Jack Daniel

Articles like these are why I use Brian Krebs articles in my workshops. If you want to learn how follow investigative thread to track down miscreants, see if you can copy one of Brian’s step by step investigative paths. https://lnkd.in/gbZDiH6Z

8

1 Comment

⚡️Some domains likely used by #transparentTribe #APT36 counciling[.]com nbssedelhi[.]org ashifdigitalseva[.]xyz birthdeath[.]in gov-certificate[.]com viewss[.]click admin-mcas-df[.]ms admin-mcas[.]ms mcas-df[.]ms mcas[.]ms verifycertificate[.]info nimsme[.]org

1

1 Comment

Move on over HIPAA, there is a new bill working its way through the Washington red tape machine called "Health Infrastructure Security and Accountability Act". Since pretty much all of our health and personal data has already been leaked by inadequate data collectors, some lawmakers decided it was time to act. They are 20 years too late but it's election season so they need to pull out all the stops. HISAA (sounds 'gangsta' doesn't it) has civil penalties for all those health data grabbers out there who don't comply (and get caught) with HISAA requirements. These include: No knowledge – Minimum of $500 Reasonable cause – Minimum of $5,000 Willful neglect (Corrected) – Minimum of $50,000 Willful neglect (Uncorrected) – Minimum of $250,000 Yes, one "reasonable cause" will cost them a month's mortgage payment (4 bedroom, 2 bath, detached garage), which will be passed down to you, the patient, in one form or another. You can compare this bill to the ole SOX Act but for health care. The bill includes checklists, audits, stress test (pen test sorta) and someplace where the CEO has to sign off on the compliance thingy. Health care organizations have 3 years to figure out ways around the bill before they need to worry, once this bill is passed (if it is passed). $800 million of taxpayer cash will be given to Medicare safe providers to help them figure out how data security works. Then there is another $500 million of TaxO'Cash to " incentivize all hospitals" to adopt data security. I've attached a two page summary of HISAA so you too can gasp in horror at how our government thinks. Happy Halloween https://lnkd.in/gmyyCxhe

9

1 Comment

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

Key quotes from the new 48CFR Rule for #CMMC. This rule is the one that goes into new and renewing contracts and requires having a CMMC certificate or self-assessment upon contract award. They tightened up the language quite a bit. On quick scan, it looks well done. The first 40 pages give a lot of information about the DoD's thought process on CMMC, including some technical clarifications like whether joint ventures need to be individually certified, and whether talking about CUI over the phone is in scope.

31

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

Check out this podcast interview with me just after my TribalNet keynote in Vegas recently. I was asked a random question at the end about the first concert I attended that you might find interesting (and it's not just what's listed in the podcast description). #infosec #CISO #CIO #businessleaders #cybersecurity #podcast #keynotespeaker #backtobasics #rockconcerts #ISAC

5

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

My interview with Irina Tsukerman at the Washington Outsider Radio Show was published last night, and I wanted to share it with all of you. We discuss my book and the real-life events that inspired the story, which are shocking by most standards. We get into how an investigation into embezzlement quickly turned into a large identity theft investigation involving health insurance brokers and American Income Life, and how that investigation brushed up against organized crime and potential nation-state activity with indications that my family was targeted due to multi-generational history with the US Army Corps of Engineers, and with all frankness, the sloppiness of my father's and the organization's security practices that left them open to vulnerabilities that affected the safety of potentially the entire city of Portland, Oregon. We also discussed the blowback I received for coming forward with such alarming information and how that endangered my safety and well-being both in general and in a particular incident best described as local yokel social engineering that resulted in me being at the wrong end of a madman with a gun. We also discuss the Russian Orthodox Church in Bend, OR, the ties between specific individuals in that church and the Oregon health insurance broker community, and connections that indicate they are profiting from the theft of Social Security numbers and banking information via identity theft and money laundering. We also touch on how the attorney I had appears to have been blackmailed, possibly due to his firm showing up in the Panama Papers, which I didn't realize then but discovered later when I took the investigation into my own hands. It's tough to summarize, and since this was the first time anyone sat me down to discuss this with probing questions, it's quite revealing and likely a story you all haven't heard in this way before. With that in mind, I hope you listen to this and all enjoy it. Be safe out there, my friends. #Fraud #InsiderThreats #IdentityTheft #PPPfraud #insurance #healthinsurance #Oregon #Obamacare #LifeInsurance #Espionage #Corruption #ACA

7

3 Comments

Why Security Matters: A Lesson from the Golf Course https://lnkd.in/duCjZ4s5

1

To news organizations looking to siphon more revenue from readers with paywalls: Content paywalls do not automatically lend credence or credibility to the content you are fronting as news. The fair and balanced aspects of your content, along with legitimate research and analysis, accomplish that goal.

3

2 Comments

Bit of a public service announcement. If you are thinking of posting an image of a postal letter or similiar item with a postal address and some codes that look a bit like QR codes (dot matrix codes, for example), and if you intend to redact the address, please redact those codes as well. These provide such things as the destination postal address and are easily readable. The full specification is also public - so no guesswork as to what is the post code. See this if you want the details for some UK formats - https://lnkd.in/eX4e8Cat

3

Hey everyone, here is where we will begin really digging into the details of #CMMC levels. My full post is here: https://lnkd.in/gZKXAY3C I tried to not be too wordy and dry, but there's only so much you can do with government regulations (even with 10+ years of experience with them, I can only do so much). For a quick summary, level 1 focuses on mostly basic hygiene requirements. It does bring in physical security as part of cyber, which I was happy to see. The most technical requirements are probably the segmentation and malicious code monitoring/scanning parts. Even for companies without DoD contracts, I would probably recommend that level 1 be followed just as a general minimum level of protection. All of these requirements will be a part of levels 2 and 3 as well, and we'll see a big jump in complexity for level 2 next week.

8

1 Comment

My book 📚 "Incident Response with Threat Intelligence" is also included in this promotion 🤓

65

7 Comments