Marcelo F.

New Post: #CISA Releases Analysis of #FY23 Risk and Vulnerability Assessments - https://lnkd.in/d-V3nXqW CISA Releases Analysis of FY23 Risk and Vulnerability Assessments 09/13/2024 12:00 PM EDT CISA has released an analysis and infographic detailing the findings from the 121 Risk and Vulnerability Assessments (RVAs) conducted across multiple critical infrastructure sectors in fiscal year 2023 (FY23). The analysis details a sample attack path including tactics and steps a cyber threat actor could follow to compromise an organization with weaknesses representative of those CISA observed in FY23 RVAs. The infographic highlights the most successful techniques for each tactic that RVAs documented. Both the analysis and infographic map threat actor behavior to the MITRE ATT&CK® framework. CISA encourages network defenders to review the analysis and infographic and apply the recommended mitigations to protect against the observed tactics and techniques.   Robert Williams#News247WorldPress

⚠️ Data Breach Alert: Unified Health System (SUS), Brazil ⚠️ A significant data breach affecting Brazil’s Unified Health System (SUS), exposing highly sensitive personal and medical data of millions of citizens. What Data Was Compromised? The leaked database allegedly contains: 🔴 Identification details (CPF, taxpayer ID, names, etc.) 🔴 Address information (city, street, ZIP code) 🔴 Contact details (primary and secondary phone numbers) 🔴 Medical information (health card numbers and issuance details) The breach poses severe risks, including identity theft, financial fraud, and privacy violations. It also highlights the growing need for healthcare systems worldwide to fortify their cybersecurity measures. The healthcare sector must prioritize data privacy to maintain trust and safeguard sensitive information. At DMonitor,we specialize in real-time data breach monitoring and exposure prevention. With tools like dMonitor, we help businesses and individuals proactively track compromised data, ensuring you're alerted before threats escalate. 👉 Visit dmonitor.io for 24/7 monitoring and protection! #CyberSecurity #DataBreach #DarkWeb #HealthDataPrivacy #Brazil #HealthcareSecurity #DarkWebMonitoring

New Post: #CISA Releases Analysis of #FY23 Risk and Vulnerability Assessments - https://lnkd.in/dJKuCGjW CISA Releases Analysis of FY23 Risk and Vulnerability Assessments 09/13/2024 12:00 PM EDT CISA has released an analysis and infographic detailing the findings from the 121 Risk and Vulnerability Assessments (RVAs) conducted across multiple critical infrastructure sectors in fiscal year 2023 (FY23). The analysis details a sample attack path including tactics and steps a cyber threat actor could follow to compromise an organization with weaknesses representative of those CISA observed in FY23 RVAs. The infographic highlights the most successful techniques for each tactic that RVAs documented. Both the analysis and infographic map threat actor behavior to the MITRE ATT&CK® framework. CISA encourages network defenders to review the analysis and infographic and apply the recommended mitigations to protect against the observed tactics and techniques.   Robert Williams#News247WorldPress

Suggested reading of Security Library (Biblioteca de Segurança): Society for Risk Analysis Glossary. Check in: https://lnkd.in/d6kby6MY Download. Security Library has the largest collection in the world about risk management, corporate security, cybersecurity, business continuity, etc. There are already over 3500 publications | Content in four languages: Portuguese, Spanish, English and French. Sinopse: Several attempts have been made to establish broadly accepted definitions of key terms related to concepts fundamental for the risk analysis field. Many scholars and institutions have devoted considerable time and effort to providing definitions and bringing some sort of unity and standardization to the field. The work has been based on the conviction that a scientific field or discipline must stand solidly on well-defined and universally understood terms and concepts. Yet, experience has shown that to agree on one unified set of definitions is not realistic – the several attempts made earlier have not achieved success. The present work is founded on the idea that it is still possible to establish an authoritative glossary, the key being to allow for different perspectives on fundamental concepts and make a distinction between overall qualitative definitions and their associated measurements. For example, defining a probability cannot be meaningfully done without referring to different types of probability (subjective, frequentist, classical, etc.), but an overall qualitative definition such as “a measure for representing or expressing uncertainty, variation or beliefs, following the rules of probability calculus” could nonetheless be broadly accepted as useful. Allowing for different perspectives does not mean that all definitions that can be found in the literature will be included in the glossary. The definitions included must meet some basic criteria – a rationale – such as being logical, well-defined, understandable, precise, etc. We will provide only definitions that are acknowledged by the committee – i.e., their meaning, rationale and justification will have to pass the scrutiny of its members. Also, it is not the aim to present an all-inclusive glossary – only key generic concepts within the field of risk analysis are covered. This means that many terms specific of various application areas are not included. The committee hopes that the logic of the glossary can be useful also as a starting point for the development of these more specific terms. Given the above, we claim that the present glossary is unique in its approach compared to existing risk analysis related glossaries (including the ISO 31000 on risk management terminology), with its incorporation of different perspectives and its systematic separation between overall qualitative concepts and their measurements. #bibliotecadeseguranca #livrosdeseguranca #segurancacorporativa

Governance, NCSC CAF vs NIST 2 Governance: When comparing the NIST 2 cyber security Framework (CSF) V2 and the NCSC Cyber Assessment Framework (CAF), there are notable key differences. 1. Implementation Tiers NIST CSF: Incorporates a tier system (Partial, Risk-Informed, Repeatable, Adaptive) that defines the level of sophistication and integration of cyber security risk management. These tiers help organisations understand their current level of cyber security maturity and aim to guide improvement over time. NCSC CAF: Does not have a tier system. Instead, it focuses more on compliance with specific outcomes and management of cyber risks through detailed controls and practices. The emphasis is on achieving specific outcomes rather than describing the maturity process. 2. Technological Specificity NIST CSF: Technology-agnostic, providing broad, outcome-based recommendations suitable for a wide range of technological environments. This allows organisations the flexibility to implement the guidelines using the technology that best fits their specific needs and circumstances. NCSC CAF: Offers more explicit guidance on specific technologies and controls, especially concerning high-risk environments. This approach is particularly detailed in its prescriptions for managing cyber risks in critical national infrastructure sectors. 3. Legal and Regulatory Context NIST CSF: While widely recognised and influential, it is a voluntary framework primarily designed for private sector organisations in the US. It serves as a guideline rather than a regulatory requirement, often referenced in other US regulatory frameworks. NCSC CAF: More closely tied to UK national security concerns, it is often used by UK regulators when assessing the cyber resilience of critical infrastructure sectors. It implies a level of regulatory expectation, particularly in the context of UK national security. 4. Governance and Accountability NIST CSF: While it emphasises senior management's role in governance, it is less prescriptive about the specific accountability structures required within an organisation. It encourages integration of cyber security into organisational risk management without stringent requirements on how this should be structured. NCSC CAF: Strongly emphasises governance and the need for board-level oversight and accountability. The framework requires explicit evidence of governance practices, including how decisions are made and how accountability is structured within the organisation. 5. Focus on Cyber Resilience NIST CSF: Focuses broadly on all aspects of cyber security, including prevention, detection, and response. It provides a holistic view of an organisation’s cyber security posture but with less focus on the concept of resilience. NCSC CAF: Heavily focused on cyber resilience, particularly on minimising the impact of cyber incidents when they occur. This is reflective of its purpose to protect critical national infrastructure from high-impact threats.

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/da36fVFW CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

📢 M3AAWG Submits Public Policy Comments to CISA M3AAWG has provided detailed feedback on CISA’s draft Product Security Bad Practices Guidance. Our comments address clarity, actionable recommendations, and industry challenges to help strengthen cybersecurity across critical infrastructures. 🔗 Learn more about our submission and the guidance: https://lnkd.in/eZ5PJXmU

CISA Warns of 10 New Advisories on Industrial Control System Vulnerabilities | Source: https://lnkd.in/gWYdZCgW The Cybersecurity and Infrastructure Security Agency (CISA) has issued ten critical advisories, highlighting vulnerabilities across Siemens’ industrial products.

CISA Warns of 10 New Advisories on Industrial Control System Vulnerabilities | Source: https://lnkd.in/gWYdZCgW The Cybersecurity and Infrastructure Security Agency (CISA) has issued ten critical advisories, highlighting vulnerabilities across Siemens’ industrial products.