💻 Rob Barnett

It's all too easy to feel overwhelmed by the rigorous demands of attaining or maintaining the CMMC compliance you need, knowing your current or future contracts could be at stake. This Stress Awareness Month, remember that preparation—and a helping hand from someone you trust—is the key to keeping your cool. Partner with a C3PAO with the experience and expertise to help you achieve CMMC certification. https://bit.ly/3MT8mH9 #Cask #caskgov #CyberConsulting #Cybersecurity #DataSecurityConsulting #StressAwarenessMonth

1

Discover the secrets to applying DoD's Zero Trust Architecture to Operational Technology (OT) networks - OT networks require a different approach to Zero Trust than IT networks. This webinar will dive into how the DoD's Zero Trust Strategy can be effectively applied to OT environments. Don't miss this opportunity to learn from industry experts! When: Wed, Jul 17, 2024, 1pm EST Topic: Applying DoD's Zero Trust Architecture to Operational Technology Networks Hosted by: Deeptech Showcase Presented by: BlastWave & Dragos Register: https://hubs.ly/Q02DB-q40 #CyberSecurity #ZeroTrust #OperationalTechnology #OTSecurity #BlastWave #DeepTechShowcase #Dragos

10

This is just one more aspect to be aware of for my fellow utility cybersecurity professionals or anyone in critical infrastructure. The assessment requirements are going to continue to expand, there is no aspect about what we do in terms of maturing our cybersecurity programs that will ever be static. Driving this point home with executive leadership to assure support for the overall cybersecurity program is going to be critical.

11

1 Comment

📚 Unlock the secrets of CMMC with our eBook: "The Alphabet Soup of CMMC: Common Terms Defined And Your Recipe for Success." Get clarity on the essential terms, acronyms, and concepts shaping cybersecurity discussions. Whether you're new or seasoned, this guide has insights for everyone. 🔍 Decode the jargon, understand compliance, and fortify your security posture. But that's not all! We go beyond definitions, offering a roadmap for CMMC success. Learn how to blend compliance, security, and efficiency seamlessly. 💡 Download now for a comprehensive CMMC journey. Secure your business, streamline processes, and elevate your cybersecurity game. Don't miss out! #CMMC #Cybersecurity #eBook #DownloadNow https://lnkd.in/gTckemEF

3

ASK DTS: What advice do you have for small business contractors going through CMMC? A: Don’t delay. The longer you wait, the more stressful and expensive the remediation will be. You're going to need 3rd party support, and cybersecurity service providers (including DTS) are getting busy and may become more selective about who they work with or charge rush fees. We're hearing that C3PAOs are already booked for months too. #DTSCybersecurity

5

Cybersecurity objectives differ between IT & OT. How? IT top priorities are described through the CIA Triad: 🤫 Confidentiality 🤝 Integrity 👐 Availability OT top priorities: 🤕 Physical Safety of on-site personnel and Protecting the Environment around the facility 👷‍♂️ Continued Operations, then 🛡 Data Integrity and Confidentiality (dependent on owner/operator requirements). If you're interested in learning more about ICS/OT Cybersecurity learn along with me by following Mike Holcomb and checking out the resources he's created.

22

2 Comments

Sisense is an analytics company that ingests client data helping them "gather insights." Companies can upload data to the Sisense data hub, or provide credentials to 3rd party sites allowing the Sisense systems to ingest that data directly. In other words: Sisense was storing a LOT of data for clients, and had access to a LOT of data for clients hosted in other 3rd parties. Then they left secret Amazon access tokens in their Gitlab code repository, which hackers found and used to access a huge store of apparently unencrypted data in Sisene's Amazon S3 buckets. So many layers of bad here. Secure credentials like access tokens should be stored in secure identity repositories/ vaults. Not in a code repository. Valuable data at rest should always be encrypted -- ideally with different encryption keys for each client to further segregate the data. Customers who uploaded 3rd party credentials probably have no mechanism to monitor when Sisense was using those credentials (eg via API calls) since it was Siense accessing the 3rd party on the customer's behalf. It looks like some clients were syncing their Active Directory with Sisense so those credentials are now compromised... and on and on and on. The linked Krebs' article below includes a disturbingly long list of recommendation remediations from Sisense. Most of us are struggling with aging and clunky identity solutions just for the humans in our environment. And so many of the new online services we want to explore have limited and inflexible identity options. When your complex identity stack doesn't work with their complex identity stack, you end up with the spaghetti mess of integrations based on unmanaged usernames, passwords and tokens. In this case, Sisense made a few mistakes and the customers are left trying to untangle the mess. Will you be ready when your provider puts you in the same position? The old adage applies here, "Never let a good disaster go to waste." Hopefully this disaster doesn't affect you directly, but gives you some insights to prepare for the next one that does. https://lnkd.in/gegY-tpk #cybersecurity #bigdata #integration #itsabouttrust

3

1 Comment