Keith McCammon

📢 Check Point Again a Frost Radar XDR Leader in 2024 In this report, Check Point was cited as a Growth and Innovation Leader in Extended Detection and Response (XDR). Check Point XDR/XPR Key Highlights: • Collaborative Threat Prevention • AI Copilot • Consolidated Threat Intelligence and Analytics • Infinity Playblocks Automation • Centralized IOC Management • Threat Intelligence & Event Correlation Download your free copy of the Frost Radar™ XDR Report to learn more about why Check Point is a Growth and Innovation leader in Extended Detection and Response 👉 https://lnkd.in/gecJVKrG Yael Cinamon

4

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

What defines value? After three years of effort, this week marks the start of the federal government's enforcement of new secure software development requirements. Starting with GSA and then shifting to all commercial vendors selling to all agencies, the Office of Management and Budget industry-changing mandate is now in action. For years, vendors commented that they thought this would never happen, but guess what? It did. Attacks on nations' software are skyrocketing, and as a nation, we need to take steps to produce more secure software by design. Before implementing tools such as application security testing (SCA/SAST/DAST), you must ensure your organization has a proper foundation. This is why the NIST 800-218 Secure Software Development Framework (#SSDF) starts with organizations preparing themselves to ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. CodeLock, Inc. received a grant from VIPC | Virginia Innovation Partnership Corporation to develop a dashboard to provide companies across the country with the resources they need to get started and comply with these new requirements. Over the last month, we have uploaded templates for policies and procedures that your organizations need to have in order to meet specific practice areas. Rather than you having to create this from scratch, we did the work for you, saving thousands of hours and the finances associated with that work. You can get a CodeLock account today and access all of these resources for only $19/month. Do no wait to take action, get started with the compliance process today. If you made it this far into my post, congratulations! Send me a message, and I will give you a discount code to get started for free. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT

13

1 Comment

A new article from Nucleus Security COO Scott Kuffer on Cybersecurity Insiders is on security debt. I'll add the link to the article in the comments.

16

1 Comment

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

Hey everyone, here is where we will begin really digging into the details of #CMMC levels. My full post is here: https://lnkd.in/gZKXAY3C I tried to not be too wordy and dry, but there's only so much you can do with government regulations (even with 10+ years of experience with them, I can only do so much). For a quick summary, level 1 focuses on mostly basic hygiene requirements. It does bring in physical security as part of cyber, which I was happy to see. The most technical requirements are probably the segmentation and malicious code monitoring/scanning parts. Even for companies without DoD contracts, I would probably recommend that level 1 be followed just as a general minimum level of protection. All of these requirements will be a part of levels 2 and 3 as well, and we'll see a big jump in complexity for level 2 next week.

8

1 Comment

With the latest and greatest #ransomware infection impacting CDK Global and its huge dealer network, I feel like it's a good time to re-share this piece I wrote from 5 years ago. I could have written this today...seems that nothing is changing on this front. #CISO #infosec #CEO #CIO

7

2 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

Enjoyed reading this post from CISA Director, Jen Easterly on the USDA's adoption of FIDO Protocols, referencing the CISA's publication from the 20th: "USDA’s success story should inspire all enterprises to migrate to FIDO authentication". Referencing the CISA publication: "Authentication technologies that do not involve FIDO or public key infrastructure (PKI)—a security framework based on public key cryptography—to support confidentiality and integrity will only continue to put organizations at risk by allowing malicious cyber actors initial access to their networks via credential phishing attacks."

1

🚨 A Smoke Signal to Early Adopters w/ SIEM Projects🚨 I have now been with Anvilogic for ~6 weeks, and as a professional seller, I am jazzed about what I am seeing. Problems that Anvilogic Solves: - A SIEM market desperate for innovation and data agnosticism - Technology that necessitates staff augmentation w/ MDR / MSSP - Vendor lock-in-by-design that precludes teams from advancing without gutting their stack - Analysis paralysis as a product of both too many emerging threats, as well as manual, cumbersome processes for ensuring the health of what's already been built - Inaccessability of cold/dark data due to budgetary constraints - Lack of an intuitive, simple method by which to map detections to risk frameworks - In-depth, language-specific knowledge required for detection creation and maintenance As I determined I was going to embark on my next Security adventure I was looking for 2 things primarily; growth potential, and a company investing in the right areas of its business. Anvilogic came out far ahead of the other manufacturers I spoke with. Startups have to have a delicate balance of bullishness and humility... they want to be first to market, but they need to be self-aware enough to see the forest through the trees and make strategy pivots nimbly and without finger-pointing. Anvilogic is LISTENING. I love selling to Early Adopters. Not in spite of the fact, but rather BECAUSE they are 'tough customers'. These are the firebrands of their organizations, the folks who are willing to accept that they might not know of everything, those willing to be educated in new paradigms, and ultimately those brave/confident enough to champion a solution that isn't on a Magic Quadrant or the like (*because it doesn't exist yet*). If you are an Early Adopter who is trying to look at SIEM through new eyes more than a, "No one get's fired for buying IBM" type, I cannot wait to speak with you. Blue = Mind-share Yellow = Market-share

22

1 Comment

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

55

🕸 The Security Data Fabric Shift Explained🕸 Last month, Zscaler acquired Avalor for $350M. A security data fabric and vulnerability management startup that only came out of stealth in April of 2023. This acquisition sparked tons of interest and funding activity in the security data management space. It also reignited the platform v. best-of-breed debate and hinted at what's to come for AI in security products. However, this acquisition had many question marks surrounding it. In this deep dive, I cover: ✅ What security data fabrics and security data ETL are ✅ The flurry of activity that happened immediately after the acquisition ✅ Why the acquisition makes sense for Zscaler ✅ What other vendors are doing with data fabrics including CrowdStrike, Microsoft, F5, and SentinelOne. ✅ The implications for the security industry, including incumbents, startups, and security teams I also explore the growing importance of data and AI in security and how this acquisition positions Zscaler well for the next 5-10 years. What are your thoughts on this acquisition and the security data management space? Let me know what you think in the comments section! 👇 🔗 Link for the full post in the comments! #cybersecurity #datasecurity #AI #acquisition #innovation #infosec

62

23 Comments

Malwarebytes has a nice tool (used for marketing) to check for your "personally identifiable information" (pii) (including sensitive pii like your SSN, DOB, address, phone number, email address) that may have been leaked to the dark web from the AT&T data breach. When you enter your email and click "scan now," you'll receive an email with a code to enter and get a personalized report on the Malwarebytes website. https://lnkd.in/eqtVYPGd If you discover that your sensitive pii was published on the dark web, place security credit freezes on your credit reports. For more info and verified links to Experian, Equifax and TransUnion credit freeze pages, visit FrozenPii.com and click the "Freeze My Credit" button. It also would be a good idea to create and lock down online accounts with the Social Security Administration (SSA) and the Internal Revenue Service (IRS). For more info and verified links to the SSA and IRS, visit FrozenPii.com and click the "Claim My Gov ID" button.

9

3 Comments

We commonly see people who are really disappointed in their organization’s Supplier Performance Risk System (SPRS) score. Remember your SPRS score measures compliance with the 110 security controls in NIST SP800-171. The defense department and prime contractors consider your SPRS score when awarding contracts. So a higher score gives you a competitive advantage. (Here’s a link to NIST SP 800-171 Rev. 3, just published in May: https://lnkd.in/eMMdA3M7.) SPRS scores range from –203 to +110. A higher score indicates higher levels of compliance. Suppliers’ final scores are ranked against each other. But don’t despair if your self-assessment reveals a low score. Even though it’s based your supplier performance information data, here’s a way to raise your score right away: Implement a good governance, risk, and compliance (GRC) tool. A GRC tool is software that helps to manage the policies, practices, and procedures critical to the assessment and remediation or risk. It can help to control user access, centralize and monitor data, and streamline overall reporting and compliance. There are lots of good GRC tools out there. And, as always, if you need some additional guidance, MNS Group is always standing by to help. #BestAdvice #RiskManagement #DoD #contractors #RiskAssessment #risk

49

As CMMC takes effect, many FSOs are discovering that their workload is growing rapidly. In our ever-connected, digital, and internet-of-things world, the lines between physical security, digital security, cybersecurity, and information security are blurring. Protecting sensitive information now means guarding against both physical and digital threats. FSOs might find themselves needing to understand not just how to secure a door, but also how to safeguard access controls with strong passwords. The modern FSO is becoming a key figure in overall compliance, taking charge of overseeing, developing, maintaining, and enhancing all aspects of security, not just the physical side. Ultimately, it's all about ensuring that national security information, classified data, CUI, and any other sensitive material are truly protected.

1

While we need to modernize our approach to security… “There are whole Private Equity firms that have built a business around buying End of Life Products and putting them on life support.” ☠️ - Andrew Morris on risky biz The industry needs to EOL more products and get them off the internet! 🙃 #cybersecurity #infosecurity

20

1 Comment