Greg G.

Cloaked and covert... "Investigations into more recent operations in 2023 following fixes from the vendors involved in the investigation have corroborated Mandiant's initial observations that the actor operates in a sophisticated, cautious, and evasive nature. Mandiant has observed that UNC3886 employed several layers of organized persistence for redundancy to maintain access to compromised environments over time. Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated. This blog post discusses UNC3886's intrusion path and subsequent actions that were performed in the environments after compromising the guest virtual machines to achieve access to the critical systems, including: The use of publicly available rootkits for long-term persistence Deployment of malware that leveraged trusted third-party services for command and control (C2 or C&C) Subverting access and collecting credentials with Secure Shell (SSH) backdoors Extracting credentials from TACACS+ authentication using custom malware"

2

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

12

1 Comment

Once NIST SP 800-171 and SP 800-171A are published this month, federal agencies are on the clock to start using Revision 3 (outlined in the Office of Management and Budget (OMB) Circular No. A-130, “Managing Information as a Strategic Resource.” The policy states on page I-16: “For legacy information systems, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines within one year of their respective publication dates unless otherwise directed by OMB. The one-year compliance date for revisions to NIST publications applies only to new or updated material in the publications. For information systems under development or for legacy systems undergoing significant changes, agencies are expected to meet the requirements of, and be in compliance with, NIST standards and guidelines immediately upon deployment of the systems.” Visibility of how your sensitive data is being handled through it's lifecycle will.be essential; even when it's sitting somewhere within your supply chain. Seclore Data Centric Security is a strong part of NIST and achieving zero trust. https://lnkd.in/efiMejPG #NIST800171 #SecurityRequirements #NIST800171A #AssessmentProcedures #CUI #OMBCircularA130

7

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

31

1 Comment

GSA announced last week that, "Starting June 8, 2024, GSA will begin collecting Common [#SSDF Attestation] Forms for new contracts (including micro-purchases) and the exercise of contract options, that include the use of software, regardless of whether or not the software is considered critical." This is a major update because it means all vendors dealing with GSA or a GSA contracts must comply in June and NOT in September, like originally thought. #ZeroTrust, #CyberSecurity, #SoftwareDevelopment, #DepartmentOfDefense, #InfoSec, #NationalSecurity, #DefenseTech, #CyberDefense, #SecureSoftware, #MilitaryTechnology, #DevSecOps, #InformationSecurity, #CyberAwareness, #GovernmentTech, #CyberThreats, #TechInnovation, #DigitalTransformation, #CloudSecurity, #DataProtection, #NetworkSecurity, #SecurityArchitecture, #CyberResilience, #IdentityManagement, #Encryption, #Compliance, #SecureCoding, #CyberRiskManagement, #AIInCybersecurity, #ThreatIntelligence, #CriticalInfrastructure, #CyberLaw, #CyberEthics, #TechnologyLeadership, #PublicSectorInnovation, #TechGovernance, #SecureByDesign, #PrivacyByDesign, #MilitaryInnovation, #DefenseStrategies, #CyberWarfare, #CyberDiplomacy, #GovernmentContracting, #DefenseContractors, #MilitaryTec, #TechPolicy, #SecureInfrastructure, #NationalCybersecurity, #TechForDefense, #SecureDevelopment, #GovernmentIT 

16

2 Comments

The key to Digital Trust is building a CULTURE capable of mitigating digital risk to protect organizational DIGITAL VALUE. The DVMS Institute NIST Cybersecurity Framework Overlay System assures that every digital service created is protected and delivered in alignment with an organizational cybersecurity risk management plan. Creating and Delivering DIGTIAL TRUST requires more than theory. It requires a culture plus an underpinning overlay system capable of assuring the digital business performance, resilience, and trust government regulators and operational stakeholders expect. https://lnkd.in/g_mQWH4T

11

🇨🇳 RED ALERT: 𝑪𝒐𝒖𝒏𝒕𝒆𝒓𝒊𝒏𝒈 𝒕𝒉𝒆 𝑪𝒚𝒃𝒆𝒓𝒕𝒉𝒓𝒆𝒂𝒕 𝒇𝒓𝒐𝒎 𝑪𝒉𝒊𝒏𝒂 - 🏛️ United States House Committee on Oversight and Accountability Subcommittee on Cybersecurity, Information Technology, and Government Innovation. The panel discussion focused on cyber warfare threats, particularly those orchestrated by the 𝑷𝒆𝒐𝒑𝒍𝒆'𝒔 𝑹𝒆𝒑𝒖𝒃𝒍𝒊𝒄 𝒐𝒇 𝑪𝒉𝒊𝒏𝒂 (𝑷𝑹𝑪), against the United States' critical infrastructure. ✅𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 𝗥𝗘𝗖𝗢𝗠𝗠𝗘𝗡𝗗𝗔𝗧𝗜𝗢𝗡𝗦 📍𝗙𝗲𝗱𝗲𝗿𝗮𝗹 𝘀𝘂𝗽𝗽𝗼𝗿𝘁 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝗶𝗻𝗰𝗿𝗲𝗮𝘀𝗲𝗱 to develop and replace outdated technology in critical infrastructure with secure alternatives. 📍𝗣𝗿𝗼𝗺𝗼𝘁𝗲 𝗮𝗻𝗱 𝗶𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁 President Biden's national cybersecurity strategy. 📍𝗔𝘀𝘀𝗶𝘀𝘁 𝗮𝗹𝗹𝗶𝗲𝘀 in resolving cyber incidents by engaging in *proactive international diplomacy.* 📍𝗜𝗻𝘃𝗲𝘀𝘁 𝗶𝗻 𝗔𝗜 𝗮𝗻𝗱 𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵 to improve cyber defenses, recognizing the potential of these technologies to detect and mitigate attacks. 📍𝗣𝗿𝗼𝘃𝗶𝗱𝗲 𝗴𝘂𝗶𝗱𝗮𝗻𝗰𝗲 𝘁𝗼 𝗻𝗼𝗻-𝗳𝗲𝗱𝗲𝗿𝗮𝗹 𝗲𝗻𝘁𝗶𝘁𝗶𝗲𝘀, clarify protocols, and support victims of cybercrime instead of imposing punishment. 📍𝗖𝗼𝗻𝘀𝗶𝗱𝗲𝗿 𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗮𝗻𝗱 𝗳𝗶𝗻𝗮𝗻𝗰𝗶𝗮𝗹 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝗲𝘀 to incentivize the removal of obsolete technologies and encourage updated and secure systems. ✅𝗞𝗘𝗬 𝗤𝗨𝗢𝗧𝗘𝗦 𝗙𝗥𝗢𝗠 𝗧𝗛𝗘 𝗛𝗘𝗔𝗥𝗜𝗡𝗚: "𝑇ℎ𝑒𝑠𝑒 𝑎𝑡𝑡𝑎𝑐𝑘𝑠 𝑜𝑛 𝑜𝑢𝑟 𝑐𝑟𝑖𝑡𝑖𝑐𝑎𝑙 𝑖𝑛𝑓𝑟𝑎𝑠𝑡𝑟𝑢𝑐𝑡𝑢𝑟𝑒 𝑎𝑟𝑒 𝑛𝑜𝑡 𝑗𝑢𝑠𝑡 𝑖𝑛𝑐𝑖𝑑𝑒𝑛𝑡𝑠 𝑜𝑓 𝑐𝑦𝑏𝑒𝑟𝑐𝑟𝑖𝑚𝑒 𝑜𝑟 𝑒𝑠𝑝𝑖𝑜𝑛𝑎𝑔𝑒; 𝑡ℎ𝑒𝑦 𝑎𝑟𝑒 𝑑𝑒𝑙𝑖𝑏𝑒𝑟𝑎𝑡𝑒 𝑎𝑛𝑑 𝑐𝑎𝑙𝑐𝑢𝑙𝑎𝑡𝑒𝑑 𝑠𝑡𝑟𝑎𝑡𝑒𝑔𝑖𝑒𝑠 𝑒𝑚𝑝𝑙𝑜𝑦𝑒𝑑 𝑏𝑦 𝑡ℎ𝑒 𝐶ℎ𝑖𝑛𝑒𝑠𝑒 𝑔𝑜𝑣𝑒𝑟𝑛𝑚𝑒𝑛𝑡 𝑎𝑖𝑚𝑒𝑑 𝑎𝑡 𝑑𝑒𝑠𝑡𝑎𝑏𝑖𝑙𝑖𝑧𝑖𝑛𝑔 𝑜𝑢𝑟 𝑐𝑜𝑛𝑓𝑖𝑑𝑒𝑛𝑐𝑒 𝑎𝑛𝑑 𝑤𝑖𝑙𝑙𝑖𝑛𝑔𝑛𝑒𝑠𝑠 𝑡𝑜 ℎ𝑒𝑙𝑝 𝑚𝑎𝑖𝑛𝑡𝑎𝑖𝑛 𝑡ℎ𝑒 𝑝𝑒𝑎𝑐𝑒𝑓𝑢𝑙 𝑤𝑜𝑟𝑙𝑑 𝑜𝑟𝑑𝑒𝑟." ~ Rob Joyce, Former Special Assistant to the President and The White House Cybersecurity Coordinator. "𝐼𝑡 𝑖𝑠 𝑒𝑠𝑡𝑖𝑚𝑎𝑡𝑒𝑑 𝑡ℎ𝑎𝑡 80% 𝑜𝑓 𝐴𝑚𝑒𝑟𝑖𝑐𝑎𝑛 𝑎𝑑𝑢𝑙𝑡𝑠 ℎ𝑎𝑣𝑒 ℎ𝑎𝑑 𝑎𝑙𝑙 𝑜𝑓 𝑡ℎ𝑒𝑖𝑟 𝑝𝑒𝑟𝑠𝑜𝑛𝑎𝑙 𝑑𝑎𝑡𝑎 𝑠𝑡𝑜𝑙𝑒𝑛 𝑏𝑦 𝑡ℎ𝑒 𝐶𝐶𝑃" ~ William Evanina, Former Director of the National Counterintelligence and Security Center. "𝑇ℎ𝑒𝑦 𝑜𝑓𝑡𝑒𝑛 𝑟𝑒𝑠𝑒𝑎𝑟𝑐ℎ 𝑎𝑛𝑑 𝑑𝑒𝑣𝑒𝑙𝑜𝑝 𝑒𝑥𝑝𝑙𝑜𝑖𝑡𝑠 𝑓𝑜𝑟 '𝑧𝑒𝑟𝑜 𝑑𝑎𝑦' 𝑣𝑢𝑙𝑛𝑒𝑟𝑎𝑏𝑖𝑙𝑖𝑡𝑖𝑒𝑠... 𝑂𝑣𝑒𝑟 𝑡ℎ𝑒 𝑝𝑎𝑠𝑡 𝑓𝑒𝑤 𝑦𝑒𝑎𝑟𝑠, 𝑤𝑒’𝑣𝑒 𝑜𝑏𝑠𝑒𝑟𝑣𝑒𝑑 𝑡𝑎𝑟𝑔𝑒𝑡𝑒𝑑 𝑧𝑒𝑟𝑜-𝑑𝑎𝑦 𝑒𝑥𝑝𝑙𝑜𝑖𝑡𝑎𝑡𝑖𝑜𝑛 𝑜𝑓 𝑣𝑢𝑙𝑛𝑒𝑟𝑎𝑏𝑖𝑙𝑖𝑡𝑖𝑒𝑠 𝑖𝑛 𝑉𝑃𝑁, 𝑓𝑖𝑟𝑒𝑤𝑎𝑙𝑙, 𝑒𝑚𝑎𝑖𝑙 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑔𝑎𝑡𝑒𝑤𝑎𝑦, ℎ𝑦𝑝𝑒𝑟𝑣𝑖𝑠𝑜𝑟𝑠, 𝑎𝑛𝑑 𝑜𝑡ℎ𝑒𝑟 𝑡𝑒𝑐ℎ𝑛𝑜𝑙𝑜𝑔𝑖𝑒𝑠 𝑡ℎ𝑎𝑡 𝑑𝑜 𝑛𝑜𝑡 𝑐𝑜𝑚𝑚𝑜𝑛𝑙𝑦 𝑠𝑢𝑝𝑝𝑜𝑟𝑡 𝑒𝑛𝑑𝑝𝑜𝑖𝑛𝑡 𝑑𝑒𝑡𝑒𝑐𝑡𝑖𝑜𝑛 𝑎𝑛𝑑 𝑟𝑒𝑠𝑝𝑜𝑛𝑠𝑒 𝑠𝑜𝑙𝑢𝑡𝑖𝑜𝑛𝑠." ~ Charles Carmakal, Chief Technology Officer Mandiant (part of Google Cloud)

90

5 Comments

RSA 2024 Takeaway: AI or Die 🥵 Met dozens of CISOs, execs & founders at RSA this week. Quick observations: 1️⃣ Every vendor is AI-fying their pitch. They're leveraging AI/LLMs for various use cases - threat intelligence, SOC automation & more. Impressed by Google Cloud, CrowdStrike & Microsoft Azure security offerings with lots of LLM-powered automation across their stack 🤖 2️⃣ The other side of AI adoption? Security / Compliance / Safety. Many pitches around securing AI systems & data. AI safety will be a hot topic for a while. Congrats to Reality Defender Ben Colman for winning the RSA Conference Innovation Sandbox 👏 3️⃣ Enterprises are shifting towards unified security stacks driven by cost, simplicity & agility needs - EDR + ASPM + CNAPP + SIEM +...all-in-one. This'll trigger a new wave of acquisitions by major players like CrowdStrike, Palo Alto Networks, Zscaler, Wiz, SentinelOne. While there are many innovative exciting startups, I'm afraid most exits may be below $500M. 4️⃣ Critical infrastructure security is gaining more attention due to rising geopolitical threats. This is an urgent national security matter. I'm super proud to be an early investor in Eclypsium, Inc.. They are the MOST innovative critical infrastructure security platform for enterprises. 💪 (cc Yuriy Bulygin Alex Bazhaniuk) 5️⃣ Identity is the new perimeter. Loads of innovation here. A non-human identity layer is emerging rapidly. Cerby showcased many exciting product updates to secure new vulnerabilities in the identity stack. Watch this space 👀 Share if I miss others. #RSAC2024 #cybersecurity #IAM #EDR #SIEM #CNAPP #ASPM #criticalinfrastructure #supplychainsecurity #ai #ml #llm #largelanguagemodels

79

10 Comments

Is it material? Well, maybe. Good article from Tim Starks in CyberScoop: CDK hack shows SEC disclosure standards are unsettled; The early application of the regulatory agency’s new cybersecurity reporting rules reveal that materiality is in the eye of the beholder. As the damage from the ransomware attack on automotive software provider CDK Global has become clear over recent weeks, numerous auto dealers felt compelled to notify the Securities and Exchange Commission that the breach had harmed their operations. CDK's parent company, Brookfield Business Partners, which apparently paid nearly $25 million in ransom to attackers, does not feel the same way. In a press release issued July 3, the company said "we do not expect this incident to have a material impact on Brookfield Business Partners." Despite the attack's downstream effect on the U.S. auto industry, CDK and its parent company did not file with the SEC under its new rules for reporting breaches. https://lnkd.in/ec3RfdMX #cybersecurity #ransomware #regulations

3

I’ve been telling folks for years to prepare for DPIAs to become public one way or another. It’s not a secret filing. Shrewd privacy and communication professionals will recognize the opportunity to counsel organizations on how to stop creating & hiding skeletons in the closet. Because when DPIAs become public, everyone will know what you know, including: - how honest & thorough you were from the jump (or did it take 5 versions to meet the requirements?) - known risks you haven’t told them about yet - how transparent you are with regulators - how you evaluate tradeoffs - if you have command of both technical & legal controls

5

Recent shifts within The NIST NVD operations have raised alarms among researchers and practitioners. ⚠️ These changes have led to delays in vulnerability analysis and a noticeable decline in enriching CVEs with critical data such as CPEs, CVSS scores, CWEs, and references. This creates significant hurdles for organizations striving to effectively identify and prioritize vulnerabilities. 💡 Meet DeviceTotal, a transformative solution reshaping this vulnerable pyramid. Our AI-powered technology propels vulnerability management into a new era, offering substantial enhancements in accuracy, speed, and automation. 🚀 DeviceTotal sources security information directly from vendors, ensuring data is updated well before it reaches the NVD. This proactive approach empowers organizations with timely insights, enabling swift and informed actions to mitigate threats. 💪 On top of that, DeviceTotal provides actionable insights for every threat, offering precise indications for available updates, mitigation options, workarounds, End-of-Life alerts, and more.  And the best part? No agents, no installations—just swift value delivered directly to your organization. Don't let your vulnerability management strategy crumble—elevate it with DeviceTotal. Experience the difference today. #VulnerabilityManagement #CyberSecurity #DeviceTotal #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement #nationalsecurity (cartoon copyright by XKCD.com)

26

1 Comment

An interesting case of ICS (Industrial control system hacking) this would likely not have happened if the routers/gateways had used strong certificat based authentication. Now is the time to secure your ICS networks. #iec62443

4

Marketing & e-commerce best practices need to evolve. If you have to trick people or withhold information to convert a sale, that should tell you something about the true value of what you're selling.

5

Access control assurance, of identity and integrity, is key to the safety and security of critical facilities and networks. Continuous post-hire audit processes should be enabled within every acceptable use, code of conduct, and procurement service contract.

1

Need some #OSINT prompts to get you going with AI? I got ya covered. Keep your eyes out for a major AI for OSINT update webinar coming soon. https://lnkd.in/gVRGBuTt

29

1 Comment