Chris Roberts

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

The Environmental Protection Agency lacks a documented plan to coordinate incident reporting with CISA, the agency’s Office of Inspector General found. Environmental Protection Agency officials found critical or high-risk vulnerabilities in 97 drinking water systems that serve more than 26 million people across the U.S., according to a report released last week by the agency’s Office of Inspector General. Another 211 water systems, servicing almost 83 million people, had medium-to low-risk vulnerabilities, including open portals that were visible from the outside. These water systems could face major disruptions or physical damage if a malicious hacker tried to exploit those vulnerable systems. The OIG report noted the EPA does not have an incident reporting system and relies on the Cybersecurity and Infrastructure Security Agency’s system. The OIG also could not find documented policies and procedures for how the EPA coordinates with CISA and other federal agencies to address these issues. #criticalinfrastructurecyberrisk #cyberriskmanagement #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

148

30 Comments

The HHS' Office for Civil Rights (OCR) must take significant steps to enhance its HIPAA audit program to ensure stronger protection of electronic protected health information (ePHI), according to a recent report from the Office of Inspector General (OIG). Amid increasing cyberattacks on healthcare organizations, the report highlights the need for more robust oversight and enforcement to safeguard sensitive health data. The audit assessed OCR’s compliance with the Health Information Technology for Economic and Clinical Health (HITECH) Act, which mandates periodic audits under the Health Insurance Portability and Accountability Act (HIPAA). While OCR has fulfilled its audit requirements, OIG found critical gaps in implementation, raising concerns about the effectiveness of OCR’s efforts to mitigate cybersecurity risks across the healthcare sector.

2

Conducting a Post-Incident Review Once the dust has settled, it's time to figure out what went wrong. A post-incident review isn't optional—it's how you identify the weaknesses that led to the breach in the first place. Without it, you're leaving your business vulnerable to the next attack. Ask yourself: how did they get in, what systems failed, and what steps need to change? This isn't just about fixing—it's about preventing future incidents. Are you ready to conduct a thorough post-incident review? Let's make sure your next breach isn't worse. #PostIncidentReview #CyberSecurityAnalysis #LessonsLearned

1

How are threat actors weaponizing generative AI, and how can AI help the good guys? You'll find out in this eBook from Microsoft Security and OpenAI. Download it here. 👇

4

Social engineering is a low-complexity TTP used by many, not just Scattered Spider. Permiso has been alerting about Scattered Spider's TTPs because it can be used by other threat actors and victims of Scattered Spider had all the security controls (CSPM, EDR, CASB, CNAPP, SIEM) but still were compromised. All victims missed early response/ containment opportunities at IdP and SaaS layers, could have caught 3 days earlier on average, a significant window given a 3-5 day operational period. By the time an alert fires in your SIEM, if it does, the blast radius is large and damage is done. DM me to discuss common gaps in threat visibility, detection, response, and containment across IdP, IaaS, PaaS, SaaS, and CI-CD that enable social engineering and other cloud TTPs to be successful, and strategies to close these gaps. We know Scattered Spider's cloud attacks, our P0 Labs Team put out a report last year detailing the cloud attacks they responded to.

3

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

The healthcare industry is at a critical crossroads regarding cybersecurity, and a new bill introduced this week marks a major step toward protecting patient safety and national security. The measure would require the Department of Health and Human Services (HHS) to establish minimum cybersecurity standards for healthcare providers, health plans, and other key entities, moving away from voluntary guidelines to enforceable requirements. This is BIG for patients with sensitive data! Healthcare data is a goldmine for hackers. It often contains sensitive patient information that, once stolen, can be weaponized for extortion or fraud. #Cybersecurity #DataProtection #PatientDataProtection #HealthcareCybersecurity

26

1 Comment

Cybersecurity Awareness Month may be coming to a close, but the importance of cyber risk management in healthcare is as crucial as ever. Hospitals often become collateral damage in cybercriminals' strategies, as seen with the recent attack on Change Healthcare. To mitigate these risks, healthcare organizations must strengthen their business continuity plans now, ensuring they can handle prolonged service losses. Regular cyber-risk assessments and testing are essential to safeguard against the cascading effects of cyber threats. #CyberRiskManagement #HealthcareSecurity #ThirdPartyRisk

5

Several voter registration databases for Illinois were left publicly exposed without encryption or any form of authentication, allowing unrestricted access to sensitive voter information for an indeterminate period of time. The database contained all sorts of details including SSN, Driver’s License Number, Historical Voting Records, Home Address, etc.   The security of our elections extends far beyond the voting process; it directly impacts the safety of the individuals who participate in it. In today's volatile political climate and with the world in a state of uncertainty, it's all too easy to imagine the disastrous consequences that could arise from neglecting this responsibility. We must do better—because the stakes are higher than ever.   “The exposed databases contained .csv documents with lists of available or active voters, absentees, early mail-in voting records, and duplicate voters. Other documents marked as “voter records” contained far more potentially sensitive personal information, including full name, physical address, some email addresses, date of birth, SSN (full and partial) or driver’s license number, and historical voting records. The database also contained copies of voter registration applications, death certificates, and records of change of address, jurisdiction, or state. There were also candidate documents (such as statements of candidacy) detailing personal phone number, email address, and home address. These candidate documents also included petitions with voter signatures, addresses, candidate loyalty oath, economic interest, and additional supporting documentation. There were also documents marked as official ballot templates for primaries and general elections.”   “The potential risk of a coordinated disinformation campaign using voter lists and voter registrations is a serious concern from both outside actors (such as Russia or China) and domestic activists looking to sway political opinions. According to a study conducted by the Pew Research Center in 2020, 75% of American voters believed there would be outside interference in the presidential election. Having PII of voters would potentially allow malicious actors to send them misleading information (about voting dates, locations, or requirements) based on their party affiliation. Another possible risk is voter intimidation, which includes using past voter history to threaten or harass voters.”   https://lnkd.in/gRJ-mh24

3

1 Comment

Security teams need actionable insights tailored to their unique risks and priorities. Hunter Strategy’s Cyber Threat Intelligence (CTI) delivers targeted, multi-source intelligence for proactive security. Our process empowers your organization with custom CTI solutions, adversary tracking, and prioritized threat mitigation. Learn more now: https://loom.ly/90WhD60 #CyberSecurity #ThreatIntelligence #AdversaryTracking #CTISolutions #ProactiveDefense

3

Last year, our p0 Labs Team at Permiso Security published groundbreaking research on Scattered Spider (aka LUCR-3), exposing their sophisticated cloud attack methods. Their weapon of choice? Stolen credentials to move invisibly through cloud environments, making traditional security tools nearly blind. Through the Permiso platform, we've been helping organizations detect compromised credentials across IDaaS, SaaS, and cloud environments in minutes. And because we know these attacks challenge even the most security mature enterprises, we've released numerous open-source tools to help the broader community detect LUCR-3 and similar credential-based cloud attacks. Check out our report here: https://lnkd.in/gSkwCmqg

11

Classical MFA (multi factor such as OTP and authenticator apps) was easily bypassed by these "Attacker in the middle" Phishing kits. Upgrade to Phishing resistant MFA is no longer an option but must be a top priority for any CISO serious about their security. Remember 90% of cyber attacks start with phishing!

6

Episode 3050 - Jason (Jay) Mar-Tang, CISSP, CCSP of Pentera discusses how ransomware continues to plague organizations. Pentera's RansomwareReady provides a unique offering, enabling organizations to proactively test their defenses against the threat of ransomware on-demand. Pentera just announced a major update to expand the capabilities of the product. RansomwareReady can now test against the Lockbit 3.0 campaign as well as test against the impact of ransomware campaigns like Lockbit 3.0 within vulnerable Linux environments https://lnkd.in/gBXBHmH9 #bhusa #bhusa2024 #blackhat #blackhatusa #blackhatusa2024 #pentera #cybersecurity #pentesting

15

1 Comment

This breach at #GlobeLife serves as a reminder that security isn't a one-time setup — it's a continuous process. Regular audits of access permissions and user identity management are essential. Orgs have to continuously evaluate their security posture to address vulnerabilities before they are exploited.

3

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5