Christopher Dorr

CMMC Level 2 Assessment Objective: Alternative Work Sites PRACTICE: Organizations must enforce safeguarding measures for containing controlled unclassified information (CUI) at alternative work sites. ASSESSMENT: Alternative work sites may include government facilities or the private residences of employees. Organizations must define and implement safeguards to account for protection of CUI beyond the enterprise perimeter. Safeguards may include physical protections, such as locked file drawers, as well as electronic protections such as encryption, audit logging, and proper access controls. Be prepared! Your assessor could ask to: 🔍 EXAMINE a list of safeguards required for alternative work sites 🗣 INTERVIEW personnel approving use of alternative work sites 📝 TEST organizational processes for security at alternative work sites (CMMC Assessment Guide: Level 2 Version 2.11, page 186) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

47

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

🔒Cybersecurity Compliance Made Simple? Not quite. For many navigating NIST SP 800-53, it’s a complex but essential journey. Compliance isn’t just a checkbox—it’s a commitment to security. Let’s explore the top challenges and practical ways to address them. 👇 𝗧𝗼𝗽 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 Achieving compliance with **NIST SP 800-53** is critical for organizations working with government systems. However, many face hurdles that complicate the process, leading to delays and frustration. Here are the top three challenges—and actionable strategies to overcome them. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟭: 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸’𝘀 𝗖𝗼𝗺𝗽𝗹𝗲𝘅𝗶𝘁𝘆 NIST SP 800-53 outlines hundreds of controls across categories like Risk Assessment and Access Control. Its technical language can overwhelm teams trying to implement them effectively. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Simplify**: Tackle one control family at a time. - Bring in Experts**: Work with consultants experienced in federal compliance. - Use Tools**: Automate mapping controls to existing processes for efficiency. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟮: 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗻𝗴 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗶𝗻𝘁𝗼 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀 Compliance is often treated as a “bolt-on” after development, leading to costly rework and inefficiencies. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Start Early**: Embed compliance into the development process. - Collaborate**: Form cross-functional teams with developers, security, and compliance experts. - Adopt DevSecOps**: Integrate compliance into development pipelines for ongoing alignment. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟯: 𝗞𝗲𝗲𝗽𝗶𝗻𝗴 𝗨𝗽 𝘄𝗶𝘁𝗵 𝗖𝗵𝗮𝗻𝗴𝗶𝗻𝗴 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱𝘀 NIST SP 800-53 evolves with emerging threats. Revision 5, for example, emphasizes supply chain risk and privacy controls, challenging organizations to adapt quickly. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Stay Updated: Regularly review updates from [NIST.gov](https://www.nist.gov). - Train Continuously: Equip teams to understand revisions and implement changes effectively. - Perform Audits: Regularly assess compliance gaps and address them proactively. 𝗪𝗵𝘆 𝗧𝗵𝗶𝘀 𝗠𝗮𝘁𝘁𝗲𝗿𝘀 Non-compliance isn’t just about penalties—it’s about protecting critical systems and data. Organizations that prioritize compliance also position themselves as trusted partners in the federal space, enhancing security and reliability. 𝗬𝗼𝘂𝗿 𝗡𝗲𝘅𝘁 𝗦𝘁𝗲𝗽𝘀 At Steel Rail Security, we help organizations navigate these challenges with tailored guidance. Whether it’s gap analyses, strategy development, or full compliance support, we’ve got you covered. What’s your biggest challenge with NIST SP 800-53 compliance? 👇Share your thoughts below or reach out to start simplifying your journey to compliance. 🔑 Let’s build a more secure future—together.

1

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

It's here - CRQ Training! If you're a CISO, risk analyst or assessor interested in quantifying cyber risk don't miss this CRQ Mastery Workshop. Learn basic and advanced method. Hands-on exercises. Full toolkit and risk models. ISC2 and ISACA Chapters save and additional 20% for their members. 20 CPEs. More info and registration https://lnkd.in/ecVj8V5N #ISC2, #ISACA, #Training, CyberRiskQuantification, #CISO, #Cybersecurity

5

We did something new (for us) in the latest edition of the Information Risk Insights Study (IRIS) that focuses on #ransomware - we projected financial losses. Normally, we restrict ourselves to known publicly-reported losses. But in this case, we felt that wouldn't do proper justice to the true impact of ransomware on the economy. But don’t worry—we didn't abandon our core principles and ride the trolley into the Neighborhood of Make-Believe. We took the data we had on ransomware losses over the last five years, fit a distribution, and then applied properly sampled values to incidents that had no loss info on public record. Using this method, we calculate the total financial losses from publicly known ransomware incidents over the last five years to be about $274 billion dollars. How does that fit with your intuition or analysis? Too high? Too low #cyberrisk #cyberattacks Read the full report, sponsored by CISA, here: https://lnkd.in/eWEnwj8n

91

7 Comments

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

Asperitas Consulting is our partner for delivery in Chicago and Nationwide. This article starts to share the vision and approach we can deliver. Threat Modeling process and program require more than technical ability. We are trying to bring the holistic delivery model to companies that are new to threat modeling, currently in process, or are looking to improve in areas of threat modeling. Feel free to reach out to Jason N. or Scott Wheeler to learn more.

1

Earlier this year, Cyentia Institute published a meta-study analyzing the top ATT&CK techniques reported across 20+ industry sources. NOT ONE OF THEM reported observing T1195.003 - Compromise Hardware Supply Chain. Hold on - my aid has an urgent message for me...oh my...they what?!...pagers exploding - really?...I see...got it...will do... Sorry for the interruption. As I was saying, T1195.003 was THE MOST REPORTED sub-technique in the entire study! Download it today from the compromised device of your choice: https://lnkd.in/eafNi5u3 #supplychain #cybersecurity #fud

91

6 Comments

Wonder what a Certified Third-Party Assessor Organization (C3PAO) like MNS Group is really looking for from your organization during a NIST SP800-171 assessment? It’s the little things. We see some common areas where organizations get tripped up. For example: · You answer the question, then answer a question that wasn’t asked, which may lead to more questions. Our advice? Answer the question and stop talking. · Your procedure points to a location where a document is stored… and it’s not there. · Your procedures regarding permissions are murky or imprecise. These are the sorts of details that assessors will be checking. We want you to pass! As always, MNS Group stands ready to help your organization prepare for assessment, always with a strict eye toward adherence to all rules and regulations. And if you have a pressing question, I’m happy to respond! Just drop your thoughts below. #compliance #CMMC #RiskManagement #cybersecurity #contractors

50

1 Comment

Does anyone believe that we know "the half of it" when it comes to the impact on patients due to Ascension's failed enterprise cyber risk management (ECRM) program? Anyone who's been a patient (that's all of us) knows how difficult it is to receive access to care, timely care, and quality care when the healthcare system is ostensibly operating at its best. In addition to patients not getting their prescriptions, having important diagnostic tests postponed, being treated without access to vitally important records, being diverted from ERs etc. etc., etc., I'm convinced there are deaths occurring. C'mon healthcare!@#! Top two root causes: 1. Risk illiteracy 2. Lack of C-suite/Board engagement #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors https://lnkd.in/esvF_ETP

18

3 Comments

Heads up on this once in 5 years opportunity to sponsor Cyentia Institute research into the largest #cybersecurity incidents. See the call for sponsors for the 2025 "Xtreme" edition of the Information Risk Insights Study at the link below. #cyberrisk #cyberresilience #cyberattacks https://lnkd.in/etc6FjsY

39

2 Comments

⚡TIP: Conduct Regular Risk Assessments Schedule quarterly risk assessments to identify vulnerabilities and evaluate the effectiveness of current controls. Use findings to adjust your risk management strategy. Leran How to Conduct Regular Risk Assessments https://lnkd.in/gHvPahux #grc #compliance #risk #cti #cybersecurity #business #healthcare #retail #ecommerce #supplychain

2

A recent report from the Environmental Protection Agency (EPA)’s Office of Inspector General (OIG) has revealed significant cybersecurity vulnerabilities in over 300 U.S. drinking water systems. These weaknesses threaten service disruptions, data breaches, and potential damage to critical infrastructure, affecting the safety and accessibility of water for millions of Americans. #DataBreaches #CyberAttacks #WeProtect cybersecurity.art - Art of Cyber Security https://lnkd.in/gXWedhpV

2

AC-02 is in the top 5 most important controls I'd recommend developing familiarity with 🚨 Let's continue our Neverending Story through NIST 800-53 with: AC-02 Access Control Account Management Simply stated: AC-02 governs: - Accounts and people (users, managers, roles, groups, etc.) - Access authorizations and privileges - Account management processes - Account monitoring and review - Account PII privacy ➡️ There are 12 control elements (A-L) within AC-02 🙂‍↕️ which each need to be fulfilled or inherited for overall AC-02 compliance How to simplify control implementation: - Consider how account management is conducted throughout the enterprise, application team, cloud service provider, data center, etc. - Map to Identity and Access Management tools and services - Leverage inheritance for external team services - Revisit onboarding and off-boarding processes How to automate control implementation & assessment: - Integrate configuration checks for access control mechanisms - Leverage Identity and Access Management capabilities - Configure logging and alerts for audits and monitoring - Automate account review checks ⬇️ Let me know what I missed ⬇️ #GRCEngineering #NIST #NIST80053 #Cybersecurity #ZeroTrust #GRC #AccessControl #PoliciesandProcedures #AI #AccountManagement

19

5 Comments

It is easy to fall into the trap of confirmation bias, where investigators see something that aligns with what they expect while missing key context that might paint a different picture. Drawing conclusions about a subject’s intent from a single post or interaction can lead your team down the wrong path.

1

Oh great! Just what we need... legislation to require a study on "...how to improve healthcare sector cybersecurity." Let's save the money; please don't waste more time. My three recommendations: 1. Stamp out risk illiteracy and the attendant fire-ready-aim controls checklist nonsense. 2. Hold C-Suite executives and board members personally accountable for cybersecurity, a la SOX and Sec 302 for financial reports/controls. 3. Start to think about enterprise cyber risk management (ECRM) and cybersecurity as a business value and competitive advantage creator. #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #cyberopportunitymanagement #cybersecurityvalue #boardcyberoversight #boardofdirectors https://lnkd.in/dBbQwdxi

11

1 Comment