved to Fortune 200 CISOs to the rest of the cybersecurity profession * The opportunities to engage and network with people at all levels * A day by day breakdown of the agenda * How to justify the event to management, if necessary * What to expect from the ship and the event As I also mentioned the entire cost to attend CruiseCon (depending upon the cabin chosen) is less than the cost of registration fees for the other major industry events. Please review the video and reach out with any questions.

38

15 Comments

Hmmm how do I leverage the NIST CSF 2.0 www.ncsecourse.com for Compliance and Reporting "How can an organization enhance its cybersecurity governance framework according to the NIST CSF 2.0's Govern function? Include recommendations for establishing roles, responsibilities, policies, and procedures to manage cybersecurity risk effectively." #NISTCSF ICTTF - Cyber Security Community, Academy and Events

2

3 Comments

The PCI Security Standards Council has released version 4.01 of PCI DSS. To quote them "It includes corrections to formatting and typographical errors and clarifies the focus and intent of some of the requirements and guidance. There are no additional or deleted requirements in this revision." The new version, and a Summary of Changes from PCI DSS Version 4.0 to 4.0.1, can be found on the PCI SSC website. #pci #pcicompliance #pcidss https://lnkd.in/gi-dBD_N

16

It's time to quit using social security number as a password Noone is allowed access to medical or financial resources based on knowing a name.  It should be the same for SSNsIt's time to publish SSNs to keep companies from using them as a password.https://https://lnkd.in/gf6A8gTN

6

EC2 Compromise Leads to S3 Bucket Exfiltration

53