Emily Cummins, CISSP, CCSP

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

This could be the source of your "aha" moment with CMMC. Trust me when I say that there's a lot of FUD and myths in the marketplace, and there's a lot of sleight of hand being performed by people who really are not the experts they pretend to be in the CMMC echo system. Here's a few quick screening questions to ask. 1. Is CUI classified information? 2. Did DoD develop the requirements for protecting my sensitive information? 3. If I don't meet a particular control, I can always get an extension of up to a year to do so, correct? 4. Do I just have to meet 80% of the assessment objectives in each control to be certified? 5. Do I pass the assessment and receive a CMMC Level 2 certification if I meet 75% of the requirements? If you encounter hesitation on any of these questions by any company you're asking to help you comply with CMMC, I would suggest you keep looking. Better yet, go the NCMBC web site and pay the admission. It's $130 per person, and you get food, entertainment and fellowship with other managers and subject matter experts as you plot your journey through the CMMC echo system. Hope to see you there. It's an in person event at McKimmon Center of North Carolina State University. (https://lnkd.in/eitYSGUf, McKimmon Conference and Training Center at NC State University, 1101 Gorman St, Raleigh, NC 27606 (919) 515-2277). Registration link is in Laura's post.

1

CMMC Level 2 Assessment Objective: Flaw Remediation for Controlled Unclassified Information (CUI) Data PRACTICE: Organizations must identify, report, and correct system flaws in a timely manner. ASSESSMENT: All software and firmware have potential flaws. Organizations must identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and antivirus signatures. Be prepared! Your assessor could ask to 🔍 EXAMINE system and information integrity policy. 🗣 INTERVIEW system or network administrators. 📝 TEST organizational processes for identifying, reporting, and correcting system flaws. (CMMC Assessment Guide: Level 2 Version 2.11, page 241) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

59

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

DFIR Triage Guide: When Every Second Matters! Triage isn't optional unless you like playing 'Guess what just crashed! During an active cyber incident, every minute counts. Triage helps quickly assess the data to identify potential leads, prioritize evidence, and allocate resources accordingly. It also helps identify the most critical systems and data to focus on, minimizing damage and preventing further compromise. Here are the key reasons why triage is critical: • Time Sensitivity • Resource Management • Containment and Mitigation • Evidence Preservation • Focused Investigation Here is an excellent article by Terryn Valikodath that explains Why Triage is Not Optional: https://lnkd.in/gYid_g8W Triage helps us act fast, but data analysis ensures we act right! Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

75

20 Comments

Coalfire (a respected QSAC) has published this excellent white paper on how HUMAN's Client-side Defense solution for PCI DSS 4.0, addresses requirements 6.4.3 and 11.6.1. Lean more about the "easy button" for protecting card holder data from third-party and nth party scripts. #payment #PCI #browsersecurity #cybersecurity #riskandcompliance #riskmanagement #compliance #ecommerce #retail https://lnkd.in/ehcbP-qN

18

ICYMI: The inaugural study on EPSS performance and broader vulnerability exploitation trends published this week. If you've ever wanted data-driven answers to questions like these listed in the ToC shown here, download it today (free, no registration req'd): https://lnkd.in/gBbsgwQM #vulnerabilitymanagement #vulnerabilities #infosec

51

8 Comments

This is very interesting... seems to be a riff on an analysis technique that we described in an article titled "Beyond Timelines - Anchors in Relative Time" ten years ago in Digital Forensics Magazine. The technique has been applied to extremely high-profile and high-stakes cases since then.

11

2 Comments

Useful tips for CUI scope management for CMMC.

4

Small business owners, this one's for you! The NIST Cybersecurity Framework offers a proven approach to managing cybersecurity risks. This free resource provides a quick start guide to help you get started. ➡️ Learn how to identify, protect, detect, respond to, and recover from cyber threats. Download the NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide today! #cybersecurity #smallbusiness #riskmanagement #NIST https://lnkd.in/gnByJvYM

20

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

YouAttest for Identity Security and Compliance:   NIST Guidelines and frameworks are crucial to government contractors.   https://lnkd.in/erkpffEh Important to these NIST recommendations is attestation of identities controlling sensitive data (PHI, PII and CUI) - https://lnkd.in/g9zSZ_gd Know your identities, and privileges, w/ (now AI-powered)   YouAttest.com, contact us:    https://lnkd.in/g96pUae Wes Jones Jeff Chao Rick Mischka  #ITSecurity #governance #cybersecurity  #compliance #mspsecurity

16

1 Comment

YouAttest for Identity Security and Compliance:   NIST Guidelines and frameworks are crucial to government contractors.   https://lnkd.in/erkpffEh Important to these NIST recommendations is attestation of identities controlling sensitive data (PHI, PII and CUI) - https://lnkd.in/g9zSZ_gd Know your identities, and privileges, w/ (now AI-powered)   YouAttest.com, contact us:    https://lnkd.in/g96pUae  #ITSecurity #governance #cybersecurity  #compliance #mspsecurity

10

1 Comment