Steve Crocker

🚨 I am Under Attack 🚨 Beware of the latest threat exploiting Microsoft Management Console files! before you are attacked and start searching "I am Under Attack" Threat actors are exploiting a novel attack technique in the wild that leverages specially crafted management saved console (MSC) files to gain full code execution using Microsoft Management Console (MMC) and evade security defenses. Elastic Security Labs has codenamed the approach GrimResource after identifying an artifact ("sccm-updater.msc") that was uploaded to the VirusTotal malware. Discover how threat actors are using specially crafted MSC files to execute malware and bypass security defenses. Learn how to protect your systems and data. https://lnkd.in/gshJvMyG Follow @rajibimran for more insight. #CyberSecurity #ThreatDetection #ITSecurity

2

Gap Assessment? Mock Assessment? Certification Assessment? Conformity Assessment? Joint Surveillance Voluntary Assessment? NIST SP 800-171 Assessment? CMMC Level 1 Assessment? CMMC Level 2 Assessment? CMMC Level 3 Assessment? Control Assessment? DIBCAC Assessment? Seriously, who knew there are so many types of assessments that occur in the CMMC & NIST SP 800-171 ecosystem today!!! If you don't understand the nuanced differences between all of these types of assessments, this whitepaper, "A Greenhorn's Guide to All of the Assessment Types" may help to clear it all up. At least until DoD provides their next set of updated documents... Like all of our content Peak InfoSec, there is no marketing passthrough where we collect your information. Everything is provided free of marketing and advertising gimmicks. ================================================= Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: cmmc@peakinfosec.us ================================================= #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors https://lnkd.in/eFtmQ6mf

12

1 Comment

Thanks to the good people at Claroty, I found services that list OT/ICS attacks! Some great material here: Newsfeed style: https://icsstrive.com/ Database: https://lnkd.in/e8KM7fJw, https://lnkd.in/eJkM9UYJ But what's interesting? None of them are complete... There was an attack on a Texas water treatment plant in January by, potentially, SANDWORM. It's not on either list. Complete databases will help us with complete information that will need to better decision-making and a fuller intuition. So, if you know of attacks that are not on these lists, use the Report button to add them. #cybersecurity #otsecurity

8

🚨 Zero Day Threats Alert! 🚨 Why should you care and listen to Drex's #2MD? Because your digital security matters more than ever. Zero day threats are like ninjas of the cyber world – silent, swift, and lethal. They exploit vulnerabilities before developers even know they exist! 💥 Your data is at risk: Zero day attacks can compromise your personal information, financial data, and even sensitive business intel in the blink of an eye. 💻 No one is immune: From individuals to corporations, everyone is a potential target. Don’t assume you’re safe – be proactive! ⚠️ Stay ahead of the game: Understanding and addressing zero day threats keeps you one step ahead of cyber criminals. Ignorance is not bliss when it comes to digital security. 🔒 Protect yourself: Invest in robust cybersecurity measures, stay vigilant against suspicious activity, and always keep your software updated. It’s not paranoia, it’s smart protection. Stay safe, stay informed! #CyberSecurity #ZeroDayThreats #229 🛡️🔒

23

2 Comments

The latest from OODA Loop Contributor Emilio Iasiello: In June 2024, the Office of the National Cyber Director (ONCD) released its report Summary of the 2023 Cybersecurity Regulatory Harmonization Request for Information, a government effort whose purpose is to find a path forward to creating a comprehensive framework to strengthen cybersecurity resilience across all sectors; simplify oversight and responsibilities of cyber regulators; and reduce administrative burden and cost on those organizations regulated.  The RFI adhered to Strategic Objective 1.1 of the 2023 National Cybersecurity Strategy, “Establish Cybersecurity Requirements to Support National Security and Public Safety.”  Eighty-six organizations responded to the RFI, representing the critical infrastructure sectors, as well as state and local government associations, academia, and non-profit and professional organizations.  The report found three major outcomes from those that responded to the survey:  1) lack of harmonization and reciprocity impacted cybersecurity outcomes while inflicting high compliance costs; 2) regulatory harmonization had challenges that extended to all sectors and organizations of all sizes and crossed jurisdictions; and 3) it was well within the U.S. government’s ability to address these existing challenges.   https://lnkd.in/eqU486u9

4

1 Comment

🚨 Critical Advisory for Healthcare and Public Health Entities! 🚨 The FBI and HHS have issued a joint Cybersecurity Advisory highlighting a significant increase in social engineering attacks targeting healthcare organizations. These attacks use sophisticated phishing schemes to steal login credentials and divert ACH payments, exploiting the sector's reliance on technology and access to sensitive information. 🔍 Key Takeaways: --Targeted Phishing Schemes: Attackers are impersonating employees to trick IT Help Desks and bypass security measures like multi-factor authentication (MFA). --Financial Theft: Once access is gained, attackers amend forms to divert legitimate payments to accounts they control. --VoIP Numbers: Spearphishing campaigns are utilizing VoIP numbers to deceive targets. 📊 Indicators of Compromise: Known VoIP numbers used in attacks (e.g., +18438888744, +16623301993). Tactics include spearphishing voice communications and modifying authentication processes. 🛡️ Recommended Mitigations: --Implement MFA across all accounts. --Train IT Help Desk staff to recognize and handle social engineering attempts. --Audit and secure remote access tools and enhance email security protocols. 🔧 Validating Security Controls: --Regularly test and validate your organization’s security measures against the MITRE ATT&CK framework to ensure robust defenses. For detailed information and a comprehensive list of recommendations, read the full advisory. Stay vigilant and proactive in safeguarding your organization against these evolving cyber threats. https://buff.ly/3XMtrua #CyberSecurity #Healthcare #PublicHealth #Phishing #SocialEngineering #MFA #SecurityAwareness

1

Pro #cybersecurity tips: 1. If you accidentally type your password into the username field in Windows, change your password immediately, especially at work. 🔒 Usernames for failed logons are stored in event logs, which are often forwarded to corporate logging or SIEM tools that many people can easily access. This could expose your password. Pro corporate #hacking tip: You can search Windows event logs for event ID 4625 (logon failure) and Logon type 2 (interactive logon). The account name field might show users' password or username concatenated with password. 🕵️‍♂️ This could be a valuable source of information for potential attackers. The key takeaway is to be extremely careful with your login credentials, as they can be easily exposed through various logging mechanisms. Protect your accounts by using strong, unique passwords and enabling multi-factor authentication wherever possible. 🔑💪 #CyberSecurity #InfoSec #Authentication #PasswordSecurity #EventLogAnalysis Follow @rajibimran, for more insight.

2

1 Comment

⏰ Just 20 hours left to register for another insightful SANS Institute webcast titled "SANS 2024 SOC Survey: Facing Top Challenges in Cybersecurity." Kicking off at 10:30am PT TOMORROW, Fri., July 12, our very own Scott Dowsett CISSP CISA CRISC CDPSE will speak soon after at 11:00am EDT and will join a panel discussion to follow (@ 11:45am EDT) with several other industry experts including Christopher Crowley, Shahar Ben-Hador, Joshua Costa, Bob Hansmann, Mick Leach, Jay Lillie, Byron Page, Edward Wu, and Ashish Malpani. 👏🏼 Learn more and register here 🔗 : https://lnkd.in/gKWdSSKN #cybersecurity #AI #SOC #ThreatIntel #SecurityAutomation #SecurityOperations

37

2 Comments

If you ever wondered what authentication methods are available to you in Entra ID, as well as what scenarios they can be used, here's an excellent table illustrating all the possible options available to you 😊

1

So, you want to be CISO. This will be a reoccurring post of the job requirements of a current CISO.  We will cover: Education Experience Leadership Skills Technical Expertise Risk Management Skills Communication Skills Regulatory Compliance Knowledge Continuous Learning Certifications Part 1. Let’s cover education today.  The minimum requirement for a CISO is a bachelor’s degree, preferably in a technical program (Computer Science, Engineering, or Informational Technology).  Showing that you have a bachelor’s degree in business administration will not get you the job, brutal but true.  The larger the company you want to work for generally has either a Masters or even a PhD requirement.  Some companies will substitute a long leadership career where you have shown constant upwards movement for higher levels of education. The key is that you must show that you have the educational background to be able to communicate and learn new technologies on a constant basis.  The Cybersecurity field is ever changing, it is accelerating with new technologies, such as ML and AI and will not stop changing.  If you do not show that you are capable of learning and mastering constantly new technologies then this is not the job for you. What may be of interest is that an MBA has a long way to go with acquiring the position.  CISO’s must not only understand the technical side, why buy what, but also managing a budget that can be very tight to what the organization needs. How much can I spend on what and what should we do first. You will be expected to attend technical conferences to understand what the next “Big” thing is and how it may fit into your organization. Network with fellow CISO’s to understand what they are doing in your vertical and how they are managing their budget. This life of a CISO is no easy and never will be.  If you have the wherewithal to meet the requirements above, I encourage you to go for it.

5

Can AI really replace cybersecurity experts? Shocking but true: 92% of organizations plan to adopt AI tools. AI is transforming cybersecurity, but can it fully take over? Here's why we still need human intuition and expertise. 1. AI excels in detecting patterns and anomalies quickly. 2. Yet, AI cannot fully understand context like a seasoned pro. 3. AI tools like CrowdStrike Falcon help, but aren't foolproof. 4. Human oversight is crucial for interpreting AI's findings. 5. Cybersecurity jobs are evolving, not disappearing. **Immediate Action Required:** Don't just rely on AI. Boost your cybersecurity strategy with both tools and training. 🔍 **Explore AI Tools:** - CrowdStrike Falcon for endpoint security. - Microsoft Security Copilot for SOC analysts. 🚀 **Be Proactive, Not Reactive:** Invest in continuous learning and new technologies. 📈 **Enhance Your Skills:** AI is here to stay. Learn to work alongside AI to enhance your cybersecurity measures. 🔗 **Connect with Experts:** Networking is key in the ever-evolving tech landscape. 👀 Looking for more insights? Follow @rajibimran, for more insight. Let's stay ahead of the game together! 💪 #CyberSecurity #AI #Innovation #BusinessLeadership #Automation #TechnologyTrends

4

ISC2. (2024, April 15). "CISSP Exam Refresh and Updated Official Training Now Live." ISC2 Insights. https://lnkd.in/e8KVTEDB Check out the 2024 Detailed Content Outline with Weights Final, Effective April 15, 2024, by clicking here: https://lnkd.in/egKsk22D  #cybersecurity #cissp #cissptraining

1

U.S. Senator Mark Warner, I'm pretty sure the U.S. Department of Health and Human Services (HHS) did this (i.e., develop Mandatory Minimum Cybersecurity Standards for Healthcare) when the HIPAA Security Rule was published in the Federal Register in February 2003 and made enforceable by April 2005. It's an enforcement issue. To wit, 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal findings. And, that's just the tip of the non-compliance iceberg. Maybe enforce what we have? OK, strengthen it by making C-suite executives and board members accountable, and then enforce it! https://lnkd.in/eQhKFw_k #hipaa #riskmanagement #enterprisecyberriskmanagement #cyberriskmanagement #cyberriskilliteracy #boardcyberoversight #boardofdirectors

9

2 Comments

Don't leave your system's security to chance. Act now to patch high-profile vulnerabilities in Cisco and CrushFTP and protect your valuable data. 🔒💻 #cybersecurity #systemsecurity #datasecurity #patching #Cisco #CrushFTP #pinedacybersecurity #securityawareness #cybersecuritymakessensehere

6

One thing we do very well at VulnCheck is help cyber product teams and enterprise teams (VM, CTI, SecOps, DevSecOps, SSCS, Threat Hunting, Pen Testing and ASM) prioritize which vulnerabilities matter for defending an organization. We do this by taking an evidence-based approach to HOW we prioritize for customers, and that evidence helps us deliver unprecedented context for over 300M records maintained on ALL CVEs that exist. VulnCheck Security Researcher Patrick Garrity 👾🛹💙 put together an interesting set of insights that will enable teams to easily take exploit and exploitation evidence and apply it to products, workflows and response actioning. Take a read! #exploitintelligence #exploitevidence #vulncheck #patrickgarrity

16

This Kiteworks article is a good read for cybersecurity professionals who want to learn more about a roadmap for Department of Defense (DoD) contractors to achieve compliance with the Cybersecurity Maturity Model Certification (CMMC) 2.0. The article outlines the steps and strategies contractors need to take to meet the updated CMMC requirements, emphasizing the importance of understanding the new framework and preparing for the certification process. Your Ultimate Guide for CMMC 2.0 Compliance Get the CMMC Roadmap: https://lnkd.in/evfK7SC8 #CMMC #compliance #cybersecurity #blog #NIST

16

Plenty of companies think they’re going above and beyond to manage cyber risk. But in reality, most are doing the bare minimum. Executives who know they need some kind of risk management framework hear terms like HITRUST, CMMC, or NIST ISO 27001 and hire someone to put one of these programs into practice thinking they’ve fulfilled their obligation. We refer to this as a “checking the box” approach. What those execs don’t know is that many high-profile security frameworks are meant to be a foundation to build on – not a bulletproof vest. Companies that just check the box leave themselves vulnerable to threats while thinking they’re protected. Unfortunately, simply adopting a security framework is just table stakes. True cyber risk management comes into play when you start asking questions like: -What are the financial losses my company might expect without a security framework in place? -How have similar businesses been affected by a data breach, either monetarily or reputationally? -Am I using a framework that is specific to my business model? -What are my internal capabilities for managing risk and where do they need to be supplemented? The answers to these questions inform the specific protocols your company needs to adopt and the level of protection you need. Frameworks themselves are not smart. They don't know what your business is, where it’s located, or what your specific level of threat is. Without that context, your cyber security measures fit your company less like a tailored suit and more like a one-size-fits-all bargain bin jacket. As an executive, your job is to take the measurements of your company’s business context and adjust the framework so it’s a perfect fit. Doing so can mean the difference between feeling protected and 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 being protected.

33

4 Comments