Steve Tucker

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

Cloaked and covert... "Investigations into more recent operations in 2023 following fixes from the vendors involved in the investigation have corroborated Mandiant's initial observations that the actor operates in a sophisticated, cautious, and evasive nature. Mandiant has observed that UNC3886 employed several layers of organized persistence for redundancy to maintain access to compromised environments over time. Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated. This blog post discusses UNC3886's intrusion path and subsequent actions that were performed in the environments after compromising the guest virtual machines to achieve access to the critical systems, including: The use of publicly available rootkits for long-term persistence Deployment of malware that leveraged trusted third-party services for command and control (C2 or C&C) Subverting access and collecting credentials with Secure Shell (SSH) backdoors Extracting credentials from TACACS+ authentication using custom malware"

2

Sandbox Escape Vulnerabilities in Judge0 Expose Systems to Complete Takeover: Multiple critical security flaws have been disclosed in the Judge0 open-source online code execution system that could be exploited to obtain code execution on the target system. The three flaws, all critical in nature, allow an "adversary with sufficient access to perform a sandbox escape and obtain root permissions on the host machine," Australian https://lnkd.in/dJGhYRqt

1

Overcoming Common Data Security Challenges: By Claude Mandy, Chief Evangelist at Symmetry Systems Organizations depend on data to operate. From day-to-day operations to strategic decisions, data is what keeps an organization ticking. As digital transformation […] The post Overcoming Common Data Security Challenges appeared first on Cyber Defense Magazine. https://lnkd.in/g-f533Ka

1

1 Comment

Coalfire (a respected QSAC) has published this excellent white paper on how HUMAN's Client-side Defense solution for PCI DSS 4.0, addresses requirements 6.4.3 and 11.6.1. Lean more about the "easy button" for protecting card holder data from third-party and nth party scripts. #payment #PCI #browsersecurity #cybersecurity #riskandcompliance #riskmanagement #compliance #ecommerce #retail https://lnkd.in/ehcbP-qN

18

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

Data-centric security is crucial in digital transformation as it focuses on protecting the most valuable asset—data—separately from network infrastructure. This approach is especially vital for industries like utilities, where data breaches can lead to significant financial loss, reputation damage, and operational disruptions. By implementing data-centric solutions like DPRM, organisations can ensure operational continuity and safeguard against sophisticated cyber threats, thereby enabling seamless digital transformation without compromising data security.

10

Google Warns of Pixel Firmware Security Flaw Exploited as Zero-Day: Google has warned that a security flaw impacting Pixel Firmware has been exploited in the wild as a zero-day. The high-severity vulnerability, tagged as CVE-2024-32896, has been described as an elevation of privilege issue in Pixel Firmware. The company did not share any additional details related to the nature of attacks exploiting it, but noted "there are indications that CVE-2024-32896 may be https://lnkd.in/gebv_zD4

1

It's official! The Maryland Online Data Privacy Act has passed and become law. Here are some questions that Maryland businesses should be able to answer to be compliant with MODPA. If you're not quite sure where to start, or if you already have data privacy policies and procedures in place and need a third-party assessment, let me know, and we can schedule a quick call to discuss your needs. ·        Data Inventory and Processing Activities o  What personal data does your business collect, and for what purposes? o  How do you document and manage data processing activities? o  Can you provide a map or inventory of where consumer data is stored and how it flows through your organization? ·        Consumer Rights and Requests o  What mechanisms allow consumers to access, correct, delete, or transfer personal data? o  How does your business handle consumer requests to opt out of data processing, such as for targeted advertising or the sale of their personal data? o  What is the average response time to consumer data requests, and how do you ensure compliance with legal timeframes? ·        Privacy Notices and Policies o  How do you inform consumers about collecting, using, and sharing data? o  Is your privacy policy aligned with current data protection laws and accessible to consumers? o  How often do you review and update your privacy notices or policies? ·        Data Security Measures o  What administrative, technical, and physical security measures are in place to protect personal data? o  How do you assess the effectiveness of these security measures? o  Have there been any data breaches in the past two years, and how were they managed? ·        Third-party Management and Contracts o  Do you share consumer data with third parties, and if so, for what purposes? o  What criteria do you use to evaluate third-party service providers regarding data protection? o  How do you ensure data processors and third parties comply with privacy obligations? ·        Training and Awareness o  What type of data protection training do employees receive? o  How frequently is data privacy and security training provided to staff? o  Are designated personnel such as a Data Protection Officer responsible for data protection compliance? ·        Legal Compliance and Data Protection Impact Assessments o  Have you conducted data protection impact assessments for processing activities that pose a high risk to consumer privacy? o  How do you ensure ongoing compliance with data privacy laws and regulations, including sector-specific requirements? o  Are there processes to handle changes in data protection laws or the legal landscape? ·        Data Integrity and Minimization o  How do you ensure the accuracy of the personal data you collect and maintain? o  Do you have policies in place for data minimization and retention? How do you determine the lifespan of the data you collect? #MODPA #GDPR #DataPrivacy #HumanRights

10

#Security Operations Centers (SOC) help detect and prevent threats, making them vital for physical security. 💻 But how do you demonstrate this to stakeholders? A detailed SOC report can help you to deliver all this information in a way that is easy to understand, including: ✅ Monitoring device review 👨🏻‍💻 Incident review 🚨 Threat analysis Get #Calipsa’s template here: https://hubs.li/Q02r16-c0 #VideoSecurity #tech #security #AI

9

1 Comment

https://lnkd.in/ePufpVtQ "The guidelines emphasize a range of steps, including understanding the dependencies of AI vendors that operators might be working with and inventorying AI use cases. They also encourage critical infrastructure owners to create procedures for reporting AI security risks and continually testing AI systems for vulnerabilities." Cybersecurity and Infrastructure Security Agency #AI #ArtificialIntelligence #Cybersecurity

1

🚀 Stand Out in the Security Crowd with Security First & Associates In a crowded market, it's not enough to just promise "better service" or a "superior product." At Security First & Associates, we've taken our offerings to the next level by incorporating managed security support and IT Risk Management Framework capabilities. This strategic enhancement has not only differentiated us from the competition but has transformed our client relationships. 🌟 What Sets Us Apart? - Dedicated 24/7 Support: Our team is on hand around the clock to ensure your security needs are continuously addressed. - Proactive Risk Management: We implement the IT Risk Management Framework to anticipate and mitigate threats before they become issues. - Client Satisfaction: Our approach has led to skyrocketing client satisfaction and a boom in referrals—proof that we're on the right track. 💡 Discover how these changes can not only meet but exceed your security expectations. Our clients feel more secure than ever, knowing they have a strong, reliable partner in their corner. 🔗 Want to know more about how we can help you stand out too? Visit our latest blog post: https://lnkd.in/ePAQWQXf 📞 Ready to upgrade your security strategy? Contact us today! #SecurityFirst #ManagedSecurity #RiskManagement #ClientSatisfaction #SecurityConsulting

9