Ryan Witt

Keep it as simple as possible. Scoping for a CMMC audit can feel daunting, but a good chunk of the work is all about preparation and continuous, incremental improvement. Here are a few things you can do now: 1. Start Small and Build Out - Don't try to implement everything at once. 2. Proper Scoping - Avoid the mistake of putting your whole company in scope. 9 times out of 10, your whole company won't be in scope. 3. Operationalize - Make sure the team knows their responsibilities and that the environment is configured as prescribed in your System Security Plan (SSP). 4. Documentation - Keep your CMMC documents up-to-date, dust-free, and ready. They're your friend and guide for your day-to-day CUI activities. 5. Stay Ahead - With CMMC 2.0 upon us, prepare now. At SecureStrux, we learned through our own experiences during our Level II assessment and can apply what we have learned as consultants to help others. We know what it takes to secure an enclave for CUI and the processes, procedures, and documentation required. If you need a team that can bring real-world experience to the CMMC certification process, please don't hesitate to reach out!

17

Whether it's PrintSpoofer on Windows abusing the Spooler Service or the recent CUPS RCE exploit on Linux, one thing is clear: If a computer doesn’t need to print, 𝐑𝐄𝐌𝐎𝐕𝐄 the printing service. Your web servers and domain controllers don’t need to print. #cybersecurity #Linux

15

2 Comments

Great supply chain attack example & its wild. I'm seeing some of these alerts that led me down the rabbit hole. policytype="policy" srcport=51642 dstport=443 attack="malicious-url" direction="outgoing" user="JohnDoe" authserver="fsso collector" msg="URL blocked by malicious-url-list" profile="IPS" crscore=30 craction=8192 crlevel="high" hostname="cdn.polyfill.io" url="/" https://lnkd.in/gxTp3JhX

1

JYSAC is getting ported to an audiobook. Listen to the introduction to Jump-start Your SOC Analyst Career: A Roadmap to Cybersecurity Success and stay posted for the Audible in a week or so.

9

3 Comments

Been doing a bit more blogging lately. In my latest piece, I'll break down how threat detection is actually a component of a larger security monitoring function. I'll also break out the other pillars of security monitoring and why these distinctions matter. https://lnkd.in/ePvjtZDW

24

4 Comments

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

TOP MOST IMPORTANT FOR SECURITY ANALYST in 2024 by Cyber Security Clips ---------What is SOAR?----------- SOAR stands for Security Orchestration, Automation, and Response. It’s a tool or platform that automates security processes, orchestrates multiple security tools, and helps teams respond to incidents faster. Example: Imagine you have several tools (firewalls, antivirus, SIEM). SOAR acts like a conductor in an orchestra, making all these tools work together to detect and respond to security threats automatically. Suppose: A phishing email is detected. what SOAR do is, it automatically analyzes the email, quarantines it, blocks the sender, and alerts the security team, saving hours of manual work. Popular Companies: Splunk SOAR, IBM Resilient, Palo Alto Networks Cortex XSOAR. For more VISIT : https://lnkd.in/dajEYA4k #cybersecurity #linkedinpost #hr #splunk #ibm #paloaltonetworks #soar #jobs

2

Too often, security teams get late invites to product launches. Here’s our guide for how to secure surprise projects so you can quickly swap emergency fire hoses for confetti cannons.

36

1 Comment

Excellent presentation! Read the words, read between the lines, read it AGAIN! What Chris is saying about cyber crisis and Incident Response is relevant to YOU!

18

2 Comments

There's nothing more intimidating than raw data and a laundry list of tasks and insights you need to gain from said data. The solution: custom dashboards. SP6's Splunk Core Certified engineers are more than capable of building custom dashboards in your environment. These help you to visualize Splunk data in ways that match your specific business and security objectives—no fear necessary! Learn more about it here: https://hubs.la/Q02LlxlQ0

10

Recently, the California Superior Court in Sonoma County fell victim to a ransomware attack, disrupting operations and jeopardizing sensitive data. Read more: https://lnkd.in/gCa8SAN5 Learn how our proactive cybersecurity solutions can safeguard your organization from similar risks. Secure your business today with XCELIT’s cybersecurity services. Contact us now!

1

#SplunkSecurity + #BHUSA, you + an insightful session on Splunk Attack Range...it seems to us that some things just make sense together. 😉 Don't miss this informative session with Splunk expert Rod Soto that'll help take your #security detection and defense to the next level: https://splk.it/46M0WiJ

59

https://lnkd.in/gbKgByt6 The cloud is just someone else's computer. And sometimes that other person inexplicably deletes all of your stuff. The cloud is also no substitute for a well thought out business continuity plan. I know of, and have personal firsthand experience with, too many BIG companies, publicly traded even, who are 100% cloud based and have no backups outside of their cloud provider. I don't understand why auditors, underwriters, shareholders, let them get away with it aside from ignorance or discounting the risk.

6

2 Comments

I think a lot about securing critical infrastructure and operational technology (OT) environments. A few months ago, I saw a post from Andy Hollingsworth about cybersec ops training from the Idaho National Lab/CISA. I found a collection of training they have online for the Cyber-CHAMP framework. It is taught from an OT operator perspective and highlights the challenges that come with the IT/OT convergence. Cyber-CHAMP is a structured framework to help organizations assess their cybersecurity posture, align security initiatives with business goals, and develop a roadmap for building a cyber-ready workforce. What makes Cyber-CHAMP so powerful is that it looks at #cybersecurity from both the organizational and individual level. It's not just about implementing the latest technologies - it's about ensuring your people have the right skills, roles, and responsibilities to be an effective line of defense. Cyber security for OT environments used to be accomplished by creating separate networks. But that strategy doesn't hold up as more and more devices demand connectivity - including things like coffee pots which the instructors share in a memorable example during the class. Cyber-CHAMP provides a way to assess gaps and develop a tailored plan for upskilling the workforce. I am encouraging everyone on my team to take these classes. The instructors are practical and experienced. The content is up to date, relevant, and vendor agnostic. And, it is free. What's not to like? #aws AWS for Energy & Utilities #timeseries #businessanalytics

10