Robert McCarthy

This was expected. Malicious cyber actors targeting artificial intelligence systems may use attack vectors unique to AI systems and techniques used against traditional IT. Review the guide “Deploying AI Systems Securely” to protect your org’s AI capabilities best. https://lnkd.in/eFW29_4V

2

1 Comment

🗞️ In CyberScoop: "[T]he years of work to build up federal collaboration with industry are paying off, from the Joint Cyber Defense Collaborative to the National Risk Management Center — the 'proto' version of the JCDC, [Chris Krebs] said — to the National Security Agency’s Cybersecurity Collaboration Center. "'We’re starting to see that these things work with the resources and time into it, but it’s generating results and there’s no better evidence of the results, I think, than when Russia invaded Ukraine, and the ‘Shields Up’ campaign and the breadth to which that was able to change behavior in industry,' said Krebs, now chief intelligence and public policy officer at SentinelOne." To learn more, read the full article by Tim Starks: https://s1.ai/CS-Collab

42

Prepare for the Cybersecurity Assessment Tool (CAT) Sunset coming in 2025. Learn about its impact on financial institutions, alternative frameworks like NIST 2.0, and how to crosswalk existing controls. https://okt.to/ZfnCdM #Cybersecurity #Alert #CATSunset #RiskAdvisory

2

Catch the Latest Episode of the Security Swarm Podcast! 🎙️ In this episode, host Andy Syrewicze and guest Paul Schnackenburg discuss critical issue of software quality in cybersecurity. They explore why we don't just have a cybersecurity problem, but a fundamental software quality problem. Key insights include: 🔹 Why software innovation shouldn't come at the cost of stability 🔹 The challenges in developing secure code 🔹 How the tech industry can prioritize security and reliability Don't miss out on this insightful discussion. Listen to the full episode here: https://lnkd.in/exCBHSB5 #Cybersecurity #SoftwareQuality #TechSecurity #SoftwareDevelopment #SecuritySwarmPodcast

6

The Cybersecurity and Infrastructure Security Agency (CISA) has recently completed the Secure Software Development Attestation common form, aligning with OMB Memo M-22-18. This mandates secure development practices for software vendors working with federal agencies. Compliance with NIST's Secure Software Development Framework (SSDF), SP 800-218, is crucial. Here’s a quick guide on how Scribe can help you automatically collect and sign evidence as proof for building this essential trust in software. https://lnkd.in/d6V_Ss69 #Cybersecurity #SoftwareDevelopment #SoftwareTrust

1

Just in - CISA publishes Encrypted DNS Implementation Guidance for Federal Agencies to enhance cybersecurity and protect sensitive data. Stay ahead of the curve with this important resource: https://lnkd.in/eMeN-uxt #cybersecurity #CISA #encryptedDNS

2

🚨 Hot Off the Press! 🚨 The DOJ and CISA have just released a Notice of Proposed Rulemaking (NPRM) and Proposed Security Requirements for Restricted Transactions, each implementing Executive Order 14117. These new rules aim to regulate the processing of certain personal data and will impact various sectors. 🔒 Key Highlights: 🗺 Data Restrictions: The proposed rules will limit the transfer of personal data—such as protected health information, financial data, government employee data, biometrics, and bulk data (over 100,000 individuals)—to specific countries. 🗺 Ownership Matters: Restrictions apply to entities more than 50% owned by citizens (both real and corporate) of these countries. It won't be enough to just avoid doing business in a given country. 💡 Why It Matters💡 If you’re building apps or solutions that process personal data for over 10,000 individuals or any government employees, brace yourself for mandatory technical controls and restrictions on outsourcing development and operations. Original Sources: https://lnkd.in/drJ3wgKq https://lnkd.in/dR-iVzzc Stay informed and prepared to adapt your strategies! #DataPrivacy #Cybersecurity #ExecutiveOrder #DOJ #CISA #Compliance #TechDevelopment

1

Attention GitLab Users: Critical Flaw Added to CISA's Known Exploited Vulnerabilities Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a critical vulnerability affecting GitLab to its Known Exploited Vulnerabilities (KEV) catalog. This addition is due to active exploitation of the flaw in the wild. The vulnerability, identified as CVE-2023-7028, has been assigned a CVSS score of 10.0, indicating maximum severity. It allows attackers to take over user accounts by sending password reset emails to unverified email addresses. GitLab has confirmed that the issue was introduced in version 16.1.0 on May 1, 2023, and affects all authentication mechanisms within the affected versions. Successful exploitation of this vulnerability can lead to serious consequences, such as: -Theft of sensitive information and credentials -Poisoning of source code repositories with malicious code -Supply chain attacks To address this critical issue, GitLab has released patches in versions 16.5.6, 16.6.4, and 16.7.2, with backported fixes available for versions 16.1.6, 16.2.9, 16.3.7, and 16.4.5. As a precautionary measure, CISA requires federal agencies to apply the latest fixes by May 22, 2024, to secure their networks against potential attacks. We strongly recommend all GitLab users to update their instances to the latest patched versions immediately to mitigate the risk of account takeover and potential supply chain attacks. https://lnkd.in/emiA3Wzz

1

DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement contractual requirements related to the Cybersecurity Maturity Model Certification (CMMC) 2.0 Program. Read the proposed rule here: https://hubs.li/Q02Lt0VR0 #CMMC #CMMC2.0

10

Yesterday, CISA released two new and one updated advisories that were added to ICS[AP] Dashboards and GitHub. The following vendor mitigation recommendations were provided to help you focus on what you can do now, plan for in the future, or address with compensating security controls. ICSA-24-123-01 - CyberPower PowerPanel https://lnkd.in/eKk8myeU Vendor mitigation: CyberPower has released a new version of PowerPanel that fixes these vulnerabilities: PowerPanel Business: Update to v4.10.1 or later version ICSA-24-123-02 - Delta Electronics DIAEnergie https://lnkd.in/etuYPKN9 Vendor mitigation: Delta Electronics recommends that users update DIAEnergie v1.10.01.004 to mitigate these vulnerabilities. Users can request this version of DIAEnergie from Delta Electronics' regional sales or agents. ICSA-24-067-01 - Chirp Systems Chirp Access (Update C) https://lnkd.in/gVHFUjMw Vendor mitigation: For additional information, please see Chirp Systems statement [https://lnkd.in/eKUBykNr] or contact RealPage (Chirp Systems' parent company) via their support page [https://lnkd.in/efndE_Ci]. Links to CISA recommended mitigations: Control systems security recommended practices: https://lnkd.in/e6Zruc2n Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies: https://lnkd.in/e7Gsjqmy Proactive defense of ICS assets: https://lnkd.in/gdcn2BS ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies: https://lnkd.in/erwz7vvb Recognizing and Avoiding Email Scams: https://lnkd.in/e-Fbr_kX Avoiding Social Engineering and Phishing Attacks: https://lnkd.in/e7mffdqc #vulnerabilitymanagement #mitigation #icssecurity #otsecurity #cybersecurity

3

If you're struggling with compliance and security challenges, CCM might me the game-changer you need. Here's why: 🏆 Rapid Certification: Achieve compliance certifications like SOC 2, CMMC, or NIST CSF in record time – like a FedRAMP High In Process package in just 3 months. 📊 Automated Evidence Collection: Cut audit prep time by up to 60%, saving costs and improving accuracy. Always be audit-ready! 🗺️ Streamlined Compliance: Map a single control across multiple frameworks, eliminating redundant tasks and ensuring a harmonized compliance posture. 🔄 DevSecOps Integration: Embed compliance checks directly into your development pipeline, maintaining security without disrupting workflows. #ContinuousControlsMonitoring #Compliance #Cybersecurity #RiskManagement #RegScale

4

⭐ AFCEA NOVA CEU Workshop: A Practical Guide to Implementing the DoD Zero Trust Strategy ⭐ 🚨Today from 12:00 PM - 1:30 PM🚨 is the insightful session on how to implement the DoD Zero Trust Strategy. This session, sponsored by Zscaler, will provide a hands-on guide to developing a Zero Trust architecture—crucial for safeguarding an organization's information and critical data. This session is approved for: 🎓1 CEC for CertNexus CyberSec First Responder (CFR) 🎓1 TGIAC CPE 🎓1 CEU for CompTIA A+, DataSys+, Network+, Security+, Linux+, and Cloud+ Speaker: 🗣️Mr. Rich Johnson, Senior Sales Engineer - Federal, Zscaler Moderator: 🎤 Dr. Keisha Benson Woods Benson Woods, Board, The Pedagogz 📍 Registration is FREE for AFCEA Members and Government (must have a valid .gov or .mil email), and open to AFCEA Non-Members for $25. 🔗 Register here: https://lnkd.in/e-5_HwyC Secure your spot and gain practical insights into Zero Trust implementation! #ZeroTrust #CyberSecurity #DoD #AFCEA #Zscaler #CyberResilience #CompTIA

3