Gary Perkins

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

Do you need to be CMMC Level 2 compliant, but are having trouble translating the cybersecurity gobbligook into real actions that your IT team can take? We are having a live webinar on June 27, 2024 at 2pm EST to demonstrate the Kieri Compliance Documentation. This is a full-featured program for CMMC Level 2 and NIST SP 800-171 compliance which includes policies, procedures, system security plan, user agreements, record-keeping databases, account request form, self-assessment form, and other vital resources needed to be compliant. Monthly Q&As and over 50 hours of video training included. Kieri Solutions uses this program to efficiently manage our CMMC Level 2 compliance. We passed a DoD assessment for CMMC Level 2 and NIST SP 800-171 compliance with a perfect 110 score using this governance program. We have over a hundred clients using the KCD to manage their compliance and prepare for CMMC Level 2 assessment themselves. 𝐃𝐨𝐞𝐬 𝐭𝐡𝐢𝐬 𝐬𝐨𝐮𝐧𝐝 𝐥𝐢𝐤𝐞 𝐲𝐨𝐮? 🔸 You are frustrated with your policies and procedures… 🔸 You don’t know how to perform some CMMC requirements, or how to answer assessment objectives like “define non-essential functions”… 🔸 Your documentation is out of date… 🔸 You bought compliance templates elsewhere and they are too complex to get through… 🔸 You are paying a huge monthly fee to a GRC website and you’re still stuck filling in blanks… 🔸 You don’t have a record keeping system that makes it easy to gather the info you need for assessment… 🔸 Your users are asking how to mark CUI and you don’t know how to help them… If so, please join us for this webinar. We will be showing the program that we use to reach and maintain a "110" score. https://lnkd.in/eRjbVFrD Kieri Solutions - Authorized C3PAO

38

6 Comments

EC2 Compromise Leads to S3 Bucket Exfiltration

53

Reading about the updated National Cybersecurity Strategy and its five pillars from Colleen Frye It’s crucial for us MSPs to understand these changes as they'll significantly influence our operations and cybersecurity measures. Check out the full breakdown to ensure your services align with these new federal standards. 💬 Let's chat about how we can leverage this strategy to enhance our cybersecurity approaches and lead the way in compliance. #MSP #CybersecurityStrategy #LeadershipInCybersecurity

2

**Critical Security Alert** Security Leaders - please check for and remove domains connected to #polyfill if it exists on any of your organizations websites. Please see write up in link for our initial analysis on the script and potential scope of exposure. #javascript #CVE #breach #CISO #Webappsec

16

2 Comments

Read this important advisory from CISA regarding Operational Technology and Industrial Control Systems vulnerabilities. #ICSsecurity #OTsecurity

13

1 Comment

Organization’s struggle with documenting NIST SP 800-171’s 3.3.1 System Auditing, especially when they are using Commercial Off the Shelf (COTS) software or cloud services. Like all of the other As the CMMC Churns Understand the Requirements series, we will walk you through understand the key definitions, the Assessment Objectives, and demonstrate how we show conformity to 3.3.1 System Auditing using SharePoint lists and Azure Sentinel. This Understand the Requirements video will be critical when we get to 3.3.3, Review and Update Logged Events, a THOROUGHLY misunderstood requirement. =============================================== Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: [email protected] =============================================== #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors https://lnkd.in/entjZARv

11

Useful tips for CUI scope management for CMMC.

4

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

A cybersecurity services business unit has more revenue than any pure-play cybersecurity company in the public markets today. Yep, you read that correctly. Accenture reported its FY'24 annual earnings yesterday. Security is a strategic business unit they break out revenue for. Guess how much cybersecurity revenue they had? ... Nine billion dollars. With 23% year-over-year growth. Just incredible. Palo Alto Networks is the only pure-play public company who is even close — currently at $8.03 billion of revenue (TTM). Of course, there is also Microsoft's reported $20 billion of cybersecurity products and services revenue, plus some very large business units in other companies that don't regularly report revenue. But any way you compare it, Accenture has a massive cybersecurity business. Product-focused companies get a lot of the hype, but services companies make it all go. This is exactly why Accenture and other large services firms are critical channel partners for almost every large cybersecurity product company. It's also a good reminder that services are an equally impressive and important part of our industry.

1,517

111 Comments

Cold-calling CISOs is counterproductive. Don't do it. Rinki Sethi, CISO of Bill.com, explains why and suggests alternate approaches. "If you're going to reach out to me...please put some time into it. I want to see that you've done a little bit of research on what's important to me and what's important to the company I work for. Pay attention to detail, and make sure it doesn’t look like a templated email or you are calling me the wrong name!" Read the blog for further insights: https://lnkd.in/ed3YCAJK

221

19 Comments

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

NCUA examiners have said that the ACET is no longer a requirement. They are now recommending that organizations choose an internal framework to align with such as NIST CSF 2.0, CIS, or other! They have stated the new NCUA ISE statements are for them to use as an examination tool and not for credit unions. I would recommend aligning with both an internal framework and the ISE by taking an evidence-based approach so you are prepped for your exam, and meet their requirements!

7

1 Comment

In a world where cybercriminals are leveraging AI to breach defenses, it’s time we turn the tables. Let’s empower your cybersecurity with cutting-edge AI solutions. Together, we can outsmart the threats and safeguard your digital realm.

1

It's time to quit using social security number as a password Noone is allowed access to medical or financial resources based on knowing a name.  It should be the same for SSNsIt's time to publish SSNs to keep companies from using them as a password.https://https://lnkd.in/gf6A8gTN

6

Team Cymru surveyed 218 cybersecurity participants, discussing the challenges and opportunities of Threat Hunting in protecting organizations. The finding are very insightful and could help operators and decision-makers assess where to spend time and money to improve threat-hunting programs. I recommend taking a few minutes to read their findings. You'll find The Voice of the Threat Hunter below

2

Built to quickly and effectively close vulnerability exposures in a unified solution, Tenable Patch Management has entered the chat: http://ow.ly/iycb105QJ9S

13

I’ve written a number of posts on testing and rolling out security controls safely on my blog including this one from 2020 ~ Better Testing for Better Outcomes. I have a bunch of others in a thread on X (sorry it’s the easiest right now) and on my blog. Taking the time to properly test and building tests into the software itself can prevent a lot of pain later. I explain how to do that in my posts and show examples of things not properly tested as well. https://lnkd.in/gcJ-PeG

10

4 Comments