Josh Bressers

Hey everyone, here is where we will begin really digging into the details of #CMMC levels. My full post is here: https://lnkd.in/gZKXAY3C I tried to not be too wordy and dry, but there's only so much you can do with government regulations (even with 10+ years of experience with them, I can only do so much). For a quick summary, level 1 focuses on mostly basic hygiene requirements. It does bring in physical security as part of cyber, which I was happy to see. The most technical requirements are probably the segmentation and malicious code monitoring/scanning parts. Even for companies without DoD contracts, I would probably recommend that level 1 be followed just as a general minimum level of protection. All of these requirements will be a part of levels 2 and 3 as well, and we'll see a big jump in complexity for level 2 next week.

8

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

I’ve written a number of posts on testing and rolling out security controls safely on my blog including this one from 2020 ~ Better Testing for Better Outcomes. I have a bunch of others in a thread on X (sorry it’s the easiest right now) and on my blog. Taking the time to properly test and building tests into the software itself can prevent a lot of pain later. I explain how to do that in my posts and show examples of things not properly tested as well. https://lnkd.in/gcJ-PeG

10

4 Comments

Regulatory compliance? 🙄 I know right? But ensuring that you enforce geographic specific access to certain systems doesn't need to be hard... one simple policy...

2

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

🔍 Technical Dive: The Critical Importance of Comparison Operators in Smart Contract Security Inspired from a conversation on X, i thought i'd write an elaborated post here. At Olympix, we keep encountering a subtle yet potentially dangerous pattern: the misuse of comparison operators, specifically '>' vs '>=' in boundary conditions. Let me break down why this seemingly minor detail matters significantly in Web3 security. 🔍 The Security Implications: 1️⃣ Edge Case Exclusion: When using '>', you're inadvertently excluding the exact boundary value. In DeFi protocols, this can lock funds permanently when amount equals minWithdrawalLimit, despite it being a valid state. 2️⃣ State Machine Transitions: In protocols with state transitions based on thresholds (like liquidation conditions), '>' instead of '>=' can create a "dead zone" where neither state is valid, breaking protocol invariants. 3️⃣ Example: A DEX implementation where LP removal was blocked when remaining liquidity exactly matched the minimum threshold - funds essentially locked due to a single comparison operator. 🛠️ Impact Assessment: Best case: User inconvenience requiring additional transactions. Worst case: Permanent fund locking or broken protocol state machines. Common severity: Low to Medium. Escalates to High when combined with precision loss in fixed-point math. 💡 Mitigation Strategy: Always question boundary conditions. Document explicit reasoning for choosing '>' over '>=' Add comprehensive test cases for exact boundary values. Consider fuzzing tests specifically targeting boundary conditions. 👉 The Rule of Thumb: Default to '>=' unless you have an explicit, documented reason for excluding the boundary value. Your future self (and auditors) will thank you.

8

There's a new cyberespionage campaign targeting government agencies in EMEA and Asia by a group called SneakyChef. They use lures that are scanned documents related to government affairs. This campaign uses a wider range of targets and infection techniques than previous ones. Stay vigilant and educate your colleagues about these threats! #cybersecurity #APT #governmentthreats https://lnkd.in/dM9qz5EM

18

A colleague sent me a link to Bob Lord's Thanksgiving "I'm thankful for TLS" post, The Quiet HTTPS Revolution https://lnkd.in/gCx2uxdU Good article, and TLS is doing a ton of work for all of us. Lest we forget about the pitfalls of metadata, however, if you're trying to achieve reasonable (not over-the-top) security, other fundamentals like the DNS exhaust from browsing should be protected, as well. Otherwise, someone that would have been in position to view the unencrypted trafffic can still make accurate guesses on what you are up to. Also, let's not forget to give a heartfelt thanks to the Electronic Frontier Foundation (EFF) for creating Let's Encrypt and Certbot, without which, millions of sites would still be without trusted certificates.

13

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

Thrilled to have the opportunity to analyze #vulnerability remediation timelines again, this time using data from NopSec. The chart below is based on a survival analysis of vulnerabilities across an environment. Essentially - the time it takes to remediate all affected assets after a vuln is discovered. Everytime I see analysis like this, I'm reminded of how different the real world of #vulnerabilitymanagement is from the "just patch it all yesterday" shallow advice that's so often bandied about. If it were that easy, vuln survival curves wouldn't look like this time after time. How does this square with your experience? I'll be discussing this chart and several others in a webinar next week. Register here and bring your questions, comments, and rants! https://lnkd.in/eHWDrEYN

92

26 Comments

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

https://lnkd.in/gGpBP9Qi Interesting read from runZero 2024 Annual Report. ❗️7% of ICS systems are directly connected to the public internet! Ouch. It's 2024 and highly likely that a substantial portion of critical infrastructure is vulnerable to compromise. (probably still running Ubuntu 14.04) #vulnerabilitymanagement #EASM #Criticalinfastructure

11

A little late, but here's the next #cmmc entry for level 2: https://lnkd.in/gKpkbpBp This one was a bit more difficult to decide what to write, as I did not want it to be a long boring read. There are almost 100 additional requirements above level 1, so I just tried to give some highlights by sections. Level 2 is where you start seeing more technical requirements that will be much more likely to start requiring outside assistance, but it also will likely greatly enhance most company's security postures.

9

Pager bombs. some discussion "is it is it not a cyber attack?" Some claim as the trigger was via "online" method then this = cyber attack. So question: are IEDs triggered via cell phone Xg considered a cyber attack then? Not in my opinion.

26

22 Comments

You need to use the findings and automate based on those. eBPF is not enough.

2

Coalfire (a respected QSAC) has published this excellent white paper on how HUMAN's Client-side Defense solution for PCI DSS 4.0, addresses requirements 6.4.3 and 11.6.1. Lean more about the "easy button" for protecting card holder data from third-party and nth party scripts. #payment #PCI #browsersecurity #cybersecurity #riskandcompliance #riskmanagement #compliance #ecommerce #retail https://lnkd.in/ehcbP-qN

18

Quick heads up: DigiCert is revoking certificates due to improper Domain Control Verification (DCV). Affected customers must replace their certificates within 24 hours (starting yesterday - have a few hours left) to stay compliant. "This impacted approximately 0.4% of the applicable domain validations we have in effect." If you're uncertain go check your DigiCert account to view impacted certificates. For detailed instructions, see the link below. Stay frosty! #CyberSecurity #CertificateManagement #DigiCert https://lnkd.in/gjtz8sBt

14

2 Comments

“It would take forever with our current tooling to try and get feature parity [with Harmonic Security] or even come close to it. We’d be writing regexes forever.” To understand what we've built at Harmonic Security, it’s best to hear from some of our customers who have deployed it and are using it in earnest. For a third-party perspective, we worked with the amazing folks at Enterprise Strategy Group to speak with our customers and see it in action for themselves. 🤘 96% fewer alerts than the existing data loss prevention (DLP) solutions 💰 75% saved on project costs, resources, and time Full report below 👇

33