Wendy Nather

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

57

The Environmental Protection Agency lacks a documented plan to coordinate incident reporting with CISA, the agency’s Office of Inspector General found. Environmental Protection Agency officials found critical or high-risk vulnerabilities in 97 drinking water systems that serve more than 26 million people across the U.S., according to a report released last week by the agency’s Office of Inspector General. Another 211 water systems, servicing almost 83 million people, had medium-to low-risk vulnerabilities, including open portals that were visible from the outside. These water systems could face major disruptions or physical damage if a malicious hacker tried to exploit those vulnerable systems. The OIG report noted the EPA does not have an incident reporting system and relies on the Cybersecurity and Infrastructure Security Agency’s system. The OIG also could not find documented policies and procedures for how the EPA coordinates with CISA and other federal agencies to address these issues. #criticalinfrastructurecyberrisk #cyberriskmanagement #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

Thanks to @Scott Small and Wade Baker, Ph.D. and the teams at Tidal and Cyentia. To my fellow cyber risk quant folk you know how strongly we drive our partners and customers to define risk scenarios using specific threat actors and/or specific TTP’s to enhance the accuracy of likelihood determination! The work both organizations are doing to help articulate the TTP’s being used for ransomware attacks can help provide a greater level of defensibility of your results. By executing adversarial simulation using these TTP’s increasingly accurate likelihood can be attained.

4

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

Known Exploited Vulnerabilities Remain Unmitigated Past Deadlines: - Critical severity KEVS took nearly 4.5 months (137 median days) - High severity vulnerabilities take more than 9 months (238 median days) - Medium severity vulnerabilities take nearly 1.5 years (517 median days) https://lnkd.in/g_RExD96

1

The National Security Agency (NSA) has recently released guidance aimed at enhancing logging and threat detection capabilities in response to living-off-the-land (LotL) incidents targeting critical infrastructure. LotL techniques involve threat actors leveraging legitimate tools and protocols to carry out malicious activities, making them harder to detect. The NSA's recommendations emphasize the importance of robust logging practices and proactive threat detection measures to counter these sophisticated attacks. #NSA #Databreaches #incidentResponse #LotL #cyberattacks

2

New blog post: Improving Cybersecurity Taxonomies Describing Impact and Cyber Harms Against Organizations I’ve introduced a new MISP taxonomy and shared insights into the critical role of impact description in effective information sharing. https://lnkd.in/eUJb-svP #CyberSecurity #MISP #taxonomies #taxonomy MISP Project (@[email protected] ) CIRCL (Computer Incident Response Center Luxembourg)

37

1 Comment

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

The proposed rule would also require the disclosure of cyber incidents to CISA and physical security concerns to TSA. The Transportation Security Administration is seeking public comment on proposed requirements for surface transportation and pipeline companies to implement cyber risk management programs, the agency said Wednesday. The public comment period ends on Feb. 5, 2025. The proposed rule calls for certain pipeline, passenger and freight rail operators and rail system companies with high-risk profiles to develop comprehensive cyber risk management programs. Pipeline, rail and certain bus transportation or transit systems would be required to report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency. The sectors would report any physical security risk concerns to TSA. #criticalinfrastructurecyberrisk #confidentialcomputing #thirdpartyriskmanagement #threatinformeddefense #GRC #cyberinsurance

2

1 Comment

Hmmm how do I leverage the NIST CSF 2.0 www.ncsecourse.com for Compliance and Reporting "How can an organization enhance its cybersecurity governance framework according to the NIST CSF 2.0's Govern function? Include recommendations for establishing roles, responsibilities, policies, and procedures to manage cybersecurity risk effectively." #NISTCSF ICTTF - Cyber Security Community, Academy and Events

2

3 Comments

I’ve written a number of posts on testing and rolling out security controls safely on my blog including this one from 2020 ~ Better Testing for Better Outcomes. I have a bunch of others in a thread on X (sorry it’s the easiest right now) and on my blog. Taking the time to properly test and building tests into the software itself can prevent a lot of pain later. I explain how to do that in my posts and show examples of things not properly tested as well. https://lnkd.in/gcJ-PeG

10

4 Comments

ICYMI: The inaugural study on EPSS performance and broader vulnerability exploitation trends published this week. If you've ever wanted data-driven answers to questions like these listed in the ToC shown here, download it today (free, no registration req'd): https://lnkd.in/gBbsgwQM #vulnerabilitymanagement #vulnerabilities #infosec

51

8 Comments

⚡️Some domains likely used by #transparentTribe #APT36 counciling[.]com nbssedelhi[.]org ashifdigitalseva[.]xyz birthdeath[.]in gov-certificate[.]com viewss[.]click admin-mcas-df[.]ms admin-mcas[.]ms mcas-df[.]ms mcas[.]ms verifycertificate[.]info nimsme[.]org

1

1 Comment

CMMC Level 2 Assessment Objective: Connections Termination PRACTICE: Organizations must terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. ASSESSMENT: This requirement applies to internal and external networks, to prevent malicious actors from taking advantage of an open network session or an unattended computer at the end of the connection. Organizations need to balance user work patterns and needs against security to determine the length of inactivity that will force a termination. Be prepared! Your assessor could ask to 🔍 EXAMINE procedures addressing network disconnect. 🗣 INTERVIEW system or network administrators. 📝 TEST mechanisms supporting or implementing network disconnect capability. (CMMC Assessment Guide: Level 2 Version 2.11, page 224) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

44