Marc Menninger, CISSP, CRISC

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Still time to register for our FREE Webinar "Cybersecurity for the Small Business". Thur Apr 18th 1pm EST / 11am MST / 10am PST Register Below: https://lnkd.in/gtZ2A9ep We have all seen news stories about Cyber Attacks on large businesses, Government Municipalities, and other organizations but do you know that small businesses are becoming a greater target for attacks? Most States require via privacy and other cyber laws that businesses of all sizes take steps to protect their employee and customer privacy data. This FREE webinar is an introduction to Cyber Risk Management for Small Businesses to include current risks, simple mitigations strategies and low to no cost fixes to protect data. Perfect information for "at home" businesses to those with one or more physical locations. Feel free to share via social media to anyone you feel might benefit from this information. Melanie Clay, CPCU Helen Thomas The Smalls Colorado Vegas Chamber Colorado Springs Chamber & EDC

18

5 Comments

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

148

30 Comments

Cyber-Informed Engineering is the most important development in OT security since the term “OT security” was coined in 2005. This webinar is designed to introduce Cyber-Informed Engineering as a program and methodology. ➡️ https://lnkd.in/gmFBwc7Y I highly recommend if you joining if you work in OT security

46

1 Comment

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

Important update for the DIB, worth reading.

5

That is not looking good ... New EU debate about chat control called Backdo-- uh sorry i mean, "Upload Moderation" is out 🙃 Here is the statement from Meredith Whittaker, Signal President if you are interested : https://lnkd.in/e7rDcehW "So let’s be very clear, again: mandating mass scanning of private communications fundamentally undermines encryption. Full stop. Whether this happens via tampering with, for instance, an encryption algorithm’s random number generation, or by implementing a key escrow system, or by forcing communications to pass through a surveillance system before they’re encrypted." #EU #encryption #privacy #debate #moderation

9

2 Comments

Great news from NIST as they adapt digital identity guidelines for state and local benefits programs. This collaboration with the Digital Benefits Network and the Center for Democracy and Technology to refine digital identity measures is a step in the right direction. It's essential to ensure that as we enhance digital services, we also safeguard privacy and equity, particularly in public benefits administration. Looking forward to seeing how these guidelines will foster more secure and inclusive digital environments. https://bit.ly/3KYuH5J

22

Wonder what a Certified Third-Party Assessor Organization (C3PAO) like MNS Group is really looking for from your organization during a NIST SP800-171 assessment? It’s the little things. We see some common areas where organizations get tripped up. For example: · You answer the question, then answer a question that wasn’t asked, which may lead to more questions. Our advice? Answer the question and stop talking. · Your procedure points to a location where a document is stored… and it’s not there. · Your procedures regarding permissions are murky or imprecise. These are the sorts of details that assessors will be checking. We want you to pass! As always, MNS Group stands ready to help your organization prepare for assessment, always with a strict eye toward adherence to all rules and regulations. And if you have a pressing question, I’m happy to respond! Just drop your thoughts below. #compliance #CMMC #RiskManagement #cybersecurity #contractors

50

1 Comment

Get ready folks! Updated guidance on safeguarding CUI is almost ready for prime time. How are you all doing implementing rev 2 of SP800-171? Rev 3 is different, same number of safeguards as observed in rev 2, but there are significant changes. #somethingnew If you’re an Indiana business Purdue cyberTAP can help, reach out let’s discuss your cybersecurity program. #CUI #CMMC

6

2 Comments

The Emotional Toll of Incident Response: Internal vs External Perspectives Discover the stark differences between the emotional experiences of internal and external incident response teams. Learn how internal staff's deep emotional investment in their network can impact their response, while external responders focus on managing emotions and bringing a sense of calm. #IncidentResponse #InternalVsExternal #EmotionalToll #NetworkSecurity #ITIncidents #Cybersecurity #ITManagement #StressManagement #EmotionalInvestment #CalmAmidstCrisis

2

Nice work #ThistleTechnologies! Signed firmware is a security measure taken by software vendors by digitally signing their firmware image using a private key. When firmware carries this cryptographic signature, a device goes through a verification-like process before accepting and installing the firmware. If discrepancies or alterations in the firmware's integrity are detected, the device declines the firmware upgrade. The use of this technique to sign firmware or software images before they are loaded onto the device's hardware helps protect against unauthorized modifications, malware injection, and other security threats enhancing the overall security posture of the system by preventing malicious modifications to the firmware which could result in: Viruses inserted into the firmware, data theft, destruction and manipulation, protection from counterfeit drives, verifiecation of the authenticity and integrity of firmware, reduces physical and logical attacks...and more.

5

The PCI DSS v4.0.1 update provides much-needed clarifications that can help us all strengthen our cybersecurity measures. With clearer guidelines on MFA and payment scripts, we can better protect sensitive data. How is your organization adapting to these changes? Reach out to Arbure for a deep dive into these updates. #PCIDSS #Cybersecurity #Compliance #PCIUpdate

4

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

47

8 Comments

🚀 Just In: Results for MITRE Engenuity's ATT&CK Evaluations on menuPass + BlackCat scenarios are out! 🔍 How do you interpret these results, and how will they influence your security program or portfolio? https://lnkd.in/gigAqGb8

17

Mark your calendars for our webinar on April 18 at 11am BST! Discover how #MenloSecurity is rethinking VDI with a secure enterprise browser! Sign up today!

2