Paul Laudanski

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

Recent shifts within The NIST NVD operations have raised alarms among researchers and practitioners. ⚠️ These changes have led to delays in vulnerability analysis and a noticeable decline in enriching CVEs with critical data such as CPEs, CVSS scores, CWEs, and references. This creates significant hurdles for organizations striving to effectively identify and prioritize vulnerabilities. 💡 Meet DeviceTotal, a transformative solution reshaping this vulnerable pyramid. Our AI-powered technology propels vulnerability management into a new era, offering substantial enhancements in accuracy, speed, and automation. 🚀 DeviceTotal sources security information directly from vendors, ensuring data is updated well before it reaches the NVD. This proactive approach empowers organizations with timely insights, enabling swift and informed actions to mitigate threats. 💪 On top of that, DeviceTotal provides actionable insights for every threat, offering precise indications for available updates, mitigation options, workarounds, End-of-Life alerts, and more.  And the best part? No agents, no installations—just swift value delivered directly to your organization. Don't let your vulnerability management strategy crumble—elevate it with DeviceTotal. Experience the difference today. #VulnerabilityManagement #CyberSecurity #DeviceTotal #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement #nationalsecurity (cartoon copyright by XKCD.com)

24

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Known Exploited Vulnerabilities Remain Unmitigated Past Deadlines: - Critical severity KEVS took nearly 4.5 months (137 median days) - High severity vulnerabilities take more than 9 months (238 median days) - Medium severity vulnerabilities take nearly 1.5 years (517 median days) https://lnkd.in/g_RExD96

1

Nice work #ThistleTechnologies! Signed firmware is a security measure taken by software vendors by digitally signing their firmware image using a private key. When firmware carries this cryptographic signature, a device goes through a verification-like process before accepting and installing the firmware. If discrepancies or alterations in the firmware's integrity are detected, the device declines the firmware upgrade. The use of this technique to sign firmware or software images before they are loaded onto the device's hardware helps protect against unauthorized modifications, malware injection, and other security threats enhancing the overall security posture of the system by preventing malicious modifications to the firmware which could result in: Viruses inserted into the firmware, data theft, destruction and manipulation, protection from counterfeit drives, verifiecation of the authenticity and integrity of firmware, reduces physical and logical attacks...and more.

5

Yet another report from Forescout Research - Vedere Labs. This time we looked into exploited vulnerabilities, the catalogues available and the impacted devices! Have a read. https://lnkd.in/griGMznV

17

Just in - CISA publishes Encrypted DNS Implementation Guidance for Federal Agencies to enhance cybersecurity and protect sensitive data. Stay ahead of the curve with this important resource: https://lnkd.in/eMeN-uxt #cybersecurity #CISA #encryptedDNS

2

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

54

6 Comments

In February 2024, NIST informed the cybersecurity community about anticipated delays in processing Common Vulnerabilities and Exposures (CVE) identifiers for the NVD. This issue stemmed from an increase in the number of vulnerabilities reported and a change in interagency support. By April, the backlog had grown substantially, prompting NIST to prioritize the analysis of the most severe vulnerabilities. They are addressing this challenge to provide additional processing support for the NVD. This move aims to help clear the backlog and return to its previous processing rates within the next few months. The NVD is a critical resource for organizations worldwide, enabling them to stay informed about emerging vulnerabilities and take appropriate mitigation measures. A delay in processing vulnerabilities can leave systems exposed to potential exploitation, putting sensitive data and operations at risk. By enlisting outside help, NIST is taking a proactive step to ensure the NVD remains up-to-date and reliable, allowing organizations to make informed decisions about their cybersecurity posture. In addition to addressing the immediate backlog, NIST is exploring long-term solutions to handle the increasing volume of vulnerabilities. This includes leveraging technology and process updates to build a sustainable program that supports automation in vulnerability management, security measurement, and compliance. At White Knight Labs, we understand the importance of staying ahead of emerging threats. Our comprehensive vulnerability assessment and penetration testing services can help you identify and mitigate vulnerabilities before they are exploited. #CyberSec #InfoSec #Exploits https://lnkd.in/dYm9g-ke

6

1 Comment

The Cybersecurity and Infrastructure Security Agency (CISA) has recently published guidance on implementing Encrypted DNS to enhance security for federal agencies. This proactive step aims to protect sensitive information and mitigate DNS-based threats. Stay informed by reading the full article here: https://lnkd.in/d3Ncqctk 🛡️💻 #CyberSecurity #CISA #EncryptedDNS #DataProtection

1

The Office of the National Cyber Director (ONCD) recently released the first-of-its-kind Cybersecurity Posture Report at #RSAC: https://bit.ly/3UybTyD The report evaluates the strategic environment and cyber risk landscape, taking into account trends in threat actor capabilities, as well as the opportunities and challenges within U.S. cybersecurity policy. From highlighting the rise of nation-state actors disrupting U.S. critical infrastructure to the prevalence of new attack vectors such as supply chain attacks in emerging technologies like #AI, the report underscores the urgent need for enhanced collaboration between government agencies, private sector entities, and international partners. As an industry leader in threat intelligence, we're committed to providing insights and solutions to empower organizations to defend against emerging threats effectively. We commend ONCD for their efforts and look forward to our continued partnership in shaping the future of cybersecurity policy.

38

🚀New DFIR Labs Case🚀 We’re releasing a new medium difficulty case based on a private threat brief! This is another intrusion that ended in a domain-wide compromise and has a wealth of data available for you to investigate. Check it out here: https://lnkd.in/gMjV7TV8

176

Expanding APT42 Threat Intelligence with Validin - an example of using high-confidence threat intelligence to find and track dozens of additional related indicators using PDNS history. https://lnkd.in/eGanB2mG

33

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

12

1 Comment

The Ransomware Defense Initiative (RDI) was just introduced at RSAC 2024. RDI offers a structured framework to evaluate your cybersecurity program’s maturity. Using our self-assessment tool at rdishield.com, you can measure your current control maturity, identify gaps in your program, and determine areas needing more focus. You'll receive a real-time report assessing your readiness to handle ransomware threats based on MITRE ATT&CK well known techniques. This proactive approach helps you stay ready against evolving threats, refine your strategies, and draft or update your cybersecurity plan. Whether you're a small business or a large enterprise, RDI provides the necessary tools and guidance to enhance your defenses. Visit rdishield.com.

10

RSA can be hectic. If anyone is looking to for a break from Moscone, let me know. Permiso has lounge space that is walking distance away. Come meet and hang out with Permiso and Permiso's P0 Labs Team and talk/ learn about a new approach to cloud threat detection and response/ confidence in containment. We can talk about how the SIEMs, CSPMs, EDRs, and other existing security controls you'll see everywhere on the show floor consistently miss alerting on cloud threats in a timely manner or at all 🚀

20

1 Comment

As you explore Moscone, consider this: Despite their mature security setups—including CSPM, SIEM, CNAPP, EDR, and more—victims of Scattered Spider were compromised. In over 150 threat briefings and incident responses with partners like KPMG, we've consistently observed missed early detection opportunities at the IDP and SaaS layers, critical in an operational window of 3-5 days. AI integration won't shift these outcomes. The Permiso HQ is walking distance from Moscone. DM me to come by and meet the Permiso and P0 Labs team (former Mandiant), let's discuss a new purpose-built approach to cloud detection and response

1