Bill O'Hern

Coalition, Inc. Cyber Risk Awareness Security Report! Could you not want a better summary to highlight the real risks? 🚨"Technology has become ingrained in modern business, and so has cyber risk. Cyber risk is now the most significant concern for business leaders globally." ⭐🔦A warning that continues to be echoed from every corner of the security landscape. In addition, the coming #digitalliabilities explosion where due diligence is under the microscope. Gerry Kennedy, Ivan Savov, FARPI, #cyberrisk #digitalpremisesliabilities #compliancerisks #businessrisk #boardofdirectors #boardroom #executives 🚨"Cyber claims originated in the inbox. More than half of all claims were business email compromise (BEC) or funds transfer fraud (FTF), highlighting the importance of email security as a key aspect of cyber risk management." ⭐🔦As perimeter security strengthens and is heavily focused upon with weak #securityawarenesstraining and weakening information security governing policies to risk manage current and evolving #securitythreats, attacks are directed to the weakest links in the organisation's security system—that is, the human element domain and all vectors surrounding it. Many organisations are not doing enough to strengthen #emailsecurity and continue to rely upon existing controls or poor continuous monitoring and evaluations of current controls. This problem is not expected to be resolved any time soon as security continues to be an emotional factor among IT teams, holding blind relationships with failing strategies and solution providers. 🚨"Businesses using select boundary devices were at greater risk. Firewalls, virtual private networks, and other devices can help reduce cyber risk. However, boundary devices with known vulnerabilities increased the likelihood of a business experiencing a cyber claim." ⭐🔦IT-driven organisation's security can result in the above, where #securityrisk is not well understood at the governance level and #informationsecuritymanagementsystems maturity capabilities are slowly maturing but not at the level for true #cyberriskmanagement. Until #cyberrisk becomes #businessrisk and #boardofdirector becomes cyber risk aware and takes responsibility and accountability for the organisation's #digitaltransformation program, this problem will continue to plague such organisations. Resolving cyber risks requires responsible action from top-level management. #businesssectors #government #ngo #privatesector #publicsector #financialsector #healthsector #insurancesector 

6

Is your organization struggling to understand how to approach 3.10.6, Alternate Work Sites? What is allowed and what an assessor may be looking for? In this CMMC Churns, we dive into 3.10.6, Enforce safeguarding measures for CUI at alternate work sites. In the requirement deep dive, we will look at the requirement, assessment objectives, the requirements relationships to other requirements, and evidentiary objects we would expect to see as assessors. Interestingly, there are four primary use cases (working at home; in public spaces & travelling; in a hotel room; and at a client location) that an organization can use to define its safeguarding requirements to be followed by staff when working outside of their offices. We also look at considerations your business should ponder when developing safeguarding measures. For example & remember, Alexa & Siri are not authorized listeners to CUI conversations… ================================================= Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: cmmc@peakinfosec.us ================================================= #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors https://lnkd.in/e28F-A86

17

1 Comment

Recent shifts within The NIST NVD operations have raised alarms among researchers and practitioners. ⚠️ These changes have led to delays in vulnerability analysis and a noticeable decline in enriching CVEs with critical data such as CPEs, CVSS scores, CWEs, and references. This creates significant hurdles for organizations striving to effectively identify and prioritize vulnerabilities. 💡 Meet DeviceTotal, a transformative solution reshaping this vulnerable pyramid. Our AI-powered technology propels vulnerability management into a new era, offering substantial enhancements in accuracy, speed, and automation. 🚀 DeviceTotal sources security information directly from vendors, ensuring data is updated well before it reaches the NVD. This proactive approach empowers organizations with timely insights, enabling swift and informed actions to mitigate threats. 💪 On top of that, DeviceTotal provides actionable insights for every threat, offering precise indications for available updates, mitigation options, workarounds, End-of-Life alerts, and more.  And the best part? No agents, no installations—just swift value delivered directly to your organization. Don't let your vulnerability management strategy crumble—elevate it with DeviceTotal. Experience the difference today. #VulnerabilityManagement #CyberSecurity #DeviceTotal #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement #nationalsecurity (cartoon copyright by XKCD.com)

26

1 Comment

THIS IS A NATIONAL SECURITY RISK - BUT GUESS WHAT - NOBODY CARES. ''DISA DOD Network Information Center (NIC) operates G.root-servers.net, one of the thirteen logical Internet Root name servers. DISA DOD NIC cooperates with the eleven other Root Server Operators to provide authoritative data for the DNS Root Zone.'' The above makes this all the more frightening. If you DO NOT understand the implications, the below NOT SECURE DISA.mil domain, along with compromised DNS, means the U.S. Government and Military are exposed to numerous well known Cyber Attacks. This includes DNS Tampering and Abuse as highlighted earlier today when the U.S. Army lost Command Control of their digital Infrastructure on Saturday 10 October 2020. These FACTS are NOT opinions. As stubborn and uncomfortable as they may be, they are FACTS and are as a result of incompetence, errors, oversight, and total lack of personal and organizational controls, management, and negligence. The implications of these exposed Assets could NOT be any more serious... Should anyone from J3HQ or the FBI wish to contact us: Andrew.jenkinson@cybersecip.com #WhitethornShield Federal Bureau of Investigation (FBI) FBI Cyber Division The White House GCHQ National Cybersecurity Coordination Center (NCSCC) #DNS #PKI #InternetSecurity

24

14 Comments

Special thanks to the Long Island NY ISC2 Chapter for hosting me to speak at their Chapter Event. Another great opportunity to talk about Cyber Risk Quantification. Ask me about the Open Education Resources that are now available for download from CyberRiskModels.com. #ISC2, #cybersecurity, #CRQ, #CIO, #CISO, #Training, #riskquantification

5

Welcome to part TWO of our three-part NIST InfoSeries with Christopher Hills. In this short video, Chris highlights the six core tenets of NIST CSF 2.0, and why each of them is a crucial part of the cybersecurity framework. ✔️ Govern: the newly added function, Govern, allows you to align your cybersecurity efforts with your overall goals and risk management approach – providing a holistic cybersecurity strategy for your organization. ✔️ Identify: Identify enhances your organization's cybersecurity posture by thoroughly assessing your assets, systems, data, and supply chain dependencies. ✔️ Protect: Protect implements robust safeguards for access control, data security, and technology infrastructure hardening, enabling you to gain unparalleled protection for your critical assets. ✔️ Detect: Enable timely discovery of cybersecurity incidents by implementing processes to identify and analyze potential attacks or compromises. ✔️ Respond: When an incident is detected, Respond guides your team with the appropriate actions to contain the impact. This includes incident response planning, mitigation, reporting, and effective communication. ✔️ Recover: After an incident, the Recover function helps restore normal operations and services for your organization. Swiftly bring affected assets and systems back online while communicating during the recovery process. Follow along for part three of the series when we'll be sharing three easy ways you can get started on meeting the NIST CSF 2.0 requirements. Until then, you can learn more in this recent blog post. https://lnkd.in/e4s87VUG #NIST #NIST2 #NISTFramework #Cybersecurity #Compliance #BeyondTrustInfoSeries #Governance

6

No mention of defense contractors or CMMC in this new DoD playbook on cybersecurity reciprocity. This is written for the government's internal use. However, I'm happy to see evidence that DoD CIO is actively thinking about reciprocity. Reciprocity is different from inheritance. Inheritance is evaluated at a granular level - control by control, requirement by requirement. In general, it is much easier to evaluate inheritance than to evaluate reciprocity. Example of cybersecurity inheritance: Assessor: "Are you performing vulnerability scans to protect your CUI?" Defense contractor: I'm not, but my managed service provider is." Assessor: "Do you have proof that they are actually doing it?" Defense contractor: "They got assessed by an independent audit firm that confirmed they perform vulnerability scans of all their customers. Here is the audit report that shows it." Assessor: "I see that a reputable company did the assessment, they verified the same criteria that I want to see for vulnerability scans, the assessment was performed a few months ago, and that the assessment scope included the department that manages your systems. Looks good. You're "MET" for vulnerability scans." In comparison to inheritance, reciprocity is evaluated as a whole. For the CMMC program, the DoD decides which frameworks are "good enough" for reciprocity. An example of reciprocity: Assessor: "Is your cloud performing all the requirements in CMMC Level 2?" Defense contractor: "No, but it was certified against this other standard, which is pretty stringent too." Assessor: "Hey DoD, do you think that standard is good enough?" DoD: "Yup, we feel it meets or exceeds CMMC Level 2." Assessor: "OK, no further questions about your cloud." No mention of SOC-2 or ISO 27001 in this playbook. This confirms to me that it is very unlikely these will count for anything from a DoD reciprocity standpoint. FedRAMP is the only real candidate I see for CMMC Level 2 reciprocity, though even that isn't official at this point. Shameless plug: Want a double-check on your CMMC preps? Contact Kieri Solutions - Authorized C3PAO to get a Gap Analysis by a Lead Assessor with real world CMMC, 800-171, and Joint Surveillance experience. Nice find, ⚡️Jil Wright! #CMMC

51

6 Comments

📆 May 14th 2:00-6:30pm | 📍Canton, MA Will you be in the Boston area this May 14th? Don't miss the chance to experience a live #ransomware attack firsthand (but without the risk!) Step into the shoes of a decision-maker at #Cohesity's immersive Ransomware Resilience Workshop. Test your abilities in a simulated 'mission control' scenario. Can you recover?

6

The recent incident involving IntelBroker obtaining Europol information has sparked concerns over potential cybersecurity threats. Despite assurances from Europe's law enforcement agency that no operational data was compromised, the breach underscores the persistent risk of sophisticated hacking outfits targeting high-profile organizations. This serves as a stark reminder of the importance of robust cybersecurity measures, continuous monitoring, and frequent security assessments to mitigate risks and fortify defenses against evolving cyber threats. Vigilance and proactive cybersecurity practices are crucial in safeguarding sensitive information amidst the ever-changing threat landscape. #Europol #IntelBroker #Databreaches

1

1 Comment

Cribl and Anvilogic present: Three steps to a security operation that doesn't lock you in: Step 1: Own your SIEM pipeline with Cribl Step 2: Own your SIEM data in your security data lake Step 3: Own your SIEM analytics with Anvilogic With multiple supported data platforms to choose from, your team can maximize detection coverage while cutting costs and avoiding disruption. That's an exciting alternative to SIEM platforms that want to own all your data. Read more about our partnership in the comments, or visit us this week at CriblCon!

147

20 Comments

Want to listen on SOC and MDR + The Future Impact of SOC of the Future. Check out this panel that I moderated. 360 SOC, Inc. Phelim Rowe https://lnkd.in/grBXWirR

16

1 Comment

At what threshold should cloud/SAAS providers be considered critical infrastructure? Should cloud service providers have something like NERC-CIP that governs their security levels when they reach a certain level of importance/concentration? We've had a couple of incidents that are really concerning...Okta, MS Exchange Online, and now Snowflake (though what actually happened is still unclear)...all have been targeted because they are acting as foundational fabric to a large part of the commercial world. Clearly threat actors are seeing the consolidation of information and processing as a very desirable target. At what point do some of these services become of such importance that they reach National Security importance? Should they? Links to referenced incidents below: https://lnkd.in/eqq5Qe_4 https://lnkd.in/ehP5thEF https://lnkd.in/eV-kuWmA

21

1 Comment

Did you know the average employee received over 180 malware or phishing emails in 2023? Not too surprising as Mimecast Cloud Integrated identified 3.4M risky emails that passed through Microsoft and into employee inboxes. Does your organization have the extra layer of protection you need to stay secure? Not sure? Start your free threat scan today and we’ll show you your company’s risk landscape and identify areas to improve defense.

29

Thanks for the share ! #CMMC has definitely been a challenges for many organizations over the past years, especially with the constant changes in requirements, formal reporting, which then switched to self assessment and so on. At a certain point, organizations would no longer what was required. Thanks for this share again ! Again, a key benefit of using a properly maintained platform like Cynomi for your assessments, is that it does evolve with the requirements of the market. It helps you stay relevant, and learn at the same time about the chances. #cybersecurity #CMMC #cmmc2 #governance #compliance #FARS

16

3 Comments

NYM and FW SIM members, come join me, • Robert Field, Matthew Lagana and others this Thursday, June 20th @ noon for a Virtual Cyber Strategy Summit. Are you ready for today's attacks? What about tomorrows? Join SIM New York Metro and SIM Fairfield/Westchester as we embark on a collaborative journey to explore today’s hottest cybersecurity topics including: -​Ransomware and Extortion Attacks ​-Supply Chain Risk ​-Artificial Intelligence and Machine Learning in Cybersecurity ​-Regulatory Compliance ​-Cybersecurity Skills Gap and Talent Shortage ​Each topic will have in its own breakout room, which will be facilitated by a peer with deep experience in the area. Come prepared to question, share, and learn from one another. ​About SIM Virtual Strategy Summits ​SIM Virtual Strategy Summits are an opportunity for SIM members to share strategies, initiatives, solutions, case studies, and questions with peers. Each summit will have a topical theme and a lightly facilitated, highly interactive format in which everyone can participate. Don't miss this unique opportunity to be at the forefront of shaping the future of your organization and the wider SIM community. Register here: https://lu.ma/feud97ko

10

GenAI: A New Headache for SaaS Security Teams: The introduction of Open AI’s ChatGPT was a defining moment for the software industry, touching off a GenAI race with its November 2022 release. SaaS vendors are now rushing to upgrade tools with enhanced productivity capabilities that are driven by generative AI. Among a wide range of uses, GenAI tools make it easier for developers to build software, assist sales teams in mundane email writing, https://lnkd.in/gsFPktfs

1