Mike Starr

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

If you're writing an RFP for continuous security testing (or even traditional security testing), here's five questions I'd recommend you ask your vendors... 1) How do you ensure that your testing efforts are focused in the right areas 2) How do you avoid inefficient overlap between scanners and manual testing 3) How quickly after a vulnerability is introduced are you likely to detect it 4) How can I use your service to provide customers and auditors with confidence 5) What key value do you provide over traditional penetration tests, bug bounties, and automated scans Now, if you're asking all of that, you may as well ask one more as well 😉 6) What's your opinion of the Cytix approach to continuous testing Let me know how you get on, I'd love to know what they come back with!

3

The proposed rule would also require the disclosure of cyber incidents to CISA and physical security concerns to TSA. The Transportation Security Administration is seeking public comment on proposed requirements for surface transportation and pipeline companies to implement cyber risk management programs, the agency said Wednesday. The public comment period ends on Feb. 5, 2025. The proposed rule calls for certain pipeline, passenger and freight rail operators and rail system companies with high-risk profiles to develop comprehensive cyber risk management programs. Pipeline, rail and certain bus transportation or transit systems would be required to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency. The sectors would report any physical security risk concerns to TSA. #criticalinfrastructurecyberrisk #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

1 Comment

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

Integrity Properties for Federations I’m writing to highly recommend the article “How to link an application protocol to an OpenID Federation 1.0 trust layer” by Vladimir Dzhuvinov. In it, he defines two kinds of integrity for Federations, and describes how to achieve them: Federation Integrity and Metadata Integrity. The article also explores how application protocols, such as OpenID Connect or digital wallet protocols, can achieve those properties in practice (and when they do and don’t need to). You can read my full recommendation at https://lnkd.in/gTRn_Yux and Vladimir's article at https://lnkd.in/gPwSnM2n.

18

1 Comment

You need to use the findings and automate based on those. eBPF is not enough.

2

API keys are essential to connect applications, services, or data lakes together. Yet, they can also be a security risk. Imagine Alice sets up an API key to give her team or a vendor access to sensitive data—many times these keys are long-lived and often shared across different workloads. If the group uses federation, actions taken by Alice or others occur using a shared credential/role in the environment. This means logs would only show the credential conducting that activity, which again, gets shared with others who have access to the role. Alice's coworker, Bob, has their legitimate cloud credentials compromised. The threat actor uses Bob's credentials to federate into a shared credential/role in the environment. The threat actor exploits native features/functions of the cloud to appear as Bob, thereby blending their activity in to avoid detection. Most security teams today won't spot Bob's impersonator fast enough or at all. Trying to make sense of cloud logs is a real challenge, especially when it's happening in real-time. It can take hours or even days to piece together what happened. And by then, detection and response are delayed and the damage might already be done. What can you do? Security teams can start by keeping a detailed record of all identities, keys, tokens, certificates, and credentials they've provisioned and used, services accounts they have access to, what roles they assume. Then, security teams can set up what's considered "normal" access and behavior. Once the team understands “normal” behavior, they can develop rules and alerts from logs to try to detect and respond to access and behavioral anomalies. At Permiso, we have developed an identity-centric approach to cloud threat detection and response. Our solution can help security teams detect and respond to access and behavioral anomalies in the environments faster and with greater confidence from having the full session access and activity. Want to learn more? DM me or visit https://lnkd.in/gC4DUJ9j to learn about our approach to solving the challenge of detecting and responding to threats in and across IaaS, SaaS, CI-CD, IDP environments.

11

What tools do you know of that allow building SSVC decision trees at scale? Do any exist? I believe some vendors in the risk based vuln mgmt sector can utilize rules to build some level of decision tree.. But I'm not sure how deep that goes. - Does anyone know tools that help with this? - If you are currently doing SSVC, what technology are you using to accomplish it across hundreds of thousands of vulnerabilities with and without CVE's? #VulnerabilityManagement #SSVC #Security #CVSS #CVE

17

17 Comments

Some good reminders as a response to Verizon DBIR report (data breach investigation report) "Credential and Secrets Theft: Insights from the 2024 Verizon Data Breach Report" It's your job as infrastructure manger, developer, security people, solution provider, so secure all of this. connected=hacked cloud=leak #cybersecurity #cloud #dbir #clowd

15

2 Comments

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

Almost a year to notify about the breach, just that, but don't worry, it's for your own good ! And don't forget to get their free credit monitoring as a compensation ! "Sav-Rx discloses data breach impacting 2.8 million Americans" ⚠ But NOW they took action, after this data has been leaked : Full name Date of birth Social Security Number (SSN) Email address Physical address Phone number Eligibility data Insurance identification number (Just more than enough to steal your identity, your finance, your life in society) So, they took action as follow : - They started to implement the basics of #cybersecurity ! YAY ! What a relief ! 💡 I really wonder what were they doing before ? As these were not implemented, state before the incident in 2023 : - No 24/7 security operations center - No multi-factor authentication on critical accounts (now they have, and they don't even enable it on ALL accounts, just the "critical" ones ! LOL common people ! ) - No network segmentation - No enhanced geo-blocking (aka geo fencing, aka conditional access) - No upgraded firewalls and switches (sure, why bothering) - No strengthened Linux security, - No BitLocker encryption (in the medical sector...) 🌨 Weather forecast : Another leak is coming, and it will most likely happen using a "non critical account", with a lateral move, and then escalation of privilege ! Then, maybe, they'll consider adding MFA on ALL accounts. 😆 But don't worry, you'll certainly get a credit monitoring extension by then ! connected=hacked #cybersecurity FAILURE https://lnkd.in/ecmcg6di

14

2 Comments

Trying to understand how AI and Analytics can help your Agency? Check this out!

2

Interesting Okta vulnerability (see link below) allowed users with usernames longer than 52 characters to potentially log in without password being validated. Kudos to Okta for a very detailed post on the issue but the root cause is that Okta seems to have used a password hashing algorithm (bcrypt) to generate a key. The fix was to use a key derivation function (PBKDF2) instead. Okta asked customers to verify logs to see any improper authentication methods. It is unlikely this was abused as the vulnerability was found (disclosed responsibly it looks like) and fixed quickly. But my co-founder Kartik CDS who full name expands to 45 characters breathed a sigh of relief :) It's 2024 - bcrypt and other password hashing functions have been around for a long time. It is well known that most implementations of bcrypt have limitations on password length (usually 72 bytes). Okta used a combination of user id + user name + password to derive a key. 20 byte user id and a 52 byte user name will easily go past the 72 byte limit rendering the password useless. Crypto is hard to get right and the impact of even a slightly improper use of crypto can be dangerous as can be seen by this advisory. We all write encryption/crypto policies as part of our compliance programs. The policies are almost always right but subtle mistakes such as these can be hidden everywhere. #encryption #keyderivation https://lnkd.in/g9dUQYXf

75

2 Comments

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1

Just in time for the Thanksgiving holiday, I’m pleased to announce that RedSense in collaboration with technical partners, mitigated a mid-tier adversary access to a Mississippi medical group. Lower tier targets, sometimes medical providers, are opportunistically targeted by threat actors hoping to exploit and then pivot to trade up the food chain to a much larger target, e.g., principal/owner, partner, subsidiary, or maybe a supply chain attack. #humans1st

32

Ever written a $50,000 email? Here's a fun story from the GRYD for your Friday. We have a member who recently finished their vCISO package re-design (and a 🔥 pitch deck) using the system, and had several deals in the pipeline. The first of these - a smaller but healthy $4,000 MRR vCISO program - was getting down to decision stage, and the client sent the dreaded "how much time are you spending" email the day before the final meeting. If you know, you know. 😬 That question can be a deal killer. The wrong answer can create a thread of doubt in the value of the service. And if the client pulls on it, can unravel the entire value prop. So our member dropped the question in a message board, and I provided the answer and positioning for a response. Just two words popped up in a message the next day: "Deal closed." I was stoked, so I asked - tell me about how it went down? "I literally copied and pasted your comment in reply to the client's email." Well that's cool 💪 And it's a curious thing... How all that planning, all that positioning, all that work can be undone - or won - with a few lines of text. But that's why the PowerGRYD vCISO System is a full spectrum approach. Because when you align messaging, positioning, packaging, pricing, service delivery, and account management with the client journey in mind... You create differentiators, and the ability to convey value easily. And bottom line, you win deals. So if you're looking to create growth opportunities for your MSP with vCISO services: Drop me a DM with the word "Growth" to position your vCISO program for value and bottom line... help you close deals. Or head here next: https://lnkd.in/gaJ7Chm2

38

19 Comments

CISOs have been telling me for a while how hard complying with privacy regs has become. This week, IANS is launching a new offering  -- Privacy Operations.  The goal is to provide tangible, actionable insights to help teams get & stay compliant. Check out the resource link below in the chat. #infosec #CISO #privacy #compliance #privacyoperations

176

10 Comments

Move on over HIPAA, there is a new bill working its way through the Washington red tape machine called "Health Infrastructure Security and Accountability Act". Since pretty much all of our health and personal data has already been leaked by inadequate data collectors, some lawmakers decided it was time to act. They are 20 years too late but it's election season so they need to pull out all the stops. HISAA (sounds 'gangsta' doesn't it) has civil penalties for all those health data grabbers out there who don't comply (and get caught) with HISAA requirements. These include: No knowledge – Minimum of $500 Reasonable cause – Minimum of $5,000 Willful neglect (Corrected) – Minimum of $50,000 Willful neglect (Uncorrected) – Minimum of $250,000 Yes, one "reasonable cause" will cost them a month's mortgage payment (4 bedroom, 2 bath, detached garage), which will be passed down to you, the patient, in one form or another. You can compare this bill to the ole SOX Act but for health care. The bill includes checklists, audits, stress test (pen test sorta) and someplace where the CEO has to sign off on the compliance thingy. Health care organizations have 3 years to figure out ways around the bill before they need to worry, once this bill is passed (if it is passed). $800 million of taxpayer cash will be given to Medicare safe providers to help them figure out how data security works. Then there is another $500 million of TaxO'Cash to " incentivize all hospitals" to adopt data security. I've attached a two page summary of HISAA so you too can gasp in horror at how our government thinks. Happy Halloween https://lnkd.in/gmyyCxhe

9

1 Comment