Eran J. Leib

💡 Unlock the Potential of Your PKI with the PKI Maturity Model! Are you maximizing the benefits of your Public Key Infrastructure (PKI)? The PKI Maturity Model (PKI MM) isn't just a tool - it's your roadmap to elevating your PKI's performance and security standards. 🛠️ Tailored Guidance: PKI MM offers a comprehensive framework, integrating best practices and expert recommendations to refine your PKI's maturity. From identifying improvement areas to implementing robust security measures, it's your go-to resource. 🔍 Assess, Improve, Excel: Leverage PKI MM to conduct thorough assessments, pinpointing vulnerabilities, and enhancing efficiency. Elevate your PKI's maturity level, mitigate risks, and align seamlessly with industry benchmarks. 👥 Stand Out: As a service provider, showcase the caliber of your PKI offerings by leveraging PKI MM to demonstrate excellence to your clientele. Consultants and auditors, use it to drive tangible improvements and provide unparalleled guidance to your clients. 📊 Benchmark and Adapt: Gain invaluable insights by benchmarking your PKI against peers. Stay ahead of trends, refine practices, and ensure your PKI stays agile and resilient. 🌐 Flexible and Dynamic: Designed to cater to diverse organizational needs, PKI MM is adaptable across various PKI implementations - both internal and external. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Leigh Bailey

22

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

Announcing a Valuable New Data Security Incident Response Service! Did you know that data is the fastest growing attack surface in the world? Your organization’s data is vulnerable to numerous potential risk scenarios that require specific evaluations to get ahead of them. This makes Data Security Incident Response a vital component of your organization's cybersecurity strategy. Cyera recently announced their Data Security Incident Response service which allows organizations to leverage and retain a team of elite cybersecurity practitioners to evaluate and respond to data security incidents post breach, helping you identify data security risks, remove ambiguity related to materiality, and determine the fastest path to recovery. Essential in this age of Data Sovereignty and the era of global privacy / regulatory compliance! Viva Cyera! Learn more about our Incident Response service today:

42

12 Comments

⚡ Cybersecurity threats are evolving fast! To stay ahead, organizations must embrace new security approaches involving fresh strategies, technologies, and a cloud-ready mindset. 🌐 Enter MITRE ATT&CK — the ultimate guide for security practitioners packed with invaluable insights into attacker techniques and behavior. Pretty handy, right? 💡 Sysdig's eBook show you how to identify and defend against common threats to #AWS environments using open-source Falco rules mapped to the ATT&CK framework. Boost your #AWScloud security and tackle any threat head-on by giving it a read today:

3

We are shifting compliance left with #Witness and #Hadolint. Want to ensure your Dockerfiles meet compliance controls? This short guide can help you automate the reporting of AC-6, CM-2, and CM-7 for every artifact every time. This is the first in a long series of how to shift compliance left. Follow me and subscribe to never miss out. If there is a tool you would like us to look at and map please let me know in the comments. https://lnkd.in/etNRetSQ

40

5 Comments

You need to use the findings and automate based on those. eBPF is not enough.

2

⚠ Areas of Overlap and Gaps between AICPA SOC2 Trust Services Criteria (TSC) and ISO 42001 - PART 2⚠ -Questions for Realistic Controls Cross Mapping- ❓ Scoping 1. What are the specific AI systems and components within the organization’s scope? 2. What are the boundaries and applicability of the AI management system within the organization? 3. What external and internal issues are relevant to the organization's AI systems? ❓TSCs Included in Scope 1. Which TSC criteria are relevant to the AI systems? (Security, Availability, Processing Integrity, Confidentiality, Privacy) 2. How do the TSC criteria map to the specific AI controls and requirements in ISO 42001? ❓Detailed Cross Mapping Questions 1. Governance and Accountability: ◾How does the organization’s governance structure ensure accountability for AI systems (ISO 42001, Clause 5.1 and AICPA TSC, Common Criteria)? ◾What roles and responsibilities are defined for AI systems, and how do they align with TSC criteria? 2. Risk Management: ◾How are AI risks identified, assessed, and mitigated (ISO 42001, Clause 6.1.2, 6.1.3 and AICPA TSC, Risk Assessment and Mitigation)? ◾How are AI impact assessments integrated into the risk management process? 3. Security and Confidentiality: ◾What controls are in place to ensure the security and confidentiality of AI systems (ISO 42001, Annex A controls and AICPA TSC, Security, Confidentiality)? ◾How is the integrity of AI data and systems maintained? 4. Monitoring and Evaluation: ◾What monitoring and evaluation processes are in place for AI systems (ISO 42001, Clause 9.1 and AICPA TSC, Monitoring of Controls)? ◾How are performance and effectiveness of AI systems measured and reported? 5. Ethics and Fairness: ◾What measures are in place to ensure ethical use and fairness of AI systems (ISO 42001, Annex A controls)? ◾How are bias and ethical considerations integrated into AI system development and deployment? 6. Documentation and Communication: ◾What documentation is maintained for AI systems (ISO 42001, Clause 7.5.1 and AICPA TSC, Information and Communication)? ◾How are AI policies, procedures, and impact assessments documented and communicated? For those of you who currently carry SOC2 attestation that are considering pursuing ISO42001 certification, please know that while the frameworks don't necessarily directly align, you will find ways to repurpose existing controls (administrative and technical) if you ask the right questions in context. As always, if you need help getting started, please reach out! A-LIGN #AICPA #SOC2 #ISO42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

14

4 Comments

A new "Ransomware" module is being deployed by #P2PInfect. Just recently we presented at fwd:cloudsec about our discovery of #P2PInfect and how aggressive it is becoming. We noticed an increase in aggressive behavior over the year. Recently a new "Ransomware" module is being deployed. Candid.Technology report here: https://lnkd.in/erQJqM6E #Ransomware fwd:cloudsec talk here: https://lnkd.in/erhEQuFi

19

1 Comment

A few recent improvements by the team (🤘) to centrally collect and export forensic data from cloud resources like VMs and Containers, as well as on-premise systems: - Centrally store the evidence as .dd, .e01 or .zip - Download and export to your existing forensic tools - Download files from acquired systems, using “encrypted zip” for suspect files. -- Similar to VirusTotal Intelligence's Download File functionality for those who know it, but for your own data. All part of helping you build a central “Repeatable Investigation Process”

25

3 Comments

ZTNA is great for remote access. But what happens when users switch between home, office, and beyond? Inconsistent policies and complex configurations create security gaps and poor user experience. Cato UZTNA is the next evolution in zero trust. Download the eBook to learn more 👇 #ZeroTrust #SASE #cybersecurity

5

CxOs, it's time to rethink your network security approach. ZTNA alone won't cut it in today's threat landscape. Discover why ZTNA integrated into SASE is the key to securing your business end-to-end 👇 #SASE #ZTNA

3

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

189

2 Comments

“AI systems give rise to new types of harms that do not require malicious intent. This, in turn, means that the traditional incident-response playbook needs to be updated for AI systems.”

7

2 Comments

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

In 2023, CISA unveiled its Secure by Design guidance, sending a clear message to software developers about the importance of crafting their products with security in mind. This included tracking and addressing CVEs, utilizing legacy AppSec tools, and implementing protocols like MFA. However, it wasn't until August 2024 that CISA introduced the Secure by Demand guidance, taking a fresh approach by empowering enterprise buyers to insist on safer commercial software from their suppliers, no exceptions.

2

2 Comments

Today's Adobe security update has patched the in-the-wild zero-day PoC that EXPMON Public (https://pub.expmon.com) detected couple months ago (https://lnkd.in/ghQYYzXR). https://lnkd.in/gqxHHCfe Note: not want to cause confusion - this is not a working exploit, but a good PoC. Users are recommended to update their Adobe Reader ASAP, as we're going to point to the public sample with all the details soon in the next few days.

12

** There's New Development about this case ** We tested the (exactly the same) sample on the "patched" Adobe Reader version, it displayed additional dialogs, but if the user clicked/closed those dialogs, the app still crashed! Same UAF bug! We're contacting Adobe to find out what's going on and will update here. For now, we have to postpone the release of the details because the bug seems not properly fixed. [Update on Monday] Adobe has confirmed to us that the bug is not properly patched. "I can confirm our Acrobat product team has identified a secondary fix that is required to fully address this issue. We are actively reviewing and working to prioritize the fix in an upcoming patch. I will be sure to follow up with you once we have a clear release timeframe." Guess we have to hold our blog posts until the new patch becomes available to users. Sigh.. https://lnkd.in/gbBDuDHC #expmon #adobe #pdf #zeroday #0day #detection

8