Jon Sparks, CISSP

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

54

6 Comments

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1

Are you a contractor that uses an external cloud service provider (CSP) to store, process, or transmit sensitive defense information? DFARS clause 252.204-7012 details several requirements you must “require and ensure” meet security requirements (Are they on FedRamp.gov Marketplace?) or provide evidence that they are 100% equivalent to the FedRAMP moderate baseline. They must comply with all DFARS 252.204-7012 requirements for: Cyber incident reporting Malicious software Media preservation and protection Access to additional information and equipment necessary for forensic analysis Cyber incident damage assessment You can read the requirements yourself here: https://lnkd.in/gb7qEeaq. Or give us a call at MNS Group. We’re an Authorized C3PAO that can help provide guidance. #DoD #compliance #contractors #cybersecurity #assessment

44

1 Comment

Today begins the Summer of CTEM! This week's installment is a brief overview of Continuous Threat Exposure Management. Stay tuned in all summer as we'll help guide you from the basic concepts all the way through adoption. https://lnkd.in/e_hRdzsm #summerofCTEM #ctem #exposuremanagement #vulnerabilitymanagement #cloudsecurity #applicationsecurity #riskmanagement #cybersecurity #guidepointsecurity #threatmanagement #securityoperations

100

8 Comments

New blog on CMMCAudit. This one is real basic, but has a few tidbits that might be interesting for you experienced cybersecurity folks. Some excerpts from the article... Assessments are priced by the complexity of your environment: having physical facilities, lots of users, or development labs can increase the price significantly. The sales team will normally offer a fixed-price quote and should be able to explain timing as well as what to expect. What is a red flag that you aren't ready? No one on the team has done it before. Book learning is way different than real life. Passing a certification test is nice, but it doesn’t compare to the experience of building and maintaining an information system that meets all 320 objectives (110 requirements). Having someone on your team who has experienced a formal assessment on either side (assessor or assess-e) is the best indication you will pass. #CMMC

45

10 Comments

MSPs often see backup only as a way to recover the system in case of a failure, data loss or cyber attack. Backups are much more than that.

18

Why is Cyber Threat Intelligence (CTI) an integral component of a stout cyber security defense strategy? This is part one of a multi-part series of posts answering this quite vexing question. CTI is imperative for organizations, particularly if they want to stay ahead of sophisticated cyber threats. CTI helps provide actionable insights into the tactics, techniques, and procedures (TTPs) adversaries employ, enabling the proactive deployment of defense measures. It enhances threat detection, informs strategic decision-making, supports rapid incident response, and informs red team testing to better mimic real-world attacks. CTI also helps with MITRE ATT&CK technique mapping, and prioritizing vulnerabilities most likely to be leveraged by threat actors, among *many* other exceedingly important areas. As cyber threats evolve, having a dedicated CTI team allows organizations to adapt defenses, reducing the risk of successful attacks and safeguarding critical assets, data, and reputation as the world continues to undergo digital transformation. CTI is inherently a proactive discipline because it involves continuously monitoring, analyzing, and anticipating potential cyber threats before they materialize into attacks. By identifying emerging threats, and understanding adversary TTPs, CTI enables organizations to take preemptive actions, such as implementing targeted defenses, identifying gaps due to MITRE ATT&CK mapping, patching vulnerabilities, educating the masses, fine-tuning incident response plans, and much more. This proactive stance not only mitigates risks but also enhances an organization's ability to swiftly respond to and recover from cyber incidents, thereby maintaining a robust security posture as threat actors constantly evolve their tradecraft. One of the first things to be quite easily done with a CTI team is threat profiling. This is a simple exercise involving creating detailed profiles of the adversaries most likely to target the organization, including their motivations, capabilities, and TTPs. Threat profiling is vital because it will helps with deep understanding of the adversaries, and develop targeted defense strategies. Here are the broad-based areas for why this is crucial: 1. Understanding Adversaries 2. MITRE ATT&CK Mapping 3. Vulnerability Exploitation 4. Predicting Attack Patterns 5. Enhancing Detection and Response 6. Improving Threat Hunting 7. Stout Cyber Defense 8. Strategic Decision-Making 9. Collaboration and Information Sharing 10. Enhancing Training and Awareness CTI is a critical solution for combating modern threats. Threat profiling is indispensable, delivering vital intelligence on adversaries' tactics, empowering organizations to craft razor-sharp defenses, and urgently fortifying their cyber security posture against sophisticated attacks. Tomorrow in part two I will dive deeper into each of the aforementioned ten topics. #threatintelligence #cybersecurity #threatprofiling #intelligence

85

1 Comment

We all have to think about the best place for "security vs. usability" to meet. Here's a new one that bugs me a little bit. I'm getting legit, real text messages with a bill from a medical provider. The "from" is just five digits and the URL is a shortener. I can usually tell what's legit and what's a scam, but many people cannot. This is going to be a scammer's dream. If medical providers are going to send bills over text, a lot of people are going to get scammed. I get that it's an easy, fast and low cost way to send out bills, but I feel like it's a little too far away from the "security" end of the spectrum. #smishing #SocialEngineering

14

1 Comment

The "Ball of Fire" really, really resonated with me, and is a key reason I joined F5. There's a reason that Problem Identification is such a core practice in both LEAN and Kaizen. I have not seen anyone better identify the problem statement facing today's enterprise technology and security teams better than François Locoh-Donou and Kara Sprague do, and identifying the problem correctly is roughly half the battle. #f5 #betterdigitalworld

50

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3

Working as CIO or MS(S)P CTO or owner? You are probably thinking about NIST, Cyber Essentials, CMMC and what's moving in #Cybersecurity? Is all of this connected? Yes, 100%, but how? and what should you be thinking about in simple terms, to not get too stressed out, because reality is, it isn't really all that complex. The first thing we all are aware of is that #cyberattack volume is going up and the attack surface is expanding. Your workforce / customer base is going more mobile and data is moving to the cloud. Protecting more vectors is crucial and more intensity of work is coming. This gets you to a first "#todotomakelifeeasier" 😎 , which applies to everyone, MS(S)P, CIO alike for a business of any size operating under National Institute of Standards and Technology (NIST), National Cyber Security Centre (Cyber Essentials) or United States Department of Defense (CMMC). You need to reduce your workload / alerts and start somewhere with high impact. I'll give you 2 "pointers of the day" and make sure to follow up with more in coming days and weeks. I will also share some considerations of what i am seeing in the market and also a bit of "why" Heimdal® took the direction we did. This means you need to feed through relevancy of alerts and think about #automation, to not be drowning in work and avoid #alertfatigue. How you did it yesterday, is not going to cut it tomorrow. This advice would apply for any size of MS(S)P, or business CIO Advertisement disclaimer!: This is one reason of why i heavily advocate for automated Patch Management (Which can be customized) from Heimdal®, but naturally you can use patching from any vendor, i honestly just don't think the rest are as good, simple to scale or as simple to use. But strong candidates also include Qualys naturally. Clearly this is subjective, based on what i see from the competition. Naturally you might not deem #vulnerabilities an alert and hence not something that takes your focus, but i would, because under the security standards above, you need to eliminate vulnerabilities. If you are a MS(S)P or CIO of larger size, here is your 2nd noise reduction tip. SOAR is a good route, but there are pro's and con's. If you are very Microsoft heavy, Azure Sentinel is a logical preferred route. However, it requires a heavy effort to set up, configure and use. It is not as automated in my view, as other solutions, but clearly it means you have one eco-system at your disposal. There are other options, Palo Alto Networks, Barracuda could in my view be routes to the same, but none of these are what i would call "complete" cybersecurity platforms. If you embark on Either of those 3 - which are some of the wider ones in the market, you still need more than one platform. Heimdal® embarked on the combined SIEM/SOAR route with the Threat Hunting and Action center, but offers a wider platform. Lot's to consider, these are my thoughts for now - more inspiration to follow and free inspiration on the link

15

How to lessen the impact of complying with DFARS CUI requirements (DFARS 252.204.7012) or the CMMC program assessment you may be required to meet. Yes, the costs will be high esp. for an SMB. The answer is a business answer and not a cybersecurity answer at all. When I study P&L statements and balance sheets with my financial review team (these days that means by myself :p), I see large expenses that are spread out across months and quarters. This is how to avoid that large lump payment that hurts. The same for the DFARS and CMMC preparations. Spread out your workload across 12-18 months. Pay for services as you need them in small affordable amounts. For example, make a $30k CMMC preparation a $1600/Month expense over 18 months. There is another secret benefit to this approach - most compliance experts will tell you that it takes that long anyway if you are to truly implement a proper and passable cybersecurity program. So many of the answers to managing a cybersecurity program can be found in the daily business practices you already are doing. I have been studying how to lessen the burden on SMB's to achieve compliance and have some controversial ideas that I have been slowly unwinding here. They include: 1. [Executive Leadership] CEO emotional intelligence (EQ) - no this is not an attack but a concept for executive leadership if you have read anything about it [Subtopic Executive Coaching] 2. [Team Building] Team Transparency and commitment. 3. [Project Management] Use of tools like OKR's to keep the 18-month program on track and accountable to each other (another sign of EQ). Trust is good but verification is better. 4. [IT Planning and Management] Putting together the right mix of tools (yes you might choose to buy some software for parts of this) that will help you cover a majority of the security controls and requirements without overlap. 5. [Board Room Discussion] Consideration of your IT architecture and migrations to platforms that will ease the compliance burden. 6. [HR} Find a compliance SME that your team can work with over the 18 months and beyond. Get the right consultant on the bus and get the wrong consultant off the bus. Food for thought. #CW #ceomindset #CMMC #cybersecurity #DFARS

2

1 Comment

Are you applying to dozens, if not hundreds of security operations openings and not hearing back? Quinnlan Varcoe will be teaching Hacker in Heels Insiders how to stand out in a unique way, and form genuine connections with people who can give you the opportunity to start or advance your career in security operations. Join me and our impressive, niche community of women in cybersecurity as we talk all things security operations tonight. 📆 Tuesday, June 11 @ 4P PT / 5P MT / 6P CT / 7P ET EXTRA: Would you, or someone you know make an excellent guest mentor? I'm looking for someone for our July 9th call. Priority will be given to women of color and/or women who want to speak on a cybersecurity subject (as opposed to personal branding, confidence, etc.) Share your proposed topic in the comments, or tag a nominee! P.S.—We offer to pay all our guest mentors, because we believe all women should have the option to be compensated for their labor 💜 #womenincybersecurity #cybersecurity #securityoperations #secops

63

15 Comments

Sorry but this feels insane to me! If you're a provider of SOC 2 reports, and you allow your auditee to put periodic in their control testing for their SOC 2 Type 2 report. What exactly are you testing as part of that control that it operates in an ad-hoc manner? Am I missing something? I understand firms want to 'de-risk' their reports, but it also removes the value and validity of the control testing. How do you reviewing access quarterly or within 24 hours of a user terminating when your report states you do it periodically? #SOC2 #VendorManagement #AICPA

11

1 Comment