Steve Roy

NCUA examiners have said that the ACET is no longer a requirement. They are now recommending that organizations choose an internal framework to align with such as NIST CSF 2.0, CIS, or other! They have stated the new NCUA ISE statements are for them to use as an examination tool and not for credit unions. I would recommend aligning with both an internal framework and the ISE by taking an evidence-based approach so you are prepped for your exam, and meet their requirements!

7

1 Comment

The world is fighting Organized Cyber Crime with Disorganized and Placebo Cyber Security. $10 trillion costs and losses to cyber crime a year, and $300 billion, poorly spent on Cyber Security. Cyberwar is clearly good for business for some... With the recent issuance of the latest version of CMMC as well as the Digital Operational Resilience Act (DORA), the latter coming into force in January 2025, you'd be forgiven to think our governments are finally getting their act together. Sadly without any disrespect to the efforts these took to author, both lack any real assurance and both will not be met and be abused from the get go. The vast majority of cybercrime stems from the Internet. The word Internet only gets mentioned twice in the below attached DORA paper... Interestingly the EU Commission paper on DNS Abuse in January 2022 used the term DNS 995 times. Utterly bizarrely, DNS is not mentioned once in this DORA paper which is a third-party risk management compliance act. ''Complement periodic questionnaire-based risk assessments with continuous tracking and analysis of external threats to third parties. As part of this, monitor the Internet and dark web for cyber threats and vulnerabilities.'' Internet Assets and DNS Servers are THE VULNERABILITIES. Today I have written to the Financial Conduct Authority, Serious Fraud Office (UK), National Crime Agency (NCA), and Information Commissioner's Office to share information of the UK's challenger digital banks. All fall woefully short of current basic 101 security and regulations, let alone DORA. As Cyber Crime and Fraud continues to destabilise economies and societies, forgive my candidness, these regulations are simply more compliance paperwork for the sake of it. Not once does DORA state - A company must ensure their Internet Assets and Servers are Secure, Controlled, and Managed to protect and secure the organisation, their customers, and shareholders. Instead it says, and I quote: ''Complement periodic questionnaire-based risk assessments...'' This then becomes a subjective, tick box exercise. DORA like GDPR, UKDPA, and CMMC will more than likely see a zero increase in REAL security, third-party or otherwise - it may however see the odd fine... Another missed opportunity and guarantee of; Us, Them, and Digital Whack-a-Mole for security teams. Cybersec Innovation Partners

55

5 Comments

National Security Agency and Cybersecurity and Infrastructure Security Agency along with other international cybersecurity agencies have recently published an enhanced-visibility-and-hardening-guidance-communications-infrastructure guide. What stood out to me in this guide was two things. ✦ They have the Network Engineer and a Network Defender role separated out. However some of the tasks they have defined for Network Engineers is typically done by Network Defenders (Implementing SIEM) and others such as enforcing configuration management is typically done by Network Engineers. I didn't see the point of separating out the two roles as roles and job titles vary across orgs. ✦ They suggest closely monitoring configuration modifications or alterations and if feasible, test and override on a frequent basis. Most of the conversations in #autocon2 was about using automation for initial configuration, changes and keeping them synced across multiple devices through a common Source of Truth. I didn't think monitoring configurations and alerting on changes was a common practice. Considering many of the security breaches happen due to configuration errors, perhaps it makes sense. https://lnkd.in/gkcWsA3R

1

👏 Segment Networks, Users and Identities, Data and Applications, and Vendors 🛜 We have all heard about the importance of network segmentation to provide protection for critical assets and services, and in fact app level segmentation is a big part of a microsegmentation strategy. Both north/south and east/west with very well defined business rules to justify every allowable connection. 🧑 But do you segment your users? Privileged vs normal users? RunAs, sudo, etc. Privilege access management Local admin accounts Remote Access credentials and how these users are treated on the network Use of jump hosts Active Directory Trust relationships - when to use them and when to not or make unidirectional How about leveraging local (throwaway) VMs for unprivileged user tasks? Are you providing controls around identity federation? Or blindly trusting them once established? How are you maintaining "Authorized" identities such as OAuth? Phishing resistant MFA? 📛 How about your application environments and data? If you are using a shared database across applications with different risk levels, you may have some opportunities for further segmentation. For instance running Prod and Dev on the same server or with implicit trust relationships. File and data classification based on risk and exposure which should be informing segmentation controls Data flows - what is going in and out and how you are managing this Data provenance and the role it plays in decision-making and AI 🧔‍♂️ Thinking about your vendors and their access to your infrastructure, network, app, etc can make a lot of sense. I frequently recommend a separate Vendor Room to provide a layer of separation between vendors and internal teams. This protects the organization from errors or infected contractor machines, but it also protects the contractors from false claims from the organization. Win/Win! ❓ How are you thinking about segmentation in your environment? #cybersecurity #segmentation #supplychainsecurity #securityarchitecture

14

2 Comments

CISA was able to move about within an agency for 5 months and no one noticed! 3 Main takeaways: 1. Identity management is a must…zero trust!!! 2. SIEM that is properly configured and modified would have helped drastically. 3. Legacy accounts must be shutdown/terminated once employees leave. https://lnkd.in/e_3YHEnP

1

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

A recent report by the Wall Street Journal reveals that the Chinese state-sponsored APT group known as Salt Typhoon has breached major US broadband provider networks through systems used for court-authorized wiretapping. The affected providers include industry giants like AT&T and Verizon Communications, as well as enterprise-specific service providers such as Lumen Technologies. Not only did Salt Typhoon gain access to wiretapping connections, but they also intercepted general Internet traffic across these networks and targeted entities outside the US. Sources suggest that the cyberattackers potentially had access for an extended period. https://lnkd.in/e7tNvdCn

2

🥇 How is CMMC like Olympic Gymnastics? You might be wondering. Well, let me explain. Ever notice how, after watching what seems like an incredible gymnastics' routine, the scores come back with one judge giving a 6.5 while another gives a 9.5? It’s puzzling because they watched the same routine and judged the same requirements, yet their scores are so different. Why? It comes down to perspective. Each judge has different training, life experiences, and personal interpretations, which lead to varying scores. CMMC assessments are quite similar. Assessors come with different backgrounds and experiences, making the final ruling somewhat subjective—no matter how much we'd like it to be objective. I've spoken with Certified CMMC Assessors (CCAs) who have decades of experience, and even they sometimes disagree on whether a scenario meets the standard or not. As much as the Cyber-AB aims to standardize, this variation is bound to happen because, ultimately, we're all human. The real challenge? In CMMC, you can only create a Plan of Action and Milestones (POA&M) for 1-point deductions. If you get a “Not Met” on a 3 or 5-point control, you fail—there's no bronze, no silver, just fail (except for control 3.13.11). I hope the final CMMC Assessment Guide (CAP) will allow more flexibility for POA&Ms, but I’m not holding my breath. So, what should you do if you're trying to implement CMMC? Talk to various CCAs about scoping, learn which controls are often debated, and take a conservative approach, especially if you’re an MSP. You don’t want to be the reason your clients fail their assessment. Connect with multiple C3PAOs to get different perspectives on the controls you’re concerned about. Just be sure to frame your questions carefully, so they don’t come across as requests for consulting, since the C3PAO conducting your assessment can't provide consulting services. Let me be clear: this isn’t a criticism of the assessment community—quite the opposite. Expecting complete consistency from everyone, given how CMMC was rolled out, is an incredibly difficult task. I have deep respect for assessors and the massive responsibility they bear. This post is more of a reminder that we’re all human, navigating the CMMC journey together. I strongly recommend getting a GAP assessment from the company that will conduct your actual assessment. If you feel you’re ready now, consider getting a GAP assessment sooner rather than later. I've seen too many horror stories where companies thought they were prepared, only to find out otherwise. Just my two cents…

7

3 Comments

📌 Q: How can I evidence compliance with NIST SP 800-171? A: Conduct your NIST 800-171 self-assessment. The assessment should be done according to NIST SP 800-171A. That methodology will result in a self-assessment score, which must be submitted via the DoD’s SPRS portal. The goal is an SPRS score of 110 v/ PreVeil Cc: Chris Petersen | Keith Dobbs | Chuck Brooks | Jason Thomas #cloud #cloudsecurity #cloudai #cyberai

17

Two-factor authentication: It’s like having a safety net at the line of scrimmage during a field goal attempt. Maybe the NY Jets defense can do that! Let MFA put in place by IT Radix be your safety net. #ExtraPointSecurity #MFA #SafetyNet #Defense #ProtectAccess #ITRadix #NYJets

4

#FCC to impose stricter cybersecurity rules on telecom operators. The advent of #salttyphoon has drawn Washington's attention and specifically Sen. Wyden who introduced the “Secure American Communications Act” bill to establish cybersecurity rules to protect American communications. The Act outlines 4 components (Requirements/Annual Testing/Independent Audits and Reporting): 1.     Cybersecurity Requirements: Carriers must implement specific cybersecurity measures designed in consultation with the Director of National Intelligence and the Director of the Cybersecurity and Infrastructure Security Agency. 2.     Annual testing of systems to check for vulnerabilities and taking corrective measures. 3.     Independent audits to assess compliance with the rules. 4.     Reporting: Carriers must submit annual reports to the FCC, including test findings, corrective actions, audit results, and a compliance statement signed by the CEO and Chief Information Security Officer. #Telecommunications #NationalCriticalInfrastructure #SecurityAssurance https://lnkd.in/dcEfPd3R

24

3 Comments

How am I helping agencies tackle cybersecurity and compliance for $1,500 or LESS a year? If you've ever had to put it off because of budget or time, i hope this can help you... I've been helping agencies with this a long time now and I've seen a lot of people hire expensive consultants when a lot of the resources they need are actually free (I'll share some with you in a moment). It's usually just that they need help with questions or figuring out how to manage a big project, but there are more affordable ways to get the right help so you can save your money to implement the right technology instead. Through our Secure My Agency program, we provide support so you have a place to turn with questions and have a ton of resources to help you stay on track. Our weekly workshops that start tomorrow, July 9th at 12MT, will guide you through the steps you need to take to meet and demonstrate compliance with most insurance data security requirements. The first phase of this series is focused on getting you compliant by the end of 2024, with additional phases that continue into 2025 that will continue to help you address your cyber risks and compliance. During each session, we'll tackle parts of the CIS framework and the core components that are needed to meet your requirements. You'll get templates that we customize together in the live workshop, resources to help you implement the best practices, and ways to track your projects. This not only gives you the help you need and someone to turn to, but helps you stay on track. What keeps it cheap is our ability to support these efforts at scale, combined with the option to join us month-to-month ($149/month right now) or get a full year access for a discount ($1,499/year). You also get access to resources from the Sell More Cyber program to help your sales team while you're an active member. I'll put a link in the comments but check out the program to unlock the content and upcoming workshops, and to get help from the team here at RLS Consulting! For those that want to go completely on their own, I recommend grabbing the CIS 18 Security Controls and their related resources (all are available for free from CIS - linked in comments as well). But if you decide you need help, we'll be here! --------------------------------------------------- Follow me for more cyber-related content dedicated to: - helping insurance agencies protect themselves from cyber risks - helping your agency sell more cyber liability

27

1 Comment

A new AD is available for public comments: 3946: NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations To post comments, create a FREE account and add comments in the box with the red balloon https://hubs.la/Q02J94Vh0 #unifiedcompliance #cybersecurity #authoritydocuments #riskmanagement

3

IANS and Artico Search do such an amazing job on this #CISO report every year. If you have any interest in #cybersecurity this is fun stuff. Budgets, salaries, priorities and more -- all sliced up to show overall and industry trends. Page 6 has a really great insight from Steven Martano, but it should be sobering: "Companies that have been hit the hardest by inflation and other macro challenges are cutting back the most—not only in cyber, but in budgets across the board..." While cyber is mostly spared (at a macro level) the problem is that, based on ransomware payout guesswork alone, the threat actors are very likely growing their investments at a much faster rate than your security team. How well do you suppose that works out?

5

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

Cyberespionage groups have been using ransomware as a tactic to make attack attribution more challenging, distract defenders, or for a financial reward as a secondary goal to data theft. A joint report from SentinelLabs and Recorded Future analysts presents the case of ChamelGang, a suspected Chinese advanced persistent threat (APT) that has been using the CatB ransomware strain in attacks that impact high-profile organizations worldwide. Read the comments below for further detail and context.. #noble1 TOM SHAW

3

1 Comment

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55