Ben Trimbo

CISO reporting to 'The Board'...Scary? Yeah probably. It should be. Its real accountability, and an open challenge to your visions and strategies, and your ability to execute accordingly. As a CISO, I often get questions about how to present to 'The BoD' directly. Truth is, there's no single model - Every business is different, and every Board is different. But you know that already cuz you're in a position of leadership and discernment for a reason :) The right message always remains the same- How does your own leadership role, function, and focus contribute to the greater good of the organization? How does it help the business to determine where and how to accept and navigate risk? Not just avoid it. Sounds simplistic. But you may be surprised how many CISO messages don't answer that basic inquiry sufficiently. Your message, at this level, needs to clearly align to a broader forward-looking strategic narrative. If it doesn't, it doesn't resonate, and you haven't positively moved the needle. You never want to be the best checkers player in a chess match. I’m looking forward to demystifying this exact topic at the CISO ExecNet National Member Symposium July 23rd at the Willis Tower in Chicago with colleagues Eric Galis, Susanne Elizer Senoff, and Michael Calderin. #cisoexecnet #ciso #executiveleadership #boardreporting

132

7 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

The evolution from CASB to SSPM (SaaS Security Posture Management) has been a good one I believe. About a week ago I signed up to receive their SSPM materials here and received them yesterday. I found them to be a really clear training set on the differences between the two and strategies to justify their use. It's worth a look especially if you see these terms and want a good lesson in the differences: https://lnkd.in/g3X-wuwm #informationsecurity #cybersecurity #cloudsecurity

5

Delayed revocation events by the numbers: An epidemic of delayed revocations has infected the public CA community. Jason Soroko and I track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes. #pki #security #CABF #ssl #revocation https://lnkd.in/g6APX-Fx

21

The 2019 HIMSS Cybersecurity Survey revealed that IT spending on cybersecurity varies significantly across healthcare organizations. However, using these percentages as a benchmark is not effective for managing cyber risk. As I emphasize in my book (Stop The Cyber Bleeding), cybersecurity is a business risk management issue, not just an IT line item. Comparing your spending to peers overlooks your organization’s unique assets, risks, and risk appetite. Your cybersecurity investment should be tailored to your specific challenges and needs, not a standard percentage of your IT budget. Find the book here: https://bobchaput.com/ #RiskManagement #Cybersecurity #Healthcare #ITBudget

9

I wonder how many SIEM vendors out there are sweating how GenAI will auto-magically translate data normalizations and field extractions, detections, reports, and dashboards between different products to make SIEM replacements far easier to do. I think they probably should be.

23

28 Comments

For anyone still dealing with the fallout of the Crowdstrike/Windows issue; I wanted to give a tip that we are using with some success to automatically and centrally remediate systems that match a certain set of characteristics. This isn't a "silver bullet" to fix all systems everywhere, but where it works it doesn't require bitlocker keys, safe mode, or preboot environments. The system has to be boot looping or restarted. The opportunity that allows this to work: we identified that most systems which are crashing actually get far enough into the boot process that the network stack and Windows Server service are starting, briefly. We see a few second window when the system is available on the network before Crowdstrike fully loads and the system crashes. This also why some systems "self-heal." During the brief period before the crash, Crowdstrike may have enough time to download the fixed channel update before the system crashes, This small network availability window has given us a way to delete the channel file using a delete command from another system on a UNC path to the impacted system. There are a number of caveats that limit the success of this approach: 1. Host must using a wired network connection (wireless may work, but we haven't been able to definitively test) 2. The host IP must be known or resolvable via DNS (the system is "on" the network for less than 12 seconds, so this is often a problem). 3. The script must be run from a fully functional system, in the context of a credential that has previously established (before the Crowdstrike channel update) local workstation administrator level privilege 4. Executing against a single host one at a time has shown a higher rate of success than executing against a large number of hosts or an entire network range in parallel. In other words, this isn't a guaranteed fix. Said another way, this seem to have the highest success against wired hosts that are continually boot looping. Please comment if you find other constraints or errors in my list. A system can be tested to see if this approach will possibly work by continually pinging the IP address of a system that is crashing, while its crashing. There will be a string ping failures followed by a few replies then failures. While the system is able to reply to the ping, the delete command can be run. We originally triggered the script once we saw an ICMP reply, but are having better success just executing the delete against the UNC path against whole subnets repeatedly. In a "healthy" system, executing the delete against a UNC path will result in a delete failure as Crowdstrike appears to have the (fixed) channel file in use/locked. If the 'delete \\[hostip/hostname]\[UNC path to CS channel file]' command succeeds, the system boots normally into windows. If it doesn't, the system will BSOD again.

207

19 Comments

It is well documented that being a leader can be a lonely experience. If you've ever lead a project, a team, a department, or a company you know how the weight of the mantel of responsibility for outcomes and decisions can lead to isolation. But, in those moments of crisis when teams must be formed, guided, and motivated to rise to a challenge that leadership takes on a new dimension. This is the case I found myself in during the morning of July 19, 2024. By the time I was involved, the emergency management function was well engaged, understating the scope and impact of the problem and developing remediation steps and planning for how to best use the small army of volunteer "technologists" who would serve as the backbone for the on-site, hands-on recovery work. I jumped in and helped where I could, but there was already significant momentum. Then an opportunity presented itself: someone automated a fix. I tracked down Jeremiah Heyt (JR) and confirmed he was having success recovering systems centrally. Was this was a chance to fix many systems without having to touch them? It was worth exploring. JR didn't work for me, I had never talked to JR before that moment, but he was ready and willing to jump into a bigger effort. We pulled in a few other people and before long we had formed a "script swat team" to look into automating and expanding the idea of centralized recovery. By the end there were 12 people working on various aspects of the script and supporting tech. This team also spear headed the development of telemetry to confirm when systems had been fixed, a key element for the hands-on teams as well. In the end, it is estimated that the script resolved between 6% and 8% of impacted systems. That doesn't sound like much, but it meant that the amazing army of over 500 in-field volunteers didn't have to touch almost 2,500 systems and those 2,500 systems were put back into the hands of users faster than they might otherwise have been. Of the 12 people on the team, I was the "upline" of only three. The common cause was greater than hierarchy and positional authority. It was a privilege to be a part of this great team: Jeremiah Heyt, Dan Boik, Eric Craddock, Kenny Daldine, Joshua Hineline, Travis Hughes, Adam C. Johnson, Jeremy Jordan, Jason Lehman, Alex Meyer, Jeremy Reynolds,John Schiffman. Thank you Scott Dresen for your support and participation! Jerry Matt and Nina Padavil, thank you for being there every step of the way! This view is but small part of the work that went into recovering. The untold part of this story is that the Corewell Health team was in the go-live of a multi-year project to consolidate the EMR when the Crowdstrike outage occurred. Our CIDO, Jason Joseph, described it as "launching a rocket in a hurricane." This could only be possible because of a team dedicated to a mission greater than oneself. Awesome job team, I'm proud to be a small part of this amazing group of dedicated professionals!

33

3 Comments

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

New study finds uptick in cybersecurity disclosers due to new SEC requirements. Still, few detail the material impact of these events. More work and clarity are needed. https://lnkd.in/gQ2paXVs #cybersecurity #infosec #SEC #disclosure

7

Reminder to stay vigilant for individuals exploiting those affected by the fires. In times of crisis, like the ongoing fires, it's crucial to be cautious of scammers. Reputable organizations like the American Red Cross and the Los Angeles Fire Department Foundation are reliable avenues for donations. Unfortunately, during disasters, malicious actors exploit the situation by launching phishing and fake donation schemes. Stay informed and safeguard yourself against these fraudulent activities. Stay safe.

25

2 Comments

Thanks to the good people at Claroty, I found services that list OT/ICS attacks! Some great material here: Newsfeed style: https://icsstrive.com/ Database: https://lnkd.in/e8KM7fJw, https://lnkd.in/eJkM9UYJ But what's interesting? None of them are complete... There was an attack on a Texas water treatment plant in January by, potentially, SANDWORM. It's not on either list. Complete databases will help us with complete information that will need to better decision-making and a fuller intuition. So, if you know of attacks that are not on these lists, use the Report button to add them. #cybersecurity #otsecurity

7

A colleague sent me a link to Bob Lord's Thanksgiving "I'm thankful for TLS" post, The Quiet HTTPS Revolution https://lnkd.in/gCx2uxdU Good article, and TLS is doing a ton of work for all of us. Lest we forget about the pitfalls of metadata, however, if you're trying to achieve reasonable (not over-the-top) security, other fundamentals like the DNS exhaust from browsing should be protected, as well. Otherwise, someone that would have been in position to view the unencrypted trafffic can still make accurate guesses on what you are up to. Also, let's not forget to give a heartfelt thanks to the Electronic Frontier Foundation (EFF) for creating Let's Encrypt and Certbot, without which, millions of sites would still be without trusted certificates.

13

Adding Humor into Cyber - It can be done. Recently I had the privilege of training leadership at the Spokane Housing Authority alongside Todd Miller. Todd had an unconventional approach to the Senior training event by wearing a T-shirt that humorously read "I find your lack of Cybersecurity Disturbing" sparked a positive shift towards prioritizing Cybersecurity within the organization. It's moments like these that showcase the importance of embracing creativity and humor in the tech space. Has anyone else wore a T-shirt like this for a senior leadership training instead of a suit and tie? #IT #Cybersecurity #TechCommunity #LeadershipTraining 🖥🔒

27

2 Comments

The SoCal CISO Summit is only 3 weeks away! Don't miss this all-star lineup with Emily O'Carroll, Jonathan Chow, and Arthur Lessard, discussing "The Imperatives of PAM" on May 21st. Organizations have suffered relentlessly from cyberattacks, each week it seems there are new headlines highlighting ransomware attacks or data breaches. With the sensitivity of privileged accounts, unpatched vulnerabilities, and an extensive remote workforce, privileged access management (PAM) is essential to securing your most critical systems and data. Join this panel session to discuss: -Why PAM plays a crucial role in mitigating cyberattacks -Gaining executive buy-in on effective solutions -Having a proactive approach to implementation and configuration Qualified InfoSec leaders, register below! #evantaciso #socalciso #informationsecurity

59

4 Comments

Important lessons I’ve learned from the Crowdstrike incident: 1. IT is a community. The amount of people sharing the remediation steps to benefit everyone shows that we’re all in this together. 2. No one has the perfect documentation format. Stop wasting time trying to create the perfect document, put the words on paper. 3. The importance of incident response, disaster recovery, and business continuity plans. And testing these plans regularly. 4. CI/CD best practices. Testing code in a development environment, staging and then pushing into production. I guarantee Crowdstrike will make deployment strategy changes in the near future. Another reason to have opt-in early adopters. And if you don’t know what N-1 is, now’s the time. 5. Developers can’t blame this issue on “networking”! 😆

29

1 Comment

Encouraged to see Gartner's latest Voice of the Customer report validating what many of us in the security trenches have experienced - the critical need for modern identity security that actually works in today's highly dynamic and hybrid environments. Key takeaway from the report: * Organizations are seeking integrated solutions that address the full spectrum of identity risks - from SaaS and non-human identities to privileged access and data system entitlements. * The traditional identity management and governance approaches simply haven't kept pace with how we operate today. I love to see the 100% recommendation rate from peer practitioners. Having spent years wrestling with identity security challenges, it's clear the market is ready for fresh approaches that deliver real risk reduction. Proud to be part of the team at Veza driving this evolution in identity security. Looking forward to continuing the collaboration with fellow security leaders as we tackle these challenges together. Learn more here: https://bit.ly/40oM7B1 #SecurityLeadership #IdentitySecurity #DigitalTrust #CISO #Cybersecurity #LeastPrivilegeAtScale

40

6 Comments