Ross Henton

In a recent conversation a cyber assessor asked me how they could get leadership buy-in to using risk quantification. Here are 3 ways I'd suggest doing this. Let me know what you think in the comments. 1. Use Industry Profiles for Context : Show how your organization compares to others in your industry in terms of risk exposure by using industry data. This helps highlight where your organization stands and can spark interest in exploring risk quantification further. 2. Highlight a Recent Attack : Use a recent cyber attack that affected your industry as an example. Show the potential financial impact and likelihood of such an attack on your organization. This makes the concept of risk quantification more real and urgent, helping leaders understand its importance. 3. Clarify Risk Levels : When discussing risk, push for clear definitions of what “high,” “moderate,” or “low” risk means by advocating for a quantified approach. This can help uncover inconsistencies in how risk is evaluated and emphasize the need for a standardized risk assessment method. Have you had success getting leadership buy-in to using risk quantification?

1

2 Comments

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Earlier this year, Cyentia Institute published a meta-study analyzing the top ATT&CK techniques reported across 20+ industry sources. NOT ONE OF THEM reported observing T1195.003 - Compromise Hardware Supply Chain. Hold on - my aid has an urgent message for me...oh my...they what?!...pagers exploding - really?...I see...got it...will do... Sorry for the interruption. As I was saying, T1195.003 was THE MOST REPORTED sub-technique in the entire study! Download it today from the compromised device of your choice: https://lnkd.in/eafNi5u3 #supplychain #cybersecurity #fud

91

6 Comments

I often get asked “where do I start with TX-RAMP?” Companies know they need it - they’re told they do. But it’s not easy to know where to start. Here’s what you need to know 👇 1️⃣ File for your provisional certification. This will give you 18 months to get the full certification. 2️⃣ Download the TX-RAMP Security Plan Workbook. This serves as your questionnaire and list of necessary controls (117 for Level 1 certification, 223 for Level 2). 3️⃣ Build your program, one control at a time. Once your program is built, you can submit your workbook and other documents to the Texas DIR for their evaluation. No expensive, third party audits necessary! TX-RAMP Certification is a big project, even for companies that have an existing cybersecurity compliance program. There’s a reason they give you 18 months to go from provisional to full certification! Your certification lasts three years, but there are some ongoing reporting requirements to meet. You need to monitor, fix, and report vulnerabilities and breaches to the Texas DIR. More helpful info can be found in the guide below. https://lnkd.in/etitFTkY 

10

✅ (3/38) CPG 1.C OT Cybersecurity Leadership. In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at OT Cybersecurity Leadership. The intent of this CPG is to establish overall documented accountability and responsibility for your cybersecurity program for Operational Technology. We need a person's name or a position title that is unambiguous. This is very similar to the CPG we covered yesterday, 1.B for Organizational Cybersecurity Leadership, but this is about OT. The CPGs captured this as a separate goal to make sure we have alignment here. It could be the same person, but ideally this would be somebody with authority over OT and understanding of the risks to the OT environment. It's noteworthy that this leader is likely much closer to operations than an organization level leader who may be more focused on overarching corporate strategy. In most cases this will go beyond cybersecurity to include Safety, Operational Resilience and other Operations focused risks. This person needs to be a senior leader in the organization with the authority and political clout to get things done, and engages in: ➡️ Planning ➡️ Resourcing ➡️ Executing This leader is accountable and responsible, but that does not mean they have to do it all themselves. These activities can be delegated, as long as the named leader ensures cybersecurity is managed effectively. I have seen a few programs that named a figurehead to this function, but did not give them the authority they needed to execute. Or did not support the resource requests needed. Resources comes in the way of staff, budget and also organizational support. The most common mistake I see is tasking somebody that does not understand OT with this responsibility. If you have decided that your CISO or similar will be responsible, it's important that we make sure to educate them and other senior leaders to align with OT risks. In our Notion CPG template at https://lnkd.in/eP-pfWfk we provide a high level overview of this goal, and suggest a potential tool, wikijs, to capture this and other details in your program. You could just as easily use SharePoint, a Word doc or commercial tools. The tool does not matter as much as clearly defining accountability and communicating this to the organization. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #cybersecurityleadership

11

1 Comment

The Environmental Protection Agency lacks a documented plan to coordinate incident reporting with CISA, the agency’s Office of Inspector General found. Environmental Protection Agency officials found critical or high-risk vulnerabilities in 97 drinking water systems that serve more than 26 million people across the U.S., according to a report released last week by the agency’s Office of Inspector General. Another 211 water systems, servicing almost 83 million people, had medium-to low-risk vulnerabilities, including open portals that were visible from the outside. These water systems could face major disruptions or physical damage if a malicious hacker tried to exploit those vulnerable systems. The OIG report noted the EPA does not have an incident reporting system and relies on the Cybersecurity and Infrastructure Security Agency’s system. The OIG also could not find documented policies and procedures for how the EPA coordinates with CISA and other federal agencies to address these issues. #criticalinfrastructurecyberrisk #cyberriskmanagement #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

Cloaked and covert... "Investigations into more recent operations in 2023 following fixes from the vendors involved in the investigation have corroborated Mandiant's initial observations that the actor operates in a sophisticated, cautious, and evasive nature. Mandiant has observed that UNC3886 employed several layers of organized persistence for redundancy to maintain access to compromised environments over time. Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated. This blog post discusses UNC3886's intrusion path and subsequent actions that were performed in the environments after compromising the guest virtual machines to achieve access to the critical systems, including: The use of publicly available rootkits for long-term persistence Deployment of malware that leveraged trusted third-party services for command and control (C2 or C&C) Subverting access and collecting credentials with Secure Shell (SSH) backdoors Extracting credentials from TACACS+ authentication using custom malware"

2

I hope everyone is having a good Friday. Time for some Sa(a)S. We're continuing the CMMC series with a more detailed breakdown of the 3 levels. The full post can be seen here: https://lnkd.in/g-DCGGi2 For a quick summary, all 3 levels are from NIST SP 800 171 (and 172 for level 3), so it's at least not completely new standards. And why the standards are still in the rule-making process, we have a good idea what the final requirements will be. Level 1 will have 17 requirements and is intended for the least sensitive DoD contracts. This certification will be based off of a self assessment. Level 2 has a big jump to 110 total requirements as more national security implications are expected with the associated contracts. This is expected to be the most common level, and in most cases will require a 3rd party assessment every 3 years with an annual self assessment. Level 3 is for the most sensitive contracts that don't involve classified (or greater) designations and will add up to an additional 35 requirements above level two. For this, companies will need to have Federal officials perform the assessment every three years. Please reach out with any questions and have a great weekend! #cmmc #cybersecurity #securityawareness

8

Managing #thirdparty #cyberrisk is hard. But it gets even harder when trying to manage 4th...5th...Nth tier #supplychain relationships because visibility, familiarity, and control tend to decline with each degree of removal. This chart, from a joint Cyentia Institute and RiskRecon, A Mastercard Company report, captures this challenge. Your organization (the square in the center) may be able to track breaches of your direct third parties. But what about all those others? Are you even aware that you're indirectly connected to - and thereby potentially exposed to - breaches of those Nth parties? We explore this topic in "Risk to the Nth-Party Degree." Link to download in comments.

239

35 Comments

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/9yeq105M2RV

4

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/4wMB105OfpG

7

Unleashing the Investigative Mindset: Uncover the Secrets of Cybersecurity Discover how to tap into your investigative mindset and unlock the hidden secrets in cybersecurity. Gain valuable insights on analyzing information, hypothesizing next moves, and finding crucial data even without advanced tools. Enhance your technical aptitude and understanding of human behavior to become a successful investigator. #InvestigativeMindset #CybersecuritySecrets #InformationAnalysis #TechnicalAptitude #HumanBehavior #CybersecurityInvestigation #DataAnalysis #CybersecuritySkills #DigitalForensics #CybercrimeDetection

4

Even Public Healthcare companies are Targets for Hackers and CyberCriminals. Looks like Parkland (County) Hospital.. right here in Dallas was hit in a Cyber Attack of some kind. Hope they have an experienced CISO to Guide them through the ordeal. Good Initial Questions are - * Did they have a Security RoadMap... * Did they address the Top 10 CyberSecurity Issues.... * Were they (verifying that) Hardening was happening.. * Did they have a good Inventory of their key / Production environment 🤔.. * Was there (adequate) Budget in Place.. * Was there a TVM (threat and Vulnerability mgmt) program in place.. * Did they have enough (Cyber/ Trained) Security staff.. * Were the CSIRT Procedures documented.. * Did they read about the Trends / Known Issues in the Healthcare Industry.. (e.g. published Whitepapers).. * etc... It's a public Fact that they have about a $3.2 Million 💰 Budget... trying to help.. Bruce McDaniels, MBA, MIS, PMP, CISM #CyberSecurity #CountyHospitalAttack #ExperiencedCISO #SecurityRoadmap #TopIssuesInMedical

5

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments