Eran Shpigelman

🔐 Breaking Down NIST CSF Subcategory GV.SC-06 🔐 When it comes to cybersecurity, it’s not just about what happens inside your organization—it’s also about who you do business with. That’s where NIST CSF Subcategory GV.SC-06 comes into play. GV.SC-06 emphasizes the importance of performing thorough planning and due diligence to reduce risks before entering into formal relationships with suppliers or other third parties. Why is this important? Imagine partnering with a vendor who has weak security practices. That connection could become a gateway for cyber threats, putting your entire organization at risk. GV.SC-06 helps ensure that before you sign any contracts or agreements, you’ve carefully evaluated the potential risks and taken steps to mitigate them. For those unfamiliar with the NIST Cybersecurity Framework, it’s a set of guidelines designed to help organizations manage and reduce cybersecurity risks. It’s a widely respected tool used across various industries to build strong and resilient security strategies. 🌐 By conducting proper due diligence before partnering with third parties, you’re not just protecting your organization—you’re also building a stronger, more secure business network. #Cybersecurity #NISTCSF #RiskManagement #ThirdPartyRisk #DueDiligence

6

CISA warns of actively exploited Apache HugeGraph-Server bug The U.S. Cybersecurity and Infrastructure Agency (CISA) has added five flaws to its Known Exploited Vulnerabilities (KEV) catalog, among which is a remote code execution (RCE) flaw impacting Apache HugeGraph-Server. The flaw, tracked as CVE-2024-27348 and rated critical (CVSS v3.1 score: 9.8), is an improper access control vulnerability that impacts HugeGraph-Server versions from 1.0.0 and up to, but not including 1.3.0. Apache fixed the vulnerability on April 22, 2024, with the release of version 1.3.0. Apart from upgrading to the latest version, users were also recommended to use Java 11 and enable the Auth system. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

1

#CISA is requiring organizations in critical sectors to update their security posture. #MFA, #vulnerabilitymanagement, and #dataencryption will be enforced These changes will help #mitigate the potential #theft of #data by #statesponsored and #nationstateactors. The US wants security requirements as #standard to stop #sensitivedata from falling into enemy hands. #CISA is seeking #publicfeedback on the proposed #requirements to refine the #framework before it is finalized. Interested stakeholders, including industry leaders and cybersecurity experts, are invited to submit their comments via regulations.gov by entering CISA-2024-0029 in the search field and following the instructions to provide input. I’d also like to see #monetaryconsequences for businesses and #enforcedcompliance of these requirements included in this framework to ensure implementation. https://lnkd.in/gz4R4vNc

19

1 Comment

Surprisingly, many companies still think they don't need a Security Framework. Adopting a Framework will help your Cyber Security program continuously built, audited, and improved. #CyberSecurity #SecurityFramework #SANS #Security #NIST #ISO27001 #PCIDSS #Compliance #Vulnerability

2

𝐓𝐡𝐞 𝐟𝐨𝐮𝐫-𝐪𝐮𝐞𝐬𝐭𝐢𝐨𝐧 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 𝐟𝐨𝐫 𝐭𝐡𝐫𝐞𝐚𝐭 𝐦𝐨𝐝𝐞𝐥𝐢𝐧𝐠 Threat modeling identifies, assesses, and mitigates potential threats before attackers can exploit them. It is fundamental to develop secure systems and a thorough security strategy. Adam Shostack has contributed to this practice by introducing a four-question framework to guide the threat modeling process systematically. Combined with the STRIDE model, Shostack's framework provides a solid methodology for analyzing and enhancing system security. 𝐒𝐓𝐑𝐈𝐃𝐄 The STRIDE model offers a structured approach to examining and classifying threats during the threat identification phase. Each element of STRIDE addresses a specific area of concern. Spoofing focuses on identifying threats related to identity falsification while tampering zeroes in on unauthorized modifications. Repudiation pertains to denying actions performed, and information disclosure involves unauthorized access to confidential data. Denial of service targets the availability of services and elevation of privilege deals with accessing privileges beyond what is authorized. 𝐓𝐡𝐞 𝐟𝐨𝐮𝐫-𝐪𝐮𝐞𝐬𝐭𝐢𝐨𝐧 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 Shostack's framework comprises four pivotal questions that drive the threat modeling process: 1. What are we working on? This initial question sets the stage for the threat modeling process by defining the scope and understanding the system architecture. It involves identifying the system components, data flows, and valuable assets, establishing a baseline for the current security posture, and ensuring the consideration of all relevant factors for thorough analysis. 2. What can go wrong? This question focuses on potential threats and uses the STRIDE model to categorize and identify specific vulnerabilities. STRIDE pinpoints where the system might be susceptible to attacks. 3. What are we going to do about it? This question focuses on strategies to mitigate potential threats. It involves planning and implementing controls to defend the system against the outlined threats. 4. Did we do a good job? The final question assesses the model's effectiveness and the implementation of measures to ensure it adequately addresses the threats and enhances the system's security. 𝐂𝐨𝐧𝐜𝐥𝐮𝐬𝐢𝐨𝐧 Integrating the four-question framework with STRIDE offers a comprehensive approach to threat modeling. It identifies and mitigates threats, continually improving measures to ensure security by design and enhance resilience. #threatanalysis #threatmodeling #stride #security #cybersecurity

17

3 Comments

🔥Processes are made to help, not hurt. Thousands of reported vulnerabilities are now backlogged for lack of enrichment data. I wonder how many attackers wait for a process to complete before exploiting a #vulnerability ? Hope we find a solution for this quickly - I for one don’t mind volunteering my personal time to assist if needed #NIST #vulnerabilities #attackers #CVEs #cybersecurity #hackers #cybersecurityawareness #NIST #NVD https://lnkd.in/eAQS6Q83

28

Has anyone here used Trustcloud for compliance?? 🤔 I see a lot of ads for this platform on Linkedin lately. I don't know this company, they are direct competitors to big players like Vanta and Drata. I got curious because they offer a free plan for startups when their main competitors charge more than 10k a year. I always have the "too good to be true" mindset, but some big companies also provide free services to smaller companies as a way to win them when they grow (Cloudflare is the best exemple, free for small companies but an incredible offer). Soooo, I'm wondering where Trustcloud stands if anyone has used their platform. Please share your thoughts 😬 If they are reliable, I think that it could help a lot of startups here to begin their compliance adventure. PS: this post is not there to debate on the use of compliance tools. My point is more that if there is a way to save money here and use that to actually increase your cybersecurity posture, I think that's something to consider. Peace ✌️ https://www.trustcloud.ai/

3

3 Comments

For most organizations, Active Directory is the key to the kingdom - and its complexity and age conspire to make it fiendishly difficult to defend. The recent joint publication of a guide to its most exploited pitfalls by the "Five Eyes" intel agencies is both a great resource and a warning that the bad guys are consistently using the same few techniques against AD to gain and maintain access. Do yourself a favor and give this a read and check out the free (!) PingCastle and PurpleKnight audit tools it recommends to help close up some of the most dangerous misconfigurations before the attackers turn their eyes on you.

1

I was recently asked why I’m so invested in automation, SOAR, and AI, and while I paused before responding, the truth is simple: the future of information security depends on these technologies. But it’s more than just the tools; we must invest in our people. Conferences, training, and continuous learning aren’t luxuries; they are necessities. In our fast-moving industry, we must make time to explore new technologies and learn from our peers to stay ahead. The rapid rise of AI is pushing CIOs and security leaders to rethink their strategies. We are in a unique position, not just advising on AI investments but leading the teams responsible for bringing these innovations to life. To do this effectively, we must embrace three key approaches: Be a Change Agent. AI’s fast evolution requires IT leaders to go beyond operations and become true change agents. It’s crucial to make decisions with business impact in mind and communicate the value of new technologies clearly. This not only drives adoption but also shapes how our teams think and operate. AI is a field that demands continuous education—through partnerships, industry involvement, and staying informed about the latest developments. 2. Invest in Continuous Learning. Learning in information security is never-ending. Skills training is just the start; real learning comes from doing. Implementing AI and automation will come with challenges, but these are opportunities to refine and improve. CIOs and security leaders need to set the right guardrails, including ethical policies and guidelines that evolve with technology, ensuring that our teams can innovate safely and securely. 3. Look Toward the Future. CIOs are uniquely positioned to influence AI strategy, build and upskill teams, and foster a culture that adapts to constant change. If we get it right today, the teams we develop will be ready to fully leverage the opportunities AI presents in the future. In the end, embracing AI, SOAR, and automation is about more than staying relevant—it’s about securing our future. By investing in our teams and fostering continuous learning, we ensure that our organizations are not just resilient, but also ready to lead in the evolving landscape of information security. #AI #Automation #CyberSecurity #SOAR #Leadership #ContinuousLearning #CIO #Infosec #Innovation

42

3 Comments

4-Step Approach to Mapping and Securing Your Organization's Most Critical Assets https://lnkd.in/ezjhGtVj

1

Cybersecurity Blind Spots in IaC and PaC Tools Expose Cloud Platforms to New Attacks: Cybersecurity researchers have disclosed two new attack techniques against infrastructure-as-code (IaC) and policy-as-code (PaC) tools like HashiCorp's Terraform and Open Policy Agent (OPA) that leverage dedicated, domain-specific languages (DSLs) to breach cloud platforms and exfiltrate data. "Since these are hardened languages with limited capabilities, they're supposed to be more secure than https://lnkd.in/guYVm7pF

1

🔐 Navigating Third-Party Risks: NIST CSF GV.SC-07 🔐 In today’s interconnected world, managing cybersecurity risks isn’t just about safeguarding your own organization—it’s also about understanding and managing the risks associated with your suppliers and third-party partners. That’s where NIST CSF Subcategory GV.SC-07 comes into play. GV.SC-07 focuses on ensuring that the risks posed by a supplier, their products and services, and other third parties are thoroughly understood, recorded, prioritized, assessed, responded to, and continuously monitored throughout the relationship. This sounds similar to GV.SC-05, which ensures the *contract language* with the vendor allows for the monitoring called for by GV.SC-07. Why is this important? Even if your internal security measures are robust, a vulnerability in a third-party provider can expose your organization to significant risks. GV.SC-07 emphasizes a proactive approach to third-party risk management, ensuring that you don’t just evaluate risks at the start of a relationship but continuously monitor and address them as the relationship evolves. For those new to the NIST Cybersecurity Framework, it’s a comprehensive guide used by organizations to manage and reduce cybersecurity risks effectively. GV.SC-07 helps organizations maintain a secure and resilient supply chain by keeping a close eye on third-party risks. 🌐 In a world where supply chains are more interconnected than ever, understanding and managing third-party risks is crucial for protecting your organization’s data and reputation. #Cybersecurity #NISTCSF #ThirdPartyRisk #SupplyChainSecurity #RiskManagement

9