Mel Reyes

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

148

30 Comments

Where should we focus the IRIS next? You decide! The Information Risk Insights Study (IRIS) research series from the Cyentia Institute aims to provide rigorous analysis to support organizations in assessing and managing cyber risk. https://lnkd.in/e_BGmwT Over the years, we've examined the overall frequency and financial losses from security incidents, compared those metrics across different sectors and org sizes, conducted in-depth study of the 100 largest cyber loss events, researched massive multi-party incidents, and focused on particular threats (e.g., ransomware). We generally select topics to cover in the IRIS based on community interest and availability of sponsorship funds. So - back to the question at the beginning of this post. What would you like to see the IRIS focus on next? Are there vendors, gov agencies, or other organizations out there interested in sponsoring an IRIS on particular topics? Let us know! #cyberrisk #cybersecurity #cyberattacks

5

Cybersecurity researchers have shed light on a new version of a ransomware strain called HardBit that comes packaged with new obfuscation techniques to deter analysis efforts. "Unlike previous versions, HardBit Ransomware group enhanced the version 4.0 with passphrase protection," Cybereason researchers Kotaro Ogino and Koshi Oyama said in an analysis. "The passphrase needs to be provided during the runtime in order for the ransomware to be executed properly. Additional obfuscation hinders security researchers from analyzing the malware." HardBit, which first emerged in October 2022, is a financially motivated threat actor that, similar to other ransomware groups, operates with an aim to generate illicit revenues via double extortion tactics. What makes the threat group stand out is that it does not operate a data leak site, and instead pressurizes victims to pay up by threatening to conduct additional attacks in the future. Its primary mode of communication occurs over the Tox instant messaging service. The exact initial access vector used to breach target environments is currently not clear, although it's suspected to involve brute-forcing RDP and SMB services. The follow-up steps encompass performing credential theft using tools like Mimikatz and NLBrute, and network discovery via utilities such as Advanced Port Scanner, allowing the attackers to laterally move across the network by means of RDP. "Having compromised a victim host, the HardBit ransomware payload is executed and performs a number of steps that reduce the security posture of the host before encrypting victim data," Varonis noted in its technical write-up about HardBit 2.0 last year. Encryption of the victim hosts is carried out by deploying HardBit, which is delivered using a known file infector virus called Neshta. It's worth noting that Neshta has been used by threat actors in the past to also distribute Big Head ransomware. HardBit is also designed to disable Microsoft Defender Antivirus and terminate processes and services to evade potential detection of its activities and inhibit system recovery. It then encrypts files of interest, updates their icons, changes desktop wallpaper, and alters the system's volume label with string "Locked by HardBit." #ransomware #passphrase #detection #cybersecurity #threatactors

1

2 Comments

To ensure your ECRM program is effective, integration throughout your organization is key. This includes making ECRM a regular part of your board meeting agenda. According to best practices, boards should have access to cybersecurity expertise and allocate sufficient time for discussions on cyber risk management. As I shared on Monday and highlighted in my ECRM book, consider establishing a three-tiered ECRM governance structure to help effectively achieve this. By integrating ECRM across these tiers and ensuring regular discussions at the board level, you can enhance cybersecurity readiness and governance within your organization. Read more: https://amzn.to/33qr17n #Cybersecurity #ECRMProgram #CybersecurityInHealthcare #CyberRiskManagement

13

More details on the nearest neighbor attack. The abuse of cipher for antifornensics is particularly clever. I wonder if this technique will eventually lead to standard MFA for wifi.... https://lnkd.in/ez_2iXWG

38

3 Comments

Secure by design. Assume breach. Shift right. TDIR. Threat-informed defense. Anti-fragility. ...I'm liking the trends in defensive thinking that I'm seeing at the moment, fundamental truths of information entropy and the defenders dilemma starting to appear in forward planning. In many ways this harks all the way back to to v1.0 of antivirus, which taught us the fragility of deny-lists, and the resilience of allow-lists. The speed of technology combined with the speed of adversarial innovation necessitates flipping the script.

66

17 Comments

The final 32 CFR #CMMC rule defines Not Applicable as such: Sec 170.24 "(3) Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope."* I get the point the authors were attempting to make, but they should have deleted "within the CMMC Assessment Scope." Publicly accessible system components have no business existing within the CMMC Assessment Scope, and as such should be Out Of Scope assets, incapable of P/S/T #CUI. Determining whether there are publicly accessible system components WITHIN the CMMC Assessment Scope is the whole point of 3.13.5 - therefore, as worded, SC.L2-3.13.5 is absolutely APPLICABLE. The focus of 3.13.5 should have been on the existence of connections to or communications through publicly accessible system components. It appears NIST agrees. In #NIST SP 800-171 rev3, 03.13.05 has been withdrawn and incorporated into 03.13.01 Boundary Protection. So, this 32 CFR 170 definition will need to be re-written anyway. DoD lost it's example within. That's ok. They have plenty of time. What do you think? *This is also in the CMMC 2.13 Level 2 Assessment Guide, p. 10

3

"This is not a book on how to dig deeper moats or higher walls to create a false sense of security. " That is part of a recent review of my book, 'Enterprise Cyber Risk Management as A Value Creator', and it struck me as spot on. I find that a strong ECRM program supports business continuity through collaborative efforts, data-driven strategies, and sustainable practices. I urge senior leaders to focus on future challenges rather than just quick fixes. This effort toward an effective ECRM program fosters a secure environment that proactively addresses emerging threats. This approach not only protects our sensitive data but also supports desired long-term resilience and trust within the organization and with our partners. Learn how to prepare for the future here: https://a.co/d/jhvtDAt #ECRM #RiskManagement #Cybersecurity #ValueCreator

19

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

Frustrated with ECRM failures? You're not alone: here are 3 common culprits. ECRM struggles often boil down to: 1. Risk Illiteracy: Leaders, even CISOs, who don't fully know what comprises cyber risk and what their unique risks are. 2. Board/C-Suite Disconnect: ECRM implementation can be hindered without buy-in from top leadership. 3. Missed Opportunities: ECRM shouldn't just address risks; it should also leverage cyber opportunities to fuel growth. My book, delves deeper into these challenges and offers solutions for building a comprehensive ECRM strategy. Get a copy of my book here: https://a.co/d/jhvtDAt #ECRM #Risk #RiskLiteracy #CSuite #CyberThreats

6

We did something new (for us) in the latest edition of the Information Risk Insights Study (IRIS) that focuses on #ransomware - we projected financial losses. Normally, we restrict ourselves to known publicly-reported losses. But in this case, we felt that wouldn't do proper justice to the true impact of ransomware on the economy. But don’t worry—we didn't abandon our core principles and ride the trolley into the Neighborhood of Make-Believe. We took the data we had on ransomware losses over the last five years, fit a distribution, and then applied properly sampled values to incidents that had no loss info on public record. Using this method, we calculate the total financial losses from publicly known ransomware incidents over the last five years to be about $274 billion dollars. How does that fit with your intuition or analysis? Too high? Too low #cyberrisk #cyberattacks Read the full report, sponsored by CISA, here: https://lnkd.in/eWEnwj8n

91

7 Comments

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

Join our upcoming webcast, "Level up and adapt: Evolving your cybersecurity strategy to align with NIST CSF 2.0," where we will explore the transition from National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 1.1 to the recently released NIST CSF 2.0. It will guide listeners on how to level up their cybersecurity strategies by aligning with the evolving framework and adapting to the new security landscape.

9

Interesting discussion about the pros and cons of branding/naming vulnerabilities. In my experience, branding vulns like Heartbleed and Log4j, branding exploits like eternal blue and dejablue, and branding attacks like NotPetya helps when broad communication and expediency are needed. Non-security folks are much more likely to remember Heartbleed then CVE-2014-0160 and when these things are given names, it heightens awareness because regular people take notice. We do need to be careful that we don't overuse branding such that it degrades these benefits... there is a reason we only give hurricanes names when they reach a certain size. #cybersecurity

8

👾 If you have the book, please share a pic of your little reader and their thoughts + favorite chapter(s)! (Or if you're a CISO that read it to brush up on skills via the acronym and terminology index, power to you. Please share your experience too.) 👾 So many people ask me how I was able to write a book as an 8-year-old. My response? "How dare you make eye contact and speak to me." This is a showcase of my amazing Kiwi humour—it doesn't make sense, no one really wins from the joke, it's not even funny—but it brings me joy. Order your copy today through the website—it's the title of the book plus dot com dot au. You have to work for that purchase because LinkedIn hates external links now, apparently. Include a note in the checkout if you want me to customize a love letter on the inside cover. Co-written by Craig Ford and me, this book tackles digital safety and awareness through engaging short stories. We address serious topics subtly so kids understand the importance of online safety—topics like sextortion, photo sharing, email scams, viruses, password importance, and much more. All done with the hope of sparking interest in a career within IT. #DigitalSafety #CyberAwareness #ChildSafety #CareersInIT #OnlineSafetyForKids

81

18 Comments

The newest Action1 release of Vulnerability Management today is set to partially address the NIST NVD Backlog Crisis. Action1 is now able to detect software vulnerabilities for applications listed in Software Repository even if the vulnerability data is not yet available in the National Vulnerability Database (NVD). Given the alarming slowdown of NIST NVD updates, this critical capability adds the much-needed visibility over many previously undetected vulnerabilities and allows to automate their remediation: https://lnkd.in/g6UY-iF7 As of right now 18,000+ CVEs are unanalyzed. National Institute of Standards and Technology (NIST) has still a long way to go in terms of analyzing newly published CVEs. As of September 21, 2024, 72.4% of CVEs (18,358 CVEs) in the NVD have yet to be analyzed, VulnCheck said, adding "46.7% of Known Exploited Vulnerabilities (KEVs) remain unanalyzed by the NVD (compared to 50.8% as of May 19, 2024)." It's worth noting that a total of 25,357 new vulnerabilities have been added to NVD since February 12, 2024, when NIST scaled back its processing and enrichment of new vulnerabilities.

26